diff --git a/404.html b/404.html index 53547cdef..667cb65fd 100644 --- a/404.html +++ b/404.html @@ -7,8 +7,8 @@ - - + +
Skip to main content

Page Not Found

We could not find what you were looking for.

Please contact the owner of the site that linked you to the original URL and let them know their link is broken.

diff --git a/assets/images/openshift-5e5a73931173ee987518a94be8fb729b.png b/assets/images/openshift-5e5a73931173ee987518a94be8fb729b.png new file mode 100644 index 000000000..7db053ae4 Binary files /dev/null and b/assets/images/openshift-5e5a73931173ee987518a94be8fb729b.png differ diff --git a/assets/js/028717eb.1f342275.js b/assets/js/028717eb.1f342275.js deleted file mode 100644 index bbca7aea2..000000000 --- a/assets/js/028717eb.1f342275.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5036],{3200:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>c,contentTitle:()=>a,default:()=>p,frontMatter:()=>o,metadata:()=>r,toc:()=>l});var t=s(5893),i=s(1151);const o={title:"Applying a License",hide_title:!0,sidebar_position:2},a="Licensing",r={id:"cado-response/manage/licenses",title:"Applying a License",description:"In order to use the Cado platform, you must upload a valid license.",source:"@site/docs/cado-response/manage/licenses.md",sourceDirName:"cado-response/manage",slug:"/cado-response/manage/licenses",permalink:"/cado-response/manage/licenses",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/licenses.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"Applying a License",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Logging In",permalink:"/cado-response/manage/logging-in"},next:{title:"Managing Users",permalink:"/cado-response/manage/users-authentication/users"}},c={},l=[];function d(e){const n={a:"a",h1:"h1",li:"li",p:"p",strong:"strong",ul:"ul",...(0,i.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"licensing",children:"Licensing"}),"\n",(0,t.jsx)(n.p,{children:"In order to use the Cado platform, you must upload a valid license."}),"\n",(0,t.jsx)(n.p,{children:"If you have received a license file from your Sales representative, you can upload it by:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Logging into your Cado instance"}),"\n",(0,t.jsxs)(n.li,{children:["Navigate to ",(0,t.jsx)(n.strong,{children:"Settings"})]}),"\n",(0,t.jsxs)(n.li,{children:["Click the ",(0,t.jsx)(n.strong,{children:"License"})," tab"]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Select file"}),", choose the new license file"]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Upload"})]}),"\n"]}),"\n",(0,t.jsxs)(n.p,{children:["If you do not have a license, please contact ",(0,t.jsx)(n.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})]})]})}function p(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},1151:(e,n,s)=>{s.d(n,{Z:()=>r,a:()=>a});var t=s(7294);const i={},o=t.createContext(i);function a(e){const n=t.useContext(o);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),t.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/028717eb.22150513.js b/assets/js/028717eb.22150513.js new file mode 100644 index 000000000..d130327eb --- /dev/null +++ b/assets/js/028717eb.22150513.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5036],{3200:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>c,contentTitle:()=>a,default:()=>p,frontMatter:()=>o,metadata:()=>r,toc:()=>l});var t=s(5893),i=s(1151);const o={title:"Applying a License",hide_title:!0,sidebar_position:2},a="Licensing",r={id:"cado-response/manage/licenses",title:"Applying a License",description:"In order to use the Cado platform, you must upload a valid license.",source:"@site/docs/cado-response/manage/licenses.md",sourceDirName:"cado-response/manage",slug:"/cado-response/manage/licenses",permalink:"/cado-response/manage/licenses",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/licenses.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"Applying a License",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Logging In",permalink:"/cado-response/manage/logging-in"},next:{title:"Managing Users",permalink:"/cado-response/manage/users-authentication/users"}},c={},l=[];function d(e){const n={a:"a",h1:"h1",li:"li",p:"p",strong:"strong",ul:"ul",...(0,i.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"licensing",children:"Licensing"}),"\n",(0,t.jsx)(n.p,{children:"In order to use the Cado platform, you must upload a valid license."}),"\n",(0,t.jsx)(n.p,{children:"If you have received a license file from your Sales representative, you can upload it by:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Logging into your Cado instance"}),"\n",(0,t.jsxs)(n.li,{children:["Navigate to ",(0,t.jsx)(n.strong,{children:"Settings"})]}),"\n",(0,t.jsxs)(n.li,{children:["Click the ",(0,t.jsx)(n.strong,{children:"License"})," tab"]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Select file"}),", choose the new license file"]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Upload"})]}),"\n"]}),"\n",(0,t.jsxs)(n.p,{children:["If you do not have a license, please contact ",(0,t.jsx)(n.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})]})]})}function p(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},1151:(e,n,s)=>{s.d(n,{Z:()=>r,a:()=>a});var t=s(7294);const i={},o=t.createContext(i);function a(e){const n=t.useContext(o);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),t.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/03a24dd5.18cef111.js b/assets/js/03a24dd5.18cef111.js new file mode 100644 index 000000000..c8e0498ba --- /dev/null +++ b/assets/js/03a24dd5.18cef111.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6683],{9333:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>d,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>c});var i=s(5893),n=s(1151);const o={title:"Automated Investigation",hide_title:!0,sidebar_position:4},a="Automated Investigations",r={id:"cado-response/investigate/automated-investigation",title:"Automated Investigation",description:"The Automated Investigation tab provides a summary of what Cado has determined during its investigation.",source:"@site/docs/cado-response/investigate/automated-investigation.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/automated-investigation",permalink:"/cado-response/investigate/automated-investigation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/automated-investigation.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:4,frontMatter:{title:"Automated Investigation",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Timeline Search",permalink:"/cado-response/investigate/timeline-search"},next:{title:"Browse Disk",permalink:"/cado-response/investigate/browse-disk"}},d={},c=[{value:"View Asset",id:"view-asset",level:2},{value:"Response Actions (Beta)",id:"response-actions-beta",level:2},{value:"Permissions Required",id:"permissions-required",level:3}];function l(e){const t={a:"a",em:"em",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"automated-investigations",children:"Automated Investigations"}),"\n",(0,i.jsx)(t.p,{children:"The Automated Investigation tab provides a summary of what Cado has determined during its investigation."}),"\n",(0,i.jsx)(t.p,{children:"The Automated Investigation includes:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"A description of how the investgation was triggered"}),"\n",(0,i.jsx)(t.li,{children:"The verdict - a one line description of what Cado determined has happened"}),"\n",(0,i.jsx)(t.li,{children:"A set of suspected compromised assets"}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"The timeline displays up to 50 events. Events are more likely to be included if they are malicious, tagged by a user, happened in rapid succession, etc."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Automated Investigation",src:s(7586).Z+"",width:"1866",height:"853"})}),"\n",(0,i.jsx)(t.h2,{id:"view-asset",children:"View Asset"}),"\n",(0,i.jsx)(t.p,{children:'Clicking the three dots and "View Cloud Resource" on a suspected compromised asset opens up a sidebar containing metadata about the asset.'}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Metadata Sidebar",src:s(3090).Z+"",width:"340",height:"345"})}),"\n",(0,i.jsx)(t.h2,{id:"response-actions-beta",children:"Response Actions (Beta)"}),"\n",(0,i.jsxs)(t.p,{children:["Response Actions make it possible to perform remediation actions in response to malicious activity being identified on a virtual machine. You can also trigger response actions using ",(0,i.jsx)(t.a,{href:"/cado-response/discovery-import/automation",children:"Automation Rules"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["Currently, Response Actions only supports ",(0,i.jsx)(t.a,{href:"/cado-response/discovery-import/import/aws/aws-ec2#triage-capture",children:"AWS EC2 instances acquired as a triage collection"}),'. To invoke an action, select the instance id from the "Suspected Compromised Assets" table']}),"\n",(0,i.jsxs)(t.p,{children:['Using the panel on the right - select the "Actions" tab, then the desired action and click "Invoke"\n',(0,i.jsx)(t.img,{alt:"Actions",src:s(2628).Z+"",width:"842",height:"418"})]}),"\n",(0,i.jsx)(t.h3,{id:"permissions-required",children:"Permissions Required"}),"\n",(0,i.jsx)(t.p,{children:"Each action requires different permissions and is controlled using IAM roles. The table below details a description of each action and the permissions required. Add these permissions to your Cado role, and ensure it has scope to cover the resource you wish to invoke an action on."}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Action"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Required Permissions"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Stop Instance"}),(0,i.jsx)(t.td,{children:"Stops an EC2 instance using the AWS API"}),(0,i.jsxs)(t.td,{children:["ec2",":StopInstances"]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Isolate Role"}),(0,i.jsx)(t.td,{children:"Isolates the IAM role attached to an EC2 instance. Isolated by adding a deny all inline policy to the given IAM role."}),(0,i.jsxs)(t.td,{children:["iam",":PutRolePolicy"]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Isolate Security Group"}),(0,i.jsx)(t.td,{children:"Isolates the security group attached to an EC2. Isolated by creating a blank security group and attaching to the EC2. Due to the behaviour of AWS security groups, existing connections will not be dropped."}),(0,i.jsxs)(t.td,{children:["ec2",":CreateSecurityGroup"," ec2",":RevokeSecurityGroupEgress"," ec2",":ModifyInstanceAttribute"]})]})]})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsxs)(t.em,{children:["NOTE: In order to perform an action on an asset in a different AWS account, you must have ",(0,i.jsx)(t.a,{href:"/cado-response/deploy/aws/iam/cross-account-creation",children:"Cross Account roles"})," configured and have added the relevant permission to the role in the different account"]})})]})}function h(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},2628:(e,t,s)=>{s.d(t,{Z:()=>i});const i=s.p+"assets/images/actions-tab-5585992eb81a41af00c49a1f502ff8e2.png"},7586:(e,t,s)=>{s.d(t,{Z:()=>i});const i=s.p+"assets/images/automated-investigation-e3cc11e53b29192f70a1de28ab872488.png"},3090:(e,t,s)=>{s.d(t,{Z:()=>i});const i=s.p+"assets/images/metadata-sidebar-d1263f81bf454d9ead1789d55d65fa88.png"},1151:(e,t,s)=>{s.d(t,{Z:()=>r,a:()=>a});var i=s(7294);const n={},o=i.createContext(n);function a(e){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),i.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/03a24dd5.4871cd7b.js b/assets/js/03a24dd5.4871cd7b.js deleted file mode 100644 index b946443b4..000000000 --- a/assets/js/03a24dd5.4871cd7b.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6683],{9333:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>d,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>c});var i=s(5893),n=s(1151);const o={title:"Automated Investigation",hide_title:!0,sidebar_position:4},a="Automated Investigations",r={id:"cado-response/investigate/automated-investigation",title:"Automated Investigation",description:"The Automated Investigation tab provides a summary of what Cado has determined during its investigation.",source:"@site/docs/cado-response/investigate/automated-investigation.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/automated-investigation",permalink:"/cado-response/investigate/automated-investigation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/automated-investigation.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:4,frontMatter:{title:"Automated Investigation",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Timeline Search",permalink:"/cado-response/investigate/timeline-search"},next:{title:"Browse Disk",permalink:"/cado-response/investigate/browse-disk"}},d={},c=[{value:"View Asset",id:"view-asset",level:2},{value:"Response Actions (Beta)",id:"response-actions-beta",level:2},{value:"Permissions Required",id:"permissions-required",level:3}];function l(e){const t={a:"a",em:"em",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"automated-investigations",children:"Automated Investigations"}),"\n",(0,i.jsx)(t.p,{children:"The Automated Investigation tab provides a summary of what Cado has determined during its investigation."}),"\n",(0,i.jsx)(t.p,{children:"The Automated Investigation includes:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"A description of how the investgation was triggered"}),"\n",(0,i.jsx)(t.li,{children:"The verdict - a one line description of what Cado determined has happened"}),"\n",(0,i.jsx)(t.li,{children:"A set of suspected compromised assets"}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"The timeline displays up to 50 events. Events are more likely to be included if they are malicious, tagged by a user, happened in rapid succession, etc."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Automated Investigation",src:s(7586).Z+"",width:"1866",height:"853"})}),"\n",(0,i.jsx)(t.h2,{id:"view-asset",children:"View Asset"}),"\n",(0,i.jsx)(t.p,{children:'Clicking the three dots and "View Cloud Resource" on a suspected compromised asset opens up a sidebar containing metadata about the asset.'}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Metadata Sidebar",src:s(3090).Z+"",width:"340",height:"345"})}),"\n",(0,i.jsx)(t.h2,{id:"response-actions-beta",children:"Response Actions (Beta)"}),"\n",(0,i.jsxs)(t.p,{children:["Response Actions make it possible to perform remediation actions in response to malicious activity being identified on a virtual machine. You can also trigger response actions using ",(0,i.jsx)(t.a,{href:"/cado-response/discovery-import/automation",children:"Automation Rules"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["Currently, Response Actions only supports ",(0,i.jsx)(t.a,{href:"/cado-response/discovery-import/import/aws/aws-ec2#triage-capture",children:"AWS EC2 instances acquired as a triage collection"}),'. To invoke an action, select the instance id from the "Suspected Compromised Assets" table']}),"\n",(0,i.jsxs)(t.p,{children:['Using the panel on the right - select the "Actions" tab, then the desired action and click "Invoke"\n',(0,i.jsx)(t.img,{alt:"Actions",src:s(2628).Z+"",width:"842",height:"418"})]}),"\n",(0,i.jsx)(t.h3,{id:"permissions-required",children:"Permissions Required"}),"\n",(0,i.jsx)(t.p,{children:"Each action requires different permissions and is controlled using IAM roles. The table below details a description of each action and the permissions required. Add these permissions to your Cado role, and ensure it has scope to cover the resource you wish to invoke an action on."}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Action"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Required Permissions"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Stop Instance"}),(0,i.jsx)(t.td,{children:"Stops an EC2 instance using the AWS API"}),(0,i.jsxs)(t.td,{children:["ec2",":StopInstances"]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Isolate Role"}),(0,i.jsx)(t.td,{children:"Isolates the IAM role attached to an EC2 instance. Isolated by adding a deny all inline policy to the given IAM role."}),(0,i.jsxs)(t.td,{children:["iam",":PutRolePolicy"]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Isolate Security Group"}),(0,i.jsx)(t.td,{children:"Isolates the security group attached to an EC2. Isolated by creating a blank security group and attaching to the EC2. Due to the behaviour of AWS security groups, existing connections will not be dropped."}),(0,i.jsxs)(t.td,{children:["ec2",":CreateSecurityGroup"," ec2",":RevokeSecurityGroupEgress"," ec2",":ModifyInstanceAttribute"]})]})]})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsxs)(t.em,{children:["NOTE: In order to perform an action on an asset in a different AWS account, you must have ",(0,i.jsx)(t.a,{href:"/cado-response/deploy/aws/iam/cross-account-creation",children:"Cross Account roles"})," configured and have added the relevant permission to the role in the different account"]})})]})}function h(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},2628:(e,t,s)=>{s.d(t,{Z:()=>i});const i=s.p+"assets/images/actions-tab-5585992eb81a41af00c49a1f502ff8e2.png"},7586:(e,t,s)=>{s.d(t,{Z:()=>i});const i=s.p+"assets/images/automated-investigation-e3cc11e53b29192f70a1de28ab872488.png"},3090:(e,t,s)=>{s.d(t,{Z:()=>i});const i=s.p+"assets/images/metadata-sidebar-d1263f81bf454d9ead1789d55d65fa88.png"},1151:(e,t,s)=>{s.d(t,{Z:()=>r,a:()=>a});var i=s(7294);const n={},o=i.createContext(n);function a(e){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),i.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/03e97922.a1f26297.js b/assets/js/03e97922.a1f26297.js new file mode 100644 index 000000000..526ca9b56 --- /dev/null +++ b/assets/js/03e97922.a1f26297.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2427],{2426:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>r,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>c,toc:()=>d});var i=t(5893),n=t(1151);const o={title:"Key Events, Alarms & Suspicious",hide_title:!0,sidebar_position:4},a="Key Events",c={id:"cado-response/investigate/key-events",title:"Key Events, Alarms & Suspicious",description:"Cado parses events from evidence items. These events may have times associated with them. They may also be tagged as Alarm, which indicates a high likelihood of malicious activity, or Suspicious, which indicates a lower likelihood of malicious activity.",source:"@site/docs/cado-response/investigate/key-events.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/key-events",permalink:"/cado-response/investigate/key-events",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/key-events.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:4,frontMatter:{title:"Key Events, Alarms & Suspicious",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Browse Disk",permalink:"/cado-response/investigate/browse-disk"},next:{title:"Indicators",permalink:"/cado-response/investigate/indicators"}},r={},d=[];function l(e){const s={code:"code",h1:"h1",img:"img",p:"p",strong:"strong",...(0,n.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"key-events",children:"Key Events"}),"\n",(0,i.jsxs)(s.p,{children:["Cado parses events from evidence items. These events may have times associated with them. They may also be tagged as ",(0,i.jsx)(s.code,{children:"Alarm"}),", which indicates a high likelihood of malicious activity, or ",(0,i.jsx)(s.code,{children:"Suspicious"}),", which indicates a lower likelihood of malicious activity."]}),"\n",(0,i.jsxs)(s.p,{children:["The ",(0,i.jsx)(s.strong,{children:"Key Events"})," tab (in Cado v2.1.0 and prior) contains all timeline events tagged as ",(0,i.jsx)(s.code,{children:"Alarm"})," or ",(0,i.jsx)(s.code,{children:"Suspicious"}),", whereas the ",(0,i.jsx)(s.strong,{children:"Alarms"})," and ",(0,i.jsx)(s.strong,{children:"Suspicous"})," tabs contains only events tagged as ",(0,i.jsx)(s.code,{children:"Alarm"})," and ",(0,i.jsx)(s.code,{children:"Suspicious"})," respectively"]}),"\n",(0,i.jsxs)(s.p,{children:["Each key timeline event shows why Cado Response has tagged that event as an ",(0,i.jsx)(s.code,{children:"Alarm"})," or ",(0,i.jsx)(s.code,{children:"Suspicious"})]}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Key Event",src:t(5136).Z+"",width:"1377",height:"252"})})]})}function h(e={}){const{wrapper:s}={...(0,n.a)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},5136:(e,s,t)=>{t.d(s,{Z:()=>i});const i=t.p+"assets/images/key-event-5a93ec00167cb3eb46fdd50ab419ffb3.png"},1151:(e,s,t)=>{t.d(s,{Z:()=>c,a:()=>a});var i=t(7294);const n={},o=i.createContext(n);function a(e){const s=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),i.createElement(o.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/03e97922.c85f066e.js b/assets/js/03e97922.c85f066e.js deleted file mode 100644 index 50ee803eb..000000000 --- a/assets/js/03e97922.c85f066e.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2427],{2426:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>r,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>c,toc:()=>d});var i=t(5893),n=t(1151);const o={title:"Key Events, Alarms & Suspicious",hide_title:!0,sidebar_position:4},a="Key Events",c={id:"cado-response/investigate/key-events",title:"Key Events, Alarms & Suspicious",description:"Cado parses events from evidence items. These events may have times associated with them. They may also be tagged as Alarm, which indicates a high likelihood of malicious activity, or Suspicious, which indicates a lower likelihood of malicious activity.",source:"@site/docs/cado-response/investigate/key-events.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/key-events",permalink:"/cado-response/investigate/key-events",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/key-events.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:4,frontMatter:{title:"Key Events, Alarms & Suspicious",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Browse Disk",permalink:"/cado-response/investigate/browse-disk"},next:{title:"Indicators",permalink:"/cado-response/investigate/indicators"}},r={},d=[];function l(e){const s={code:"code",h1:"h1",img:"img",p:"p",strong:"strong",...(0,n.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"key-events",children:"Key Events"}),"\n",(0,i.jsxs)(s.p,{children:["Cado parses events from evidence items. These events may have times associated with them. They may also be tagged as ",(0,i.jsx)(s.code,{children:"Alarm"}),", which indicates a high likelihood of malicious activity, or ",(0,i.jsx)(s.code,{children:"Suspicious"}),", which indicates a lower likelihood of malicious activity."]}),"\n",(0,i.jsxs)(s.p,{children:["The ",(0,i.jsx)(s.strong,{children:"Key Events"})," tab (in Cado v2.1.0 and prior) contains all timeline events tagged as ",(0,i.jsx)(s.code,{children:"Alarm"})," or ",(0,i.jsx)(s.code,{children:"Suspicious"}),", whereas the ",(0,i.jsx)(s.strong,{children:"Alarms"})," and ",(0,i.jsx)(s.strong,{children:"Suspicous"})," tabs contains only events tagged as ",(0,i.jsx)(s.code,{children:"Alarm"})," and ",(0,i.jsx)(s.code,{children:"Suspicious"})," respectively"]}),"\n",(0,i.jsxs)(s.p,{children:["Each key timeline event shows why Cado Response has tagged that event as an ",(0,i.jsx)(s.code,{children:"Alarm"})," or ",(0,i.jsx)(s.code,{children:"Suspicious"})]}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Key Event",src:t(5136).Z+"",width:"1377",height:"252"})})]})}function h(e={}){const{wrapper:s}={...(0,n.a)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},5136:(e,s,t)=>{t.d(s,{Z:()=>i});const i=t.p+"assets/images/key-event-5a93ec00167cb3eb46fdd50ab419ffb3.png"},1151:(e,s,t)=>{t.d(s,{Z:()=>c,a:()=>a});var i=t(7294);const n={},o=i.createContext(n);function a(e){const s=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),i.createElement(o.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0718c59c.82871a5b.js b/assets/js/0718c59c.82871a5b.js new file mode 100644 index 000000000..8cd09b67a --- /dev/null +++ b/assets/js/0718c59c.82871a5b.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[170],{2698:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>a,contentTitle:()=>c,default:()=>l,frontMatter:()=>n,metadata:()=>i,toc:()=>d});var s=t(5893),r=t(1151);const n={title:"Cross-Project Setup",hide_title:!0,sidebar_position:5},c="GCP Cross-Project Importing",i={id:"cado-response/deploy/gcp/gcp-cross-project",title:"Cross-Project Setup",description:"After creating the service account, enabling Cloud Build and other relevant APIs, and setting up the Primary GCP Project as discussed in the Overview, we can use these principals to import from other GCP projects under the same service acount.",source:"@site/docs/cado-response/deploy/gcp/gcp-cross-project.md",sourceDirName:"cado-response/deploy/gcp",slug:"/cado-response/deploy/gcp/gcp-cross-project",permalink:"/cado-response/deploy/gcp/gcp-cross-project",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/gcp/gcp-cross-project.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:5,frontMatter:{title:"Cross-Project Setup",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Automated Setup",permalink:"/cado-response/deploy/gcp/gcp-auto-setup"},next:{title:"Overview",permalink:"/cado-response/discovery-import/intro"}},a={},d=[{value:"Secondary Project Permissions",id:"secondary-project-permissions",level:2}];function p(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",p:"p",strong:"strong",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(o.h1,{id:"gcp-cross-project-importing",children:"GCP Cross-Project Importing"}),"\n",(0,s.jsxs)(o.p,{children:["After creating the service account, enabling Cloud Build and other relevant APIs, and setting up the Primary GCP Project as discussed in the ",(0,s.jsx)(o.a,{href:"/cado-response/deploy/gcp/gcp-settings",children:"Overview"}),", we can use these principals to import from other GCP projects under the same service acount."]}),"\n",(0,s.jsx)(o.admonition,{type:"info",children:(0,s.jsxs)(o.p,{children:["This also allows cross-project importing, meaning images from an instance in ",(0,s.jsx)(o.code,{children:"Project-A"})," can be saved to a bucket in ",(0,s.jsx)(o.code,{children:"Project-B"})]})}),"\n",(0,s.jsxs)(o.p,{children:["In this example we'll be using ",(0,s.jsx)(o.code,{children:"cadoserviceaccount@my-project.iam.gserviceaccount.com"})," as the service account we've already set up, and ",(0,s.jsx)(o.code,{children:"01234567890@cloudbuild.gserviceaccount.com"})," as the defualt Cloud Build principal for our primary project."]}),"\n",(0,s.jsx)(o.admonition,{type:"info",children:(0,s.jsx)(o.p,{children:"Cloud Build API needs to be enabled in every GCP project from which you want to collect"})}),"\n",(0,s.jsx)(o.h2,{id:"secondary-project-permissions",children:"Secondary Project Permissions"}),"\n",(0,s.jsxs)(o.p,{children:["In the secondary project, navigate to the ",(0,s.jsx)(o.strong,{children:"IAM and Admin > IAM"})," section and select ",(0,s.jsx)(o.strong,{children:"Grant Access"}),". Add both the created service account and cloud buid ",(0,s.jsx)(o.code,{children:"gserviceaccount.com"})," emails in the ",(0,s.jsx)(o.strong,{children:"Add Principal"})," section and assign them both the ",(0,s.jsx)(o.strong,{children:"Basic -> Editor"})," role."]}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"GCP-Cross-Project-IAM",src:t(3415).Z+"",width:"586",height:"744"})}),"\n",(0,s.jsxs)(o.p,{children:["Once added they should both appear as principals in the ",(0,s.jsx)(o.strong,{children:"IAM"})," section of that project."]}),"\n",(0,s.jsx)(o.admonition,{type:"tip",children:(0,s.jsxs)(o.p,{children:["This approach also works for adding permissions to Folders or Organizations. Simply select whichever resource you wish to grant access to in the ",(0,s.jsx)(o.a,{href:"https://console.cloud.google.com/cloud-resource-manager",children:"Manage Resources"})," section, and navigate to the ",(0,s.jsx)(o.strong,{children:"IAM and Admin > IAM"})," section for that resource."]})}),"\n",(0,s.jsx)(o.h1,{id:"project-selection",children:"Project Selection"}),"\n",(0,s.jsxs)(o.p,{children:["Now in Cado, if the credentials of the service account are already in the platform after following the ",(0,s.jsx)(o.a,{href:"/cado-response/deploy/gcp/gcp-settings",children:"Overview"}),", when importing from GCP you will now have a selection of projects to choose from."]}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"GCP-Cado-Cross-Project",src:t(3708).Z+"",width:"789",height:"403"})}),"\n",(0,s.jsxs)(o.admonition,{type:"info",children:[(0,s.jsxs)(o.p,{children:["This configuration only allows us to import from our Secondary Project to our Primary Project. If we want to be able to import the other way as well, the Seconday Account's Cloud Build ",(0,s.jsx)(o.code,{children:"gserviceaccount.com"})," will need to be granted access to the Primary Account's IAM section and given the ",(0,s.jsx)(o.strong,{children:"Editor"})," role."]}),(0,s.jsxs)(o.p,{children:["Simply follow the same steps in the ",(0,s.jsx)(o.strong,{children:"Secondary Project Permissions"})," section, but using the Secondary Project's principal and adding it to the Primary Project."]})]})]})}function l(e={}){const{wrapper:o}={...(0,r.a)(),...e.components};return o?(0,s.jsx)(o,{...e,children:(0,s.jsx)(p,{...e})}):p(e)}},3708:(e,o,t)=>{t.d(o,{Z:()=>s});const s=t.p+"assets/images/gcp-cado-project-selection-2762ea12f2f1cc7d5b52ca71dafb1590.png"},3415:(e,o,t)=>{t.d(o,{Z:()=>s});const s=t.p+"assets/images/gcp-cross-project-iam-3349e5d4ad1b5bfbcab5285b531c9d06.png"},1151:(e,o,t)=>{t.d(o,{Z:()=>i,a:()=>c});var s=t(7294);const r={},n=s.createContext(r);function c(e){const o=s.useContext(n);return s.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function i(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:c(e.components),s.createElement(n.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0718c59c.fc81d017.js b/assets/js/0718c59c.fc81d017.js deleted file mode 100644 index 74806dfa4..000000000 --- a/assets/js/0718c59c.fc81d017.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[170],{2698:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>a,contentTitle:()=>c,default:()=>l,frontMatter:()=>n,metadata:()=>i,toc:()=>d});var s=t(5893),r=t(1151);const n={title:"Cross-Project Setup",hide_title:!0,sidebar_position:5},c="GCP Cross-Project Importing",i={id:"cado-response/deploy/gcp/gcp-cross-project",title:"Cross-Project Setup",description:"After creating the service account, enabling Cloud Build and other relevant APIs, and setting up the Primary GCP Project as discussed in the Overview, we can use these principals to import from other GCP projects under the same service acount.",source:"@site/docs/cado-response/deploy/gcp/gcp-cross-project.md",sourceDirName:"cado-response/deploy/gcp",slug:"/cado-response/deploy/gcp/gcp-cross-project",permalink:"/cado-response/deploy/gcp/gcp-cross-project",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/gcp/gcp-cross-project.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:5,frontMatter:{title:"Cross-Project Setup",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Automated Setup",permalink:"/cado-response/deploy/gcp/gcp-auto-setup"},next:{title:"Overview",permalink:"/cado-response/discovery-import/intro"}},a={},d=[{value:"Secondary Project Permissions",id:"secondary-project-permissions",level:2}];function p(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",p:"p",strong:"strong",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(o.h1,{id:"gcp-cross-project-importing",children:"GCP Cross-Project Importing"}),"\n",(0,s.jsxs)(o.p,{children:["After creating the service account, enabling Cloud Build and other relevant APIs, and setting up the Primary GCP Project as discussed in the ",(0,s.jsx)(o.a,{href:"/cado-response/deploy/gcp/gcp-settings",children:"Overview"}),", we can use these principals to import from other GCP projects under the same service acount."]}),"\n",(0,s.jsx)(o.admonition,{type:"info",children:(0,s.jsxs)(o.p,{children:["This also allows cross-project importing, meaning images from an instance in ",(0,s.jsx)(o.code,{children:"Project-A"})," can be saved to a bucket in ",(0,s.jsx)(o.code,{children:"Project-B"})]})}),"\n",(0,s.jsxs)(o.p,{children:["In this example we'll be using ",(0,s.jsx)(o.code,{children:"cadoserviceaccount@my-project.iam.gserviceaccount.com"})," as the service account we've already set up, and ",(0,s.jsx)(o.code,{children:"01234567890@cloudbuild.gserviceaccount.com"})," as the defualt Cloud Build principal for our primary project."]}),"\n",(0,s.jsx)(o.admonition,{type:"info",children:(0,s.jsx)(o.p,{children:"Cloud Build API needs to be enabled in every GCP project from which you want to collect"})}),"\n",(0,s.jsx)(o.h2,{id:"secondary-project-permissions",children:"Secondary Project Permissions"}),"\n",(0,s.jsxs)(o.p,{children:["In the secondary project, navigate to the ",(0,s.jsx)(o.strong,{children:"IAM and Admin > IAM"})," section and select ",(0,s.jsx)(o.strong,{children:"Grant Access"}),". Add both the created service account and cloud buid ",(0,s.jsx)(o.code,{children:"gserviceaccount.com"})," emails in the ",(0,s.jsx)(o.strong,{children:"Add Principal"})," section and assign them both the ",(0,s.jsx)(o.strong,{children:"Basic -> Editor"})," role."]}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"GCP-Cross-Project-IAM",src:t(3415).Z+"",width:"586",height:"744"})}),"\n",(0,s.jsxs)(o.p,{children:["Once added they should both appear as principals in the ",(0,s.jsx)(o.strong,{children:"IAM"})," section of that project."]}),"\n",(0,s.jsx)(o.admonition,{type:"tip",children:(0,s.jsxs)(o.p,{children:["This approach also works for adding permissions to Folders or Organizations. Simply select whichever resource you wish to grant access to in the ",(0,s.jsx)(o.a,{href:"https://console.cloud.google.com/cloud-resource-manager",children:"Manage Resources"})," section, and navigate to the ",(0,s.jsx)(o.strong,{children:"IAM and Admin > IAM"})," section for that resource."]})}),"\n",(0,s.jsx)(o.h1,{id:"project-selection",children:"Project Selection"}),"\n",(0,s.jsxs)(o.p,{children:["Now in Cado, if the credentials of the service account are already in the platform after following the ",(0,s.jsx)(o.a,{href:"/cado-response/deploy/gcp/gcp-settings",children:"Overview"}),", when importing from GCP you will now have a selection of projects to choose from."]}),"\n",(0,s.jsx)(o.p,{children:(0,s.jsx)(o.img,{alt:"GCP-Cado-Cross-Project",src:t(3708).Z+"",width:"789",height:"403"})}),"\n",(0,s.jsxs)(o.admonition,{type:"info",children:[(0,s.jsxs)(o.p,{children:["This configuration only allows us to import from our Secondary Project to our Primary Project. If we want to be able to import the other way as well, the Seconday Account's Cloud Build ",(0,s.jsx)(o.code,{children:"gserviceaccount.com"})," will need to be granted access to the Primary Account's IAM section and given the ",(0,s.jsx)(o.strong,{children:"Editor"})," role."]}),(0,s.jsxs)(o.p,{children:["Simply follow the same steps in the ",(0,s.jsx)(o.strong,{children:"Secondary Project Permissions"})," section, but using the Secondary Project's principal and adding it to the Primary Project."]})]})]})}function l(e={}){const{wrapper:o}={...(0,r.a)(),...e.components};return o?(0,s.jsx)(o,{...e,children:(0,s.jsx)(p,{...e})}):p(e)}},3708:(e,o,t)=>{t.d(o,{Z:()=>s});const s=t.p+"assets/images/gcp-cado-project-selection-2762ea12f2f1cc7d5b52ca71dafb1590.png"},3415:(e,o,t)=>{t.d(o,{Z:()=>s});const s=t.p+"assets/images/gcp-cross-project-iam-3349e5d4ad1b5bfbcab5285b531c9d06.png"},1151:(e,o,t)=>{t.d(o,{Z:()=>i,a:()=>c});var s=t(7294);const r={},n=s.createContext(r);function c(e){const o=s.useContext(n);return s.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function i(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:c(e.components),s.createElement(n.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0a48197e.e05f092b.js b/assets/js/0a48197e.e05f092b.js new file mode 100644 index 000000000..ef49f9559 --- /dev/null +++ b/assets/js/0a48197e.e05f092b.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2891],{9134:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>i,contentTitle:()=>a,default:()=>u,frontMatter:()=>r,metadata:()=>d,toc:()=>l});var s=o(5893),n=o(1151);const r={title:"Private IP Addresses",hide_title:!0,sidebar_position:2},a="Removing Internet Routable Addresses",d={id:"cado-response/deploy/aws/networking/internet-routable-addresses",title:"Private IP Addresses",description:"By default, the Cado platform deploys into its own VPC with an allow-list of known good IP Addresses set by the user. Public IPv4 addresses are assigned to the main Cado platform to enable a user to connect with their web browser, and are also assigned to workers to allow them to connect to required AWS services e.g. s3.amazonaws.com.",source:"@site/docs/cado-response/deploy/aws/networking/internet-routable-addresses.md",sourceDirName:"cado-response/deploy/aws/networking",slug:"/cado-response/deploy/aws/networking/internet-routable-addresses",permalink:"/cado-response/deploy/aws/networking/internet-routable-addresses",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/networking/internet-routable-addresses.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"Private IP Addresses",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Load Balancer",permalink:"/cado-response/deploy/aws/networking/aws-load-balancer"},next:{title:"Backups and Recovery",permalink:"/cado-response/deploy/aws/performance-resiliency/aws-backups"}},i={},l=[];function c(e){const t={a:"a",h1:"h1",p:"p",...(0,n.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"removing-internet-routable-addresses",children:"Removing Internet Routable Addresses"}),"\n",(0,s.jsx)(t.p,{children:"By default, the Cado platform deploys into its own VPC with an allow-list of known good IP Addresses set by the user. Public IPv4 addresses are assigned to the main Cado platform to enable a user to connect with their web browser, and are also assigned to workers to allow them to connect to required AWS services e.g. s3.amazonaws.com."}),"\n",(0,s.jsxs)(t.p,{children:["You can remove the requirement for publicly routable IP addresses if you have set up ",(0,s.jsx)(t.a,{href:"https://tomgregory.com/when-to-use-an-aws-s3-vpc-endpoint/",children:"VPC Endpoints"})," to connect Cado to required AWS Services.\nYou can remove the Public IP addresses associated with Workers under Settings > Advanced.\nYou can edit the deployment to remove the Public Elastic IP address from the main Cado web server and set up an Application Load Balancer instead to handle traffic to the user over the internet. If you remove the Public Elastic IP address, the built-in Update service will be unable to function and you will need to update via Terraform instead."]})]})}function u(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}},1151:(e,t,o)=>{o.d(t,{Z:()=>d,a:()=>a});var s=o(7294);const n={},r=s.createContext(n);function a(e){const t=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),s.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0a48197e.e6ecb4a0.js b/assets/js/0a48197e.e6ecb4a0.js deleted file mode 100644 index 558dd588b..000000000 --- a/assets/js/0a48197e.e6ecb4a0.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2891],{9134:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>i,contentTitle:()=>a,default:()=>u,frontMatter:()=>r,metadata:()=>d,toc:()=>l});var s=o(5893),n=o(1151);const r={title:"Private IP Addresses",hide_title:!0,sidebar_position:2},a="Removing Internet Routable Addresses",d={id:"cado-response/deploy/aws/networking/internet-routable-addresses",title:"Private IP Addresses",description:"By default, the Cado platform deploys into its own VPC with an allow-list of known good IP Addresses set by the user. Public IPv4 addresses are assigned to the main Cado platform to enable a user to connect with their web browser, and are also assigned to workers to allow them to connect to required AWS services e.g. s3.amazonaws.com.",source:"@site/docs/cado-response/deploy/aws/networking/internet-routable-addresses.md",sourceDirName:"cado-response/deploy/aws/networking",slug:"/cado-response/deploy/aws/networking/internet-routable-addresses",permalink:"/cado-response/deploy/aws/networking/internet-routable-addresses",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/networking/internet-routable-addresses.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"Private IP Addresses",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Load Balancer",permalink:"/cado-response/deploy/aws/networking/aws-load-balancer"},next:{title:"Backups and Recovery",permalink:"/cado-response/deploy/aws/performance-resiliency/aws-backups"}},i={},l=[];function c(e){const t={a:"a",h1:"h1",p:"p",...(0,n.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"removing-internet-routable-addresses",children:"Removing Internet Routable Addresses"}),"\n",(0,s.jsx)(t.p,{children:"By default, the Cado platform deploys into its own VPC with an allow-list of known good IP Addresses set by the user. Public IPv4 addresses are assigned to the main Cado platform to enable a user to connect with their web browser, and are also assigned to workers to allow them to connect to required AWS services e.g. s3.amazonaws.com."}),"\n",(0,s.jsxs)(t.p,{children:["You can remove the requirement for publicly routable IP addresses if you have set up ",(0,s.jsx)(t.a,{href:"https://tomgregory.com/when-to-use-an-aws-s3-vpc-endpoint/",children:"VPC Endpoints"})," to connect Cado to required AWS Services.\nYou can remove the Public IP addresses associated with Workers under Settings > Advanced.\nYou can edit the deployment to remove the Public Elastic IP address from the main Cado web server and set up an Application Load Balancer instead to handle traffic to the user over the internet. If you remove the Public Elastic IP address, the built-in Update service will be unable to function and you will need to update via Terraform instead."]})]})}function u(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}},1151:(e,t,o)=>{o.d(t,{Z:()=>d,a:()=>a});var s=o(7294);const n={},r=s.createContext(n);function a(e){const t=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),s.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0b3c7d72.a5974bf2.js b/assets/js/0b3c7d72.a5974bf2.js deleted file mode 100644 index e54ada91d..000000000 --- a/assets/js/0b3c7d72.a5974bf2.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[990],{958:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>d,contentTitle:()=>s,default:()=>m,frontMatter:()=>a,metadata:()=>r,toc:()=>l});var o=t(5893),i=t(1151);const a={sidebar_position:1,id:"community-intro",title:"Summary"},s="Cado Community Edition",r={id:"cado-response/community-edition/community-intro",title:"Summary",description:"The Cado platform platform leverages the scale, speed and automation of the cloud to expedite investigation and response. Cado Community Edition is a free version of the Cado platform that lets you analyze:",source:"@site/docs/cado-response/community-edition/intro.md",sourceDirName:"cado-response/community-edition",slug:"/cado-response/community-edition/community-intro",permalink:"/cado-response/community-edition/community-intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/community-edition/intro.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{sidebar_position:1,id:"community-intro",title:"Summary"},sidebar:"tutorialSidebar",previous:{title:"Cost Management",permalink:"/cado-response/manage/cost-management"},next:{title:"Summary",permalink:"/cado-host/intro"}},d={},l=[{value:"Benefits",id:"benefits",level:3},{value:"Getting Started",id:"getting-started",level:2},{value:"Signing up for Cado Community Edition",id:"signing-up-for-cado-community-edition",level:3},{value:"Deploying in your cloud environment",id:"deploying-in-your-cloud-environment",level:3},{value:"Processing Data",id:"processing-data",level:3},{value:"Analyzing Evidence",id:"analyzing-evidence",level:3},{value:"How does Cado Community Edition differ from the full Cado platform?",id:"how-does-cado-community-edition-differ-from-the-full-cado-platform",level:2}];function c(e){const n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",hr:"hr",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",p:"p",strong:"strong",ul:"ul",...(0,i.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(n.h1,{id:"cado-community-edition",children:"Cado Community Edition"}),"\n",(0,o.jsxs)(n.p,{children:["The ",(0,o.jsx)(n.a,{href:"/cado-response/intro",children:"Cado platform"})," platform leverages the scale, speed and automation of the cloud to expedite investigation and response. Cado Community Edition is a free version of the Cado platform that lets you analyze:"]}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsx)(n.li,{children:"Disk images captured in DD format"}),"\n",(0,o.jsx)(n.li,{children:"Exports of triaged items from open source forensics tools like KAPE and Velociraptor"}),"\n",(0,o.jsx)(n.li,{children:"Sample data - e.g data published by Cado that illustrates different types of issues incident responders might encounter across server-based, container-based and serverless systems in the cloud.\nWith Cado Community Edition, users can:\nNavigate files and folders\nView a timeline of activities performed on the system\nAnalyze captured artifacts for threats and indicators of compromise\nEasily pivot and search across artifacts"}),"\n"]}),"\n",(0,o.jsx)(n.h3,{id:"benefits",children:"Benefits"}),"\n",(0,o.jsx)(n.p,{children:"Cado Community Edition gives you:"}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.strong,{children:"Cloud Scale and Speed"})," - Adding the speed of cloud-native analysis to their existing data capture processes"]}),"\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.strong,{children:"Automated Analysis"})," - Performing automated analysis of systems using built-in detections provided by experts in the Cado Labs team"]}),"\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.strong,{children:"Easier Sharing"})," - Easier sharing of artifacts and findings using a cloud-based system"]}),"\n"]}),"\n",(0,o.jsx)(n.hr,{}),"\n",(0,o.jsx)(n.h2,{id:"getting-started",children:"Getting Started"}),"\n",(0,o.jsx)(n.p,{children:"Interested in getting started? Here are some of the most frequently accessed help topics."}),"\n",(0,o.jsx)(n.h3,{id:"signing-up-for-cado-community-edition",children:"Signing up for Cado Community Edition"}),"\n",(0,o.jsxs)(n.p,{children:["Visit the ",(0,o.jsx)(n.a,{href:"https://www.cadosecurity.com/cado-community-edition/#get-access",children:"Cado Community Edition website"})," page to sign up. Once signed up, a Cado representative will send you a license and link to our CloudFormation template."]}),"\n",(0,o.jsx)(n.h3,{id:"deploying-in-your-cloud-environment",children:"Deploying in your cloud environment"}),"\n",(0,o.jsx)(n.p,{children:"How to deploy Cado Community Edition in your cloud environment in AWS. Please note that Cado Community Edition only supports CloudFormation deployment in AWS. Also, although there are many configurable deployment settings accepting the default values will work well for Cado Community Edition. You\u2019ll need a key pair in case you want to access the SSH port of the system (however, for the Community Edition this probably won\u2019t be necessary). Lastly, we recommend that you take advantage of the IP address restrictions available."}),"\n",(0,o.jsxs)(n.admonition,{type:"caution",children:[(0,o.jsx)(n.mdxAdmonitionTitle,{}),(0,o.jsxs)(n.p,{children:["Please note that by deploying and running Cado Community Edition you will incur AWS charges. In order to keep charges to a minimum, you can shut down the main instance that serves the web interface when all processing is finished and you are no longer using it. You can also adjust the worker size under ",(0,o.jsx)(n.code,{children:"Processing > Settings"}),". The ",(0,o.jsx)(n.code,{children:"i3"})," series of worker instances (used by default) provide more disk space to enable processing of larger disks, however, the ",(0,o.jsx)(n.code,{children:"t3"})," series operate at a lower cost. If you are concerned about cost, you may want to select e.g. a ",(0,o.jsx)(n.code,{children:"t3.large"})," worker size in settings."]})]}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.strong,{children:(0,o.jsx)(n.a,{href:"/cado-response/deploy/aws/overview",children:"Learn how >"})})}),"\n",(0,o.jsx)(n.h3,{id:"processing-data",children:"Processing Data"}),"\n",(0,o.jsxs)(n.p,{children:["After deploying Cado Community Edition, you can import data from the S3 bucket created by the CloudFormation template (you can find the identifier under CloudFormation - Stacks - ",(0,o.jsx)(n.em,{children:"stack name"})," - Outputs - S3Bucket). Please note that all other options will be unavailable. Also, please note that Cado Community Edition will only analyze .dd, dd.gz, and .zip files"]}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.strong,{children:(0,o.jsx)(n.a,{href:"/cado-response/discovery-import/intro",children:"Learn how >"})})}),"\n",(0,o.jsx)(n.h3,{id:"analyzing-evidence",children:"Analyzing Evidence"}),"\n",(0,o.jsx)(n.p,{children:"Data which is imported is automatically processed, analyzed and added to the platform. Automatic detections, timeline of events and more are available for investigation."}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.strong,{children:(0,o.jsx)(n.a,{href:"/cado-response/investigate/intro",children:"Learn how >"})})}),"\n",(0,o.jsx)(n.hr,{}),"\n",(0,o.jsx)(n.h2,{id:"how-does-cado-community-edition-differ-from-the-full-cado-platform",children:"How does Cado Community Edition differ from the full Cado platform?"}),"\n",(0,o.jsx)(n.p,{children:"The Cado Community Edition provides only a subset of the features that are available in the enterprise version of the Cado platform.\nIn addition to the features available in the Cado Community Edition, The enterprise version of the Cado Platform also supports:"}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsx)(n.li,{children:"Automated capture and processing of data cloud based systems across AWS, Azure and Google Cloud Platform"}),"\n",(0,o.jsx)(n.li,{children:"Analysis of container based, serverless and infrastructure as code artifacts"}),"\n",(0,o.jsx)(n.li,{children:"Automated integration of threat feeds and YARA rules"}),"\n",(0,o.jsx)(n.li,{children:"API and automated capture and processing of data"}),"\n",(0,o.jsx)(n.li,{children:"Multiple concurrent users with role-based access"}),"\n"]})]})}function m(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,o.jsx)(n,{...e,children:(0,o.jsx)(c,{...e})}):c(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>r,a:()=>s});var o=t(7294);const i={},a=o.createContext(i);function s(e){const n=o.useContext(a);return o.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:s(e.components),o.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0b3c7d72.e77d4f71.js b/assets/js/0b3c7d72.e77d4f71.js new file mode 100644 index 000000000..ce8201d9f --- /dev/null +++ b/assets/js/0b3c7d72.e77d4f71.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[990],{958:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>d,contentTitle:()=>s,default:()=>m,frontMatter:()=>a,metadata:()=>r,toc:()=>l});var o=t(5893),i=t(1151);const a={sidebar_position:1,id:"community-intro",title:"Summary"},s="Cado Community Edition",r={id:"cado-response/community-edition/community-intro",title:"Summary",description:"The Cado platform platform leverages the scale, speed and automation of the cloud to expedite investigation and response. Cado Community Edition is a free version of the Cado platform that lets you analyze:",source:"@site/docs/cado-response/community-edition/intro.md",sourceDirName:"cado-response/community-edition",slug:"/cado-response/community-edition/community-intro",permalink:"/cado-response/community-edition/community-intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/community-edition/intro.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{sidebar_position:1,id:"community-intro",title:"Summary"},sidebar:"tutorialSidebar",previous:{title:"Cost Management",permalink:"/cado-response/manage/cost-management"},next:{title:"Summary",permalink:"/cado-host/intro"}},d={},l=[{value:"Benefits",id:"benefits",level:3},{value:"Getting Started",id:"getting-started",level:2},{value:"Signing up for Cado Community Edition",id:"signing-up-for-cado-community-edition",level:3},{value:"Deploying in your cloud environment",id:"deploying-in-your-cloud-environment",level:3},{value:"Processing Data",id:"processing-data",level:3},{value:"Analyzing Evidence",id:"analyzing-evidence",level:3},{value:"How does Cado Community Edition differ from the full Cado platform?",id:"how-does-cado-community-edition-differ-from-the-full-cado-platform",level:2}];function c(e){const n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",hr:"hr",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",p:"p",strong:"strong",ul:"ul",...(0,i.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(n.h1,{id:"cado-community-edition",children:"Cado Community Edition"}),"\n",(0,o.jsxs)(n.p,{children:["The ",(0,o.jsx)(n.a,{href:"/cado-response/intro",children:"Cado platform"})," platform leverages the scale, speed and automation of the cloud to expedite investigation and response. Cado Community Edition is a free version of the Cado platform that lets you analyze:"]}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsx)(n.li,{children:"Disk images captured in DD format"}),"\n",(0,o.jsx)(n.li,{children:"Exports of triaged items from open source forensics tools like KAPE and Velociraptor"}),"\n",(0,o.jsx)(n.li,{children:"Sample data - e.g data published by Cado that illustrates different types of issues incident responders might encounter across server-based, container-based and serverless systems in the cloud.\nWith Cado Community Edition, users can:\nNavigate files and folders\nView a timeline of activities performed on the system\nAnalyze captured artifacts for threats and indicators of compromise\nEasily pivot and search across artifacts"}),"\n"]}),"\n",(0,o.jsx)(n.h3,{id:"benefits",children:"Benefits"}),"\n",(0,o.jsx)(n.p,{children:"Cado Community Edition gives you:"}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.strong,{children:"Cloud Scale and Speed"})," - Adding the speed of cloud-native analysis to their existing data capture processes"]}),"\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.strong,{children:"Automated Analysis"})," - Performing automated analysis of systems using built-in detections provided by experts in the Cado Labs team"]}),"\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.strong,{children:"Easier Sharing"})," - Easier sharing of artifacts and findings using a cloud-based system"]}),"\n"]}),"\n",(0,o.jsx)(n.hr,{}),"\n",(0,o.jsx)(n.h2,{id:"getting-started",children:"Getting Started"}),"\n",(0,o.jsx)(n.p,{children:"Interested in getting started? Here are some of the most frequently accessed help topics."}),"\n",(0,o.jsx)(n.h3,{id:"signing-up-for-cado-community-edition",children:"Signing up for Cado Community Edition"}),"\n",(0,o.jsxs)(n.p,{children:["Visit the ",(0,o.jsx)(n.a,{href:"https://www.cadosecurity.com/cado-community-edition/#get-access",children:"Cado Community Edition website"})," page to sign up. Once signed up, a Cado representative will send you a license and link to our CloudFormation template."]}),"\n",(0,o.jsx)(n.h3,{id:"deploying-in-your-cloud-environment",children:"Deploying in your cloud environment"}),"\n",(0,o.jsx)(n.p,{children:"How to deploy Cado Community Edition in your cloud environment in AWS. Please note that Cado Community Edition only supports CloudFormation deployment in AWS. Also, although there are many configurable deployment settings accepting the default values will work well for Cado Community Edition. You\u2019ll need a key pair in case you want to access the SSH port of the system (however, for the Community Edition this probably won\u2019t be necessary). Lastly, we recommend that you take advantage of the IP address restrictions available."}),"\n",(0,o.jsxs)(n.admonition,{type:"caution",children:[(0,o.jsx)(n.mdxAdmonitionTitle,{}),(0,o.jsxs)(n.p,{children:["Please note that by deploying and running Cado Community Edition you will incur AWS charges. In order to keep charges to a minimum, you can shut down the main instance that serves the web interface when all processing is finished and you are no longer using it. You can also adjust the worker size under ",(0,o.jsx)(n.code,{children:"Processing > Settings"}),". The ",(0,o.jsx)(n.code,{children:"i3"})," series of worker instances (used by default) provide more disk space to enable processing of larger disks, however, the ",(0,o.jsx)(n.code,{children:"t3"})," series operate at a lower cost. If you are concerned about cost, you may want to select e.g. a ",(0,o.jsx)(n.code,{children:"t3.large"})," worker size in settings."]})]}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.strong,{children:(0,o.jsx)(n.a,{href:"/cado-response/deploy/aws/overview",children:"Learn how >"})})}),"\n",(0,o.jsx)(n.h3,{id:"processing-data",children:"Processing Data"}),"\n",(0,o.jsxs)(n.p,{children:["After deploying Cado Community Edition, you can import data from the S3 bucket created by the CloudFormation template (you can find the identifier under CloudFormation - Stacks - ",(0,o.jsx)(n.em,{children:"stack name"})," - Outputs - S3Bucket). Please note that all other options will be unavailable. Also, please note that Cado Community Edition will only analyze .dd, dd.gz, and .zip files"]}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.strong,{children:(0,o.jsx)(n.a,{href:"/cado-response/discovery-import/intro",children:"Learn how >"})})}),"\n",(0,o.jsx)(n.h3,{id:"analyzing-evidence",children:"Analyzing Evidence"}),"\n",(0,o.jsx)(n.p,{children:"Data which is imported is automatically processed, analyzed and added to the platform. Automatic detections, timeline of events and more are available for investigation."}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.strong,{children:(0,o.jsx)(n.a,{href:"/cado-response/investigate/intro",children:"Learn how >"})})}),"\n",(0,o.jsx)(n.hr,{}),"\n",(0,o.jsx)(n.h2,{id:"how-does-cado-community-edition-differ-from-the-full-cado-platform",children:"How does Cado Community Edition differ from the full Cado platform?"}),"\n",(0,o.jsx)(n.p,{children:"The Cado Community Edition provides only a subset of the features that are available in the enterprise version of the Cado platform.\nIn addition to the features available in the Cado Community Edition, The enterprise version of the Cado Platform also supports:"}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsx)(n.li,{children:"Automated capture and processing of data cloud based systems across AWS, Azure and Google Cloud Platform"}),"\n",(0,o.jsx)(n.li,{children:"Analysis of container based, serverless and infrastructure as code artifacts"}),"\n",(0,o.jsx)(n.li,{children:"Automated integration of threat feeds and YARA rules"}),"\n",(0,o.jsx)(n.li,{children:"API and automated capture and processing of data"}),"\n",(0,o.jsx)(n.li,{children:"Multiple concurrent users with role-based access"}),"\n"]})]})}function m(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,o.jsx)(n,{...e,children:(0,o.jsx)(c,{...e})}):c(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>r,a:()=>s});var o=t(7294);const i={},a=o.createContext(i);function s(e){const n=o.useContext(a);return o.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:s(e.components),o.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0d8bf183.8f9aa3f1.js b/assets/js/0d8bf183.8f9aa3f1.js new file mode 100644 index 000000000..3ecccf80d --- /dev/null +++ b/assets/js/0d8bf183.8f9aa3f1.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[354],{5791:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>s,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var i=t(5893),o=t(1151);const r={title:"CrowdStrike",hide_title:!0,sidebar_position:4},s="CrowdStrike Integration (Beta)",a={id:"cado-response/manage/integrations/xdr/crowdstrike",title:"CrowdStrike",description:"Integrating with CrowdStrike Falcon allows you to select and kick off triage acquisition on hosts with the Falcon Sensor installed using CrowdStrike Real Time Response.",source:"@site/docs/cado-response/manage/integrations/xdr/crowdstrike.md",sourceDirName:"cado-response/manage/integrations/xdr",slug:"/cado-response/manage/integrations/xdr/crowdstrike",permalink:"/cado-response/manage/integrations/xdr/crowdstrike",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/xdr/crowdstrike.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:4,frontMatter:{title:"CrowdStrike",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"SentinelOne",permalink:"/cado-response/manage/integrations/xdr/sentinelone"},next:{title:"Worker Management",permalink:"/cado-response/manage/workers"}},l={},d=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Enabling integration in the Cado Platform",id:"enabling-integration-in-the-cado-platform",level:2}];function c(e){const n={a:"a",admonition:"admonition",em:"em",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,o.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"crowdstrike-integration-beta",children:"CrowdStrike Integration (Beta)"}),"\n",(0,i.jsx)(n.p,{children:"Integrating with CrowdStrike Falcon allows you to select and kick off triage acquisition on hosts with the Falcon Sensor installed using CrowdStrike Real Time Response."}),"\n",(0,i.jsx)(n.p,{children:"Once you have kicked off the triage acquisition CrowdStrike Falcon Real Time Response will locate the endpoint running CrowdStrike Falcon Sensor\nRun a Cado Host command on the endpoint that performs collection of the triage package and uploads it to Cado for processing"}),"\n",(0,i.jsx)(n.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["Create an API Client with the permissions listed below. For more information on how to do this see this helpful ",(0,i.jsx)(n.a,{href:"https://www.crowdstrike.com/blog/tech-center/get-access-falcon-apis/",children:"blog article"}),". This API Client will need"]}),"\n"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Real Time Response Admin"}),": Write"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Hosts"}),": Read"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Real Time Response"}),": Read"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Real Time Response"}),": Write"]}),"\n"]}),"\n",(0,i.jsxs)(n.ol,{start:"2",children:["\n",(0,i.jsx)(n.li,{children:"Copy and note down the Client ID, Client Secret and Endpoint URL to enter into the Cado Platform"}),"\n",(0,i.jsx)(n.li,{children:"Enable Real Time Response in either the Default policies for each operating system, or your own that you can attach to a host group."}),"\n",(0,i.jsx)(n.li,{children:"Create Detections and Preventions Machine Learning exclusions with the following pattern to allow the Windows integration to function:"}),"\n"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:'"C:\\Windows\\Temp\\_MEI*\\**\\CadoHostRawGrabber.exe"'}),"\n",(0,i.jsx)(n.li,{children:'"C:\\Windows\\Temp\\cado-host-*\\cado-host.exe"'}),"\n"]}),"\n",(0,i.jsx)(n.admonition,{type:"note",children:(0,i.jsx)(n.p,{children:"CrowdStrike Falcon defines policies on a \u201cper platform basis\u201d, so you will need a Windows Response Policy and a Linux Response Policy which allows RTR Admin."})}),"\n",(0,i.jsx)(n.h2,{id:"enabling-integration-in-the-cado-platform",children:"Enabling integration in the Cado Platform"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["Enable beta CrowdStrike integration feature by navigating to ",(0,i.jsx)(n.em,{children:"Settings > Experiments"}),". Then toggle the \u201cCrowdstrike\u201d feature."]}),"\n"]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.img,{alt:"beta crowstrike setting",src:t(1938).Z+"",width:"632",height:"190"}),"\n2. Navigate to ",(0,i.jsx)(n.em,{children:"Settings > Integrations > XDR"})," and click \u201cAdd Connection\u201d.\n3. Click \u201cAdd Connection\u201d and select CrowdStrike from the dropdown menu.\nEnter the URL, Client ID and Client Secret from the previous section. The integration should then appear on the settings page."]}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"crowdstrike dropdown",src:t(7681).Z+"",width:"792",height:"361"})}),"\n",(0,i.jsxs)(n.ol,{start:"4",children:["\n",(0,i.jsxs)(n.li,{children:["In any project, click ",(0,i.jsx)(n.em,{children:"\u201cImport\u201d -> XDR -> CrowdStrike"})]}),"\n",(0,i.jsx)(n.li,{children:"If you have configured it correctly, then it should show a paginated list of all the hosts the CrowdStrike Falcon sensor installed and are part of the correct Host Group."}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,o.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},1938:(e,n,t)=>{t.d(n,{Z:()=>i});const i=t.p+"assets/images/beta-settings-crowdstrike-1efbcfdae1f6f5209ff9825b74e112bc.png"},7681:(e,n,t)=>{t.d(n,{Z:()=>i});const i=t.p+"assets/images/crowdstrike-xdr-dropdown-3b9895e9d42554ee27186801136b6554.png"},1151:(e,n,t)=>{t.d(n,{Z:()=>a,a:()=>s});var i=t(7294);const o={},r=i.createContext(o);function s(e){const n=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),i.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0d8bf183.e313bb52.js b/assets/js/0d8bf183.e313bb52.js deleted file mode 100644 index 76e3a7887..000000000 --- a/assets/js/0d8bf183.e313bb52.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[354],{5791:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>s,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var i=t(5893),o=t(1151);const r={title:"CrowdStrike",hide_title:!0,sidebar_position:4},s="CrowdStrike Integration (Beta)",a={id:"cado-response/manage/integrations/xdr/crowdstrike",title:"CrowdStrike",description:"Integrating with CrowdStrike Falcon allows you to select and kick off triage acquisition on hosts with the Falcon Sensor installed using CrowdStrike Real Time Response.",source:"@site/docs/cado-response/manage/integrations/xdr/crowdstrike.md",sourceDirName:"cado-response/manage/integrations/xdr",slug:"/cado-response/manage/integrations/xdr/crowdstrike",permalink:"/cado-response/manage/integrations/xdr/crowdstrike",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/xdr/crowdstrike.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:4,frontMatter:{title:"CrowdStrike",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"SentinelOne",permalink:"/cado-response/manage/integrations/xdr/sentinelone"},next:{title:"Worker Management",permalink:"/cado-response/manage/workers"}},l={},d=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Enabling integration in the Cado Platform",id:"enabling-integration-in-the-cado-platform",level:2}];function c(e){const n={a:"a",admonition:"admonition",em:"em",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,o.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"crowdstrike-integration-beta",children:"CrowdStrike Integration (Beta)"}),"\n",(0,i.jsx)(n.p,{children:"Integrating with CrowdStrike Falcon allows you to select and kick off triage acquisition on hosts with the Falcon Sensor installed using CrowdStrike Real Time Response."}),"\n",(0,i.jsx)(n.p,{children:"Once you have kicked off the triage acquisition CrowdStrike Falcon Real Time Response will locate the endpoint running CrowdStrike Falcon Sensor\nRun a Cado Host command on the endpoint that performs collection of the triage package and uploads it to Cado for processing"}),"\n",(0,i.jsx)(n.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["Create an API Client with the permissions listed below. For more information on how to do this see this helpful ",(0,i.jsx)(n.a,{href:"https://www.crowdstrike.com/blog/tech-center/get-access-falcon-apis/",children:"blog article"}),". This API Client will need"]}),"\n"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Real Time Response Admin"}),": Write"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Hosts"}),": Read"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Real Time Response"}),": Read"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.strong,{children:"Real Time Response"}),": Write"]}),"\n"]}),"\n",(0,i.jsxs)(n.ol,{start:"2",children:["\n",(0,i.jsx)(n.li,{children:"Copy and note down the Client ID, Client Secret and Endpoint URL to enter into the Cado Platform"}),"\n",(0,i.jsx)(n.li,{children:"Enable Real Time Response in either the Default policies for each operating system, or your own that you can attach to a host group."}),"\n",(0,i.jsx)(n.li,{children:"Create Detections and Preventions Machine Learning exclusions with the following pattern to allow the Windows integration to function:"}),"\n"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:'"C:\\Windows\\Temp\\_MEI*\\**\\CadoHostRawGrabber.exe"'}),"\n",(0,i.jsx)(n.li,{children:'"C:\\Windows\\Temp\\cado-host-*\\cado-host.exe"'}),"\n"]}),"\n",(0,i.jsx)(n.admonition,{type:"note",children:(0,i.jsx)(n.p,{children:"CrowdStrike Falcon defines policies on a \u201cper platform basis\u201d, so you will need a Windows Response Policy and a Linux Response Policy which allows RTR Admin."})}),"\n",(0,i.jsx)(n.h2,{id:"enabling-integration-in-the-cado-platform",children:"Enabling integration in the Cado Platform"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["Enable beta CrowdStrike integration feature by navigating to ",(0,i.jsx)(n.em,{children:"Settings > Experiments"}),". Then toggle the \u201cCrowdstrike\u201d feature."]}),"\n"]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.img,{alt:"beta crowstrike setting",src:t(1938).Z+"",width:"632",height:"190"}),"\n2. Navigate to ",(0,i.jsx)(n.em,{children:"Settings > Integrations > XDR"})," and click \u201cAdd Connection\u201d.\n3. Click \u201cAdd Connection\u201d and select CrowdStrike from the dropdown menu.\nEnter the URL, Client ID and Client Secret from the previous section. The integration should then appear on the settings page."]}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"crowdstrike dropdown",src:t(7681).Z+"",width:"792",height:"361"})}),"\n",(0,i.jsxs)(n.ol,{start:"4",children:["\n",(0,i.jsxs)(n.li,{children:["In any project, click ",(0,i.jsx)(n.em,{children:"\u201cImport\u201d -> XDR -> CrowdStrike"})]}),"\n",(0,i.jsx)(n.li,{children:"If you have configured it correctly, then it should show a paginated list of all the hosts the CrowdStrike Falcon sensor installed and are part of the correct Host Group."}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,o.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},1938:(e,n,t)=>{t.d(n,{Z:()=>i});const i=t.p+"assets/images/beta-settings-crowdstrike-1efbcfdae1f6f5209ff9825b74e112bc.png"},7681:(e,n,t)=>{t.d(n,{Z:()=>i});const i=t.p+"assets/images/crowdstrike-xdr-dropdown-3b9895e9d42554ee27186801136b6554.png"},1151:(e,n,t)=>{t.d(n,{Z:()=>a,a:()=>s});var i=t(7294);const o={},r=i.createContext(o);function s(e){const n=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),i.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/13c5f577.7e580419.js b/assets/js/13c5f577.7e580419.js deleted file mode 100644 index cb7c8e7dc..000000000 --- a/assets/js/13c5f577.7e580419.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8403],{9014:(A,e,g)=>{g.r(e),g.d(e,{assets:()=>Q,contentTitle:()=>E,default:()=>n,frontMatter:()=>C,metadata:()=>s,toc:()=>I});var t=g(5893),B=g(1151);const C={title:"Oracle Cloud Virtual Machines",hide_title:!0,sidebar_position:1},E="Oracle Cloud Virtual Machines",s={id:"cado-response/discovery-import/import/oracle/virtual-machine",title:"Oracle Cloud Virtual Machines",description:"First, you need to take a clone of the instance boot volume. Note that this will affect the instance as it performs a shutdown task and will restart the instance on completion.",source:"@site/docs/cado-response/discovery-import/import/oracle/virtual-machine.md",sourceDirName:"cado-response/discovery-import/import/oracle",slug:"/cado-response/discovery-import/import/oracle/virtual-machine",permalink:"/cado-response/discovery-import/import/oracle/virtual-machine",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/oracle/virtual-machine.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Oracle Cloud Virtual Machines",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Google Cloud Kubernetes Engine",permalink:"/cado-response/discovery-import/import/gcp/kubernetes-engine"},next:{title:"Exporting Data",permalink:"/cado-response/export/intro"}},Q={},I=[];function a(A){const e={code:"code",h1:"h1",img:"img",p:"p",...(0,B.a)(),...A.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{id:"oracle-cloud-virtual-machines",children:"Oracle Cloud Virtual Machines"}),"\n",(0,t.jsx)(e.p,{children:"First, you need to take a clone of the instance boot volume. Note that this will affect the instance as it performs a shutdown task and will restart the instance on completion."}),"\n",(0,t.jsx)(e.p,{children:"Open the Oracle Cloud Infrastructure (\u201cOCI\u201d) console, and browse to Compute -> Instances:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(9983).Z+"",width:"1919",height:"675"})}),"\n",(0,t.jsx)(e.p,{children:"Select the instance you want to acquire:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(5358).Z+"",width:"1908",height:"142"})}),"\n",(0,t.jsxs)(e.p,{children:["From the Resources section, select Boot volume and then click on the Boot volume that is attached to the instance:\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(3628).Z+"",width:"1893",height:"266"})]}),"\n",(0,t.jsxs)(e.p,{children:["This will take you to the Boot volume's details page -> select Boot Volume Clones from the Resources menu on the left:\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(7205).Z+"",width:"1908",height:"273"})]}),"\n",(0,t.jsxs)(e.p,{children:["Click ",(0,t.jsx)(e.code,{children:"Create Clone"})," button -> Give the clone volume an appropriate name -> then click the ",(0,t.jsx)(e.code,{children:"Create Clone"})," button at the bottom of the page:"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(6162).Z+"",width:"1917",height:"791"})}),"\n",(0,t.jsx)(e.p,{children:"Deploy your pre-built forensics instance, in this case example Kali Linux:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(7154).Z+"",width:"1496",height:"885"})}),"\n",(0,t.jsxs)(e.p,{children:["For ",(0,t.jsx)(e.code,{children:"Kali Linux"}),", the ",(0,t.jsx)(e.code,{children:"SSH"})," daemon is not installed by default and connections to the instance are made using Cloud Shell. Select Console connection from the Resources list on the left of the screen."]}),"\n",(0,t.jsx)(e.p,{children:"Click on Launch Cloud Shell connection:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(7994).Z+"",width:"1912",height:"668"})}),"\n",(0,t.jsx)(e.p,{children:"Attach the cloned disk to the forensic instance, selecting Paravirtualized as the attachment type. As this is a Boot volume we are not able to select Read only - shareable as the Access type:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(8566).Z+"",width:"1918",height:"916"})}),"\n",(0,t.jsxs)(e.p,{children:["Once the volume is attached you can switch over to your Cloud Shell session to acquire an image. We have used the command ",(0,t.jsx)(e.code,{children:"lsblk"})," to identify the device identified for the attached disk, in this case it is sdb:"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(3984).Z+"",width:"1186",height:"330"})}),"\n",(0,t.jsx)(e.p,{children:"To create the disk image, you can use dc3dd:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(3693).Z+"",width:"1163",height:"362"})}),"\n",(0,t.jsx)(e.p,{children:"Looking at the size of the image file test-clone.dd, 47GB, it's going to take time to transfer the image out of OCI:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(9426).Z+"",width:"740",height:"298"})}),"\n",(0,t.jsxs)(e.p,{children:["To make the process easier, you can use gzip to compress it:\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(8230).Z+"",width:"985",height:"496"})]}),"\n",(0,t.jsx)(e.p,{children:"As the dd.gz file is less than 5GB in size, you can use our cado-host binary to upload the file directly to an S3 bucket and it will be automatically imported into a project for processing and analysis."}),"\n",(0,t.jsx)(e.p,{children:"The first step is to create a project in the Cado platform, from there we will use the Cado Host import capability:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(2323).Z+"",width:"1912",height:"695"})}),"\n",(0,t.jsx)(e.p,{children:"When you select Cado Host, you are presented with a series of options and in this case as we are using Kali Linux we will select Linux as the Target Operating System. We are not going to using any additional Runtime Options so we can skip that step and you can see that we automatically generate a command block, to be used to transfer the image:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(3890).Z+"",width:"1908",height:"883"})}),"\n",(0,t.jsx)(e.p,{children:"The cado-host binary is available from our public s3 bucket so you can use curl to download it onto the Kali instance:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(7738).Z+"",width:"1166",height:"173"})}),"\n",(0,t.jsx)(e.p,{children:"One of the switches for cado-host is \u2013single_file_unzipped, which will upload a single file to the Cado response bucket using the presigned_data details from the command that\u2019s generated from the import page:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(6595).Z+"",width:"1233",height:"271"})}),"\n",(0,t.jsx)(e.p,{children:"Switching over to our Cado platform, you can see that the file has been successfully imported and processing tasks have been started:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(6072).Z+"",width:"1867",height:"512"})}),"\n",(0,t.jsx)(e.p,{children:"Once the processing has been completed, you can move onto analysing the captured image:"}),"\n",(0,t.jsxs)(e.p,{children:[(0,t.jsx)(e.img,{alt:"Oracle",src:g(1860).Z+"",width:"1917",height:"862"}),"\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(6911).Z+"",width:"1918",height:"917"}),"\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(1739).Z+"",width:"1915",height:"895"})]})]})}function n(A={}){const{wrapper:e}={...(0,B.a)(),...A.components};return e?(0,t.jsx)(e,{...A,children:(0,t.jsx)(a,{...A})}):a(A)}},1860:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image1-db1670c8e122124bca18b626f5f38984.png"},2323:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image10-e97bebe4cbf37cd54c2b8e8c4cd1877b.png"},6595:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image11-b4225041547dfbba2826cf50bf93c798.png"},9983:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image12-a7451fd2351f561b35bc1e9d22f39915.png"},3628:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image13-b6dad8e699a0d29db609a041ba78c8f4.png"},7994:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image15-582caeb37debd8d31aa21d045111335b.png"},9426:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image16-c10b46229d70ec1c76088fd9b313ab8e.png"},7205:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image17-a86044dd99972223452a3e92f03615fa.png"},5358:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image18-aae8d90695693ee3975e24f3082d34ae.png"},8230:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image19-40b7785b583e3678b731b5f2e9c5224d.png"},3693:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image2-3c15f313aa86fe6541c5ed99123907f8.png"},7738:(A,e,g)=>{g.d(e,{Z:()=>t});const t="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABI4AAACtCAYAAADWHDQSAAAgAElEQVR4Xu3dO8gl12EH8KPSrUBrbFChwpZkSBHW2CFBTcyCURL1WstslaRQpRAM23h33RhM8FYqklSL7VWvJLJgkZslIZhsG0s2ZAuBjVewjVuDcuc+Z+bOOXPmPr4zZ7/fFnnou3fOmd95zJn/PO5zf/onX/s8+EeAAAECBAgQIECAAAECBAgQIECgJ/Cc4EifIECAAAECBAgQIECAAAECBAgQGBIQHOkXBAgQIECAAAECBAgQIECAAAECgwLP/fznP//82rVreAgQIECAAAECBAgQIECAAAECBAh0BJ77wx/+8PkXvvAFLAQIECBAgAABAgQIECBAgAABAgS6wdEf//hHL8fWKQgQIECAAAECBAgQIECAAAECBPYEnhMc6RUECBAgQIAAAQIECBAgQIAAAQJDAoIj/YIAAQIECBAgQIAAAQIECBAgQGBQQHCkYxAgQIAAAQIECBAgQIAAAQIECAiO9AECBAgQIECAAAECBAgQIECAAIF8AXcc5Vv5JAECBAgQIECAAAECBAgQIEDgUgkIji5Vc9tZAgQIECBAgAABAgQIECBAgEC+gOAo38onCRAgQIAAAQIECBAgQIAAAQKXSkBwdKma284SIECAAAECBAgQIECAAAECBPIFBEf5Vj5JgAABAgQIECBAgAABAgQIELhUAhcWHH35S188CPa3v/v9Qd/zJQIECBAgQIAAAQIECBAgQIAAgeMEBEfH+fk2AQIECBAgQIAAAQIECBAgQOCZFbiw4Ki84Efhe1+6Hn7aqsjVO/8d/u3vXlr/l+bvPw5f+a//CH+7+U+nrPQv/jF8+Tsh/PR3/xT+MrLdX3zvi+Gtn7T++N374bc/+larftdD+Nnvw49iG0jWt71/Z97XU7rZFgECBAgQIECAAAECBAgQIFBM4HIER4//OfzNn38/vNoJXdZB0jacOXOYMhIcLUOj0A6KHod//es/C7e+tvlvq/oKjoqNFQUTIECAAAECBAgQIECAAIFLJ3AJgqNVAPP+G+27i9btvAxzfhXuLO8y6gdH6+Dm0fqzV38Q/vPf/z6sbkYaCHH2gqH2HU5fD3fuvBpu3YrdcRQJrTrbXJd55wfhV7e+H1bVWmy3c4fUWJ03d1SdOSS7dMPIDhMgQIAAAQIECBAgQIAAgWdT4NkPjpZ3G70f3hh9BK0dpvTv9glheUfQ/27Co7HgqB9WbUKk70YeVdsvb7+77W+jW6f9gOzxv/xV+Iv331gHXh5VezaHsL0iQIAAAQIECBAgQIAAAQLnE7iw4KjYr6plvFtoxdsKVkITNv0mvNN5H1E7LBoJjobKHK1H7x1MnTucNvXrParW3ubg9ldh0m/+oXkvkuDofMPIlgkQIECAAAECBAgQIECAwLMpIDjatmsrWHm8eITtx19pPZrWfKh9R8//7b9vqBXcvNS502ddwPLOp34YFetUrRCp8w6meHC0LPPW/wxucPUS8KbOHlV7NoexvSJAgAABAgQIECBAgAABAucRuLDg6DzVz9hq8lG1x+Hx45fCS8sXF80pOGqHTZvH7NJ3OQ2GVR0edxxl9BYfIUCAAAECBAgQIECAAAECBFoCz35w1LlTaPVq6+2/zq+tFXxULfoY25GPxwmODHYCBAgQIECAAAECBAgQIEDgCIFLEBwtdNYBUVg+srUJj9aPg3UeBds8yjX2cuz+3ze/ZrZ5+XX/75kvxw7tX25bVHv5+Nmr6xdq572Q+1Z7G9FfjfOrakeMGV8lQIAAAQIECBAgQIAAAQKXRuByBEfL5uy9fHrxX1bv/mkHSZvgqPl86qft+9v7erjzszfC+99pv8Oo/f3F3++8Gm7dCpFfVVv1t+WvpP2k1fc6L8geC44G6hwW5W5/Tc6japdmVNtRAgQIECBAgAABAgQIECBwIoELC46K/araiaBshgABAgQIECBAgAABAgQIECBw2QQER5etxe0vAQIECBAgQIAAAQIECBAgQCBT4MKCo8z6+BgBAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBJ775je/+flM6qIaBAgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIEAgW+Db3/529LMffvhh9nZ8kACBuIDgSO8gQIAAAQIECBAgQIAAgSoFmuBoKCCK/fcqd1KlCRQWEBz1G+Ctu+GD6yHcf/2d8NNTNc45tnmquuVu51nYh9x9PdXnajGrpZ6nahfbIXCZBYz3y9z69p0AgXMJmFvPJZu1XcFRFpMPEThKYAbB0Vvh7gdXw6PBoOYb4ea92+G1F1b7+Mn918M7yzQn9Z2UR3t7nwyHQ5Mn/nNs86g2Pc+XJ7t0q/GNm/fC2+HdcOOHvzyi/U6za9269LbZ7OfVR+H1VUdL/Mvog0eaJXtyx/NIl5x6ZrscWZfo1xfe914M7934Yfjq3Q/C1UebueBc5cW2mzHeD6jSW+fYp2W7vryuTWS+26vrWL9O/X3suwfAZH4lNaaT4z1z+/tMufPEoQUcOvdk9M+c8X6SaneP3+Gzh+H2Yvw2R4B5/cswO3mFy42Vk+/KJd/gfOeXc/WxvO1Oc2m2eT28HD4LD2/fCMtlYva/zfjNPcYtNtw+Nibmpe4+ZMwTFza3dnGmWWfCnmTNl9dXMmvU+tjwdgVH0yV9g8BUgRkHR6tJ+pWPb7fChmvhyfKgcuxkdOz3h5jPsc2pzTnXz/dtSlqNlJ19sJzxPpyjG2S7nKPwZpub4Oij8K17b4fw7tTF5anrddr2P3lw9I2b4d7tV8LH60V4s7C8/crHGSfuY/s1x+CoQJ2KjoexNlqPl+gFmVOPhbztNX382pPN8TzvOxf7qRzXU9XoIss6VZ1tZ1/gTO14kvnlTHXLunA7oezlsepKePD6o3D1g80aP7+vLY9tV56GTxbXSIYvQPe2tS1v9VRBPHSJ7cOEfcvfjSM+eab6VNgHBUdHdCNfJZApMCE4aoKcxQnbx0/Da6+trmJ/9rC1CExd3Y78rVlIbi+Ibyr8yf3V3R4Dk1Yzwb/56Y3FXUftiXJ9FSDsrmZ2tzt0FWJoos24mpBEnbrN1Ynwk6evhRVn+0pLb1tti6Xl89urMsuD5mtP8x6tS96B0L06vGvbcZexOuwfmFf79+Th84u+1NxO1rvKFKnncjuLBUJ4+eXwwicPw8PnF3YvtNp3uSB4LaxuUBu++jS4SOh8r/nqug82m4luM7UPabN4/0z1iV3nG9+H3b6vFlUPWndQDYydJdiA16Eu0X69BO3cRdiZQyLWq/61vu2wNQZ3dyCmBmasvMQYW9YxMdctizvtYu3UwdF+H1nv02jgFu/Xqfk6OZevQ7/hua6hbN8ZtX/Fefr8MjJWEn0weexIjYdD7+465Biw7nvR+TPaP8fm8sTYTA2xkfZbfXW17SsP8u4UTB/DU/WcPr/sdi0ypqPHgPQ8EduH9FhJHXOSC5DFMGqvp7rHgNRxM3k8Wt4FsvuXt+ZLH8dSLv07STvzYlY/GzJK9IlD1xrrYoZDh3h5Fz6/HLDOWk0fw3PyaN+NuKTXIZs2a8bfxOCoEzrFnlzo9Yn+uUWzjeW1qO7dkNMCpdTcet61vj7YLF9Xa3bBUfoY4a8ETiEwMThaPDb2dHNS3Vpk9RL85UHn2pPV1e3U3xInYG/dvRdefO9G+PTN9WKouZ30wZXw9ovvLe5A+ur28bbF/xGuh9aJfl9lMDU/xxXqqdtsPn89PL8O37oH1tRJ7fqgvnycKiQe8+tBjLTD+NXg+P6lT+yGTlhX+/7yerLv7Huinoszj1VIdvtJuLYIiJ7evx2eXNvcfTJgtumDW4pYXVqLlU5/SW2z236dPr8tLyNc2Csv1ic2G43tQ2vR1B5//YAjezz0FnEHuvQXjPF+NtJ+Tb9489NwY0qfXw6V2F0OY8FRZK6b0rYTZuhTB0dD28srIzE2E/P1aldj/T01VsYDrenzS2qspPpE6gQjMR5Gj3GxjpBySfXPY+ee4XYaPwbETspTdwCu+1Pz1XYgP2Fs9C8ipeo5abzvHR+GXFLz0vpkcWhNNLoOSY2V2Fw+Aa01X2/Hz+Bxc+Skuj3frR8VXj5FlOzzqbVNvLzthcFfb07k23eXjs8T0VEWOwYcvNaoa36Zus765ebCSfQiw9i6JnONsvdKgKnBUTuMHqtTq3d01ker48H15/uP0ab625zW+sP1zJ7L99Z1kbXwkce4i+qDgqMJxwgfJXCgwMTgKLJA3DsZbU2sqb8lTjZu3rsbPn13ERA0Rb4bwtvNSeOjq+HeNjhaXwkbWIzu3aGw95mpE//qdtbdXQ+5dzFtWiVzQbo9kI4ER+sT4uZurf5dF9F6Jtsh56Cb85mBXpgTVPTvqOosKHbl/nrzXp+PvrW+QtRaWH61fYVsXY/+s+tDden/t727u9rXWxfb3W6z75HRxutqxfvneLsP3YnXvTq4v+/twGA4PBio+6lcUoFTu7t0rnAOtN/i79ux3z6BSU58E8Z5p545JynTx0NqDskLdfZ3NrbN44Kj3olrZDzuvwUs82S4FzBtrmLn3UGWe6K7nCQH3leWbrfo2BwbDwmjeLun5pCx4Kh9dT1/7lnpTf18enWR237Lz7Uu8qTGQ/Yc2alaom3H5peYS/J76XkivQ6J1DWrnsPtEStve0fC0HFzkQKNr5ea/XwzfLpI7bdjfsp6ovfZsXq+G94Mb78SwoMb74UXW+Xm9rOuzkifOGStsXn/Tm3zS+Y6q2njtPXIsW/QZbXNzR1l8XVI/h1HyYutIydE7TunPnn4MDy/6G+dO44i+xCfPy9+rb+asio7xp25DwqODkwCfI3ABIHZBkd3790M723uMPr0zeVJ44Mrt9cHntWBa3mrfv+9Hb13e0yfWKefEJY5mNwLV5uCHzWP7mW0+JSF3uDmDnGJLawTJ0WJeo4GR8mXWkfqMumEsJN0dO/2GrzdecAs2T/HgqPMfei3X/tuncHQ5YDgKGo95YS3VdHEQu3mvQ+2L8jffSPnRZjzCo5So/TQ4Ci2zWMfVdu+K2I0+E+Mie2feu3Qv3q5/tz0E8PUiXvm3NOufmpsTponcufKlMuEcZQ798TaIxaaZBxWOq2/flQqGgA2hnt3+QwUMmWO7Hx9SkgwtHMZ82Dna4n+N7oOSQRHWT/O0Kt/orxkcBS670JLvyIgNV+39yfRdzPG2P1mZfMoLP7n4n9cW/0gQvtdydPmiSl9YvfZ5FpjdcvV6nHmvbtyEuVl7Pv2RzkmnGDHh+lh66z2cnLYOjW/jYyJzV3D0XVIfnA0vC7Yv5g6Oo3tHePGLhxNWFcMza2pi2kD66Dm6Yvhtb4+2H+nleBotLf7AIGjBU4THA28bG77ItbU37aT6v7B4ubdm+Gj9xZ3GjXvrPnss/DZCy8s/vfmdtLuAb7z0tdOef1byTdeUyf+HOep2xw7MWi/CHz3WNdyybJ9b03zqFrmgTbZDiun3YvIMxfV649FHyWJPDu+d8W7fbBM1LN5VG35y2yDV04bz4RFrC6d8ppttK1T2+y23/4z/A1OLDhqXgTZXL0dedShv4hIeqb6wfqK8YNmHd486tn/yZKxeh7u0j0RSfWzdPttH2MIU37NKre8/v6NLRwjbZszTUQ+c+rgqP8oybJ/HvJy7MHgKNbXYm2YM1ZWMEPva5g+vyw3NPjeis27dgbnutSxIzVPjB7jYh0j5dK2HBp/uzuOsueebTWGjlXjx4BVO4Tkrx4Ntd/2qJv7cuzkMTxVz9zxntceq0+l5qWx4Cg2z6e2O3Ic2xz/++2QMBsPjhL13F506F2dSvb5seAoUt5yzF4JTz9+FN756MXF/724DSR8vPfumfQ80e+fiT5x8FqjzvmlcyyeMGftj+lEH43Ou8tWW925llyHDB9bxuee4fV33vd6ZSb3YezYP1SPM631KzzGnbsPCo6OWIT6KoFMgdMER9vFzOYFtt27AcYe8+r8ff1Y2fJRtfat0Z0d6k7Eq6siuzJ3t6EuXrT6cPEy7yubn1dfL8Db2+qEUd0XQeb9fPCh20wdTNq3j/f2YXkre9i9DHv5/+9elp1q93Q7dPdj9xLM1P7tTvaGXtAdPxnO3fdm+72XfEaDo2aN331crf0iz9SJ+a6/LMq6H8L19hXf6DZ7Lp3H4tJm6f4Zf0woGS4k9n2z0N4/6cut51SXsUedduMs/rLV7sv3t/u+CI5Wj6zl/l5vrF8nxljyHQ/j4yFz7u3OaP0fCjjBT5d3xnv29tJjc9eX1nN97zHgobl8dfLdmluTY2X/TrJYcDQ2pvsv2t2Bx/tEfGzuHt9Yzkm9eWLsGDfcJ1Iuqf45xXNRcvYxLu6SP4e02y+9vdQ4SbVDvz915pBeX8ubX0bGdHRuTQfM6X3oPSLWHkcHzeXt/tldM4w9qhav5/rCRvt3CVpjN97n03PI2Pps9d7HsPoRhc77o9rrs9g8MRRs5hwDpq010kH/nOaX+LE43X451vvHgLELIMNBzvgxNS8A2n859vD32v16/8cY0uvW2DnC2HlATjtMW+vrg63Xh3g59iHLTt8hcJDAhODooO0f/KXhq6gHb84XL1pg9KrNBVZoTnU5dLefhX04dN99r3KB4avBR+1UajxUM1bO4HIUqi8TIDAqUM38Mronp/3As+BSyz7UUs/T9rDRrbnjaJTIBwgcLTDb4KjZs/YL7GI/r360gA0QIECAwBkFBCTDuFzO2OlsmgABAgQukYDg6BI1tl0tJjDr4KiYioIJECBAgAABAgQIECBAYPYCTXAU+/fhhx/Ovv4qSKAGAcFRDa2kjgQIECBAgAABAgQIECBAgACBAgKCowLoiiRAgAABAgQIECBAgAABAgQI1CAgOKqhldSRAAECBAgQIECAAAECBAgQIFBAQHBUAF2RBAgQIECAAAECBAgQIECAAIEaBARHNbSSOhIgQIAAAQIECBAgQIAAAQIECggIjgqgK5IAAQIECBAgQIAAAQIECBAgUIOA4KiGVlJHAgQIECBAgAABAgQIECBAgEABAcFRAXRFEiBAgAABAgQIECBAgAABAgRqEBAc1dBK6kiAAAECBAgQIECAAAECBAgQKCAgOCqArkgCBAgQIECAAAECBAgQIECAQA0CgqMaWkkdCRAgQIAAAQIECBAgQIAAAQIFBARHBdAVSYAAAQIECBAgQIAAAQIECBCoQUBwVEMrqSMBAgQIECBAgAABAgQIECBAoICA4KgAuiIJECBAgAABAgQIECBAgAABAjUICI5qaCV1JECAAAECBAgQIECAAAECBAgUEBAcFUBXJAECBAgQIECAAAECBAgQIECgBgHBUQ2tpI4ECBAgQIAAAQIECBAgQIAAgQICgqMC6IokQIAAAQIECBAgQIAAAQIECNQgIDiqoZXUkQABAgQIECBAgAABAgQIECBQQEBwVABdkQQIECBAgAABAgQIECBAgACBGgQERzW0kjoSIECAAAECBAgQIECAAAECBAoICI4KoCuSAAECBAgQIECAAAECBAgQIFCDgOCohlZSRwIECBAgQIAAAQIECBAgQIBAAQHBUQF0RRIgQIAAAQIECBAgQIAAAQIEahAQHNXQSupIgAABAgQIECBAgAABAgQIECggIDgqgK5IAgQIECBAgAABAgQIECBAgEANAoKjGlpJHQkQIECAAAECBAgQIECAAAECBQQERwXQFUmAAAECBAgQIECAAAECBAgQqEFAcFRDK6kjAQIECBAgQIAAAQIECBAgQKCAgOCoALoiCRAgQIAAAQIECBAgQIAAAQI1CAiOamgldSRAgAABAgQIECBAgAABAgQIFBAQHBVAVyQBAgQIECBAgAABAgQIECBAoAYBwVENraSOBAgQIECAAAECBAgQIECAAIECAoKjAuiKJECAAAECBAgQIECAAAECBAjUICA4qqGV1JEAAQIECBAgQIAAAQIECBAgUEBAcFQAXZEECBAgQIAAAQIECBAgQIAAgRoEBEc1tJI6EiBAgAABAgQIECBAgAABAgQKCAiOCqArkgABAgQIECBAgAABAgQIECBQg4DgqIZWUkcCBAgQIECAAAECBAgQIECAQAEBwVEBdEUSIECAAAECBAgQIECAAAECBGoQEBzV0ErqSIAAAQIECBAgQIAAAQIECBAoICA4KoCuSAIECBAgQIAAAQIECBAgQIBADQKCoxpaSR0JECBAgAABAgQIECBAgAABAgUEBEcF0BVJgAABAgQIECBAgAABAgQIEKhBQHBUQyupIwECBAgQIECAAAECBAgQIECggIDgqAC6IgkQIECAAAECBAgQIECAAAECNQgIjmpoJXUkQIAAAQIECBAgQIAAAQIECBQQEBwVQFckAQIECBAgQIAAAQIECBAgQKAGAcFRDa2kjgQIECBAgAABAgQIECBAgACBAgKCowLoiiRAgAABAgQIECBAgAABAgQI1CAgOKqhldSRAAECBAgQIECAAAECBAgQIFBAQHBUAF2RBAgQIECAAAECBAgQIECAAIEaBARHNbSSOhIgQIAAAQIECBAgQIAAAQIECggIjgqgK5IAAQIECBAgQIAAAQIECBAgUIOA4KiGVlJHAgQIECBAgAABAgQIECBAgEABAcFRAXRFEiBAgAABAgQIECBAgAABAgRqEBAc1dBK6kiAAAECBAgQIECAAAECBAgQKCAgOCqArkgCBAgQIECAAAECBAgQIECAQA0CgqMaWkkdCRAgQIAAAQIECBAgQIAAAQIFBARHBdAVSYAAAQIECBAgQIAAAQIECBCoQUBwVEMrqSMBAgQIECBAgAABAgQIECBAoICA4KgAuiIJECBAgAABAgQIECBAgAABAjUICI5qaCV1JECAAAECBAgQIECAAAECBAgUEBAcFUBXJAECBAgQIECAAAECBAgQIECgBgHBUQ2tpI4ECBAgQIAAAQIECBAgQIAAgQICgqMC6IokQIAAAQIECBAgQIAAAQIECNQgIDiqoZXUkQABAgQIECBAgAABAgQIECBQQEBwVABdkQQIECBAgAABAgQIECBAgACBGgQERzW0kjoSIECAAAECBAgQIECAAAECBAoICI4KoCuSAAECBAgQIECAAAECBAgQIFCDgOCohlZSRwIECBAgQIAAAQIECBAgQIBAAQHBUQF0RRIgQIAAAQIECBAgQIAAAQIEahAQHNXQSupIgAABAgQIECBAgAABAgQIECggIDgqgK5IAgQIECBAgAABAgQIECBAgEANAoKjGlpJHQkQIECAAAECBAgQIECAAAECBQQERwXQFUmAAAECBAgQIECAAAECBAgQqEFAcFRDK6kjAQIECBAgQIAAAQIECBAgQKCAgOCoALoiCRAgQIAAAQIECBAgQIAAAQI1CAiOamgldSRAgAABAgQIECBAgAABAgQIFBAQHBVAVyQBAgQIECBAgAABAgQIECBAoAYBwVENraSOBAgQIECAAAECBAgQIECAAIECAoKjAuiKJECAAAECBAgQIECAAAECBAjUICA4qqGV1JEAAQIECBAgQIAAAQIECBAgUEBAcFQAXZEECBAgQIAAAQIECBAgQIAAgRoEBEc1tJI6EiBAgAABAgQIECBAgAABAgQKCAiOCqArkgABAgQIECBAgAABAgQIECBQg4DgqIZWUkcCBAgQIECAAAECBAgQIECAQAEBwVEBdEUSIECAAAECBAgQIECAAAECBGoQEBzV0ErqSIAAAQIECBAgQIAAAQIECBAoICA4KoCuSAIECBAgQIAAAQIECBAgQIBADQKCoxpaSR0JECBAgAABAgQIECBAgAABAgUEBEcF0BVJgAABAgQIECBAgAABAgQIEKhBQHBUQyupIwECBAgQIECAAAECBAgQIECggIDgqAC6IgkQIECAAAECBAgQIECAAAECNQgIjmpoJXUkQIAAAQIECBAgQIAAAQIECBQQEBwVQFckAQIECBAgQIAAAQIECBAgQKAGAcFRDa2kjgQIECBAgAABAgQIECBAgACBAgKCowLoiiRAgAABAgQIECBAgAABAgQI1CAgOKqhldSRAAECBAgQIECAAAECBAgQIFBAQHBUAF2RBAgQIECAAAECBAgQIECAAIEaBARHNbSSOhIgQIAAAQIECBAgQIAAAQIECggIjgqgK5IAAQIECBAgQIAAAQIECBAgUIOA4KiGVlJHAgQIECBAgAABAgQIECBAgEABAcFRAXRFEiBAgAABAi/1Ew4AAABdSURBVAQIECBAgAABAgRqEBAc1dBK6kiAAAECBAgQIECAAAECBAgQKCAgOCqArkgCBAgQIECAAAECBAgQIECAQA0CgqMaWkkdCRAgQIAAAQIECBAgQIAAAQIFBP4ftTNCjYAUPqAAAAAASUVORK5CYII="},3984:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image21-3749f63b9af49921d7d969c8ce65de5e.png"},6162:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image3-986d5308b0c11e779bddb07c50e838f3.png"},3890:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image4-0a491ff6ce4726e65d7d8a47d9e276c5.png"},8566:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image5-e0fe3ad4d1c07e0650d288e996910446.png"},6072:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image6-e186bec7ca1a0004681a31020c922531.png"},7154:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image7-167d970e81932cb727a06c6d365b70aa.png"},1739:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image8-0074a10f3660d9e1853f6bf6c6c10914.png"},6911:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image9-efadd6865de74c3c8cec1b9a54390930.png"},1151:(A,e,g)=>{g.d(e,{Z:()=>s,a:()=>E});var t=g(7294);const B={},C=t.createContext(B);function E(A){const e=t.useContext(C);return t.useMemo((function(){return"function"==typeof A?A(e):{...e,...A}}),[e,A])}function s(A){let e;return e=A.disableParentContext?"function"==typeof A.components?A.components(B):A.components||B:E(A.components),t.createElement(C.Provider,{value:e},A.children)}}}]); \ No newline at end of file diff --git a/assets/js/13c5f577.f86e2535.js b/assets/js/13c5f577.f86e2535.js new file mode 100644 index 000000000..a3fc85b11 --- /dev/null +++ b/assets/js/13c5f577.f86e2535.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8403],{9014:(A,e,g)=>{g.r(e),g.d(e,{assets:()=>Q,contentTitle:()=>s,default:()=>n,frontMatter:()=>C,metadata:()=>E,toc:()=>I});var t=g(5893),B=g(1151);const C={title:"Oracle Cloud Virtual Machines",hide_title:!0,sidebar_position:1},s="Oracle Cloud Virtual Machines",E={id:"cado-response/discovery-import/import/oracle/virtual-machine",title:"Oracle Cloud Virtual Machines",description:"First, you need to take a clone of the instance boot volume. Note that this will affect the instance as it performs a shutdown task and will restart the instance on completion.",source:"@site/docs/cado-response/discovery-import/import/oracle/virtual-machine.md",sourceDirName:"cado-response/discovery-import/import/oracle",slug:"/cado-response/discovery-import/import/oracle/virtual-machine",permalink:"/cado-response/discovery-import/import/oracle/virtual-machine",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/oracle/virtual-machine.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Oracle Cloud Virtual Machines",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Google Cloud Kubernetes Engine",permalink:"/cado-response/discovery-import/import/gcp/kubernetes-engine"},next:{title:"RedHat Openshift",permalink:"/cado-response/discovery-import/import/openshift/"}},Q={},I=[];function a(A){const e={code:"code",h1:"h1",img:"img",p:"p",...(0,B.a)(),...A.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{id:"oracle-cloud-virtual-machines",children:"Oracle Cloud Virtual Machines"}),"\n",(0,t.jsx)(e.p,{children:"First, you need to take a clone of the instance boot volume. Note that this will affect the instance as it performs a shutdown task and will restart the instance on completion."}),"\n",(0,t.jsx)(e.p,{children:"Open the Oracle Cloud Infrastructure (\u201cOCI\u201d) console, and browse to Compute -> Instances:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(9983).Z+"",width:"1919",height:"675"})}),"\n",(0,t.jsx)(e.p,{children:"Select the instance you want to acquire:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(5358).Z+"",width:"1908",height:"142"})}),"\n",(0,t.jsxs)(e.p,{children:["From the Resources section, select Boot volume and then click on the Boot volume that is attached to the instance:\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(3628).Z+"",width:"1893",height:"266"})]}),"\n",(0,t.jsxs)(e.p,{children:["This will take you to the Boot volume's details page -> select Boot Volume Clones from the Resources menu on the left:\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(7205).Z+"",width:"1908",height:"273"})]}),"\n",(0,t.jsxs)(e.p,{children:["Click ",(0,t.jsx)(e.code,{children:"Create Clone"})," button -> Give the clone volume an appropriate name -> then click the ",(0,t.jsx)(e.code,{children:"Create Clone"})," button at the bottom of the page:"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(6162).Z+"",width:"1917",height:"791"})}),"\n",(0,t.jsx)(e.p,{children:"Deploy your pre-built forensics instance, in this case example Kali Linux:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(7154).Z+"",width:"1496",height:"885"})}),"\n",(0,t.jsxs)(e.p,{children:["For ",(0,t.jsx)(e.code,{children:"Kali Linux"}),", the ",(0,t.jsx)(e.code,{children:"SSH"})," daemon is not installed by default and connections to the instance are made using Cloud Shell. Select Console connection from the Resources list on the left of the screen."]}),"\n",(0,t.jsx)(e.p,{children:"Click on Launch Cloud Shell connection:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(7994).Z+"",width:"1912",height:"668"})}),"\n",(0,t.jsx)(e.p,{children:"Attach the cloned disk to the forensic instance, selecting Paravirtualized as the attachment type. As this is a Boot volume we are not able to select Read only - shareable as the Access type:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(8566).Z+"",width:"1918",height:"916"})}),"\n",(0,t.jsxs)(e.p,{children:["Once the volume is attached you can switch over to your Cloud Shell session to acquire an image. We have used the command ",(0,t.jsx)(e.code,{children:"lsblk"})," to identify the device identified for the attached disk, in this case it is sdb:"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(3984).Z+"",width:"1186",height:"330"})}),"\n",(0,t.jsx)(e.p,{children:"To create the disk image, you can use dc3dd:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(3693).Z+"",width:"1163",height:"362"})}),"\n",(0,t.jsx)(e.p,{children:"Looking at the size of the image file test-clone.dd, 47GB, it's going to take time to transfer the image out of OCI:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(9426).Z+"",width:"740",height:"298"})}),"\n",(0,t.jsxs)(e.p,{children:["To make the process easier, you can use gzip to compress it:\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(8230).Z+"",width:"985",height:"496"})]}),"\n",(0,t.jsx)(e.p,{children:"As the dd.gz file is less than 5GB in size, you can use our cado-host binary to upload the file directly to an S3 bucket and it will be automatically imported into a project for processing and analysis."}),"\n",(0,t.jsx)(e.p,{children:"The first step is to create a project in the Cado platform, from there we will use the Cado Host import capability:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(2323).Z+"",width:"1912",height:"695"})}),"\n",(0,t.jsx)(e.p,{children:"When you select Cado Host, you are presented with a series of options and in this case as we are using Kali Linux we will select Linux as the Target Operating System. We are not going to using any additional Runtime Options so we can skip that step and you can see that we automatically generate a command block, to be used to transfer the image:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(3890).Z+"",width:"1908",height:"883"})}),"\n",(0,t.jsx)(e.p,{children:"The cado-host binary is available from our public s3 bucket so you can use curl to download it onto the Kali instance:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(7738).Z+"",width:"1166",height:"173"})}),"\n",(0,t.jsx)(e.p,{children:"One of the switches for cado-host is \u2013single_file_unzipped, which will upload a single file to the Cado response bucket using the presigned_data details from the command that\u2019s generated from the import page:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(6595).Z+"",width:"1233",height:"271"})}),"\n",(0,t.jsx)(e.p,{children:"Switching over to our Cado platform, you can see that the file has been successfully imported and processing tasks have been started:"}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Oracle",src:g(6072).Z+"",width:"1867",height:"512"})}),"\n",(0,t.jsx)(e.p,{children:"Once the processing has been completed, you can move onto analysing the captured image:"}),"\n",(0,t.jsxs)(e.p,{children:[(0,t.jsx)(e.img,{alt:"Oracle",src:g(1860).Z+"",width:"1917",height:"862"}),"\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(6911).Z+"",width:"1918",height:"917"}),"\n",(0,t.jsx)(e.img,{alt:"Oracle",src:g(1739).Z+"",width:"1915",height:"895"})]})]})}function n(A={}){const{wrapper:e}={...(0,B.a)(),...A.components};return e?(0,t.jsx)(e,{...A,children:(0,t.jsx)(a,{...A})}):a(A)}},1860:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image1-db1670c8e122124bca18b626f5f38984.png"},2323:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image10-e97bebe4cbf37cd54c2b8e8c4cd1877b.png"},6595:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image11-b4225041547dfbba2826cf50bf93c798.png"},9983:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image12-a7451fd2351f561b35bc1e9d22f39915.png"},3628:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image13-b6dad8e699a0d29db609a041ba78c8f4.png"},7994:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image15-582caeb37debd8d31aa21d045111335b.png"},9426:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image16-c10b46229d70ec1c76088fd9b313ab8e.png"},7205:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image17-a86044dd99972223452a3e92f03615fa.png"},5358:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image18-aae8d90695693ee3975e24f3082d34ae.png"},8230:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image19-40b7785b583e3678b731b5f2e9c5224d.png"},3693:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image2-3c15f313aa86fe6541c5ed99123907f8.png"},7738:(A,e,g)=>{g.d(e,{Z:()=>t});const t="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABI4AAACtCAYAAADWHDQSAAAgAElEQVR4Xu3dO8gl12EH8KPSrUBrbFChwpZkSBHW2CFBTcyCURL1WstslaRQpRAM23h33RhM8FYqklSL7VWvJLJgkZslIZhsG0s2ZAuBjVewjVuDcuc+Z+bOOXPmPr4zZ7/fFnnou3fOmd95zJn/PO5zf/onX/s8+EeAAAECBAgQIECAAAECBAgQIECgJ/Cc4EifIECAAAECBAgQIECAAAECBAgQGBIQHOkXBAgQIECAAAECBAgQIECAAAECgwLP/fznP//82rVreAgQIECAAAECBAgQIECAAAECBAh0BJ77wx/+8PkXvvAFLAQIECBAgAABAgQIECBAgAABAgS6wdEf//hHL8fWKQgQIECAAAECBAgQIECAAAECBPYEnhMc6RUECBAgQIAAAQIECBAgQIAAAQJDAoIj/YIAAQIECBAgQIAAAQIECBAgQGBQQHCkYxAgQIAAAQIECBAgQIAAAQIECAiO9AECBAgQIECAAAECBAgQIECAAIF8AXcc5Vv5JAECBAgQIECAAAECBAgQIEDgUgkIji5Vc9tZAgQIECBAgAABAgQIECBAgEC+gOAo38onCRAgQIAAAQIECBAgQIAAAQKXSkBwdKma284SIECAAAECBAgQIECAAAECBPIFBEf5Vj5JgAABAgQIECBAgAABAgQIELhUAhcWHH35S188CPa3v/v9Qd/zJQIECBAgQIAAAQIECBAgQIAAgeMEBEfH+fk2AQIECBAgQIAAAQIECBAgQOCZFbiw4Ki84Efhe1+6Hn7aqsjVO/8d/u3vXlr/l+bvPw5f+a//CH+7+U+nrPQv/jF8+Tsh/PR3/xT+MrLdX3zvi+Gtn7T++N374bc/+larftdD+Nnvw49iG0jWt71/Z97XU7rZFgECBAgQIECAAAECBAgQIFBM4HIER4//OfzNn38/vNoJXdZB0jacOXOYMhIcLUOj0A6KHod//es/C7e+tvlvq/oKjoqNFQUTIECAAAECBAgQIECAAIFLJ3AJgqNVAPP+G+27i9btvAxzfhXuLO8y6gdH6+Dm0fqzV38Q/vPf/z6sbkYaCHH2gqH2HU5fD3fuvBpu3YrdcRQJrTrbXJd55wfhV7e+H1bVWmy3c4fUWJ03d1SdOSS7dMPIDhMgQIAAAQIECBAgQIAAgWdT4NkPjpZ3G70f3hh9BK0dpvTv9glheUfQ/27Co7HgqB9WbUKk70YeVdsvb7+77W+jW6f9gOzxv/xV+Iv331gHXh5VezaHsL0iQIAAAQIECBAgQIAAAQLnE7iw4KjYr6plvFtoxdsKVkITNv0mvNN5H1E7LBoJjobKHK1H7x1MnTucNvXrParW3ubg9ldh0m/+oXkvkuDofMPIlgkQIECAAAECBAgQIECAwLMpIDjatmsrWHm8eITtx19pPZrWfKh9R8//7b9vqBXcvNS502ddwPLOp34YFetUrRCp8w6meHC0LPPW/wxucPUS8KbOHlV7NoexvSJAgAABAgQIECBAgAABAucRuLDg6DzVz9hq8lG1x+Hx45fCS8sXF80pOGqHTZvH7NJ3OQ2GVR0edxxl9BYfIUCAAAECBAgQIECAAAECBFoCz35w1LlTaPVq6+2/zq+tFXxULfoY25GPxwmODHYCBAgQIECAAAECBAgQIEDgCIFLEBwtdNYBUVg+srUJj9aPg3UeBds8yjX2cuz+3ze/ZrZ5+XX/75kvxw7tX25bVHv5+Nmr6xdq572Q+1Z7G9FfjfOrakeMGV8lQIAAAQIECBAgQIAAAQKXRuByBEfL5uy9fHrxX1bv/mkHSZvgqPl86qft+9v7erjzszfC+99pv8Oo/f3F3++8Gm7dCpFfVVv1t+WvpP2k1fc6L8geC44G6hwW5W5/Tc6japdmVNtRAgQIECBAgAABAgQIECBwIoELC46K/araiaBshgABAgQIECBAgAABAgQIECBw2QQER5etxe0vAQIECBAgQIAAAQIECBAgQCBT4MKCo8z6+BgBAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBARHM2kI1SBAgAABAgQIECBAgAABAgQIzE1AcDS3FlEfAgQIECBAgAABAgQIECBAgMBMBJ775je/+flM6qIaBAgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIECAAAECMxIQHM2oMVSFAAECBAgQIECAAAECBAgQIDAnAcHRnFpDXQgQIECAAAECBAgQIEAgW+Db3/529LMffvhh9nZ8kACBuIDgSO8gQIAAAQIECBAgQIAAgSoFmuBoKCCK/fcqd1KlCRQWEBz1G+Ctu+GD6yHcf/2d8NNTNc45tnmquuVu51nYh9x9PdXnajGrpZ6nahfbIXCZBYz3y9z69p0AgXMJmFvPJZu1XcFRFpMPEThKYAbB0Vvh7gdXw6PBoOYb4ea92+G1F1b7+Mn918M7yzQn9Z2UR3t7nwyHQ5Mn/nNs86g2Pc+XJ7t0q/GNm/fC2+HdcOOHvzyi/U6za9269LbZ7OfVR+H1VUdL/Mvog0eaJXtyx/NIl5x6ZrscWZfo1xfe914M7934Yfjq3Q/C1UebueBc5cW2mzHeD6jSW+fYp2W7vryuTWS+26vrWL9O/X3suwfAZH4lNaaT4z1z+/tMufPEoQUcOvdk9M+c8X6SaneP3+Gzh+H2Yvw2R4B5/cswO3mFy42Vk+/KJd/gfOeXc/WxvO1Oc2m2eT28HD4LD2/fCMtlYva/zfjNPcYtNtw+Nibmpe4+ZMwTFza3dnGmWWfCnmTNl9dXMmvU+tjwdgVH0yV9g8BUgRkHR6tJ+pWPb7fChmvhyfKgcuxkdOz3h5jPsc2pzTnXz/dtSlqNlJ19sJzxPpyjG2S7nKPwZpub4Oij8K17b4fw7tTF5anrddr2P3lw9I2b4d7tV8LH60V4s7C8/crHGSfuY/s1x+CoQJ2KjoexNlqPl+gFmVOPhbztNX382pPN8TzvOxf7qRzXU9XoIss6VZ1tZ1/gTO14kvnlTHXLunA7oezlsepKePD6o3D1g80aP7+vLY9tV56GTxbXSIYvQPe2tS1v9VRBPHSJ7cOEfcvfjSM+eab6VNgHBUdHdCNfJZApMCE4aoKcxQnbx0/Da6+trmJ/9rC1CExd3Y78rVlIbi+Ibyr8yf3V3R4Dk1Yzwb/56Y3FXUftiXJ9FSDsrmZ2tzt0FWJoos24mpBEnbrN1Ynwk6evhRVn+0pLb1tti6Xl89urMsuD5mtP8x6tS96B0L06vGvbcZexOuwfmFf79+Th84u+1NxO1rvKFKnncjuLBUJ4+eXwwicPw8PnF3YvtNp3uSB4LaxuUBu++jS4SOh8r/nqug82m4luM7UPabN4/0z1iV3nG9+H3b6vFlUPWndQDYydJdiA16Eu0X69BO3cRdiZQyLWq/61vu2wNQZ3dyCmBmasvMQYW9YxMdctizvtYu3UwdF+H1nv02jgFu/Xqfk6OZevQ7/hua6hbN8ZtX/Fefr8MjJWEn0weexIjYdD7+465Biw7nvR+TPaP8fm8sTYTA2xkfZbfXW17SsP8u4UTB/DU/WcPr/sdi0ypqPHgPQ8EduH9FhJHXOSC5DFMGqvp7rHgNRxM3k8Wt4FsvuXt+ZLH8dSLv07STvzYlY/GzJK9IlD1xrrYoZDh3h5Fz6/HLDOWk0fw3PyaN+NuKTXIZs2a8bfxOCoEzrFnlzo9Yn+uUWzjeW1qO7dkNMCpdTcet61vj7YLF9Xa3bBUfoY4a8ETiEwMThaPDb2dHNS3Vpk9RL85UHn2pPV1e3U3xInYG/dvRdefO9G+PTN9WKouZ30wZXw9ovvLe5A+ur28bbF/xGuh9aJfl9lMDU/xxXqqdtsPn89PL8O37oH1tRJ7fqgvnycKiQe8+tBjLTD+NXg+P6lT+yGTlhX+/7yerLv7Huinoszj1VIdvtJuLYIiJ7evx2eXNvcfTJgtumDW4pYXVqLlU5/SW2z236dPr8tLyNc2Csv1ic2G43tQ2vR1B5//YAjezz0FnEHuvQXjPF+NtJ+Tb9489NwY0qfXw6V2F0OY8FRZK6b0rYTZuhTB0dD28srIzE2E/P1aldj/T01VsYDrenzS2qspPpE6gQjMR5Gj3GxjpBySfXPY+ee4XYaPwbETspTdwCu+1Pz1XYgP2Fs9C8ipeo5abzvHR+GXFLz0vpkcWhNNLoOSY2V2Fw+Aa01X2/Hz+Bxc+Skuj3frR8VXj5FlOzzqbVNvLzthcFfb07k23eXjs8T0VEWOwYcvNaoa36Zus765ebCSfQiw9i6JnONsvdKgKnBUTuMHqtTq3d01ker48H15/uP0ab625zW+sP1zJ7L99Z1kbXwkce4i+qDgqMJxwgfJXCgwMTgKLJA3DsZbU2sqb8lTjZu3rsbPn13ERA0Rb4bwtvNSeOjq+HeNjhaXwkbWIzu3aGw95mpE//qdtbdXQ+5dzFtWiVzQbo9kI4ER+sT4uZurf5dF9F6Jtsh56Cb85mBXpgTVPTvqOosKHbl/nrzXp+PvrW+QtRaWH61fYVsXY/+s+tDden/t727u9rXWxfb3W6z75HRxutqxfvneLsP3YnXvTq4v+/twGA4PBio+6lcUoFTu7t0rnAOtN/i79ux3z6BSU58E8Z5p545JynTx0NqDskLdfZ3NrbN44Kj3olrZDzuvwUs82S4FzBtrmLn3UGWe6K7nCQH3leWbrfo2BwbDwmjeLun5pCx4Kh9dT1/7lnpTf18enWR237Lz7Uu8qTGQ/Yc2alaom3H5peYS/J76XkivQ6J1DWrnsPtEStve0fC0HFzkQKNr5ea/XwzfLpI7bdjfsp6ovfZsXq+G94Mb78SwoMb74UXW+Xm9rOuzkifOGStsXn/Tm3zS+Y6q2njtPXIsW/QZbXNzR1l8XVI/h1HyYutIydE7TunPnn4MDy/6G+dO44i+xCfPy9+rb+asio7xp25DwqODkwCfI3ABIHZBkd3790M723uMPr0zeVJ44Mrt9cHntWBa3mrfv+9Hb13e0yfWKefEJY5mNwLV5uCHzWP7mW0+JSF3uDmDnGJLawTJ0WJeo4GR8mXWkfqMumEsJN0dO/2GrzdecAs2T/HgqPMfei3X/tuncHQ5YDgKGo95YS3VdHEQu3mvQ+2L8jffSPnRZjzCo5So/TQ4Ci2zWMfVdu+K2I0+E+Mie2feu3Qv3q5/tz0E8PUiXvm3NOufmpsTponcufKlMuEcZQ798TaIxaaZBxWOq2/flQqGgA2hnt3+QwUMmWO7Hx9SkgwtHMZ82Dna4n+N7oOSQRHWT/O0Kt/orxkcBS670JLvyIgNV+39yfRdzPG2P1mZfMoLP7n4n9cW/0gQvtdydPmiSl9YvfZ5FpjdcvV6nHmvbtyEuVl7Pv2RzkmnGDHh+lh66z2cnLYOjW/jYyJzV3D0XVIfnA0vC7Yv5g6Oo3tHePGLhxNWFcMza2pi2kD66Dm6Yvhtb4+2H+nleBotLf7AIGjBU4THA28bG77ItbU37aT6v7B4ubdm+Gj9xZ3GjXvrPnss/DZCy8s/vfmdtLuAb7z0tdOef1byTdeUyf+HOep2xw7MWi/CHz3WNdyybJ9b03zqFrmgTbZDiun3YvIMxfV649FHyWJPDu+d8W7fbBM1LN5VG35y2yDV04bz4RFrC6d8ppttK1T2+y23/4z/A1OLDhqXgTZXL0dedShv4hIeqb6wfqK8YNmHd486tn/yZKxeh7u0j0RSfWzdPttH2MIU37NKre8/v6NLRwjbZszTUQ+c+rgqP8oybJ/HvJy7MHgKNbXYm2YM1ZWMEPva5g+vyw3NPjeis27dgbnutSxIzVPjB7jYh0j5dK2HBp/uzuOsueebTWGjlXjx4BVO4Tkrx4Ntd/2qJv7cuzkMTxVz9zxntceq0+l5qWx4Cg2z6e2O3Ic2xz/++2QMBsPjhL13F506F2dSvb5seAoUt5yzF4JTz9+FN756MXF/724DSR8vPfumfQ80e+fiT5x8FqjzvmlcyyeMGftj+lEH43Ou8tWW925llyHDB9bxuee4fV33vd6ZSb3YezYP1SPM631KzzGnbsPCo6OWIT6KoFMgdMER9vFzOYFtt27AcYe8+r8ff1Y2fJRtfat0Z0d6k7Eq6siuzJ3t6EuXrT6cPEy7yubn1dfL8Db2+qEUd0XQeb9fPCh20wdTNq3j/f2YXkre9i9DHv5/+9elp1q93Q7dPdj9xLM1P7tTvaGXtAdPxnO3fdm+72XfEaDo2aN331crf0iz9SJ+a6/LMq6H8L19hXf6DZ7Lp3H4tJm6f4Zf0woGS4k9n2z0N4/6cut51SXsUedduMs/rLV7sv3t/u+CI5Wj6zl/l5vrF8nxljyHQ/j4yFz7u3OaP0fCjjBT5d3xnv29tJjc9eX1nN97zHgobl8dfLdmluTY2X/TrJYcDQ2pvsv2t2Bx/tEfGzuHt9Yzkm9eWLsGDfcJ1Iuqf45xXNRcvYxLu6SP4e02y+9vdQ4SbVDvz915pBeX8ubX0bGdHRuTQfM6X3oPSLWHkcHzeXt/tldM4w9qhav5/rCRvt3CVpjN97n03PI2Pps9d7HsPoRhc77o9rrs9g8MRRs5hwDpq010kH/nOaX+LE43X451vvHgLELIMNBzvgxNS8A2n859vD32v16/8cY0uvW2DnC2HlATjtMW+vrg63Xh3g59iHLTt8hcJDAhODooO0f/KXhq6gHb84XL1pg9KrNBVZoTnU5dLefhX04dN99r3KB4avBR+1UajxUM1bO4HIUqi8TIDAqUM38Mronp/3As+BSyz7UUs/T9rDRrbnjaJTIBwgcLTDb4KjZs/YL7GI/r360gA0QIECAwBkFBCTDuFzO2OlsmgABAgQukYDg6BI1tl0tJjDr4KiYioIJECBAgAABAgQIECBAYPYCTXAU+/fhhx/Ovv4qSKAGAcFRDa2kjgQIECBAgAABAgQIECBAgACBAgKCowLoiiRAgAABAgQIECBAgAABAgQI1CAgOKqhldSRAAECBAgQIECAAAECBAgQIFBAQHBUAF2RBAgQIECAAAECBAgQIECAAIEaBARHNbSSOhIgQIAAAQIECBAgQIAAAQIECggIjgqgK5IAAQIECBAgQIAAAQIECBAgUIOA4KiGVlJHAgQIECBAgAABAgQIECBAgEABAcFRAXRFEiBAgAABAgQIECBAgAABAgRqEBAc1dBK6kiAAAECBAgQIECAAAECBAgQKCAgOCqArkgCBAgQIECAAAECBAgQIECAQA0CgqMaWkkdCRAgQIAAAQIECBAgQIAAAQIFBARHBdAVSYAAAQIECBAgQIAAAQIECBCoQUBwVEMrqSMBAgQIECBAgAABAgQIECBAoICA4KgAuiIJECBAgAABAgQIECBAgAABAjUICI5qaCV1JECAAAECBAgQIECAAAECBAgUEBAcFUBXJAECBAgQIECAAAECBAgQIECgBgHBUQ2tpI4ECBAgQIAAAQIECBAgQIAAgQICgqMC6IokQIAAAQIECBAgQIAAAQIECNQgIDiqoZXUkQABAgQIECBAgAABAgQIECBQQEBwVABdkQQIECBAgAABAgQIECBAgACBGgQERzW0kjoSIECAAAECBAgQIECAAAECBAoICI4KoCuSAAECBAgQIECAAAECBAgQIFCDgOCohlZSRwIECBAgQIAAAQIECBAgQIBAAQHBUQF0RRIgQIAAAQIECBAgQIAAAQIEahAQHNXQSupIgAABAgQIECBAgAABAgQIECggIDgqgK5IAgQIECBAgAABAgQIECBAgEANAoKjGlpJHQkQIECAAAECBAgQIECAAAECBQQERwXQFUmAAAECBAgQIECAAAECBAgQqEFAcFRDK6kjAQIECBAgQIAAAQIECBAgQKCAgOCoALoiCRAgQIAAAQIECBAgQIAAAQI1CAiOamgldSRAgAABAgQIECBAgAABAgQIFBAQHBVAVyQBAgQIECBAgAABAgQIECBAoAYBwVENraSOBAgQIECAAAECBAgQIECAAIECAoKjAuiKJECAAAECBAgQIECAAAECBAjUICA4qqGV1JEAAQIECBAgQIAAAQIECBAgUEBAcFQAXZEECBAgQIAAAQIECBAgQIAAgRoEBEc1tJI6EiBAgAABAgQIECBAgAABAgQKCAiOCqArkgABAgQIECBAgAABAgQIECBQg4DgqIZWUkcCBAgQIECAAAECBAgQIECAQAEBwVEBdEUSIECAAAECBAgQIECAAAECBGoQEBzV0ErqSIAAAQIECBAgQIAAAQIECBAoICA4KoCuSAIECBAgQIAAAQIECBAgQIBADQKCoxpaSR0JECBAgAABAgQIECBAgAABAgUEBEcF0BVJgAABAgQIECBAgAABAgQIEKhBQHBUQyupIwECBAgQIECAAAECBAgQIECggIDgqAC6IgkQIECAAAECBAgQIECAAAECNQgIjmpoJXUkQIAAAQIECBAgQIAAAQIECBQQEBwVQFckAQIECBAgQIAAAQIECBAgQKAGAcFRDa2kjgQIECBAgAABAgQIECBAgACBAgKCowLoiiRAgAABAgQIECBAgAABAgQI1CAgOKqhldSRAAECBAgQIECAAAECBAgQIFBAQHBUAF2RBAgQIECAAAECBAgQIECAAIEaBARHNbSSOhIgQIAAAQIECBAgQIAAAQIECggIjgqgK5IAAQIECBAgQIAAAQIECBAgUIOA4KiGVlJHAgQIECBAgAABAgQIECBAgEABAcFRAXRFEiBAgAABAgQIECBAgAABAgRqEBAc1dBK6kiAAAECBAgQIECAAAECBAgQKCAgOCqArkgCBAgQIECAAAECBAgQIECAQA0CgqMaWkkdCRAgQIAAAQIECBAgQIAAAQIFBARHBdAVSYAAAQIECBAgQIAAAQIECBCoQUBwVEMrqSMBAgQIECBAgAABAgQIECBAoICA4KgAuiIJECBAgAABAgQIECBAgAABAjUICI5qaCV1JECAAAECBAgQIECAAAECBAgUEBAcFUBXJAECBAgQIECAAAECBAgQIECgBgHBUQ2tpI4ECBAgQIAAAQIECBAgQIAAgQICgqMC6IokQIAAAQIECBAgQIAAAQIECNQgIDiqoZXUkQABAgQIECBAgAABAgQIECBQQEBwVABdkQQIECBAgAABAgQIECBAgACBGgQERzW0kjoSIECAAAECBAgQIECAAAECBAoICI4KoCuSAAECBAgQIECAAAECBAgQIFCDgOCohlZSRwIECBAgQIAAAQIECBAgQIBAAQHBUQF0RRIgQIAAAQIECBAgQIAAAQIEahAQHNXQSupIgAABAgQIECBAgAABAgQIECggIDgqgK5IAgQIECBAgAABAgQIECBAgEANAoKjGlpJHQkQIECAAAECBAgQIECAAAECBQQERwXQFUmAAAECBAgQIECAAAECBAgQqEFAcFRDK6kjAQIECBAgQIAAAQIECBAgQKCAgOCoALoiCRAgQIAAAQIECBAgQIAAAQI1CAiOamgldSRAgAABAgQIECBAgAABAgQIFBAQHBVAVyQBAgQIECBAgAABAgQIECBAoAYBwVENraSOBAgQIECAAAECBAgQIECAAIECAoKjAuiKJECAAAECBAgQIECAAAECBAjUICA4qqGV1JEAAQIECBAgQIAAAQIECBAgUEBAcFQAXZEECBAgQIAAAQIECBAgQIAAgRoEBEc1tJI6EiBAgAABAgQIECBAgAABAgQKCAiOCqArkgABAgQIECBAgAABAgQIECBQg4DgqIZWUkcCBAgQIECAAAECBAgQIECAQAEBwVEBdEUSIECAAAECBAgQIECAAAECBGoQEBzV0ErqSIAAAQIECBAgQIAAAQIECBAoICA4KoCuSAIECBAgQIAAAQIECBAgQIBADQKCoxpaSR0JECBAgAABAgQIECBAgAABAgUEBEcF0BVJgAABAgQIECBAgAABAgQIEKhBQHBUQyupIwECBAgQIECAAAECBAgQIECggIDgqAC6IgkQIECAAAECBAgQIECAAAECNQgIjmpoJXUkQIAAAQIECBAgQIAAAQIECBQQEBwVQFckAQIECBAgQIAAAQIECBAgQKAGAcFRDa2kjgQIECBAgAABAgQIECBAgACBAgKCowLoiiRAgAABAgQIECBAgAABAgQI1CAgOKqhldSRAAECBAgQIECAAAECBAgQIFBAQHBUAF2RBAgQIECAAAECBAgQIECAAIEaBARHNbSSOhIgQIAAAQIECBAgQIAAAQIECggIjgqgK5IAAQIECBAgQIAAAQIECBAgUIOA4KiGVlJHAgQIECBAgAABAgQIECBAgEABAcFRAXRFEiBAgAABAi/1Ew4AAABdSURBVAQIECBAgAABAgRqEBAc1dBK6kiAAAECBAgQIECAAAECBAgQKCAgOCqArkgCBAgQIECAAAECBAgQIECAQA0CgqMaWkkdCRAgQIAAAQIECBAgQIAAAQIFBP4ftTNCjYAUPqAAAAAASUVORK5CYII="},3984:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image21-3749f63b9af49921d7d969c8ce65de5e.png"},6162:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image3-986d5308b0c11e779bddb07c50e838f3.png"},3890:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image4-0a491ff6ce4726e65d7d8a47d9e276c5.png"},8566:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image5-e0fe3ad4d1c07e0650d288e996910446.png"},6072:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image6-e186bec7ca1a0004681a31020c922531.png"},7154:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image7-167d970e81932cb727a06c6d365b70aa.png"},1739:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image8-0074a10f3660d9e1853f6bf6c6c10914.png"},6911:(A,e,g)=>{g.d(e,{Z:()=>t});const t=g.p+"assets/images/image9-efadd6865de74c3c8cec1b9a54390930.png"},1151:(A,e,g)=>{g.d(e,{Z:()=>E,a:()=>s});var t=g(7294);const B={},C=t.createContext(B);function s(A){const e=t.useContext(C);return t.useMemo((function(){return"function"==typeof A?A(e):{...e,...A}}),[e,A])}function E(A){let e;return e=A.disableParentContext?"function"==typeof A.components?A.components(B):A.components||B:s(A.components),t.createElement(C.Provider,{value:e},A.children)}}}]); \ No newline at end of file diff --git a/assets/js/176bafeb.5ced8076.js b/assets/js/176bafeb.5ced8076.js new file mode 100644 index 000000000..64781caa4 --- /dev/null +++ b/assets/js/176bafeb.5ced8076.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4442],{1297:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>d,contentTitle:()=>i,default:()=>l,frontMatter:()=>a,metadata:()=>r,toc:()=>h});var t=n(5893),s=n(1151);const a={title:"Webhooks",hide_title:!0,sidebar_position:5},i="Webhook Integration",r={id:"cado-response/manage/integrations/webhooks",title:"Webhooks",description:"A webhook integration allows you to automatically send information from the Cado platform to another application using a unique URL.",source:"@site/docs/cado-response/manage/integrations/webhooks.md",sourceDirName:"cado-response/manage/integrations",slug:"/cado-response/manage/integrations/webhooks",permalink:"/cado-response/manage/integrations/webhooks",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/webhooks.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:5,frontMatter:{title:"Webhooks",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Cortex XSOAR",permalink:"/cado-response/manage/integrations/soar/cortex-xsoar"},next:{title:"SophosLabs Intelix",permalink:"/cado-response/manage/integrations/sandbox/intelix"}},d={},h=[{value:"Before You Begin",id:"before-you-begin",level:2},{value:"Add or Modify a Webhook",id:"add-or-modify-a-webhook",level:2},{value:"Delete an Existing Webhook",id:"delete-an-existing-webhook",level:2},{value:"Custom Payloads",id:"custom-payloads",level:2},{value:"Slack Integration",id:"slack-integration",level:2},{value:"Teams Integration",id:"teams-integration",level:2}];function c(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,s.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"webhook-integration",children:"Webhook Integration"}),"\n",(0,t.jsx)(o.p,{children:"A webhook integration allows you to automatically send information from the Cado platform to another application using a unique URL."}),"\n",(0,t.jsx)(o.h2,{id:"before-you-begin",children:"Before You Begin"}),"\n",(0,t.jsx)(o.p,{children:"To add the webhook integration from Cado, you will need to generate a webhook URL from your desired application. Most applications that can receive a post request can be supported."}),"\n",(0,t.jsxs)(o.p,{children:["To view and manage your webhooks settings navigate to ",(0,t.jsx)(o.strong,{children:"Settings"})," > ",(0,t.jsx)(o.strong,{children:"Integrations"})," > ",(0,t.jsx)(o.strong,{children:"Webhooks"}),"."]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Webhooks settings page",src:n(8136).Z+"",width:"1485",height:"883"})}),"\n",(0,t.jsx)(o.h2,{id:"add-or-modify-a-webhook",children:"Add or Modify a Webhook"}),"\n",(0,t.jsxs)(o.p,{children:["To add a new webhook click the ",(0,t.jsx)(o.strong,{children:"New webhook"})," button at the bottom of the settings page."]}),"\n",(0,t.jsxs)(o.p,{children:["You can modify an existing webhook by simply clicking the ",(0,t.jsx)(o.strong,{children:"Edit"})," button. Any new events will be sent to the updated URL or modified payload."]}),"\n",(0,t.jsx)(o.p,{children:"You will then see a form where you must enter all the following:"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"Name"}),": The name of the webhook to describe what it is."]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"URL"}),": The webhook URL generated by the application you wish to integrate with."]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"Events to send"}),": Tick the events you wish to send from Cado to your webhook URL. Only high severity alarms are supported currently."]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"Payload"}),": This is a JSON object that refers to how the webhook URL will receive the data. A webhook must be in the correct format, more information can be found ",(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"#custom-payloads",children:"here"})}),"."]}),"\n"]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Adding a new webhook",src:n(8176).Z+"",width:"924",height:"1177"})}),"\n",(0,t.jsx)(o.h2,{id:"delete-an-existing-webhook",children:"Delete an Existing Webhook"}),"\n",(0,t.jsxs)(o.p,{children:["Delete an existing webhook by clicking the associated ",(0,t.jsx)(o.strong,{children:"Delete"})," button. Any new webhooks will not be sent to the entered URL."]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Deleting a webhook",src:n(6082).Z+"",width:"920",height:"313"})}),"\n",(0,t.jsx)(o.h2,{id:"custom-payloads",children:"Custom Payloads"}),"\n",(0,t.jsxs)(o.p,{children:["When entering a webhook you must specify a payload. This is how the webhook URL receives the data from Cado. The payload must be a valid JSON object and have both ",(0,t.jsx)(o.strong,{children:"$Title"})," and ",(0,t.jsx)(o.strong,{children:"$Event"})," as values somewhere in the JSON object. These values tell Cado where to enter the data about the event."]}),"\n",(0,t.jsx)(o.admonition,{type:"note",children:(0,t.jsx)(o.p,{children:"When entering the payload refer to the documentation of the application you wish to integration to understand the format the payload must be in. If the payload is not in the correct format for the destination application the event may not be received."})}),"\n",(0,t.jsx)(o.p,{children:"An example of a valid payload:"}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{className:"language-json",children:'{\n "title": "$Title",\n "message": "$Event"\n}\n'})}),"\n",(0,t.jsx)(o.h2,{id:"slack-integration",children:"Slack Integration"}),"\n",(0,t.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/izHu3gpSaS0",title:"How to Integrate Slack with Cado Response",frameborder:"0",allowfullscreen:!0}),"\n",(0,t.jsx)(o.p,{children:"You can use webhooks to send notifications to a Slack channel from Cado Response."}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["See the ",(0,t.jsx)(o.a,{href:"https://api.slack.com/messaging/webhooks#create_a_webhook",children:"Slack documentation"})," on creating incoming webhooks for Slack. Once you have created an app with incoming webhooks copy the Webhook URL to your clipbard."]}),"\n",(0,t.jsxs)(o.li,{children:["In the Cado platform under ",(0,t.jsx)(o.strong,{children:"Settings > Integrations > Webhooks"})," select ",(0,t.jsx)(o.strong,{children:"New webhook"}),"."]}),"\n",(0,t.jsx)(o.li,{children:'Name your webhook and paste the URL from Slack. Then check "High Severity Alarms" under events to send.'}),"\n",(0,t.jsxs)(o.li,{children:["Cado requires the ",(0,t.jsx)(o.code,{children:"$Title"})," and ",(0,t.jsx)(o.code,{children:"$Event"})," values to be specified in the payload and Slack requires a JSON key of ",(0,t.jsx)(o.code,{children:"text"}),". You can read more about Slack message payloads ",(0,t.jsx)(o.a,{href:"https://api.slack.com/reference/messaging/payload",children:"here"})," and Slack message formatting with Markdown ",(0,t.jsx)(o.a,{href:"https://api.slack.com/messaging/composing",children:"here"}),"."]}),"\n"]}),"\n",(0,t.jsx)(o.p,{children:"We include an example payload and the Slack message it creates."}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{className:"language-json",children:'{\n "text": "*$Title*\\nDetails: $Event"\n}\n'})}),"\n",(0,t.jsx)(o.h2,{id:"teams-integration",children:"Teams Integration"}),"\n",(0,t.jsx)(o.p,{children:"You can use webhooks to send notifications to a Microsoft Teams channel from the Cado platform."}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["See the ",(0,t.jsx)(o.a,{href:"https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook",children:"Microsoft Teams documentation"})," on creating incoming webhooks for Teams. Once you have created a connector with incoming webhooks copy the Webhook URL to your clipboard."]}),"\n",(0,t.jsxs)(o.li,{children:["In the Cado platform under ",(0,t.jsx)(o.strong,{children:"Settings > Integrations > Webhooks"})," select ",(0,t.jsx)(o.strong,{children:"New webhook"}),"."]}),"\n",(0,t.jsx)(o.li,{children:'Name your webhook and paste the URL from Teams. Then check "High Severity Alarms" under events to send.'}),"\n",(0,t.jsxs)(o.li,{children:["Cado requires the ",(0,t.jsx)(o.code,{children:"$Title"})," and ",(0,t.jsx)(o.code,{children:"$Event"})," values to be specified in the payload and Teams requires a JSON key of ",(0,t.jsx)(o.code,{children:"text"}),". You can read more about Teams message payloads ",(0,t.jsx)(o.a,{href:"https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/connectors-using?tabs=cURL",children:"here"})," and Teams message formatting with Markdown ",(0,t.jsx)(o.a,{href:"https://docs.microsoft.com/en-us/microsoftteams/platform/task-modules-and-cards/cards/cards-format?tabs=adaptive-md%2Cconnector-html",children:"here"}),"."]}),"\n"]}),"\n",(0,t.jsx)(o.p,{children:"We include an example payload and the Teams message it creates (note that the newline character most be preceded by three spaces)."}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{className:"language-json",children:'{\n "text": "**$Title** \\nDetails: $Event"\n}\n'})})]})}function l(e={}){const{wrapper:o}={...(0,s.a)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},6082:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/webhooks-delete-e73ce8e4db982a74a10d53e9e40b11c4.png"},8176:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/webhooks-new-05cc091a15fe3d2a1f0c8d9c380d1ac6.png"},8136:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/webhooks-settings-abfae41425cf9807abee570032a368eb.png"},1151:(e,o,n)=>{n.d(o,{Z:()=>r,a:()=>i});var t=n(7294);const s={},a=t.createContext(s);function i(e){const o=t.useContext(a);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),t.createElement(a.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/176bafeb.9837b493.js b/assets/js/176bafeb.9837b493.js deleted file mode 100644 index 4e93a26e6..000000000 --- a/assets/js/176bafeb.9837b493.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4442],{1297:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>d,contentTitle:()=>i,default:()=>l,frontMatter:()=>a,metadata:()=>r,toc:()=>h});var t=n(5893),s=n(1151);const a={title:"Webhooks",hide_title:!0,sidebar_position:5},i="Webhook Integration",r={id:"cado-response/manage/integrations/webhooks",title:"Webhooks",description:"A webhook integration allows you to automatically send information from the Cado platform to another application using a unique URL.",source:"@site/docs/cado-response/manage/integrations/webhooks.md",sourceDirName:"cado-response/manage/integrations",slug:"/cado-response/manage/integrations/webhooks",permalink:"/cado-response/manage/integrations/webhooks",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/webhooks.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:5,frontMatter:{title:"Webhooks",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Cortex XSOAR",permalink:"/cado-response/manage/integrations/soar/cortex-xsoar"},next:{title:"SophosLabs Intelix",permalink:"/cado-response/manage/integrations/sandbox/intelix"}},d={},h=[{value:"Before You Begin",id:"before-you-begin",level:2},{value:"Add or Modify a Webhook",id:"add-or-modify-a-webhook",level:2},{value:"Delete an Existing Webhook",id:"delete-an-existing-webhook",level:2},{value:"Custom Payloads",id:"custom-payloads",level:2},{value:"Slack Integration",id:"slack-integration",level:2},{value:"Teams Integration",id:"teams-integration",level:2}];function c(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,s.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"webhook-integration",children:"Webhook Integration"}),"\n",(0,t.jsx)(o.p,{children:"A webhook integration allows you to automatically send information from the Cado platform to another application using a unique URL."}),"\n",(0,t.jsx)(o.h2,{id:"before-you-begin",children:"Before You Begin"}),"\n",(0,t.jsx)(o.p,{children:"To add the webhook integration from Cado, you will need to generate a webhook URL from your desired application. Most applications that can receive a post request can be supported."}),"\n",(0,t.jsxs)(o.p,{children:["To view and manage your webhooks settings navigate to ",(0,t.jsx)(o.strong,{children:"Settings"})," > ",(0,t.jsx)(o.strong,{children:"Integrations"})," > ",(0,t.jsx)(o.strong,{children:"Webhooks"}),"."]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Webhooks settings page",src:n(8136).Z+"",width:"1485",height:"883"})}),"\n",(0,t.jsx)(o.h2,{id:"add-or-modify-a-webhook",children:"Add or Modify a Webhook"}),"\n",(0,t.jsxs)(o.p,{children:["To add a new webhook click the ",(0,t.jsx)(o.strong,{children:"New webhook"})," button at the bottom of the settings page."]}),"\n",(0,t.jsxs)(o.p,{children:["You can modify an existing webhook by simply clicking the ",(0,t.jsx)(o.strong,{children:"Edit"})," button. Any new events will be sent to the updated URL or modified payload."]}),"\n",(0,t.jsx)(o.p,{children:"You will then see a form where you must enter all the following:"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"Name"}),": The name of the webhook to describe what it is."]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"URL"}),": The webhook URL generated by the application you wish to integrate with."]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"Events to send"}),": Tick the events you wish to send from Cado to your webhook URL. Only high severity alarms are supported currently."]}),"\n",(0,t.jsxs)(o.li,{children:[(0,t.jsx)(o.strong,{children:"Payload"}),": This is a JSON object that refers to how the webhook URL will receive the data. A webhook must be in the correct format, more information can be found ",(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"#custom-payloads",children:"here"})}),"."]}),"\n"]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Adding a new webhook",src:n(8176).Z+"",width:"924",height:"1177"})}),"\n",(0,t.jsx)(o.h2,{id:"delete-an-existing-webhook",children:"Delete an Existing Webhook"}),"\n",(0,t.jsxs)(o.p,{children:["Delete an existing webhook by clicking the associated ",(0,t.jsx)(o.strong,{children:"Delete"})," button. Any new webhooks will not be sent to the entered URL."]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Deleting a webhook",src:n(6082).Z+"",width:"920",height:"313"})}),"\n",(0,t.jsx)(o.h2,{id:"custom-payloads",children:"Custom Payloads"}),"\n",(0,t.jsxs)(o.p,{children:["When entering a webhook you must specify a payload. This is how the webhook URL receives the data from Cado. The payload must be a valid JSON object and have both ",(0,t.jsx)(o.strong,{children:"$Title"})," and ",(0,t.jsx)(o.strong,{children:"$Event"})," as values somewhere in the JSON object. These values tell Cado where to enter the data about the event."]}),"\n",(0,t.jsx)(o.admonition,{type:"note",children:(0,t.jsx)(o.p,{children:"When entering the payload refer to the documentation of the application you wish to integration to understand the format the payload must be in. If the payload is not in the correct format for the destination application the event may not be received."})}),"\n",(0,t.jsx)(o.p,{children:"An example of a valid payload:"}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{className:"language-json",children:'{\n "title": "$Title",\n "message": "$Event"\n}\n'})}),"\n",(0,t.jsx)(o.h2,{id:"slack-integration",children:"Slack Integration"}),"\n",(0,t.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/izHu3gpSaS0",title:"How to Integrate Slack with Cado Response",frameborder:"0",allowfullscreen:!0}),"\n",(0,t.jsx)(o.p,{children:"You can use webhooks to send notifications to a Slack channel from Cado Response."}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["See the ",(0,t.jsx)(o.a,{href:"https://api.slack.com/messaging/webhooks#create_a_webhook",children:"Slack documentation"})," on creating incoming webhooks for Slack. Once you have created an app with incoming webhooks copy the Webhook URL to your clipbard."]}),"\n",(0,t.jsxs)(o.li,{children:["In the Cado platform under ",(0,t.jsx)(o.strong,{children:"Settings > Integrations > Webhooks"})," select ",(0,t.jsx)(o.strong,{children:"New webhook"}),"."]}),"\n",(0,t.jsx)(o.li,{children:'Name your webhook and paste the URL from Slack. Then check "High Severity Alarms" under events to send.'}),"\n",(0,t.jsxs)(o.li,{children:["Cado requires the ",(0,t.jsx)(o.code,{children:"$Title"})," and ",(0,t.jsx)(o.code,{children:"$Event"})," values to be specified in the payload and Slack requires a JSON key of ",(0,t.jsx)(o.code,{children:"text"}),". You can read more about Slack message payloads ",(0,t.jsx)(o.a,{href:"https://api.slack.com/reference/messaging/payload",children:"here"})," and Slack message formatting with Markdown ",(0,t.jsx)(o.a,{href:"https://api.slack.com/messaging/composing",children:"here"}),"."]}),"\n"]}),"\n",(0,t.jsx)(o.p,{children:"We include an example payload and the Slack message it creates."}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{className:"language-json",children:'{\n "text": "*$Title*\\nDetails: $Event"\n}\n'})}),"\n",(0,t.jsx)(o.h2,{id:"teams-integration",children:"Teams Integration"}),"\n",(0,t.jsx)(o.p,{children:"You can use webhooks to send notifications to a Microsoft Teams channel from the Cado platform."}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["See the ",(0,t.jsx)(o.a,{href:"https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook",children:"Microsoft Teams documentation"})," on creating incoming webhooks for Teams. Once you have created a connector with incoming webhooks copy the Webhook URL to your clipboard."]}),"\n",(0,t.jsxs)(o.li,{children:["In the Cado platform under ",(0,t.jsx)(o.strong,{children:"Settings > Integrations > Webhooks"})," select ",(0,t.jsx)(o.strong,{children:"New webhook"}),"."]}),"\n",(0,t.jsx)(o.li,{children:'Name your webhook and paste the URL from Teams. Then check "High Severity Alarms" under events to send.'}),"\n",(0,t.jsxs)(o.li,{children:["Cado requires the ",(0,t.jsx)(o.code,{children:"$Title"})," and ",(0,t.jsx)(o.code,{children:"$Event"})," values to be specified in the payload and Teams requires a JSON key of ",(0,t.jsx)(o.code,{children:"text"}),". You can read more about Teams message payloads ",(0,t.jsx)(o.a,{href:"https://docs.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/connectors-using?tabs=cURL",children:"here"})," and Teams message formatting with Markdown ",(0,t.jsx)(o.a,{href:"https://docs.microsoft.com/en-us/microsoftteams/platform/task-modules-and-cards/cards/cards-format?tabs=adaptive-md%2Cconnector-html",children:"here"}),"."]}),"\n"]}),"\n",(0,t.jsx)(o.p,{children:"We include an example payload and the Teams message it creates (note that the newline character most be preceded by three spaces)."}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{className:"language-json",children:'{\n "text": "**$Title** \\nDetails: $Event"\n}\n'})})]})}function l(e={}){const{wrapper:o}={...(0,s.a)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},6082:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/webhooks-delete-e73ce8e4db982a74a10d53e9e40b11c4.png"},8176:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/webhooks-new-05cc091a15fe3d2a1f0c8d9c380d1ac6.png"},8136:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/webhooks-settings-abfae41425cf9807abee570032a368eb.png"},1151:(e,o,n)=>{n.d(o,{Z:()=>r,a:()=>i});var t=n(7294);const s={},a=t.createContext(s);function i(e){const o=t.useContext(a);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),t.createElement(a.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/1a958a62.1fc5a438.js b/assets/js/1a958a62.1fc5a438.js deleted file mode 100644 index bab9cd58b..000000000 --- a/assets/js/1a958a62.1fc5a438.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7017],{1978:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>d,contentTitle:()=>a,default:()=>l,frontMatter:()=>o,metadata:()=>r,toc:()=>c});var i=n(5893),t=n(1151);const o={title:"Readiness (Beta)",hide_title:!0,sidebar_position:3},a="Readiness (Beta)",r={id:"cado-response/discovery-import/readiness",title:"Readiness (Beta)",description:"Readiness is a powerful tool designed to help you identify and address issues related to the acquisition of workloads within your environments. It provides a centralised platform for tracking these issues and assigns a readiness score to each environment, giving you a quick overview of the health of your workload acquisition process.",source:"@site/docs/cado-response/discovery-import/readiness.md",sourceDirName:"cado-response/discovery-import",slug:"/cado-response/discovery-import/readiness",permalink:"/cado-response/discovery-import/readiness",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/readiness.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:3,frontMatter:{title:"Readiness (Beta)",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Automation Rules (Beta)",permalink:"/cado-response/discovery-import/automation"},next:{title:"Overview",permalink:"/cado-response/discovery-import/import/intro"}},d={},c=[{value:"Readiness Dashboard",id:"readiness-dashboard",level:2},{value:"Readiness Score",id:"readiness-score",level:3},{value:"Environment Readiness",id:"environment-readiness",level:2},{value:"Issues",id:"issues",level:3},{value:"Checks",id:"checks",level:3}];function h(e){const s={a:"a",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",ul:"ul",...(0,t.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"readiness-beta",children:"Readiness (Beta)"}),"\n",(0,i.jsx)(s.p,{children:"Readiness is a powerful tool designed to help you identify and address issues related to the acquisition of workloads within your environments. It provides a centralised platform for tracking these issues and assigns a readiness score to each environment, giving you a quick overview of the health of your workload acquisition process."}),"\n",(0,i.jsx)(s.h2,{id:"readiness-dashboard",children:"Readiness Dashboard"}),"\n",(0,i.jsx)(s.p,{children:"The Readiness Dashboard gives a summary view of your readiness, relative to the cloud environments that have been configured within the Cado Platform"}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Readiness Dashboard",src:n(1760).Z+"",width:"1632",height:"777"})}),"\n",(0,i.jsx)(s.h3,{id:"readiness-score",children:"Readiness Score"}),"\n",(0,i.jsx)(s.p,{children:"The Readiness score is a numerical value that represents the health of your EC2 acquisition process for a specific environment. The higher the score, the higher the likelihood you will be able to succesfully investigate an incident in that environment. The score is based on a variety of factors, including:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"EC2 instance provisioning time."}),"\n",(0,i.jsx)(s.li,{children:"Resource availability within your environment."}),"\n",(0,i.jsx)(s.li,{children:"Compliance with best practices."}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:"The Readiness score is a composite score calculated from the readiness of each of the cloud environments configured within the platform. Environments with lower scores might need attention in order to increase the likelihood of a successful investigation. Cado measures and displays changes of the readiness score over time to show the impacts of any changes you have made."}),"\n",(0,i.jsx)(s.h2,{id:"environment-readiness",children:"Environment Readiness"}),"\n",(0,i.jsx)(s.p,{children:"With Cado you can assess the readiness of a given cloud environment. To see the details of the readiness of a given a given environment, click on the envrionment in the list."}),"\n",(0,i.jsxs)(s.p,{children:["At installation Cado creates a default environment for the account in which Cado is installed called 'Cado Platform Environment'. To configure additional environments see ",(0,i.jsx)(s.a,{href:"/cado-response/discovery-import/automation#creating-an-environment",children:"Creating an Environment"})]}),"\n",(0,i.jsx)(s.p,{children:'To check the readiness of an environment and get updated status click "Run Check", and Cado will test acquiring an image from a randomly selected workload in that environment'}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Environment Dashboard",src:n(1087).Z+"",width:"1420",height:"811"})}),"\n",(0,i.jsx)(s.h3,{id:"issues",children:"Issues"}),"\n",(0,i.jsx)(s.p,{children:"Cado outlines any issues it has encountered in assessing the readiness for a given environment. This allows you to make changes in that environment that will increase the likelihood that you will be able to perform an investigation in the event of an incident. Each issue shows:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The category of the issue"}),"\n",(0,i.jsx)(s.li,{children:"The resource type"}),"\n",(0,i.jsx)(s.li,{children:"The ID of the workload"}),"\n",(0,i.jsx)(s.li,{children:"The full error message associated with the issue"}),"\n"]}),"\n",(0,i.jsx)(s.h3,{id:"checks",children:"Checks"}),"\n",(0,i.jsx)(s.p,{children:"Cado outlines a full list of all the checks it has performed on that environment, when they check occurred, the workload against which the check was performed and the result of that check."})]})}function l(e={}){const{wrapper:s}={...(0,t.a)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(h,{...e})}):h(e)}},1087:(e,s,n)=>{n.d(s,{Z:()=>i});const i=n.p+"assets/images/environment-dashboard-4b0939cdc4b7ecc5f7b6e26a713ff394.png"},1760:(e,s,n)=>{n.d(s,{Z:()=>i});const i=n.p+"assets/images/readiness-dashboard-f456392620e7e46f0468aaea51e58d54.png"},1151:(e,s,n)=>{n.d(s,{Z:()=>r,a:()=>a});var i=n(7294);const t={},o=i.createContext(t);function a(e){const s=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function r(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:a(e.components),i.createElement(o.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/1a958a62.ee2dbbfe.js b/assets/js/1a958a62.ee2dbbfe.js new file mode 100644 index 000000000..e5afe7ec6 --- /dev/null +++ b/assets/js/1a958a62.ee2dbbfe.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7017],{1978:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>d,contentTitle:()=>a,default:()=>l,frontMatter:()=>o,metadata:()=>r,toc:()=>c});var i=n(5893),t=n(1151);const o={title:"Readiness (Beta)",hide_title:!0,sidebar_position:3},a="Readiness (Beta)",r={id:"cado-response/discovery-import/readiness",title:"Readiness (Beta)",description:"Readiness is a powerful tool designed to help you identify and address issues related to the acquisition of workloads within your environments. It provides a centralised platform for tracking these issues and assigns a readiness score to each environment, giving you a quick overview of the health of your workload acquisition process.",source:"@site/docs/cado-response/discovery-import/readiness.md",sourceDirName:"cado-response/discovery-import",slug:"/cado-response/discovery-import/readiness",permalink:"/cado-response/discovery-import/readiness",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/readiness.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:3,frontMatter:{title:"Readiness (Beta)",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Automation Rules (Beta)",permalink:"/cado-response/discovery-import/automation"},next:{title:"Overview",permalink:"/cado-response/discovery-import/import/intro"}},d={},c=[{value:"Readiness Dashboard",id:"readiness-dashboard",level:2},{value:"Readiness Score",id:"readiness-score",level:3},{value:"Environment Readiness",id:"environment-readiness",level:2},{value:"Issues",id:"issues",level:3},{value:"Checks",id:"checks",level:3}];function h(e){const s={a:"a",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",ul:"ul",...(0,t.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"readiness-beta",children:"Readiness (Beta)"}),"\n",(0,i.jsx)(s.p,{children:"Readiness is a powerful tool designed to help you identify and address issues related to the acquisition of workloads within your environments. It provides a centralised platform for tracking these issues and assigns a readiness score to each environment, giving you a quick overview of the health of your workload acquisition process."}),"\n",(0,i.jsx)(s.h2,{id:"readiness-dashboard",children:"Readiness Dashboard"}),"\n",(0,i.jsx)(s.p,{children:"The Readiness Dashboard gives a summary view of your readiness, relative to the cloud environments that have been configured within the Cado Platform"}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Readiness Dashboard",src:n(1760).Z+"",width:"1632",height:"777"})}),"\n",(0,i.jsx)(s.h3,{id:"readiness-score",children:"Readiness Score"}),"\n",(0,i.jsx)(s.p,{children:"The Readiness score is a numerical value that represents the health of your EC2 acquisition process for a specific environment. The higher the score, the higher the likelihood you will be able to succesfully investigate an incident in that environment. The score is based on a variety of factors, including:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"EC2 instance provisioning time."}),"\n",(0,i.jsx)(s.li,{children:"Resource availability within your environment."}),"\n",(0,i.jsx)(s.li,{children:"Compliance with best practices."}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:"The Readiness score is a composite score calculated from the readiness of each of the cloud environments configured within the platform. Environments with lower scores might need attention in order to increase the likelihood of a successful investigation. Cado measures and displays changes of the readiness score over time to show the impacts of any changes you have made."}),"\n",(0,i.jsx)(s.h2,{id:"environment-readiness",children:"Environment Readiness"}),"\n",(0,i.jsx)(s.p,{children:"With Cado you can assess the readiness of a given cloud environment. To see the details of the readiness of a given a given environment, click on the envrionment in the list."}),"\n",(0,i.jsxs)(s.p,{children:["At installation Cado creates a default environment for the account in which Cado is installed called 'Cado Platform Environment'. To configure additional environments see ",(0,i.jsx)(s.a,{href:"/cado-response/discovery-import/automation#creating-an-environment",children:"Creating an Environment"})]}),"\n",(0,i.jsx)(s.p,{children:'To check the readiness of an environment and get updated status click "Run Check", and Cado will test acquiring an image from a randomly selected workload in that environment'}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Environment Dashboard",src:n(1087).Z+"",width:"1420",height:"811"})}),"\n",(0,i.jsx)(s.h3,{id:"issues",children:"Issues"}),"\n",(0,i.jsx)(s.p,{children:"Cado outlines any issues it has encountered in assessing the readiness for a given environment. This allows you to make changes in that environment that will increase the likelihood that you will be able to perform an investigation in the event of an incident. Each issue shows:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The category of the issue"}),"\n",(0,i.jsx)(s.li,{children:"The resource type"}),"\n",(0,i.jsx)(s.li,{children:"The ID of the workload"}),"\n",(0,i.jsx)(s.li,{children:"The full error message associated with the issue"}),"\n"]}),"\n",(0,i.jsx)(s.h3,{id:"checks",children:"Checks"}),"\n",(0,i.jsx)(s.p,{children:"Cado outlines a full list of all the checks it has performed on that environment, when they check occurred, the workload against which the check was performed and the result of that check."})]})}function l(e={}){const{wrapper:s}={...(0,t.a)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(h,{...e})}):h(e)}},1087:(e,s,n)=>{n.d(s,{Z:()=>i});const i=n.p+"assets/images/environment-dashboard-4b0939cdc4b7ecc5f7b6e26a713ff394.png"},1760:(e,s,n)=>{n.d(s,{Z:()=>i});const i=n.p+"assets/images/readiness-dashboard-f456392620e7e46f0468aaea51e58d54.png"},1151:(e,s,n)=>{n.d(s,{Z:()=>r,a:()=>a});var i=n(7294);const t={},o=i.createContext(t);function a(e){const s=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function r(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:a(e.components),i.createElement(o.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/22183dc2.358e46f6.js b/assets/js/22183dc2.358e46f6.js new file mode 100644 index 000000000..ec43df35e --- /dev/null +++ b/assets/js/22183dc2.358e46f6.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1186],{2991:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>o,contentTitle:()=>d,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>l});var n=s(5893),i=s(1151);const r={title:"SIEM",hide_title:!0,sidebar_position:3},d="SIEM Integration",a={id:"cado-response/manage/integrations/siem",title:"SIEM",description:"SIEM (Security Information and Event Management) is a tool that provides real-time analysis of security events generated by applications and network hardware - an essential capability for SecOps teams to correlate events and logs from different systems and manage risks more wisely. The integration with the Cado platform leverages the power of SIEM systems with Cado\u2019s unique forensics value in the cloud.",source:"@site/docs/cado-response/manage/integrations/siem.md",sourceDirName:"cado-response/manage/integrations",slug:"/cado-response/manage/integrations/siem",permalink:"/cado-response/manage/integrations/siem",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/siem.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:3,frontMatter:{title:"SIEM",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"GuardDuty via Lambda",permalink:"/cado-response/manage/integrations/aws-lambda"},next:{title:"Tines",permalink:"/cado-response/manage/integrations/soar/tines"}},o={},l=[{value:"Getting Started",id:"getting-started",level:2},{value:"Extensions",id:"extensions",level:2}];function c(e){const t={code:"code",h1:"h1",h2:"h2",img:"img",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,i.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"siem-integration",children:"SIEM Integration"}),"\n",(0,n.jsx)(t.p,{children:"SIEM (Security Information and Event Management) is a tool that provides real-time analysis of security events generated by applications and network hardware - an essential capability for SecOps teams to correlate events and logs from different systems and manage risks more wisely. The integration with the Cado platform leverages the power of SIEM systems with Cado\u2019s unique forensics value in the cloud."}),"\n",(0,n.jsx)(t.p,{children:"The processed timeline from Cado will be converted to a standard format (CEF) so it can be universally read by SIEM systems. It will also be exported in Cado's custom Json format (CadoJson) which is better parsed by some SIEMs such as Splunk and Sentinel."}),"\n",(0,n.jsx)(t.p,{children:"The CEF and JSON file will then be uploaded to your AWS S3 bucket and folder of choice."}),"\n",(0,n.jsx)(t.p,{children:"You can configure your SIEM system to automatically check for new files in the S3 bucket and to add them to your SIEM system automatically."}),"\n",(0,n.jsx)(t.h2,{id:"getting-started",children:"Getting Started"}),"\n",(0,n.jsxs)(t.p,{children:["Before you can export the timeline you need to enable SIEM integration found under ",(0,n.jsx)(t.strong,{children:"Settings -> Platform Settings -> Integrations -> SIEM"}),". After it is enabled you will be asked to set the S3 bucket and S3 folder you wish for the timeline to be exported to."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"SIEM Settings in Cado",src:s(5681).Z+"",width:"1221",height:"967"})}),"\n",(0,n.jsx)(t.p,{children:"When enabled whenever you import an evidence item, the timeline will be automatically converted and uploaded to S3.\nYou then need to configure your SIEM system to watch the folder for any new files uploaded so they can be automatically added to your SIEM."}),"\n",(0,n.jsx)(t.h1,{id:"cado-cef-standard",children:"Cado CEF Standard"}),"\n",(0,n.jsx)(t.p,{children:"This is a sample CEF log that can be generated by Cado:"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.strong,{children:"CEF:0|CadoSecurity|CadoResponse|1.0.2|0|Content Modification Time|10|alarm=True evidence_id=2 evidence_name=aws_compromise.zip macb=M... source=FILE eventTime=1595194940 filePath=/tmp/file.txt eventId=Q5FBqHwBX9dvp1T5IsHT msg=Malicious File Detected: cryptomining_malware_wannamine"})}),"\n",(0,n.jsx)(t.p,{children:"The log follows the below standard:"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.strong,{children:"CEF:0|CadoSecurity|CadoResponse|Version|Signature ID|Name|Severity|Extension"})}),"\n",(0,n.jsx)(t.p,{children:"The extension part of the message is a placeholder for additional fields that are represented by key-value pairs. The keys are part of a predefined set and are outlined below."}),"\n",(0,n.jsx)(t.h2,{id:"extensions",children:"Extensions"}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"EXTENSION FIELD"}),(0,n.jsx)(t.th,{children:"EXAMPLE VALUE"}),(0,n.jsx)(t.th,{children:"TYPE"}),(0,n.jsx)(t.th,{children:"FIELD DESCRIPTION"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"eventTime"}),(0,n.jsx)(t.td,{children:"890430600"}),(0,n.jsx)(t.td,{children:"int"}),(0,n.jsx)(t.td,{children:"Unix timestamp of event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"source"}),(0,n.jsx)(t.td,{children:"REG"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"More specific subtype of source."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"sourcetype"}),(0,n.jsx)(t.td,{children:"LOG"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"The type of the file or data that produced this event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"type"}),(0,n.jsx)(t.td,{children:"Last Time Executed"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"; separated list of event types, e.g. Last Executed Time, Updated Time, Content Modification Time, Creation Time."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"filePath"}),(0,n.jsx)(t.td,{children:"/Users/nromanoff/NTUSER.DAT"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"The path of the file associated with this event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"short"}),(0,n.jsx)(t.td,{children:"Executable in suspicious location"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Short text providing additional data from raw event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"evidence_id"}),(0,n.jsx)(t.td,{children:"1"}),(0,n.jsx)(t.td,{children:"int"}),(0,n.jsx)(t.td,{children:"ID of evidence item in Response."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"alarm_severity"}),(0,n.jsx)(t.td,{children:"1"}),(0,n.jsx)(t.td,{children:"int"}),(0,n.jsx)(t.td,{children:"Severity of event based on detections. Malicious 1, Suspicious 3, Other 10."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"parent"}),(0,n.jsx)(t.td,{children:"/Users/nromanoff"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"The path of the file associated with this event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"macb"}),(0,n.jsx)(t.td,{children:".A.."}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"MACB (Modification, Access, Change, Birth) group representation."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"suser"}),(0,n.jsx)(t.td,{children:"nromanoff"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"User associated with the event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"host"}),(0,n.jsx)(t.td,{children:"EC2AMAZ-T80EJE1"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Host name associated with the event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"version"}),(0,n.jsx)(t.td,{children:"2"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Field in log2timeline CSV."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"filename_stripped"}),(0,n.jsx)(t.td,{children:"Users nromanoff NTUSER.DAT"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Name of the file associated with this event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"inode"}),(0,n.jsx)(t.td,{children:"123"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:'The "inode" attribute if present in the event data, otherwise derived from the file system identifier (such as inode, MFT entry) in the path specification.'})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"notes"}),(0,n.jsx)(t.td,{children:"This is something that should be further investigated."}),(0,n.jsx)(t.td,{children:"Union[str, List[Dict[str, Any]]]"}),(0,n.jsx)(t.td,{children:"A list of notes the user has added to his event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"format"}),(0,n.jsx)(t.td,{children:"winreg/userassist"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"The type of event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"extra"}),(0,n.jsx)(t.td,{children:"file_size: 5760; file_system_type: OS; is_allocated: True"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Longer text, providing more raw data than short."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"isFolder"}),(0,n.jsx)(t.td,{children:"False"}),(0,n.jsx)(t.td,{children:"bool"}),(0,n.jsx)(t.td,{children:"If this event relates to a folder."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"domain"}),(0,n.jsx)(t.td,{children:"SHIELDBASE"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Domain associated with the event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"source_hostname"}),(0,n.jsx)(t.td,{children:"203.78.103.109"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"For network connections, the hostname that it originated from."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"destination_hostname"}),(0,n.jsx)(t.td,{children:"194.61.24.102"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"For network connections, the destination hostname."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"tag"}),(0,n.jsx)(t.td,{children:"Execution"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Tag representing type of event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"alarm_description"}),(0,n.jsx)(t.td,{children:"Executable in suspicious location"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Description of the alarm in the event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"alarm"}),(0,n.jsx)(t.td,{children:"True"}),(0,n.jsx)(t.td,{children:"bool"}),(0,n.jsx)(t.td,{children:"If this event has an alarm associated with it."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"executed_process"}),(0,n.jsx)(t.td,{children:"C:/Users/Tdungan/AppData/Local/Temp/ install_reader10_en_air_gtbd_aih.exe"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Where we detect a process execution, the path of the executed file."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"file_access"}),(0,n.jsx)(t.td,{children:"Windows Explorer.lnk"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"How the file was accessed."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"super_short"}),(0,n.jsx)(t.td,{children:"A Process Was Executed"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Super short text providing summary of event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"process_cwd"}),(0,n.jsx)(t.td,{children:"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"For memory evidence items, current working directory of event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"process_arguments"}),(0,n.jsx)(t.td,{children:"/sbin/dhclient -q -lf /var/lib/dhclient/dhclient--eth0.lease -pf /var/run/dhclient-eth0.pid eth0"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"For memory evidence items, command line arguments from event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"source_port"}),(0,n.jsx)(t.td,{children:"443"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"For memory evidence items, port of the source address."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"destination_port"}),(0,n.jsx)(t.td,{children:"443"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"For memory evidence items, port of the destination address."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"eventId"}),(0,n.jsx)(t.td,{children:"nEqI5nwBOI5t76pr_Z6g"}),(0,n.jsx)(t.td,{children:"Any"}),(0,n.jsx)(t.td,{children:"ID relating to the event generated in Cado Response."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"evidence_name"}),(0,n.jsx)(t.td,{children:"import_test.dd"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Name of the evidence item imported into Cado Response."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"query_suggestions"}),(0,n.jsx)(t.td,{children:"[{'str_detected': 'install_reader10_en_air_gtbd_aih.exe', 'url': '?query=install_reader10_en_air_gtbd_aih.exe'}]"}),(0,n.jsx)(t.td,{children:"List[Dict[str, Any]]"}),(0,n.jsx)(t.td,{children:"List of suggestions as to what to query next."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"alarm_help_text"}),(0,n.jsx)(t.td,{children:"Review the malware analysis playbook for advice on how to identify and respond to the malware."}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Information to help the user undertstand what the alarm is about and how to respond."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"sha256"}),(0,n.jsx)(t.td,{children:"9473976b2769337ca9a7243bf1ceddb3335f9551e113240ebb0c53ae789878d5"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"The hash of the file originating the event."})]})]})]}),"\n",(0,n.jsx)(t.h1,{id:"cadojson-format",children:"CadoJson Format"}),"\n",(0,n.jsx)(t.p,{children:"The CadoJson format represents the same fields that Cado Response uses internally.\nThe fields are the same as described above for CEF."}),"\n",(0,n.jsx)(t.p,{children:"An example is provided below:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:'{\n\t"macb": "M...",\n\t"source": "REG",\n\t"sourcetype": "Registry Key",\n\t"type": "Content Modification Time",\n\t"user": null,\n\t"host": "-",\n\t"short": "[HKEY_CURRENT_USER/AppEvents/Schemes/Apps/.Default/Notification.Proximity] (empty)",\n\t"inode": "-",\n\t"notes": "-",\n\t"format": "winreg/winreg_default",\n\t"extra": "",\n\t"sha256": "9473976b2769337ca9a7243bf1ceddb3335f9551e113240ebb0c53ae789878d5",\n\t"tag": null,\n\t"eventTime": 1610559005,\n\t"filePath": "/NTUSER.DAT"\n}\n'})})]})}function h(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},5681:(e,t,s)=>{s.d(t,{Z:()=>n});const n=s.p+"assets/images/siem-settings-72e698a1df218c4294f1588602513965.png"},1151:(e,t,s)=>{s.d(t,{Z:()=>a,a:()=>d});var n=s(7294);const i={},r=n.createContext(i);function d(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:d(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/22183dc2.f46088ea.js b/assets/js/22183dc2.f46088ea.js deleted file mode 100644 index b1fba0d0c..000000000 --- a/assets/js/22183dc2.f46088ea.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1186],{2991:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>o,contentTitle:()=>d,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>l});var n=s(5893),i=s(1151);const r={title:"SIEM",hide_title:!0,sidebar_position:3},d="SIEM Integration",a={id:"cado-response/manage/integrations/siem",title:"SIEM",description:"SIEM (Security Information and Event Management) is a tool that provides real-time analysis of security events generated by applications and network hardware - an essential capability for SecOps teams to correlate events and logs from different systems and manage risks more wisely. The integration with the Cado platform leverages the power of SIEM systems with Cado\u2019s unique forensics value in the cloud.",source:"@site/docs/cado-response/manage/integrations/siem.md",sourceDirName:"cado-response/manage/integrations",slug:"/cado-response/manage/integrations/siem",permalink:"/cado-response/manage/integrations/siem",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/siem.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:3,frontMatter:{title:"SIEM",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"GuardDuty via Lambda",permalink:"/cado-response/manage/integrations/aws-lambda"},next:{title:"Tines",permalink:"/cado-response/manage/integrations/soar/tines"}},o={},l=[{value:"Getting Started",id:"getting-started",level:2},{value:"Extensions",id:"extensions",level:2}];function c(e){const t={code:"code",h1:"h1",h2:"h2",img:"img",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,i.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"siem-integration",children:"SIEM Integration"}),"\n",(0,n.jsx)(t.p,{children:"SIEM (Security Information and Event Management) is a tool that provides real-time analysis of security events generated by applications and network hardware - an essential capability for SecOps teams to correlate events and logs from different systems and manage risks more wisely. The integration with the Cado platform leverages the power of SIEM systems with Cado\u2019s unique forensics value in the cloud."}),"\n",(0,n.jsx)(t.p,{children:"The processed timeline from Cado will be converted to a standard format (CEF) so it can be universally read by SIEM systems. It will also be exported in Cado's custom Json format (CadoJson) which is better parsed by some SIEMs such as Splunk and Sentinel."}),"\n",(0,n.jsx)(t.p,{children:"The CEF and JSON file will then be uploaded to your AWS S3 bucket and folder of choice."}),"\n",(0,n.jsx)(t.p,{children:"You can configure your SIEM system to automatically check for new files in the S3 bucket and to add them to your SIEM system automatically."}),"\n",(0,n.jsx)(t.h2,{id:"getting-started",children:"Getting Started"}),"\n",(0,n.jsxs)(t.p,{children:["Before you can export the timeline you need to enable SIEM integration found under ",(0,n.jsx)(t.strong,{children:"Settings -> Platform Settings -> Integrations -> SIEM"}),". After it is enabled you will be asked to set the S3 bucket and S3 folder you wish for the timeline to be exported to."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"SIEM Settings in Cado",src:s(5681).Z+"",width:"1221",height:"967"})}),"\n",(0,n.jsx)(t.p,{children:"When enabled whenever you import an evidence item, the timeline will be automatically converted and uploaded to S3.\nYou then need to configure your SIEM system to watch the folder for any new files uploaded so they can be automatically added to your SIEM."}),"\n",(0,n.jsx)(t.h1,{id:"cado-cef-standard",children:"Cado CEF Standard"}),"\n",(0,n.jsx)(t.p,{children:"This is a sample CEF log that can be generated by Cado:"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.strong,{children:"CEF:0|CadoSecurity|CadoResponse|1.0.2|0|Content Modification Time|10|alarm=True evidence_id=2 evidence_name=aws_compromise.zip macb=M... source=FILE eventTime=1595194940 filePath=/tmp/file.txt eventId=Q5FBqHwBX9dvp1T5IsHT msg=Malicious File Detected: cryptomining_malware_wannamine"})}),"\n",(0,n.jsx)(t.p,{children:"The log follows the below standard:"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.strong,{children:"CEF:0|CadoSecurity|CadoResponse|Version|Signature ID|Name|Severity|Extension"})}),"\n",(0,n.jsx)(t.p,{children:"The extension part of the message is a placeholder for additional fields that are represented by key-value pairs. The keys are part of a predefined set and are outlined below."}),"\n",(0,n.jsx)(t.h2,{id:"extensions",children:"Extensions"}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"EXTENSION FIELD"}),(0,n.jsx)(t.th,{children:"EXAMPLE VALUE"}),(0,n.jsx)(t.th,{children:"TYPE"}),(0,n.jsx)(t.th,{children:"FIELD DESCRIPTION"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"eventTime"}),(0,n.jsx)(t.td,{children:"890430600"}),(0,n.jsx)(t.td,{children:"int"}),(0,n.jsx)(t.td,{children:"Unix timestamp of event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"source"}),(0,n.jsx)(t.td,{children:"REG"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"More specific subtype of source."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"sourcetype"}),(0,n.jsx)(t.td,{children:"LOG"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"The type of the file or data that produced this event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"type"}),(0,n.jsx)(t.td,{children:"Last Time Executed"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"; separated list of event types, e.g. Last Executed Time, Updated Time, Content Modification Time, Creation Time."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"filePath"}),(0,n.jsx)(t.td,{children:"/Users/nromanoff/NTUSER.DAT"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"The path of the file associated with this event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"short"}),(0,n.jsx)(t.td,{children:"Executable in suspicious location"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Short text providing additional data from raw event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"evidence_id"}),(0,n.jsx)(t.td,{children:"1"}),(0,n.jsx)(t.td,{children:"int"}),(0,n.jsx)(t.td,{children:"ID of evidence item in Response."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"alarm_severity"}),(0,n.jsx)(t.td,{children:"1"}),(0,n.jsx)(t.td,{children:"int"}),(0,n.jsx)(t.td,{children:"Severity of event based on detections. Malicious 1, Suspicious 3, Other 10."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"parent"}),(0,n.jsx)(t.td,{children:"/Users/nromanoff"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"The path of the file associated with this event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"macb"}),(0,n.jsx)(t.td,{children:".A.."}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"MACB (Modification, Access, Change, Birth) group representation."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"suser"}),(0,n.jsx)(t.td,{children:"nromanoff"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"User associated with the event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"host"}),(0,n.jsx)(t.td,{children:"EC2AMAZ-T80EJE1"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Host name associated with the event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"version"}),(0,n.jsx)(t.td,{children:"2"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Field in log2timeline CSV."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"filename_stripped"}),(0,n.jsx)(t.td,{children:"Users nromanoff NTUSER.DAT"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Name of the file associated with this event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"inode"}),(0,n.jsx)(t.td,{children:"123"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:'The "inode" attribute if present in the event data, otherwise derived from the file system identifier (such as inode, MFT entry) in the path specification.'})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"notes"}),(0,n.jsx)(t.td,{children:"This is something that should be further investigated."}),(0,n.jsx)(t.td,{children:"Union[str, List[Dict[str, Any]]]"}),(0,n.jsx)(t.td,{children:"A list of notes the user has added to his event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"format"}),(0,n.jsx)(t.td,{children:"winreg/userassist"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"The type of event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"extra"}),(0,n.jsx)(t.td,{children:"file_size: 5760; file_system_type: OS; is_allocated: True"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Longer text, providing more raw data than short."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"isFolder"}),(0,n.jsx)(t.td,{children:"False"}),(0,n.jsx)(t.td,{children:"bool"}),(0,n.jsx)(t.td,{children:"If this event relates to a folder."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"domain"}),(0,n.jsx)(t.td,{children:"SHIELDBASE"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Domain associated with the event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"source_hostname"}),(0,n.jsx)(t.td,{children:"203.78.103.109"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"For network connections, the hostname that it originated from."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"destination_hostname"}),(0,n.jsx)(t.td,{children:"194.61.24.102"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"For network connections, the destination hostname."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"tag"}),(0,n.jsx)(t.td,{children:"Execution"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Tag representing type of event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"alarm_description"}),(0,n.jsx)(t.td,{children:"Executable in suspicious location"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Description of the alarm in the event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"alarm"}),(0,n.jsx)(t.td,{children:"True"}),(0,n.jsx)(t.td,{children:"bool"}),(0,n.jsx)(t.td,{children:"If this event has an alarm associated with it."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"executed_process"}),(0,n.jsx)(t.td,{children:"C:/Users/Tdungan/AppData/Local/Temp/ install_reader10_en_air_gtbd_aih.exe"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Where we detect a process execution, the path of the executed file."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"file_access"}),(0,n.jsx)(t.td,{children:"Windows Explorer.lnk"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"How the file was accessed."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"super_short"}),(0,n.jsx)(t.td,{children:"A Process Was Executed"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Super short text providing summary of event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"process_cwd"}),(0,n.jsx)(t.td,{children:"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"For memory evidence items, current working directory of event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"process_arguments"}),(0,n.jsx)(t.td,{children:"/sbin/dhclient -q -lf /var/lib/dhclient/dhclient--eth0.lease -pf /var/run/dhclient-eth0.pid eth0"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"For memory evidence items, command line arguments from event."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"source_port"}),(0,n.jsx)(t.td,{children:"443"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"For memory evidence items, port of the source address."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"destination_port"}),(0,n.jsx)(t.td,{children:"443"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"For memory evidence items, port of the destination address."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"eventId"}),(0,n.jsx)(t.td,{children:"nEqI5nwBOI5t76pr_Z6g"}),(0,n.jsx)(t.td,{children:"Any"}),(0,n.jsx)(t.td,{children:"ID relating to the event generated in Cado Response."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"evidence_name"}),(0,n.jsx)(t.td,{children:"import_test.dd"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Name of the evidence item imported into Cado Response."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"query_suggestions"}),(0,n.jsx)(t.td,{children:"[{'str_detected': 'install_reader10_en_air_gtbd_aih.exe', 'url': '?query=install_reader10_en_air_gtbd_aih.exe'}]"}),(0,n.jsx)(t.td,{children:"List[Dict[str, Any]]"}),(0,n.jsx)(t.td,{children:"List of suggestions as to what to query next."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"alarm_help_text"}),(0,n.jsx)(t.td,{children:"Review the malware analysis playbook for advice on how to identify and respond to the malware."}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"Information to help the user undertstand what the alarm is about and how to respond."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"sha256"}),(0,n.jsx)(t.td,{children:"9473976b2769337ca9a7243bf1ceddb3335f9551e113240ebb0c53ae789878d5"}),(0,n.jsx)(t.td,{children:"str"}),(0,n.jsx)(t.td,{children:"The hash of the file originating the event."})]})]})]}),"\n",(0,n.jsx)(t.h1,{id:"cadojson-format",children:"CadoJson Format"}),"\n",(0,n.jsx)(t.p,{children:"The CadoJson format represents the same fields that Cado Response uses internally.\nThe fields are the same as described above for CEF."}),"\n",(0,n.jsx)(t.p,{children:"An example is provided below:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:'{\n\t"macb": "M...",\n\t"source": "REG",\n\t"sourcetype": "Registry Key",\n\t"type": "Content Modification Time",\n\t"user": null,\n\t"host": "-",\n\t"short": "[HKEY_CURRENT_USER/AppEvents/Schemes/Apps/.Default/Notification.Proximity] (empty)",\n\t"inode": "-",\n\t"notes": "-",\n\t"format": "winreg/winreg_default",\n\t"extra": "",\n\t"sha256": "9473976b2769337ca9a7243bf1ceddb3335f9551e113240ebb0c53ae789878d5",\n\t"tag": null,\n\t"eventTime": 1610559005,\n\t"filePath": "/NTUSER.DAT"\n}\n'})})]})}function h(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},5681:(e,t,s)=>{s.d(t,{Z:()=>n});const n=s.p+"assets/images/siem-settings-72e698a1df218c4294f1588602513965.png"},1151:(e,t,s)=>{s.d(t,{Z:()=>a,a:()=>d});var n=s(7294);const i={},r=n.createContext(i);function d(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:d(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/22b9ab39.b0892051.js b/assets/js/22b9ab39.b0892051.js new file mode 100644 index 000000000..28990135c --- /dev/null +++ b/assets/js/22b9ab39.b0892051.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[10],{8086:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>i,metadata:()=>a,toc:()=>p});var n=o(5893),s=o(1151);const i={title:"RedHat Openshift",hide_title:!0,sidebar_position:1},r="RedHat Openshift",a={id:"cado-response/discovery-import/import/openshift/openshift",title:"RedHat Openshift",description:"First, generate a collection script using Cado Host under Import > Cado Host.",source:"@site/docs/cado-response/discovery-import/import/openshift/openshift.md",sourceDirName:"cado-response/discovery-import/import/openshift",slug:"/cado-response/discovery-import/import/openshift/",permalink:"/cado-response/discovery-import/import/openshift/",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/openshift/openshift.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"RedHat Openshift",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Oracle Cloud Virtual Machines",permalink:"/cado-response/discovery-import/import/oracle/virtual-machine"},next:{title:"Exporting Data",permalink:"/cado-response/export/intro"}},c={},p=[];function d(e){const t={a:"a",h1:"h1",img:"img",p:"p",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"redhat-openshift",children:"RedHat Openshift"}),"\n",(0,n.jsx)(t.p,{children:"First, generate a collection script using Cado Host under Import > Cado Host."}),"\n",(0,n.jsx)(t.p,{children:"Then, you will need to execute the script on the target container, as such:"}),"\n",(0,n.jsxs)(t.p,{children:["oc login --token=sha256~... --server=",(0,n.jsx)(t.a,{href:"https://api.system.openshiftapps.com:443",children:"https://api.system.openshiftapps.com:443"}),"\noc exec container-name -c container -- mkdir -p /tmp/cado-host\noc exec container-name -c container -- curl -s ",(0,n.jsx)(t.a,{href:"https://cado-public.s3-accelerate.amazonaws.com/cado-host/v1.5.4/linux/cado-host",children:"https://cado-public.s3-accelerate.amazonaws.com/cado-host/v1.5.4/linux/cado-host"})," --output /tmp/cado-host/cado-host\noc exec container-name -c container -- chmod +x /tmp/cado-host/cado-host\noc exec container-name -c container -- ./tmp/cado-host/cado-host --presigned_data ..."]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Openshift",src:o(989).Z+"",width:"1728",height:"482"})})]})}function h(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},989:(e,t,o)=>{o.d(t,{Z:()=>n});const n=o.p+"assets/images/openshift-5e5a73931173ee987518a94be8fb729b.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>a,a:()=>r});var n=o(7294);const s={},i=n.createContext(s);function r(e){const t=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),n.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/29faa1db.9040ab31.js b/assets/js/29faa1db.9040ab31.js deleted file mode 100644 index 864df5c7f..000000000 --- a/assets/js/29faa1db.9040ab31.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7618],{9:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>l,frontMatter:()=>n,metadata:()=>a,toc:()=>d});var o=s(5893),i=s(1151);const n={title:"S3",hide_title:!0,sidebar_position:2},r="AWS S3 Support and Uploading On-Premise Files",a={id:"cado-response/discovery-import/import/aws/aws-s3",title:"S3",description:"The Cado platform supports acquistion of data from AWS S3 buckets. The two main use cases for this are:",source:"@site/docs/cado-response/discovery-import/import/aws/aws-s3.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/aws-s3",permalink:"/cado-response/discovery-import/import/aws/aws-s3",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/aws-s3.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"S3",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"EC2 and EBS",permalink:"/cado-response/discovery-import/import/aws/aws-ec2"},next:{title:"AMI, EBS Snapshot and Volume",permalink:"/cado-response/discovery-import/import/aws/aws-ami"}},c={},d=[{value:"Uploading On-Premise evidence to S3 for Import",id:"uploading-on-premise-evidence-to-s3-for-import",level:2}];function p(e){const t={a:"a",h1:"h1",h2:"h2",img:"img",li:"li",p:"p",ul:"ul",...(0,i.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"aws-s3-support-and-uploading-on-premise-files",children:"AWS S3 Support and Uploading On-Premise Files"}),"\n",(0,o.jsx)(t.p,{children:"The Cado platform supports acquistion of data from AWS S3 buckets. The two main use cases for this are:"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsx)(t.li,{children:"Analyzing disk images or zip files that have been uploaded to an S3 bucket as part of an investigation (e.g. as part of using Cado Community Edition)"}),"\n",(0,o.jsx)(t.li,{children:"Analyzing the contents of an S3 bucket for any uploaded content that could be part of an incident"}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Select or search for the bucket you require. Navigate and select the objects you need, and click the 'Import n objects' button. Confirm the details and click 'Start Import'."}),"\n",(0,o.jsx)(t.p,{children:(0,o.jsx)(t.img,{alt:"Import S3 Bucket",src:s(1321).Z+"",width:"1792",height:"717"})}),"\n",(0,o.jsx)(t.h2,{id:"uploading-on-premise-evidence-to-s3-for-import",children:"Uploading On-Premise evidence to S3 for Import"}),"\n",(0,o.jsxs)(t.p,{children:["You can use the ",(0,o.jsx)(t.a,{href:"https://aws.amazon.com/",children:"AWS Console"})," to upload data from your web browser if you have access to it."]}),"\n",(0,o.jsxs)(t.p,{children:["Alternatively, you can create an ",(0,o.jsx)(t.a,{href:"https://aws.amazon.com/blogs/security/wheres-my-secret-access-key/",children:"AWS Access and Secret Key"})," then use a Desktop GUI tool such as ",(0,o.jsx)(t.a,{href:"https://cyberduck.io/",children:"Cyberduck"})," to easily upload files from your desktop, with support for functionality such as resuming failed uploads."]}),"\n",(0,o.jsx)(t.p,{children:"If you create an Access/Secret for uploading data to S3, we reccomend you scope the access by:"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsxs)(t.li,{children:["Giving the associated role ",(0,o.jsx)(t.a,{href:"https://stackoverflow.com/questions/15076645/amazon-s3-write-only-access",children:"write-only"})," access to a single s3 bucket"]}),"\n",(0,o.jsxs)(t.li,{children:["Use ",(0,o.jsx)(t.a,{href:"https://docs.cyberduck.io/protocols/s3/",children:"temporary credentials"})," if possible"]}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"You can also use Cado Host with the --single_file_unzipped parameter - this may be a good option if you do not have direct access to Azure as Cado Response will generate the credentials at Import > Forensic Artifacts."})]})}function l(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(p,{...e})}):p(e)}},1321:(e,t,s)=>{s.d(t,{Z:()=>o});const o=s.p+"assets/images/aws-s3-c3bf146f7f2bb323a692f608e9adb13b.png"},1151:(e,t,s)=>{s.d(t,{Z:()=>a,a:()=>r});var o=s(7294);const i={},n=o.createContext(i);function r(e){const t=o.useContext(n);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),o.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/29faa1db.fd701a62.js b/assets/js/29faa1db.fd701a62.js new file mode 100644 index 000000000..43d54e482 --- /dev/null +++ b/assets/js/29faa1db.fd701a62.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7618],{9:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>l,frontMatter:()=>n,metadata:()=>a,toc:()=>d});var o=s(5893),i=s(1151);const n={title:"S3",hide_title:!0,sidebar_position:2},r="AWS S3 Support and Uploading On-Premise Files",a={id:"cado-response/discovery-import/import/aws/aws-s3",title:"S3",description:"The Cado platform supports acquistion of data from AWS S3 buckets. The two main use cases for this are:",source:"@site/docs/cado-response/discovery-import/import/aws/aws-s3.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/aws-s3",permalink:"/cado-response/discovery-import/import/aws/aws-s3",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/aws-s3.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"S3",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"EC2 and EBS",permalink:"/cado-response/discovery-import/import/aws/aws-ec2"},next:{title:"AMI, EBS Snapshot and Volume",permalink:"/cado-response/discovery-import/import/aws/aws-ami"}},c={},d=[{value:"Uploading On-Premise evidence to S3 for Import",id:"uploading-on-premise-evidence-to-s3-for-import",level:2}];function p(e){const t={a:"a",h1:"h1",h2:"h2",img:"img",li:"li",p:"p",ul:"ul",...(0,i.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"aws-s3-support-and-uploading-on-premise-files",children:"AWS S3 Support and Uploading On-Premise Files"}),"\n",(0,o.jsx)(t.p,{children:"The Cado platform supports acquistion of data from AWS S3 buckets. The two main use cases for this are:"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsx)(t.li,{children:"Analyzing disk images or zip files that have been uploaded to an S3 bucket as part of an investigation (e.g. as part of using Cado Community Edition)"}),"\n",(0,o.jsx)(t.li,{children:"Analyzing the contents of an S3 bucket for any uploaded content that could be part of an incident"}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Select or search for the bucket you require. Navigate and select the objects you need, and click the 'Import n objects' button. Confirm the details and click 'Start Import'."}),"\n",(0,o.jsx)(t.p,{children:(0,o.jsx)(t.img,{alt:"Import S3 Bucket",src:s(1321).Z+"",width:"1792",height:"717"})}),"\n",(0,o.jsx)(t.h2,{id:"uploading-on-premise-evidence-to-s3-for-import",children:"Uploading On-Premise evidence to S3 for Import"}),"\n",(0,o.jsxs)(t.p,{children:["You can use the ",(0,o.jsx)(t.a,{href:"https://aws.amazon.com/",children:"AWS Console"})," to upload data from your web browser if you have access to it."]}),"\n",(0,o.jsxs)(t.p,{children:["Alternatively, you can create an ",(0,o.jsx)(t.a,{href:"https://aws.amazon.com/blogs/security/wheres-my-secret-access-key/",children:"AWS Access and Secret Key"})," then use a Desktop GUI tool such as ",(0,o.jsx)(t.a,{href:"https://cyberduck.io/",children:"Cyberduck"})," to easily upload files from your desktop, with support for functionality such as resuming failed uploads."]}),"\n",(0,o.jsx)(t.p,{children:"If you create an Access/Secret for uploading data to S3, we reccomend you scope the access by:"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsxs)(t.li,{children:["Giving the associated role ",(0,o.jsx)(t.a,{href:"https://stackoverflow.com/questions/15076645/amazon-s3-write-only-access",children:"write-only"})," access to a single s3 bucket"]}),"\n",(0,o.jsxs)(t.li,{children:["Use ",(0,o.jsx)(t.a,{href:"https://docs.cyberduck.io/protocols/s3/",children:"temporary credentials"})," if possible"]}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"You can also use Cado Host with the --single_file_unzipped parameter - this may be a good option if you do not have direct access to Azure as Cado Response will generate the credentials at Import > Forensic Artifacts."})]})}function l(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(p,{...e})}):p(e)}},1321:(e,t,s)=>{s.d(t,{Z:()=>o});const o=s.p+"assets/images/aws-s3-c3bf146f7f2bb323a692f608e9adb13b.png"},1151:(e,t,s)=>{s.d(t,{Z:()=>a,a:()=>r});var o=s(7294);const i={},n=o.createContext(i);function r(e){const t=o.useContext(n);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),o.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/34fa7a81.38594030.js b/assets/js/34fa7a81.38594030.js new file mode 100644 index 000000000..f780ef363 --- /dev/null +++ b/assets/js/34fa7a81.38594030.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4368],{3201:(e,t,a)=>{a.r(t),a.d(t,{assets:()=>d,contentTitle:()=>o,default:()=>p,frontMatter:()=>s,metadata:()=>i,toc:()=>c});var n=a(5893),r=a(1151);const s={title:"GuardDuty via Lambda",hide_title:!0,sidebar_position:2},o="Overview",i={id:"cado-response/manage/integrations/aws-lambda",title:"GuardDuty via Lambda",description:"The Cado platform can integrate with other AWS Services through AWS Lambda.",source:"@site/docs/cado-response/manage/integrations/aws-lambda.md",sourceDirName:"cado-response/manage/integrations",slug:"/cado-response/manage/integrations/aws-lambda",permalink:"/cado-response/manage/integrations/aws-lambda",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/aws-lambda.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"GuardDuty via Lambda",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Overview & API",permalink:"/cado-response/manage/integrations/api-overview"},next:{title:"SIEM",permalink:"/cado-response/manage/integrations/siem"}},d={},c=[];function m(e){const t={a:"a",h1:"h1",img:"img",p:"p",...(0,r.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"overview",children:"Overview"}),"\n",(0,n.jsx)(t.p,{children:"The Cado platform can integrate with other AWS Services through AWS Lambda."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"AwsLambda",src:a(4101).Z+"",width:"1280",height:"628"})}),"\n",(0,n.jsxs)(t.p,{children:["For more, see our ",(0,n.jsx)(t.a,{href:"https://github.com/cado-security/guardduty-lambda-cado",children:"example on GitHub"}),"."]})]})}function p(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(m,{...e})}):m(e)}},4101:(e,t,a)=>{a.d(t,{Z:()=>n});const n=a.p+"assets/images/GuardDuty_AWS_Lambda-1cc0fdefda4174c37a6d67b2b18cdd16.png"},1151:(e,t,a)=>{a.d(t,{Z:()=>i,a:()=>o});var n=a(7294);const r={},s=n.createContext(r);function o(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/34fa7a81.ffcaeb30.js b/assets/js/34fa7a81.ffcaeb30.js deleted file mode 100644 index 8cd2510e1..000000000 --- a/assets/js/34fa7a81.ffcaeb30.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4368],{3201:(e,t,a)=>{a.r(t),a.d(t,{assets:()=>d,contentTitle:()=>o,default:()=>p,frontMatter:()=>s,metadata:()=>i,toc:()=>c});var n=a(5893),r=a(1151);const s={title:"GuardDuty via Lambda",hide_title:!0,sidebar_position:2},o="Overview",i={id:"cado-response/manage/integrations/aws-lambda",title:"GuardDuty via Lambda",description:"The Cado platform can integrate with other AWS Services through AWS Lambda.",source:"@site/docs/cado-response/manage/integrations/aws-lambda.md",sourceDirName:"cado-response/manage/integrations",slug:"/cado-response/manage/integrations/aws-lambda",permalink:"/cado-response/manage/integrations/aws-lambda",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/aws-lambda.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"GuardDuty via Lambda",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Overview & API",permalink:"/cado-response/manage/integrations/api-overview"},next:{title:"SIEM",permalink:"/cado-response/manage/integrations/siem"}},d={},c=[];function m(e){const t={a:"a",h1:"h1",img:"img",p:"p",...(0,r.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"overview",children:"Overview"}),"\n",(0,n.jsx)(t.p,{children:"The Cado platform can integrate with other AWS Services through AWS Lambda."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"AwsLambda",src:a(4101).Z+"",width:"1280",height:"628"})}),"\n",(0,n.jsxs)(t.p,{children:["For more, see our ",(0,n.jsx)(t.a,{href:"https://github.com/cado-security/guardduty-lambda-cado",children:"example on GitHub"}),"."]})]})}function p(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(m,{...e})}):m(e)}},4101:(e,t,a)=>{a.d(t,{Z:()=>n});const n=a.p+"assets/images/GuardDuty_AWS_Lambda-1cc0fdefda4174c37a6d67b2b18cdd16.png"},1151:(e,t,a)=>{a.d(t,{Z:()=>i,a:()=>o});var n=a(7294);const r={},s=n.createContext(r);function o(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/3c595458.c3cbc2a3.js b/assets/js/3c595458.c3cbc2a3.js new file mode 100644 index 000000000..b8ed8281b --- /dev/null +++ b/assets/js/3c595458.c3cbc2a3.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7605],{1525:(n,e,i)=>{i.r(e),i.d(e,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>o,metadata:()=>a,toc:()=>l});var t=i(5893),s=i(1151);const o={title:"Ping SAML",hide_title:!0,sidebar_position:4},r="Ping SAML Integration",a={id:"cado-response/manage/users-authentication/sso/ping_saml",title:"Ping SAML",description:"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.",source:"@site/docs/cado-response/manage/users-authentication/sso/ping_saml.md",sourceDirName:"cado-response/manage/users-authentication/sso",slug:"/cado-response/manage/users-authentication/sso/ping_saml",permalink:"/cado-response/manage/users-authentication/sso/ping_saml",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/users-authentication/sso/ping_saml.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:4,frontMatter:{title:"Ping SAML",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Okta SAML",permalink:"/cado-response/manage/users-authentication/sso/okta_saml"},next:{title:"Overview & API",permalink:"/cado-response/manage/integrations/api-overview"}},c={},l=[{value:"Setting up Ping SSO",id:"setting-up-ping-sso",level:3}];function d(n){const e={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.a)(),...n.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{id:"ping-saml-integration",children:"Ping SAML Integration"}),"\n",(0,t.jsx)(e.admonition,{type:"warning",children:(0,t.jsxs)(e.p,{children:["If you encounter issues, please contact ",(0,t.jsx)(e.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," describing your issue and providing as much detail about your configuration as possible."]})}),"\n",(0,t.jsxs)(e.p,{children:["You can now enable the beta of Ping SAML Integration in the Cado platform by going to ",(0,t.jsx)(e.code,{children:"Settings > SSO > Ping SAML"}),"."]}),"\n",(0,t.jsx)(e.h3,{id:"setting-up-ping-sso",children:"Setting up Ping SSO"}),"\n",(0,t.jsxs)(e.ol,{children:["\n",(0,t.jsxs)(e.li,{children:["Open the Ping admin dashboard and navigate to ",(0,t.jsx)(e.code,{children:"Connections > Applications"})]}),"\n",(0,t.jsxs)(e.li,{children:["Give your application a name and select ",(0,t.jsx)(e.strong,{children:"SAML Application"})," as your application type"]}),"\n",(0,t.jsxs)(e.li,{children:["Click ",(0,t.jsx)(e.strong,{children:"Configure Application"})]}),"\n",(0,t.jsxs)(e.li,{children:["Then click ",(0,t.jsx)(e.strong,{children:"Manually Enter"})]}),"\n",(0,t.jsxs)(e.li,{children:["Add an ACS URL. This should be the URL you use to access cado in the web browser concatenated with the ",(0,t.jsx)(e.code,{children:"/api/v2/auth/saml/ping"})," path. E.g. ",(0,t.jsx)(e.code,{children:"https://my.cado.instance/api/v2/auth/saml/ping"})]}),"\n",(0,t.jsxs)(e.li,{children:["Add an Entity ID. Typically this is the instance URI of your application. E.g. ",(0,t.jsx)(e.code,{children:"https://my.cado.instance"})]}),"\n",(0,t.jsxs)(e.li,{children:["Click ",(0,t.jsx)(e.strong,{children:"Save"})]}),"\n",(0,t.jsxs)(e.li,{children:["Optional: Choose who is granted access to the application","\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["Navigate over to ",(0,t.jsx)(e.code,{children:"Identities > Groups"})]}),"\n",(0,t.jsxs)(e.li,{children:["Add a new group. In this example the group will be called ",(0,t.jsx)(e.code,{children:"CadoAdmin"})]}),"\n",(0,t.jsx)(e.li,{children:"This can also be done at a later stage"}),"\n",(0,t.jsxs)(e.li,{children:["If you name a group ",(0,t.jsx)(e.code,{children:"CadoAdmin"}),", then any users in that group will become admin users of Cado when logging in"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(e.admonition,{type:"tip",children:(0,t.jsxs)(e.p,{children:["If you are looking to assign non-admin users within Cado, you can use a group name other than ",(0,t.jsx)(e.code,{children:"CadoAdmin"}),". For example: adding a group ",(0,t.jsx)(e.code,{children:"CadoNonAdmin"})," and assigning users to it will result in those users being Normal Users within Cado."]})}),"\n",(0,t.jsxs)(e.ol,{start:"9",children:["\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["Navigate back over to the application you created earlier and click ",(0,t.jsx)(e.strong,{children:"Attribute Mappings"})]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Add an email attribute to the application:"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"Attributes"})," field enter ",(0,t.jsx)(e.code,{children:"emailAttrStatement"})]}),"\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"PingOne Mappings"})," field select ",(0,t.jsx)(e.strong,{children:"Email Address"})]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Add a Group attribute to the application:"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"Attributes"})," field enter ",(0,t.jsx)(e.code,{children:"groupAttrStatement"})]}),"\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"PingOne Mappings"})," field select ",(0,t.jsx)(e.strong,{children:"Group Names"})]}),"\n"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Ping Attribute Statement",src:i(9636).Z+"",width:"935",height:"279"})}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["Click ",(0,t.jsx)(e.strong,{children:"Save"})," after configuring the attributes"]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Configure SSO in cado:"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsx)(e.li,{children:"Open your cado instance and log in as an admin user"}),"\n",(0,t.jsxs)(e.li,{children:["Go to ",(0,t.jsx)(e.code,{children:"Settings > SSO > Ping SAML"})]}),"\n",(0,t.jsxs)(e.li,{children:["Click ",(0,t.jsx)(e.strong,{children:"Enabled"})]}),"\n",(0,t.jsxs)(e.li,{children:["Populate the fields with the following:","\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["Enter the ",(0,t.jsx)(e.code,{children:"Issuer ID"})," value from the Ping application ",(0,t.jsx)(e.strong,{children:"Configuration"})," tab into the ",(0,t.jsx)(e.code,{children:"Ping SAML App IdP entity ID"})," field"]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the ",(0,t.jsx)(e.code,{children:"Single Signon Service"})," value from the Ping application ",(0,t.jsx)(e.strong,{children:"Configuration"})," tab into the ",(0,t.jsx)(e.code,{children:"Ping SAML App IdP entity ID"})," field"]}),"\n",(0,t.jsxs)(e.li,{children:["Download the signing certificate and enter the value (text inbetween ",(0,t.jsx)(e.code,{children:"-----BEGIN CERTIFICATE-----"})," and ",(0,t.jsx)(e.code,{children:"-----END CERTIFICATE-----"}),") into the ",(0,t.jsx)(e.code,{children:"Ping SAML App x509 Cert"})," field"]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the exact URL you provided in step 6 into the ",(0,t.jsx)(e.code,{children:"Ping SAML App SP entity ID"})," field"]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the exact URL you provided in step 5 into the ",(0,t.jsx)(e.code,{children:"Ping SAML App SP ACS URL"})," field"]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the exact name of your admin group you configured in step 8 into the ",(0,t.jsx)(e.code,{children:"Admin Group Name"})," field"]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["Optional: You can confirm if this was configured correctly by clicking ",(0,t.jsx)(e.strong,{children:"Test new settings"})]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["Click ",(0,t.jsx)(e.strong,{children:"Update"})]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Log out with your existing user, and login with Ping SAML"}),"\n"]}),"\n"]})]})}function h(n={}){const{wrapper:e}={...(0,s.a)(),...n.components};return e?(0,t.jsx)(e,{...n,children:(0,t.jsx)(d,{...n})}):d(n)}},9636:(n,e,i)=>{i.d(e,{Z:()=>t});const t=i.p+"assets/images/ping-attribute-statement-62c7ddc0f711cb0904db75b7c9e94f75.png"},1151:(n,e,i)=>{i.d(e,{Z:()=>a,a:()=>r});var t=i(7294);const s={},o=t.createContext(s);function r(n){const e=t.useContext(o);return t.useMemo((function(){return"function"==typeof n?n(e):{...e,...n}}),[e,n])}function a(n){let e;return e=n.disableParentContext?"function"==typeof n.components?n.components(s):n.components||s:r(n.components),t.createElement(o.Provider,{value:e},n.children)}}}]); \ No newline at end of file diff --git a/assets/js/3c595458.db973ef2.js b/assets/js/3c595458.db973ef2.js deleted file mode 100644 index 31435d869..000000000 --- a/assets/js/3c595458.db973ef2.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7605],{1525:(n,e,i)=>{i.r(e),i.d(e,{assets:()=>c,contentTitle:()=>r,default:()=>h,frontMatter:()=>o,metadata:()=>a,toc:()=>l});var t=i(5893),s=i(1151);const o={title:"Ping SAML",hide_title:!0,sidebar_position:4},r="Ping SAML Integration",a={id:"cado-response/manage/users-authentication/sso/ping_saml",title:"Ping SAML",description:"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.",source:"@site/docs/cado-response/manage/users-authentication/sso/ping_saml.md",sourceDirName:"cado-response/manage/users-authentication/sso",slug:"/cado-response/manage/users-authentication/sso/ping_saml",permalink:"/cado-response/manage/users-authentication/sso/ping_saml",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/users-authentication/sso/ping_saml.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:4,frontMatter:{title:"Ping SAML",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Okta SAML",permalink:"/cado-response/manage/users-authentication/sso/okta_saml"},next:{title:"Overview & API",permalink:"/cado-response/manage/integrations/api-overview"}},c={},l=[{value:"Setting up Ping SSO",id:"setting-up-ping-sso",level:3}];function d(n){const e={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.a)(),...n.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{id:"ping-saml-integration",children:"Ping SAML Integration"}),"\n",(0,t.jsx)(e.admonition,{type:"warning",children:(0,t.jsxs)(e.p,{children:["If you encounter issues, please contact ",(0,t.jsx)(e.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," describing your issue and providing as much detail about your configuration as possible."]})}),"\n",(0,t.jsxs)(e.p,{children:["You can now enable the beta of Ping SAML Integration in the Cado platform by going to ",(0,t.jsx)(e.code,{children:"Settings > SSO > Ping SAML"}),"."]}),"\n",(0,t.jsx)(e.h3,{id:"setting-up-ping-sso",children:"Setting up Ping SSO"}),"\n",(0,t.jsxs)(e.ol,{children:["\n",(0,t.jsxs)(e.li,{children:["Open the Ping admin dashboard and navigate to ",(0,t.jsx)(e.code,{children:"Connections > Applications"})]}),"\n",(0,t.jsxs)(e.li,{children:["Give your application a name and select ",(0,t.jsx)(e.strong,{children:"SAML Application"})," as your application type"]}),"\n",(0,t.jsxs)(e.li,{children:["Click ",(0,t.jsx)(e.strong,{children:"Configure Application"})]}),"\n",(0,t.jsxs)(e.li,{children:["Then click ",(0,t.jsx)(e.strong,{children:"Manually Enter"})]}),"\n",(0,t.jsxs)(e.li,{children:["Add an ACS URL. This should be the URL you use to access cado in the web browser concatenated with the ",(0,t.jsx)(e.code,{children:"/api/v2/auth/saml/ping"})," path. E.g. ",(0,t.jsx)(e.code,{children:"https://my.cado.instance/api/v2/auth/saml/ping"})]}),"\n",(0,t.jsxs)(e.li,{children:["Add an Entity ID. Typically this is the instance URI of your application. E.g. ",(0,t.jsx)(e.code,{children:"https://my.cado.instance"})]}),"\n",(0,t.jsxs)(e.li,{children:["Click ",(0,t.jsx)(e.strong,{children:"Save"})]}),"\n",(0,t.jsxs)(e.li,{children:["Optional: Choose who is granted access to the application","\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["Navigate over to ",(0,t.jsx)(e.code,{children:"Identities > Groups"})]}),"\n",(0,t.jsxs)(e.li,{children:["Add a new group. In this example the group will be called ",(0,t.jsx)(e.code,{children:"CadoAdmin"})]}),"\n",(0,t.jsx)(e.li,{children:"This can also be done at a later stage"}),"\n",(0,t.jsxs)(e.li,{children:["If you name a group ",(0,t.jsx)(e.code,{children:"CadoAdmin"}),", then any users in that group will become admin users of Cado when logging in"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(e.admonition,{type:"tip",children:(0,t.jsxs)(e.p,{children:["If you are looking to assign non-admin users within Cado, you can use a group name other than ",(0,t.jsx)(e.code,{children:"CadoAdmin"}),". For example: adding a group ",(0,t.jsx)(e.code,{children:"CadoNonAdmin"})," and assigning users to it will result in those users being Normal Users within Cado."]})}),"\n",(0,t.jsxs)(e.ol,{start:"9",children:["\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["Navigate back over to the application you created earlier and click ",(0,t.jsx)(e.strong,{children:"Attribute Mappings"})]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Add an email attribute to the application:"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"Attributes"})," field enter ",(0,t.jsx)(e.code,{children:"emailAttrStatement"})]}),"\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"PingOne Mappings"})," field select ",(0,t.jsx)(e.strong,{children:"Email Address"})]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Add a Group attribute to the application:"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"Attributes"})," field enter ",(0,t.jsx)(e.code,{children:"groupAttrStatement"})]}),"\n",(0,t.jsxs)(e.li,{children:["In the ",(0,t.jsx)(e.code,{children:"PingOne Mappings"})," field select ",(0,t.jsx)(e.strong,{children:"Group Names"})]}),"\n"]}),"\n",(0,t.jsx)(e.p,{children:(0,t.jsx)(e.img,{alt:"Ping Attribute Statement",src:i(9636).Z+"",width:"935",height:"279"})}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["Click ",(0,t.jsx)(e.strong,{children:"Save"})," after configuring the attributes"]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Configure SSO in cado:"}),"\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsx)(e.li,{children:"Open your cado instance and log in as an admin user"}),"\n",(0,t.jsxs)(e.li,{children:["Go to ",(0,t.jsx)(e.code,{children:"Settings > SSO > Ping SAML"})]}),"\n",(0,t.jsxs)(e.li,{children:["Click ",(0,t.jsx)(e.strong,{children:"Enabled"})]}),"\n",(0,t.jsxs)(e.li,{children:["Populate the fields with the following:","\n",(0,t.jsxs)(e.ul,{children:["\n",(0,t.jsxs)(e.li,{children:["Enter the ",(0,t.jsx)(e.code,{children:"Issuer ID"})," value from the Ping application ",(0,t.jsx)(e.strong,{children:"Configuration"})," tab into the ",(0,t.jsx)(e.code,{children:"Ping SAML App IdP entity ID"})," field"]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the ",(0,t.jsx)(e.code,{children:"Single Signon Service"})," value from the Ping application ",(0,t.jsx)(e.strong,{children:"Configuration"})," tab into the ",(0,t.jsx)(e.code,{children:"Ping SAML App IdP entity ID"})," field"]}),"\n",(0,t.jsxs)(e.li,{children:["Download the signing certificate and enter the value (text inbetween ",(0,t.jsx)(e.code,{children:"-----BEGIN CERTIFICATE-----"})," and ",(0,t.jsx)(e.code,{children:"-----END CERTIFICATE-----"}),") into the ",(0,t.jsx)(e.code,{children:"Ping SAML App x509 Cert"})," field"]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the exact URL you provided in step 6 into the ",(0,t.jsx)(e.code,{children:"Ping SAML App SP entity ID"})," field"]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the exact URL you provided in step 5 into the ",(0,t.jsx)(e.code,{children:"Ping SAML App SP ACS URL"})," field"]}),"\n",(0,t.jsxs)(e.li,{children:["Enter the exact name of your admin group you configured in step 8 into the ",(0,t.jsx)(e.code,{children:"Admin Group Name"})," field"]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["Optional: You can confirm if this was configured correctly by clicking ",(0,t.jsx)(e.strong,{children:"Test new settings"})]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsxs)(e.p,{children:["Click ",(0,t.jsx)(e.strong,{children:"Update"})]}),"\n"]}),"\n",(0,t.jsxs)(e.li,{children:["\n",(0,t.jsx)(e.p,{children:"Log out with your existing user, and login with Ping SAML"}),"\n"]}),"\n"]})]})}function h(n={}){const{wrapper:e}={...(0,s.a)(),...n.components};return e?(0,t.jsx)(e,{...n,children:(0,t.jsx)(d,{...n})}):d(n)}},9636:(n,e,i)=>{i.d(e,{Z:()=>t});const t=i.p+"assets/images/ping-attribute-statement-62c7ddc0f711cb0904db75b7c9e94f75.png"},1151:(n,e,i)=>{i.d(e,{Z:()=>a,a:()=>r});var t=i(7294);const s={},o=t.createContext(s);function r(n){const e=t.useContext(o);return t.useMemo((function(){return"function"==typeof n?n(e):{...e,...n}}),[e,n])}function a(n){let e;return e=n.disableParentContext?"function"==typeof n.components?n.components(s):n.components||s:r(n.components),t.createElement(o.Provider,{value:e},n.children)}}}]); \ No newline at end of file diff --git a/assets/js/40e7ab60.7d621307.js b/assets/js/40e7ab60.7d621307.js new file mode 100644 index 000000000..70da96e50 --- /dev/null +++ b/assets/js/40e7ab60.7d621307.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4692],{4474:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>o,default:()=>p,frontMatter:()=>i,metadata:()=>a,toc:()=>l});var n=t(5893),r=t(1151);const i={title:"ECS",hide_title:!0,sidebar_position:4},o="AWS ECS Support",a={id:"cado-response/discovery-import/import/aws/aws-ecs",title:"ECS",description:"The Cado platform will collect key logs and forensic artifacts from AWS ECS systems.",source:"@site/docs/cado-response/discovery-import/import/aws/aws-ecs.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/aws-ecs",permalink:"/cado-response/discovery-import/import/aws/aws-ecs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/aws-ecs.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:4,frontMatter:{title:"ECS",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"AMI, EBS Snapshot and Volume",permalink:"/cado-response/discovery-import/import/aws/aws-ami"},next:{title:"EKS",permalink:"/cado-response/discovery-import/import/aws/aws-eks"}},c={},l=[{value:"ECS Import Requirements",id:"ecs-import-requirements",level:2}];function d(e){const s={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.h1,{id:"aws-ecs-support",children:"AWS ECS Support"}),"\n",(0,n.jsx)(s.p,{children:"The Cado platform will collect key logs and forensic artifacts from AWS ECS systems."}),"\n",(0,n.jsx)(s.h1,{id:"how-to-import",children:"How to Import"}),"\n",(0,n.jsxs)(s.ol,{children:["\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:["Go to ",(0,n.jsx)(s.strong,{children:"Import > Cloud"}),"\n",(0,n.jsx)(s.img,{alt:"Import ECS 1",src:t(263).Z+"",width:"842",height:"242"})]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:["Then select the target Cluster and Task:\n",(0,n.jsx)(s.img,{alt:"Import ECS 2",src:t(6384).Z+"",width:"1837",height:"500"})]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsx)(s.p,{children:"Then click Acquire Container."}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:["Confirm details and click ",(0,n.jsx)(s.strong,{children:"Start Import"})]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(s.p,{children:"Cado will now automatically collect all the key logs and forensic artifacts from the container to enable an investigation."}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.img,{alt:"Import ECS 3",src:t(4257).Z+"",width:"1838",height:"397"})}),"\n",(0,n.jsx)(s.p,{children:"For a typical acquisition, import and processing will take a few minutes to complete."}),"\n",(0,n.jsxs)(s.admonition,{type:"info",children:[(0,n.jsx)(s.h2,{id:"ecs-import-requirements",children:"ECS Import Requirements"}),(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["You\u2019ll need to enable ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html",children:"enableExecuteCommand"})," on your ECS task, there is no way to add this to an already existing task."]}),"\n",(0,n.jsx)(s.li,{children:"Currently ECS acquisitions are only available on Linux based containers."}),"\n"]}),(0,n.jsxs)(s.p,{children:["You will receive an error such as this:\n",(0,n.jsx)(s.img,{alt:"ECS Error",src:t(1472).Z+"",width:"1796",height:"476"})]}),(0,n.jsx)(s.p,{children:"If either:"}),(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:"Your IAM role doesn't have the required ECS permissions for IAM:"}),"\n"]}),(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{children:'\t"ecs:ListClusters",\n\t"ecs:DescribeClusters",\n\t"ecs:ListServices",\n\t"ecs:DescribeServices",\n\t"ecs:ListTasks",\n\t"ecs:DescribeTasks",\n\t"ecs:ExecuteCommand"\n'})}),(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["Or the Cluster and Task do not have ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html",children:"enableExecuteCommand"})," enabled."]}),"\n"]})]})]})}function p(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},6384:(e,s,t)=>{t.d(s,{Z:()=>n});const n=t.p+"assets/images/ecs_2-ddea443833f7163d0055ffe587d79e5c.png"},4257:(e,s,t)=>{t.d(s,{Z:()=>n});const n=t.p+"assets/images/ecs_3-1e10eeaa4f63181ff0cd5875d2e5b8f2.png"},1472:(e,s,t)=>{t.d(s,{Z:()=>n});const n=t.p+"assets/images/ecs_error-0f87edd56a3f111531fa1a915ee6e13b.png"},263:(e,s,t)=>{t.d(s,{Z:()=>n});const n=t.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},1151:(e,s,t)=>{t.d(s,{Z:()=>a,a:()=>o});var n=t(7294);const r={},i=n.createContext(r);function o(e){const s=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),n.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/40e7ab60.83db4d26.js b/assets/js/40e7ab60.83db4d26.js deleted file mode 100644 index 0c164e57f..000000000 --- a/assets/js/40e7ab60.83db4d26.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4692],{4474:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>o,default:()=>p,frontMatter:()=>i,metadata:()=>a,toc:()=>l});var n=t(5893),r=t(1151);const i={title:"ECS",hide_title:!0,sidebar_position:4},o="AWS ECS Support",a={id:"cado-response/discovery-import/import/aws/aws-ecs",title:"ECS",description:"The Cado platform will collect key logs and forensic artifacts from AWS ECS systems.",source:"@site/docs/cado-response/discovery-import/import/aws/aws-ecs.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/aws-ecs",permalink:"/cado-response/discovery-import/import/aws/aws-ecs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/aws-ecs.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:4,frontMatter:{title:"ECS",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"AMI, EBS Snapshot and Volume",permalink:"/cado-response/discovery-import/import/aws/aws-ami"},next:{title:"EKS",permalink:"/cado-response/discovery-import/import/aws/aws-eks"}},c={},l=[{value:"ECS Import Requirements",id:"ecs-import-requirements",level:2}];function d(e){const s={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.h1,{id:"aws-ecs-support",children:"AWS ECS Support"}),"\n",(0,n.jsx)(s.p,{children:"The Cado platform will collect key logs and forensic artifacts from AWS ECS systems."}),"\n",(0,n.jsx)(s.h1,{id:"how-to-import",children:"How to Import"}),"\n",(0,n.jsxs)(s.ol,{children:["\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:["Go to ",(0,n.jsx)(s.strong,{children:"Import > Cloud"}),"\n",(0,n.jsx)(s.img,{alt:"Import ECS 1",src:t(263).Z+"",width:"842",height:"242"})]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:["Then select the target Cluster and Task:\n",(0,n.jsx)(s.img,{alt:"Import ECS 2",src:t(6384).Z+"",width:"1837",height:"500"})]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsx)(s.p,{children:"Then click Acquire Container."}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:["Confirm details and click ",(0,n.jsx)(s.strong,{children:"Start Import"})]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(s.p,{children:"Cado will now automatically collect all the key logs and forensic artifacts from the container to enable an investigation."}),"\n",(0,n.jsx)(s.p,{children:(0,n.jsx)(s.img,{alt:"Import ECS 3",src:t(4257).Z+"",width:"1838",height:"397"})}),"\n",(0,n.jsx)(s.p,{children:"For a typical acquisition, import and processing will take a few minutes to complete."}),"\n",(0,n.jsxs)(s.admonition,{type:"info",children:[(0,n.jsx)(s.h2,{id:"ecs-import-requirements",children:"ECS Import Requirements"}),(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["You\u2019ll need to enable ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html",children:"enableExecuteCommand"})," on your ECS task, there is no way to add this to an already existing task."]}),"\n",(0,n.jsx)(s.li,{children:"Currently ECS acquisitions are only available on Linux based containers."}),"\n"]}),(0,n.jsxs)(s.p,{children:["You will receive an error such as this:\n",(0,n.jsx)(s.img,{alt:"ECS Error",src:t(1472).Z+"",width:"1796",height:"476"})]}),(0,n.jsx)(s.p,{children:"If either:"}),(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:"Your IAM role doesn't have the required ECS permissions for IAM:"}),"\n"]}),(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{children:'\t"ecs:ListClusters",\n\t"ecs:DescribeClusters",\n\t"ecs:ListServices",\n\t"ecs:DescribeServices",\n\t"ecs:ListTasks",\n\t"ecs:DescribeTasks",\n\t"ecs:ExecuteCommand"\n'})}),(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["Or the Cluster and Task do not have ",(0,n.jsx)(s.a,{href:"https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html",children:"enableExecuteCommand"})," enabled."]}),"\n"]})]})]})}function p(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},6384:(e,s,t)=>{t.d(s,{Z:()=>n});const n=t.p+"assets/images/ecs_2-ddea443833f7163d0055ffe587d79e5c.png"},4257:(e,s,t)=>{t.d(s,{Z:()=>n});const n=t.p+"assets/images/ecs_3-1e10eeaa4f63181ff0cd5875d2e5b8f2.png"},1472:(e,s,t)=>{t.d(s,{Z:()=>n});const n=t.p+"assets/images/ecs_error-0f87edd56a3f111531fa1a915ee6e13b.png"},263:(e,s,t)=>{t.d(s,{Z:()=>n});const n=t.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},1151:(e,s,t)=>{t.d(s,{Z:()=>a,a:()=>o});var n=t(7294);const r={},i=n.createContext(r);function o(e){const s=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),n.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/41db3c92.1e25f665.js b/assets/js/41db3c92.1e25f665.js deleted file mode 100644 index b334fd6f5..000000000 --- a/assets/js/41db3c92.1e25f665.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[449],{1190:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>l,frontMatter:()=>i,metadata:()=>a,toc:()=>p});var o=s(5893),n=s(1151);const i={title:"Automated Setup",hide_title:!0,sidebar_position:3},r="GCP Automated Setup",a={id:"cado-response/deploy/gcp/gcp-auto-setup",title:"Automated Setup",description:"To streamline the process of configuring your GCP environment ready for Cado, this page details how to use our GCP Setup Scripts.",source:"@site/docs/cado-response/deploy/gcp/gcp-auto-setup.md",sourceDirName:"cado-response/deploy/gcp",slug:"/cado-response/deploy/gcp/gcp-auto-setup",permalink:"/cado-response/deploy/gcp/gcp-auto-setup",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/gcp/gcp-auto-setup.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:3,frontMatter:{title:"Automated Setup",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"GCP Settings",permalink:"/cado-response/deploy/gcp/gcp-settings"},next:{title:"Cross-Project Setup",permalink:"/cado-response/deploy/gcp/gcp-cross-project"}},c={},p=[{value:"Uploading and Running the Scripts",id:"uploading-and-running-the-scripts",level:3},{value:"Scripts",id:"scripts",level:2}];function d(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",hr:"hr",p:"p",pre:"pre",strong:"strong",...(0,n.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"gcp-automated-setup",children:"GCP Automated Setup"}),"\n",(0,o.jsx)(t.p,{children:"To streamline the process of configuring your GCP environment ready for Cado, this page details how to use our GCP Setup Scripts."}),"\n",(0,o.jsx)(t.admonition,{type:"note",children:(0,o.jsx)(t.p,{children:"The actions in these scripts can take a few minutes to take effect, as such, it's best not to run them in quick succession."})}),"\n",(0,o.jsx)(t.h3,{id:"uploading-and-running-the-scripts",children:"Uploading and Running the Scripts"}),"\n",(0,o.jsx)(t.p,{children:"To make use of these scripts, it's best to upload them using the gcloud terminal. To do this, navigate to the GCP console and click the 'Activate Cloud Shell' button in the top-right corner."}),"\n",(0,o.jsxs)(t.p,{children:["The scripts can be found in our Cado GCP Scripts github:\n",(0,o.jsx)(t.a,{href:"https://github.com/cado-security/gcp-setup",children:"https://github.com/cado-security/gcp-setup"})]}),"\n",(0,o.jsx)("img",{src:"/img/gcp-shell.png",alt:"Cloud Shell",width:"350"}),"\n",(0,o.jsx)(t.p,{children:"Once they've been uploaded to your user area in the gcloud terminal, you can run them with bash."}),"\n",(0,o.jsx)("img",{src:"/img/gcp-scripts.png",alt:"Cloud Shell",width:"800"}),"\n",(0,o.jsx)(t.h2,{id:"scripts",children:"Scripts"}),"\n",(0,o.jsxs)(t.p,{children:["The first script in the series '",(0,o.jsx)(t.strong,{children:"gcp_setup_1_role.sh"}),"' will create a 'CadoGCPRole' role within the active project with scoped permissions for Cado to operate. If you want to create the role at the organization level for use across multiple projects, add the organization ID as a parameter.\nWhen the script finishes you should see the role ID printed, we will use this role ID in other scripts so it's best to save it somewhere."]}),"\n",(0,o.jsx)(t.pre,{children:(0,o.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_1_role.sh \nSave this role ID to be used in the next script: organizations/0123456789/roles/CadoGCPRole\n"})}),"\n",(0,o.jsx)(t.hr,{}),"\n",(0,o.jsxs)(t.p,{children:["The second script '",(0,o.jsx)(t.strong,{children:"gcp_setup_2_service_account.sh"}),"' will create a 'CadoServiceAccount' service account within the active project, using the CadoGCPRole role's permissions. You need to specify the role ID from the previous script as a parameter when executing."]}),"\n",(0,o.jsx)(t.pre,{children:(0,o.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_2_service_account.sh \n"})}),"\n",(0,o.jsx)(t.hr,{}),"\n",(0,o.jsxs)(t.p,{children:["The third script '",(0,o.jsx)(t.strong,{children:"gcp_setup_3_WIF.sh"}),"' will create a 'cado-aws-pool' workload identity pool with a 'Cado-AWS-Provider' identity provider and will also connect the previously created 'CadoServiceAccount' service account. This script needs the AWS account ID you will be authenticating with passed as a parameter. Once executing finishes, you can navigate to the 'Connected Service Accounts' tab in the pool and download the credentials ready to use in the platform."]}),"\n",(0,o.jsx)(t.pre,{children:(0,o.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_3_WIF.sh \n"})}),"\n",(0,o.jsx)(t.hr,{}),"\n",(0,o.jsxs)(t.p,{children:["The last script '",(0,o.jsx)(t.strong,{children:"gcp_setup_4_cross_project.sh"}),"' is optional and will setup a target project ready for acquisition using the original 'CadoServiceAccount', meaning you won't need separate credentials to access assets in the target project. This script will only work if the original 'CadoGCPRole' was created at the organization level and will need that role ID along with the target project's ID passed as parameters."]}),"\n",(0,o.jsx)(t.pre,{children:(0,o.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_4_cross_project.sh \n"})})]})}function l(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},1151:(e,t,s)=>{s.d(t,{Z:()=>a,a:()=>r});var o=s(7294);const n={},i=o.createContext(n);function r(e){const t=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:r(e.components),o.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/41db3c92.f41ea746.js b/assets/js/41db3c92.f41ea746.js new file mode 100644 index 000000000..352ff6a73 --- /dev/null +++ b/assets/js/41db3c92.f41ea746.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[449],{1190:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>l,frontMatter:()=>i,metadata:()=>a,toc:()=>p});var o=s(5893),n=s(1151);const i={title:"Automated Setup",hide_title:!0,sidebar_position:3},r="GCP Automated Setup",a={id:"cado-response/deploy/gcp/gcp-auto-setup",title:"Automated Setup",description:"To streamline the process of configuring your GCP environment ready for Cado, this page details how to use our GCP Setup Scripts.",source:"@site/docs/cado-response/deploy/gcp/gcp-auto-setup.md",sourceDirName:"cado-response/deploy/gcp",slug:"/cado-response/deploy/gcp/gcp-auto-setup",permalink:"/cado-response/deploy/gcp/gcp-auto-setup",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/gcp/gcp-auto-setup.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:3,frontMatter:{title:"Automated Setup",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"GCP Settings",permalink:"/cado-response/deploy/gcp/gcp-settings"},next:{title:"Cross-Project Setup",permalink:"/cado-response/deploy/gcp/gcp-cross-project"}},c={},p=[{value:"Uploading and Running the Scripts",id:"uploading-and-running-the-scripts",level:3},{value:"Scripts",id:"scripts",level:2}];function d(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",hr:"hr",p:"p",pre:"pre",strong:"strong",...(0,n.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"gcp-automated-setup",children:"GCP Automated Setup"}),"\n",(0,o.jsx)(t.p,{children:"To streamline the process of configuring your GCP environment ready for Cado, this page details how to use our GCP Setup Scripts."}),"\n",(0,o.jsx)(t.admonition,{type:"note",children:(0,o.jsx)(t.p,{children:"The actions in these scripts can take a few minutes to take effect, as such, it's best not to run them in quick succession."})}),"\n",(0,o.jsx)(t.h3,{id:"uploading-and-running-the-scripts",children:"Uploading and Running the Scripts"}),"\n",(0,o.jsx)(t.p,{children:"To make use of these scripts, it's best to upload them using the gcloud terminal. To do this, navigate to the GCP console and click the 'Activate Cloud Shell' button in the top-right corner."}),"\n",(0,o.jsxs)(t.p,{children:["The scripts can be found in our Cado GCP Scripts github:\n",(0,o.jsx)(t.a,{href:"https://github.com/cado-security/gcp-setup",children:"https://github.com/cado-security/gcp-setup"})]}),"\n",(0,o.jsx)("img",{src:"/img/gcp-shell.png",alt:"Cloud Shell",width:"350"}),"\n",(0,o.jsx)(t.p,{children:"Once they've been uploaded to your user area in the gcloud terminal, you can run them with bash."}),"\n",(0,o.jsx)("img",{src:"/img/gcp-scripts.png",alt:"Cloud Shell",width:"800"}),"\n",(0,o.jsx)(t.h2,{id:"scripts",children:"Scripts"}),"\n",(0,o.jsxs)(t.p,{children:["The first script in the series '",(0,o.jsx)(t.strong,{children:"gcp_setup_1_role.sh"}),"' will create a 'CadoGCPRole' role within the active project with scoped permissions for Cado to operate. If you want to create the role at the organization level for use across multiple projects, add the organization ID as a parameter.\nWhen the script finishes you should see the role ID printed, we will use this role ID in other scripts so it's best to save it somewhere."]}),"\n",(0,o.jsx)(t.pre,{children:(0,o.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_1_role.sh \nSave this role ID to be used in the next script: organizations/0123456789/roles/CadoGCPRole\n"})}),"\n",(0,o.jsx)(t.hr,{}),"\n",(0,o.jsxs)(t.p,{children:["The second script '",(0,o.jsx)(t.strong,{children:"gcp_setup_2_service_account.sh"}),"' will create a 'CadoServiceAccount' service account within the active project, using the CadoGCPRole role's permissions. You need to specify the role ID from the previous script as a parameter when executing."]}),"\n",(0,o.jsx)(t.pre,{children:(0,o.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_2_service_account.sh \n"})}),"\n",(0,o.jsx)(t.hr,{}),"\n",(0,o.jsxs)(t.p,{children:["The third script '",(0,o.jsx)(t.strong,{children:"gcp_setup_3_WIF.sh"}),"' will create a 'cado-aws-pool' workload identity pool with a 'Cado-AWS-Provider' identity provider and will also connect the previously created 'CadoServiceAccount' service account. This script needs the AWS account ID you will be authenticating with passed as a parameter. Once executing finishes, you can navigate to the 'Connected Service Accounts' tab in the pool and download the credentials ready to use in the platform."]}),"\n",(0,o.jsx)(t.pre,{children:(0,o.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_3_WIF.sh \n"})}),"\n",(0,o.jsx)(t.hr,{}),"\n",(0,o.jsxs)(t.p,{children:["The last script '",(0,o.jsx)(t.strong,{children:"gcp_setup_4_cross_project.sh"}),"' is optional and will setup a target project ready for acquisition using the original 'CadoServiceAccount', meaning you won't need separate credentials to access assets in the target project. This script will only work if the original 'CadoGCPRole' was created at the organization level and will need that role ID along with the target project's ID passed as parameters."]}),"\n",(0,o.jsx)(t.pre,{children:(0,o.jsx)(t.code,{className:"language-bash",children:"bash gcp_setup_4_cross_project.sh \n"})})]})}function l(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},1151:(e,t,s)=>{s.d(t,{Z:()=>a,a:()=>r});var o=s(7294);const n={},i=o.createContext(n);function r(e){const t=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:r(e.components),o.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/42a8c3d6.a4575c55.js b/assets/js/42a8c3d6.a4575c55.js deleted file mode 100644 index 1b7cfeb6c..000000000 --- a/assets/js/42a8c3d6.a4575c55.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9188],{7068:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>c,toc:()=>r});var n=i(5893),s=i(1151);const a={title:"Evidence",hide_title:!0,sidebar_position:2},o="Evidence",c={id:"cado-response/investigate/evidence",title:"Evidence",description:"The Evidence tab is a focused view of the data that has been collected as part of this project, and the current processing status of that data. Clicking on the menu icon to the right of a piece of evidence allows you to delete that piece of evidence.",source:"@site/docs/cado-response/investigate/evidence.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/evidence",permalink:"/cado-response/investigate/evidence",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/evidence.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"Evidence",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Investigate",permalink:"/cado-response/investigate/intro"},next:{title:"Timeline Search",permalink:"/cado-response/investigate/timeline-search"}},d={},r=[];function p(e){const t={h1:"h1",img:"img",p:"p",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"evidence",children:"Evidence"}),"\n",(0,n.jsx)(t.p,{children:"The Evidence tab is a focused view of the data that has been collected as part of this project, and the current processing status of that data. Clicking on the menu icon to the right of a piece of evidence allows you to delete that piece of evidence."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Evidence List",src:i(6265).Z+"",width:"1827",height:"518"})}),"\n",(0,n.jsx)(t.p,{children:"Expanding a piece of evidence provides a detailed processing history for that piece of evidence."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Evidence Details",src:i(5253).Z+"",width:"1581",height:"658"})})]})}function h(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(p,{...e})}):p(e)}},5253:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/evidence-details-eb13006dcb3a0c086da52a0eaee3aae5.png"},6265:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/evidence-9aa81b10443f0c9144d5235c4aa651de.png"},1151:(e,t,i)=>{i.d(t,{Z:()=>c,a:()=>o});var n=i(7294);const s={},a=n.createContext(s);function o(e){const t=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),n.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/42a8c3d6.d0af8391.js b/assets/js/42a8c3d6.d0af8391.js new file mode 100644 index 000000000..d7496a148 --- /dev/null +++ b/assets/js/42a8c3d6.d0af8391.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9188],{7068:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>c,toc:()=>r});var n=i(5893),s=i(1151);const a={title:"Evidence",hide_title:!0,sidebar_position:2},o="Evidence",c={id:"cado-response/investigate/evidence",title:"Evidence",description:"The Evidence tab is a focused view of the data that has been collected as part of this project, and the current processing status of that data. Clicking on the menu icon to the right of a piece of evidence allows you to delete that piece of evidence.",source:"@site/docs/cado-response/investigate/evidence.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/evidence",permalink:"/cado-response/investigate/evidence",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/evidence.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"Evidence",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Investigate",permalink:"/cado-response/investigate/intro"},next:{title:"Timeline Search",permalink:"/cado-response/investigate/timeline-search"}},d={},r=[];function p(e){const t={h1:"h1",img:"img",p:"p",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"evidence",children:"Evidence"}),"\n",(0,n.jsx)(t.p,{children:"The Evidence tab is a focused view of the data that has been collected as part of this project, and the current processing status of that data. Clicking on the menu icon to the right of a piece of evidence allows you to delete that piece of evidence."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Evidence List",src:i(6265).Z+"",width:"1827",height:"518"})}),"\n",(0,n.jsx)(t.p,{children:"Expanding a piece of evidence provides a detailed processing history for that piece of evidence."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Evidence Details",src:i(5253).Z+"",width:"1581",height:"658"})})]})}function h(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(p,{...e})}):p(e)}},5253:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/evidence-details-eb13006dcb3a0c086da52a0eaee3aae5.png"},6265:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/evidence-9aa81b10443f0c9144d5235c4aa651de.png"},1151:(e,t,i)=>{i.d(t,{Z:()=>c,a:()=>o});var n=i(7294);const s={},a=n.createContext(s);function o(e){const t=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),n.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4302dc3e.43aa5265.js b/assets/js/4302dc3e.43aa5265.js new file mode 100644 index 000000000..ff9907262 --- /dev/null +++ b/assets/js/4302dc3e.43aa5265.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2309],{1939:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>p,frontMatter:()=>n,metadata:()=>a,toc:()=>l});var r=s(5893),o=s(1151);const n={title:"Azure Kubernetes Service",hide_title:!0,sidebar_position:3},i="Azure Kubernetes Service",a={id:"cado-response/discovery-import/import/azure/azure-aks",title:"Azure Kubernetes Service",description:"The Cado platform will collect key logs and forensic artifacts from Azure Kubernetes Service containers.",source:"@site/docs/cado-response/discovery-import/import/azure/azure-aks.md",sourceDirName:"cado-response/discovery-import/import/azure",slug:"/cado-response/discovery-import/import/azure/azure-aks",permalink:"/cado-response/discovery-import/import/azure/azure-aks",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/azure/azure-aks.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:3,frontMatter:{title:"Azure Kubernetes Service",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Azure Storage",permalink:"/cado-response/discovery-import/import/azure/azure-storage"},next:{title:"Google Compute Engine",permalink:"/cado-response/discovery-import/import/gcp/engine-instance"}},c={},l=[{value:"Import Steps",id:"import-steps",level:2},{value:"Private Cluster Support",id:"private-cluster-support",level:3}];function d(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,o.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"azure-kubernetes-service",children:"Azure Kubernetes Service"}),"\n",(0,r.jsx)(t.p,{children:"The Cado platform will collect key logs and forensic artifacts from Azure Kubernetes Service containers."}),"\n",(0,r.jsx)(t.admonition,{type:"info",children:(0,r.jsxs)(t.p,{children:["Due to the way the Cado platform interacts with Kubernetes, it is not possible to import containers built from a ",(0,r.jsx)(t.a,{href:"https://github.com/GoogleContainerTools/distroless#why-should-i-use-distroless-images",children:"distroless"})," image."]})}),"\n",(0,r.jsx)(t.h2,{id:"import-steps",children:"Import Steps"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["Go to ",(0,r.jsx)(t.strong,{children:"Import > Cloud"})]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Cado Import Screen showing the AKS options",src:s(263).Z+"",width:"842",height:"242"})}),"\n",(0,r.jsxs)(t.ol,{start:"2",children:["\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:["Choose the Azure Credenitals configured in ",(0,r.jsx)(t.a,{href:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions",children:"Azure > Cross Subscription and Tenancy"})]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsx)(t.p,{children:"Choose the resource group the AKS cluster is attached to."}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:["Go through the steps to choose your ",(0,r.jsx)(t.strong,{children:"Cluster"}),", ",(0,r.jsx)(t.strong,{children:"Pod"})," and ",(0,r.jsx)(t.strong,{children:"Container"}),":"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Cado Import Screen showing the available AKS Clusters",src:s(2693).Z+"",width:"1837",height:"497"})}),"\n",(0,r.jsxs)(t.ol,{start:"5",children:["\n",(0,r.jsxs)(t.li,{children:["Confirm the details and click ",(0,r.jsx)(t.strong,{children:"Start Import"})]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Cado will now automatically collect all the key logs and forensic artifacts from the container to enable an investigation.\nFor a typical acquisition, import and processing will take a few minutes to complete."}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Cado showing the confirmation screen of a successful AKS container capture",src:s(1574).Z+"",width:"1795",height:"698"})}),"\n",(0,r.jsxs)(t.admonition,{type:"info",children:[(0,r.jsx)(t.h3,{id:"private-cluster-support",children:"Private Cluster Support"}),(0,r.jsxs)(t.p,{children:["As of release v2.31.0, the Cado platform now supports capture of AKS Private Clusters. It should be noted that the Cado platform\nuses the ",(0,r.jsx)(t.a,{href:"https://learn.microsoft.com/en-us/azure/aks/command-invoke",children:"Azure Command Invoke APIs"})," to achieve this functionality."]}),(0,r.jsx)(t.p,{children:"There are two main caveats to this method:"}),(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsx)(t.li,{children:"The process is consideribly slower than capturing a Public Cluster"}),"\n",(0,r.jsx)(t.li,{children:"The Azure API will spin up a pod inside the cluster to execute Cado Host, make sure that there are enough nodes and resources in your cluster to schedule this command pod."}),"\n"]}),(0,r.jsx)(t.p,{children:"The newly created pod will shutdown and remove itself after 1 hour."})]})]})}function p(e={}){const{wrapper:t}={...(0,o.a)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},2693:(e,t,s)=>{s.d(t,{Z:()=>r});const r=s.p+"assets/images/aks-a8db98692b9b481c6fc41df7f42005c1.png"},1574:(e,t,s)=>{s.d(t,{Z:()=>r});const r=s.p+"assets/images/eks3-fc961c2189e29adc6a2571cacf950e28.png"},263:(e,t,s)=>{s.d(t,{Z:()=>r});const r=s.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},1151:(e,t,s)=>{s.d(t,{Z:()=>a,a:()=>i});var r=s(7294);const o={},n=r.createContext(o);function i(e){const t=r.useContext(n);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:i(e.components),r.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4302dc3e.5d85a5dd.js b/assets/js/4302dc3e.5d85a5dd.js deleted file mode 100644 index ef22f55da..000000000 --- a/assets/js/4302dc3e.5d85a5dd.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2309],{1939:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>p,frontMatter:()=>n,metadata:()=>a,toc:()=>l});var r=s(5893),o=s(1151);const n={title:"Azure Kubernetes Service",hide_title:!0,sidebar_position:3},i="Azure Kubernetes Service",a={id:"cado-response/discovery-import/import/azure/azure-aks",title:"Azure Kubernetes Service",description:"The Cado platform will collect key logs and forensic artifacts from Azure Kubernetes Service containers.",source:"@site/docs/cado-response/discovery-import/import/azure/azure-aks.md",sourceDirName:"cado-response/discovery-import/import/azure",slug:"/cado-response/discovery-import/import/azure/azure-aks",permalink:"/cado-response/discovery-import/import/azure/azure-aks",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/azure/azure-aks.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:3,frontMatter:{title:"Azure Kubernetes Service",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Azure Storage",permalink:"/cado-response/discovery-import/import/azure/azure-storage"},next:{title:"Google Compute Engine",permalink:"/cado-response/discovery-import/import/gcp/engine-instance"}},c={},l=[{value:"Import Steps",id:"import-steps",level:2},{value:"Private Cluster Support",id:"private-cluster-support",level:3}];function d(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,o.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"azure-kubernetes-service",children:"Azure Kubernetes Service"}),"\n",(0,r.jsx)(t.p,{children:"The Cado platform will collect key logs and forensic artifacts from Azure Kubernetes Service containers."}),"\n",(0,r.jsx)(t.admonition,{type:"info",children:(0,r.jsxs)(t.p,{children:["Due to the way the Cado platform interacts with Kubernetes, it is not possible to import containers built from a ",(0,r.jsx)(t.a,{href:"https://github.com/GoogleContainerTools/distroless#why-should-i-use-distroless-images",children:"distroless"})," image."]})}),"\n",(0,r.jsx)(t.h2,{id:"import-steps",children:"Import Steps"}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsxs)(t.li,{children:["Go to ",(0,r.jsx)(t.strong,{children:"Import > Cloud"})]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Cado Import Screen showing the AKS options",src:s(263).Z+"",width:"842",height:"242"})}),"\n",(0,r.jsxs)(t.ol,{start:"2",children:["\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:["Choose the Azure Credenitals configured in ",(0,r.jsx)(t.a,{href:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions",children:"Azure > Cross Subscription and Tenancy"})]}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsx)(t.p,{children:"Choose the resource group the AKS cluster is attached to."}),"\n"]}),"\n",(0,r.jsxs)(t.li,{children:["\n",(0,r.jsxs)(t.p,{children:["Go through the steps to choose your ",(0,r.jsx)(t.strong,{children:"Cluster"}),", ",(0,r.jsx)(t.strong,{children:"Pod"})," and ",(0,r.jsx)(t.strong,{children:"Container"}),":"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Cado Import Screen showing the available AKS Clusters",src:s(2693).Z+"",width:"1837",height:"497"})}),"\n",(0,r.jsxs)(t.ol,{start:"5",children:["\n",(0,r.jsxs)(t.li,{children:["Confirm the details and click ",(0,r.jsx)(t.strong,{children:"Start Import"})]}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Cado will now automatically collect all the key logs and forensic artifacts from the container to enable an investigation.\nFor a typical acquisition, import and processing will take a few minutes to complete."}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Cado showing the confirmation screen of a successful AKS container capture",src:s(1574).Z+"",width:"1795",height:"698"})}),"\n",(0,r.jsxs)(t.admonition,{type:"info",children:[(0,r.jsx)(t.h3,{id:"private-cluster-support",children:"Private Cluster Support"}),(0,r.jsxs)(t.p,{children:["As of release v2.31.0, the Cado platform now supports capture of AKS Private Clusters. It should be noted that the Cado platform\nuses the ",(0,r.jsx)(t.a,{href:"https://learn.microsoft.com/en-us/azure/aks/command-invoke",children:"Azure Command Invoke APIs"})," to achieve this functionality."]}),(0,r.jsx)(t.p,{children:"There are two main caveats to this method:"}),(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsx)(t.li,{children:"The process is consideribly slower than capturing a Public Cluster"}),"\n",(0,r.jsx)(t.li,{children:"The Azure API will spin up a pod inside the cluster to execute Cado Host, make sure that there are enough nodes and resources in your cluster to schedule this command pod."}),"\n"]}),(0,r.jsx)(t.p,{children:"The newly created pod will shutdown and remove itself after 1 hour."})]})]})}function p(e={}){const{wrapper:t}={...(0,o.a)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},2693:(e,t,s)=>{s.d(t,{Z:()=>r});const r=s.p+"assets/images/aks-a8db98692b9b481c6fc41df7f42005c1.png"},1574:(e,t,s)=>{s.d(t,{Z:()=>r});const r=s.p+"assets/images/eks3-fc961c2189e29adc6a2571cacf950e28.png"},263:(e,t,s)=>{s.d(t,{Z:()=>r});const r=s.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},1151:(e,t,s)=>{s.d(t,{Z:()=>a,a:()=>i});var r=s(7294);const o={},n=r.createContext(o);function i(e){const t=r.useContext(n);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:i(e.components),r.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/465ec75b.a2bacbe9.js b/assets/js/465ec75b.a2bacbe9.js new file mode 100644 index 000000000..a84927f28 --- /dev/null +++ b/assets/js/465ec75b.a2bacbe9.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4808],{1148:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>a,contentTitle:()=>n,default:()=>c,frontMatter:()=>r,metadata:()=>l,toc:()=>d});var i=s(5893),o=s(1151);const r={title:"File Types",hide_title:!0,sidebar_position:1},n="File Types",l={id:"cado-response/discovery-import/import/data-types/filetypes",title:"File Types",description:"The Cado platform supports the processing of a wide range of evidence types. These may differ slightly based on your cloud platform.",source:"@site/docs/cado-response/discovery-import/import/data-types/filetypes.md",sourceDirName:"cado-response/discovery-import/import/data-types",slug:"/cado-response/discovery-import/import/data-types/filetypes",permalink:"/cado-response/discovery-import/import/data-types/filetypes",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/data-types/filetypes.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"File Types",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Import from Cloud",permalink:"/cado-response/discovery-import/import/import-from-cloud"},next:{title:"Log Types",permalink:"/cado-response/discovery-import/import/data-types/logs"}},a={},d=[{value:"AWS Capture Formats",id:"aws-capture-formats",level:3},{value:"Azure Capture Formats",id:"azure-capture-formats",level:3},{value:"Storage Formats",id:"storage-formats",level:3},{value:"Storage Media",id:"storage-media",level:4},{value:"Volume Systems",id:"volume-systems",level:4},{value:"File Systems",id:"file-systems",level:4}];function p(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",h4:"h4",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",p:"p",strong:"strong",ul:"ul",...(0,o.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"file-types",children:"File Types"}),"\n",(0,i.jsx)(t.p,{children:"The Cado platform supports the processing of a wide range of evidence types. These may differ slightly based on your cloud platform."}),"\n",(0,i.jsx)(t.h3,{id:"aws-capture-formats",children:"AWS Capture Formats"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"EC2"}),"\n",(0,i.jsx)(t.li,{children:"S3 Storage (normal and glacier)"}),"\n",(0,i.jsx)(t.li,{children:"AWS Kubernetes"}),"\n",(0,i.jsx)(t.li,{children:"AWS Lambda"}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"azure-capture-formats",children:"Azure Capture Formats"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Virtual Machines"}),"\n",(0,i.jsx)(t.li,{children:"Disks"}),"\n",(0,i.jsx)(t.li,{children:"Storage Containers"}),"\n",(0,i.jsx)(t.li,{children:"Container Blobs"}),"\n",(0,i.jsx)(t.li,{children:"Kubernetes Disks"}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"storage-formats",children:"Storage Formats"}),"\n",(0,i.jsx)(t.p,{children:"In addition to native capture support for machines and data running/stored in the cloud, Cado also supports processing of the following local evidence formats."}),"\n",(0,i.jsx)(t.h4,{id:"storage-media",children:"Storage Media"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:".E01, and split E01"}),"\n",(0,i.jsx)(t.li,{children:".VHD and .VHDX"}),"\n",(0,i.jsx)(t.li,{children:".DD (Optionally .GZ Compressed)"}),"\n",(0,i.jsx)(t.li,{children:".GZ / .Tar / .Zip"}),"\n",(0,i.jsx)(t.li,{children:".VMDK (Partial Support*)"}),"\n",(0,i.jsxs)(t.li,{children:["Other forensic triage artifacts collected by EDR Tools or ",(0,i.jsx)(t.a,{href:"https://docs.cadosecurity.com/cado-host/intro",children:"Cado Host"})]}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["To import a compressed dd image, compress with Gzip and add .gz to the extension. (example: ",(0,i.jsx)(t.code,{children:"disk.dd.gz"}),")"]}),"\n",(0,i.jsxs)(t.admonition,{type:"info",children:[(0,i.jsx)(t.mdxAdmonitionTitle,{}),(0,i.jsx)(t.p,{children:"Currently, split E01 format disks are supported in AWS only.\n*VMDK's are partially supported as the file format contains many different sub-formats. If possible, we recommend converting to dd format before importing."})]}),"\n",(0,i.jsx)(t.admonition,{type:"info",children:(0,i.jsxs)(t.p,{children:["If you import a zip, it will be treated as a container of files ",(0,i.jsx)(t.strong,{children:"unless"})," it is a zip of a single file. Importing zipped split E01s is not supported."]})}),"\n",(0,i.jsx)(t.h4,{id:"volume-systems",children:"Volume Systems"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"GPT"}),"\n",(0,i.jsx)(t.li,{children:"LVM"}),"\n",(0,i.jsx)(t.li,{children:"MBR"}),"\n",(0,i.jsx)(t.li,{children:"Volume Shadow Snapshots (VSS)"}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"file-systems",children:"File Systems"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"ext version 2, 3, 4"}),"\n",(0,i.jsx)(t.li,{children:"FAT"}),"\n",(0,i.jsx)(t.li,{children:"NTFS version 3"}),"\n",(0,i.jsx)(t.li,{children:"XFS version 4, 5"}),"\n",(0,i.jsx)(t.li,{children:"Apple File System (APFS)"}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["Cado can also import a number of other disk image and file formats that are not listed here; however, these evidence types and file formats are not officially supported. If you have a filetype that you would like to see supported, please reach out to ",(0,i.jsx)(t.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," and let us know."]})]})}function c(e={}){const{wrapper:t}={...(0,o.a)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(p,{...e})}):p(e)}},1151:(e,t,s)=>{s.d(t,{Z:()=>l,a:()=>n});var i=s(7294);const o={},r=i.createContext(o);function n(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function l(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:n(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/465ec75b.a6aa542f.js b/assets/js/465ec75b.a6aa542f.js deleted file mode 100644 index 644c37b2a..000000000 --- a/assets/js/465ec75b.a6aa542f.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4808],{1148:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>a,contentTitle:()=>n,default:()=>c,frontMatter:()=>r,metadata:()=>l,toc:()=>d});var i=s(5893),o=s(1151);const r={title:"File Types",hide_title:!0,sidebar_position:1},n="File Types",l={id:"cado-response/discovery-import/import/data-types/filetypes",title:"File Types",description:"The Cado platform supports the processing of a wide range of evidence types. These may differ slightly based on your cloud platform.",source:"@site/docs/cado-response/discovery-import/import/data-types/filetypes.md",sourceDirName:"cado-response/discovery-import/import/data-types",slug:"/cado-response/discovery-import/import/data-types/filetypes",permalink:"/cado-response/discovery-import/import/data-types/filetypes",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/data-types/filetypes.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"File Types",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Import from Cloud",permalink:"/cado-response/discovery-import/import/import-from-cloud"},next:{title:"Log Types",permalink:"/cado-response/discovery-import/import/data-types/logs"}},a={},d=[{value:"AWS Capture Formats",id:"aws-capture-formats",level:3},{value:"Azure Capture Formats",id:"azure-capture-formats",level:3},{value:"Storage Formats",id:"storage-formats",level:3},{value:"Storage Media",id:"storage-media",level:4},{value:"Volume Systems",id:"volume-systems",level:4},{value:"File Systems",id:"file-systems",level:4}];function p(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",h4:"h4",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",p:"p",strong:"strong",ul:"ul",...(0,o.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"file-types",children:"File Types"}),"\n",(0,i.jsx)(t.p,{children:"The Cado platform supports the processing of a wide range of evidence types. These may differ slightly based on your cloud platform."}),"\n",(0,i.jsx)(t.h3,{id:"aws-capture-formats",children:"AWS Capture Formats"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"EC2"}),"\n",(0,i.jsx)(t.li,{children:"S3 Storage (normal and glacier)"}),"\n",(0,i.jsx)(t.li,{children:"AWS Kubernetes"}),"\n",(0,i.jsx)(t.li,{children:"AWS Lambda"}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"azure-capture-formats",children:"Azure Capture Formats"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Virtual Machines"}),"\n",(0,i.jsx)(t.li,{children:"Disks"}),"\n",(0,i.jsx)(t.li,{children:"Storage Containers"}),"\n",(0,i.jsx)(t.li,{children:"Container Blobs"}),"\n",(0,i.jsx)(t.li,{children:"Kubernetes Disks"}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"storage-formats",children:"Storage Formats"}),"\n",(0,i.jsx)(t.p,{children:"In addition to native capture support for machines and data running/stored in the cloud, Cado also supports processing of the following local evidence formats."}),"\n",(0,i.jsx)(t.h4,{id:"storage-media",children:"Storage Media"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:".E01, and split E01"}),"\n",(0,i.jsx)(t.li,{children:".VHD and .VHDX"}),"\n",(0,i.jsx)(t.li,{children:".DD (Optionally .GZ Compressed)"}),"\n",(0,i.jsx)(t.li,{children:".GZ / .Tar / .Zip"}),"\n",(0,i.jsx)(t.li,{children:".VMDK (Partial Support*)"}),"\n",(0,i.jsxs)(t.li,{children:["Other forensic triage artifacts collected by EDR Tools or ",(0,i.jsx)(t.a,{href:"https://docs.cadosecurity.com/cado-host/intro",children:"Cado Host"})]}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["To import a compressed dd image, compress with Gzip and add .gz to the extension. (example: ",(0,i.jsx)(t.code,{children:"disk.dd.gz"}),")"]}),"\n",(0,i.jsxs)(t.admonition,{type:"info",children:[(0,i.jsx)(t.mdxAdmonitionTitle,{}),(0,i.jsx)(t.p,{children:"Currently, split E01 format disks are supported in AWS only.\n*VMDK's are partially supported as the file format contains many different sub-formats. If possible, we recommend converting to dd format before importing."})]}),"\n",(0,i.jsx)(t.admonition,{type:"info",children:(0,i.jsxs)(t.p,{children:["If you import a zip, it will be treated as a container of files ",(0,i.jsx)(t.strong,{children:"unless"})," it is a zip of a single file. Importing zipped split E01s is not supported."]})}),"\n",(0,i.jsx)(t.h4,{id:"volume-systems",children:"Volume Systems"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"GPT"}),"\n",(0,i.jsx)(t.li,{children:"LVM"}),"\n",(0,i.jsx)(t.li,{children:"MBR"}),"\n",(0,i.jsx)(t.li,{children:"Volume Shadow Snapshots (VSS)"}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"file-systems",children:"File Systems"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"ext version 2, 3, 4"}),"\n",(0,i.jsx)(t.li,{children:"FAT"}),"\n",(0,i.jsx)(t.li,{children:"NTFS version 3"}),"\n",(0,i.jsx)(t.li,{children:"XFS version 4, 5"}),"\n",(0,i.jsx)(t.li,{children:"Apple File System (APFS)"}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["Cado can also import a number of other disk image and file formats that are not listed here; however, these evidence types and file formats are not officially supported. If you have a filetype that you would like to see supported, please reach out to ",(0,i.jsx)(t.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," and let us know."]})]})}function c(e={}){const{wrapper:t}={...(0,o.a)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(p,{...e})}):p(e)}},1151:(e,t,s)=>{s.d(t,{Z:()=>l,a:()=>n});var i=s(7294);const o={},r=i.createContext(o);function n(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function l(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:n(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4745e9e4.2b6c25f9.js b/assets/js/4745e9e4.2b6c25f9.js new file mode 100644 index 000000000..06c1491da --- /dev/null +++ b/assets/js/4745e9e4.2b6c25f9.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8935],{6347:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>a,contentTitle:()=>r,default:()=>o,frontMatter:()=>d,metadata:()=>c,toc:()=>h});var l=i(5893),s=i(1151);const d={title:"Release Notes",hide_title:!0,sidebar_position:1},r="Cado Release Notes",c={id:"release-notes/release-notes",title:"Release Notes",description:"Latest release notes",source:"@site/docs/release-notes/release-notes.md",sourceDirName:"release-notes",slug:"/release-notes/",permalink:"/release-notes/",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/release-notes/release-notes.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Release Notes",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Sep 23 2022 - AWS Role Update",permalink:"/support-bulletins/role-update"}},a={},h=[{value:"Latest release notes",id:"latest-release-notes",level:2},{value:"v.2.112.0",id:"v21120",level:2},{value:"v.2.111.0",id:"v21110",level:2},{value:"v.2.110.0",id:"v21100",level:2},{value:"v.2.109.0",id:"v21090",level:2},{value:"v.2.108.0",id:"v21080",level:2},{value:"v.2.107.0",id:"v21070",level:2},{value:"v.2.106.0",id:"v21060",level:2},{value:"v.2.105.0",id:"v21050",level:2},{value:"v.2.104.0",id:"v21040",level:2},{value:"v.2.103.0",id:"v21030",level:2},{value:"v.2.103.0",id:"v21030-1",level:2},{value:"v.2.102.0",id:"v21020",level:2},{value:"v.2.101.0",id:"v21010",level:2},{value:"v.2.100.0",id:"v21000",level:2},{value:"v.2.99.0",id:"v2990",level:2},{value:"v.2.98.0",id:"v2980",level:2},{value:"v.2.97.0",id:"v2970",level:2},{value:"v.2.96.0",id:"v2960",level:2},{value:"v.2.95.0",id:"v2950",level:2},{value:"v.2.94.0",id:"v2940",level:2},{value:"v.2.93.0",id:"v2930",level:2},{value:"v.2.92.0",id:"v2920",level:2},{value:"v.2.91.0",id:"v2910",level:2},{value:"v.2.90.0",id:"v2900",level:2},{value:"v.2.89.0",id:"v2890",level:2},{value:"v.2.88.0",id:"v2880",level:2},{value:"v.2.87.0",id:"v2870",level:2},{value:"v.2.86.0",id:"v2860",level:2},{value:"v.2.85.0",id:"v2850",level:2},{value:"v.2.84.0",id:"v2840",level:2},{value:"v.2.83.0",id:"v2830",level:2},{value:"v.2.82.0",id:"v2820",level:2},{value:"v.2.81.0",id:"v2810",level:2},{value:"v.2.80.0",id:"v2800",level:2},{value:"v.2.79.0",id:"v2790",level:2},{value:"v.2.78.0",id:"v2780",level:2},{value:"v.2.77.0",id:"v2770",level:2},{value:"v.2.76.0",id:"v2760",level:2},{value:"v.2.75.0",id:"v2750",level:2},{value:"v.2.74.0",id:"v2740",level:2},{value:"v.2.72.0",id:"v2720",level:2},{value:"v.2.71.0",id:"v2710",level:2},{value:"v.2.70.0",id:"v2700",level:2},{value:"v.2.68.0",id:"v2680",level:2},{value:"v.2.66.0",id:"v2660",level:2},{value:"v.2.65.0",id:"v2650",level:2},{value:"v.2.64.0",id:"v2640",level:2},{value:"v.2.63.0",id:"v2630",level:2},{value:"v.2.62.0",id:"v2620",level:2},{value:"v.2.61.0",id:"v2610",level:2},{value:"v.2.60.0",id:"v2600",level:2},{value:"v.2.59.0",id:"v2590",level:2},{value:"v.2.58.0",id:"v2580",level:2},{value:"v.2.57.0",id:"v2570",level:2},{value:"v.2.56.0",id:"v2560",level:2},{value:"v.2.55.0",id:"v2550",level:2},{value:"v.2.52.0",id:"v2520",level:2},{value:"v.2.51.0",id:"v2510",level:2},{value:"v.2.49.0",id:"v2490",level:2},{value:"v.2.47.0",id:"v2470",level:2},{value:"v.2.46.0",id:"v2460",level:2},{value:"v.2.45.0",id:"v2450",level:2},{value:"v.2.44.0",id:"v2440",level:2},{value:"v.2.43.0",id:"v2430",level:2},{value:"v.2.42.0",id:"v2420",level:2},{value:"v.2.41.0",id:"v2410",level:2},{value:"v.2.40.0",id:"v2400",level:2},{value:"v.2.39.0",id:"v2390",level:2},{value:"v.2.38.0",id:"v2380",level:2},{value:"v.2.37.0",id:"v2370",level:2},{value:"v.2.35.0",id:"v2350",level:2},{value:"v.2.34.0",id:"v2340",level:2},{value:"v.2.33.0",id:"v2330",level:2},{value:"v.2.32.0",id:"v2320",level:2},{value:"v.2.31.0",id:"v2310",level:2},{value:"v.2.29.0",id:"v2290",level:2},{value:"v.2.28.0",id:"v2280",level:2},{value:"v.2.26.0",id:"v2260",level:2},{value:"v.2.25.0",id:"v2250",level:2},{value:"v.2.24.0",id:"v2240",level:2},{value:"v.2.22.0",id:"v2220",level:2},{value:"v.2.21.0",id:"v2210",level:2},{value:"v.2.20.0",id:"v2200",level:2},{value:"v.2.19.0",id:"v2190",level:2},{value:"v.2.18.0",id:"v2180",level:2},{value:"v.2.17.0",id:"v2170",level:2},{value:"v.2.16.0",id:"v2160",level:2},{value:"v.2.15.0",id:"v2150",level:2},{value:"v.2.14.0",id:"v2140",level:2},{value:"v.2.12.0",id:"v2120",level:2},{value:"v.2.11.0",id:"v2110",level:2},{value:"v.2.9.0",id:"v290",level:2},{value:"v.2.8.0",id:"v280",level:2},{value:"v2.7.0",id:"v270",level:2},{value:"v.2.6.0",id:"v260",level:2},{value:"v.2.5.0",id:"v250",level:2},{value:"v.2.4.0",id:"v240",level:2},{value:"v.2.2.0",id:"v220",level:2},{value:"v.2.1.1",id:"v211",level:2},{value:"v2.1",id:"v21",level:2},{value:"v2.0.2",id:"v202",level:2},{value:"v2.0.1",id:"v201",level:2},{value:"v2.0.0",id:"v200",level:2},{value:"v1.6.5",id:"v165",level:2},{value:"v1.6.4",id:"v164",level:2},{value:"v1.6.3",id:"v163",level:2},{value:"v1.6.2",id:"v162",level:2},{value:"v1.6.1",id:"v161",level:2},{value:"v1.6.0",id:"v160",level:2},{value:"Older Release Notes",id:"older-release-notes",level:2}];function v(e){const n={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",li:"li",p:"p",ul:"ul",...(0,s.a)(),...e.components};return(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(n.h1,{id:"cado-release-notes",children:"Cado Release Notes"}),"\n",(0,l.jsx)(n.h2,{id:"latest-release-notes",children:"Latest release notes"}),"\n",(0,l.jsx)(n.h2,{id:"v21120",children:"v.2.112.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-24"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21110",children:"v.2.111.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-23"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21100",children:"v.2.110.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-22"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21090",children:"v.2.109.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-19"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21080",children:"v.2.108.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-17"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21070",children:"v.2.107.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-16"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"AI Investigator in beta"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21060",children:"v.2.106.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-16"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21050",children:"v.2.105.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-07"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Deprecate support for Intelix integration"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21040",children:"v.2.104.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21030",children:"v.2.103.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-23"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21030-1",children:"v.2.103.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-23"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21020",children:"v.2.102.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-22"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21010",children:"v.2.101.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-21"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21000",children:"v.2.100.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-20"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2990",children:"v.2.99.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-18"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2980",children:"v.2.98.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-14"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Limit on number of alarms and suspicions for a given project"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2970",children:"v.2.97.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-14"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Moved 'Saved Searches' capability from Experiments to Generally Available"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2960",children:"v.2.96.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-11"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2950",children:"v.2.95.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-08"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2940",children:"v.2.94.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-07"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsxs)(n.li,{children:["Option to convert EC2 imports from DD to E01 format (requires ",(0,l.jsx)(n.code,{children:"Settings - Preservation"})," to be set)"]}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2930",children:"v.2.93.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-01"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2920",children:"v.2.92.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-30"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2910",children:"v.2.91.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-29"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Scoping down of required KMS permissions for proper operation (required role change)"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2900",children:"v.2.90.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-23"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2890",children:"v.2.89.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-20"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2880",children:"v.2.88.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-17"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Increase default instance size to m5.4xlarge for new installs in AWS"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2870",children:"v.2.87.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-14"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2860",children:"v.2.86.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-13"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"New project overview page (beta)"}),"\n",(0,l.jsx)(n.li,{children:"CloudFormation Template for deployment with Private IP addresses"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2850",children:"v.2.85.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-09"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2840",children:"v.2.84.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-07"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2830",children:"v.2.83.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-07"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2820",children:"v.2.82.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-30"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2810",children:"v.2.81.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-25"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2800",children:"v.2.80.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-18"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2790",children:"v.2.79.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-16"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2780",children:"v.2.78.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-13"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Readiness testing in beta"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2770",children:"v.2.77.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-12"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"CrowdStrike integration in beta"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2760",children:"v.2.76.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-09"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2750",children:"v.2.75.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2740",children:"v.2.74.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-05"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Improvements to search within facet filters"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2720",children:"v.2.72.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-09-29"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Ability to sort items within facet filters"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2710",children:"v.2.71.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-09-27"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2700",children:"v.2.70.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-09-20"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Additional Health Checks leveraging Role Policy Simulation (NOTE: Role change required)"}),"\n",(0,l.jsx)(n.li,{children:"New, consistent import experience across evidence types"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2680",children:"v.2.68.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-09-11"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2660",children:"v.2.66.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-09-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Deprecated graph view and Overview tab"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2650",children:"v.2.65.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-31"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2640",children:"v.2.64.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-25"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Additional health checks"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2630",children:"v.2.63.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-21"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2620",children:"v.2.62.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-18"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2610",children:"v.2.61.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-07"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2600",children:"v.2.60.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-03"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2590",children:"v.2.59.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-02"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Improved ability to display deleted files during investigations"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2580",children:"v.2.58.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-01"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2570",children:"v.2.57.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-07-25"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2560",children:"v.2.56.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-07-20"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2550",children:"v.2.55.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-07-18"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Support acquiring GCP systems from Azure-based Cado platform"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2520",children:"v.2.52.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-06-27"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Ability to add groups of users to projects"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2510",children:"v.2.51.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-06-21"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"New tabular timeline view"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2490",children:"v.2.49.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-06-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Changes to the way Azure subscriptions and display names appear"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2470",children:"v.2.47.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-05-30"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2460",children:"v.2.46.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-05-15"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2450",children:"v.2.45.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-05-13"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2440",children:"v.2.44.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-05-05"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Ability to automatically upload logs to Cado as part of support process"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2430",children:"v.2.43.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-04-25"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Improvements in handling multiple GCP projects"}),"\n",(0,l.jsx)(n.li,{children:"Temporarily suspending support for PCAP processing due to unpatched vulnerability in Debian package"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2420",children:"v.2.42.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-04-20"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2410",children:"v.2.41.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-04-11"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"New UI and API for managing roles across multiple AWS Accounts"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n",(0,l.jsx)(n.li,{children:(0,l.jsx)(n.em,{children:"(NOTE: This is a required update release - upgrades to any subsquent releases must first upgrade to this release)"})}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2400",children:"v.2.40.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-04-03"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2390",children:"v.2.39.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-03-30"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2380",children:"v.2.38.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-03-28"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Support for High Availability deployment in AWS"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2370",children:"v.2.37.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-03-16"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Manage Azure resources from tenant root or management group levels"}),"\n",(0,l.jsx)(n.li,{children:"Improved Audit logs UI"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2350",children:"v.2.35.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-03-10"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsxs)(n.li,{children:['Improved support of KMS encrpyted volumes (NOTE: requires add "iam',":CreateServiceLinkedRole",'" role permission)']}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2340",children:"v.2.34.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-02-23"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Ability to set customer AWS EBS snapshot tag and prefix to monitor and automatically import"}),"\n",(0,l.jsx)(n.li,{children:"Improved import page"}),"\n",(0,l.jsx)(n.li,{children:"Improved tabluar view of timeline events (beta)"}),"\n",(0,l.jsx)(n.li,{children:"More detail around context of imported evidence"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2330",children:"v.2.33.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-02-17"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Legacy memory acquisition capability deprecated"}),"\n",(0,l.jsx)(n.li,{children:"Added project ID and evidence ID to audit log table"}),"\n",(0,l.jsxs)(n.li,{children:['Asset metadata available for all acquired EC2 instances (NOTE: requires additional "iam',":GetInstanceProfile",'" role permission)']}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2320",children:"v.2.32.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-02-09"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:'Support for acquiring AWS volumes encrypted using default key (NOTE: requires additional "ReplicateKey" role permission)'}),"\n",(0,l.jsx)(n.li,{children:"Bug fixed and perfomance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2310",children:"v.2.31.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-02-08"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2290",children:"v.2.29.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-02-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Additional file attributes in file browser view"}),"\n",(0,l.jsx)(n.li,{children:"Display more AWS tags/metadata for cloud native acquisitions"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2280",children:"v.2.28.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-02-03"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Improved import navigation for newly created projects"}),"\n",(0,l.jsx)(n.li,{children:"Improved search for MITRE ATT&ACK IDs"}),"\n",(0,l.jsx)(n.li,{children:"Improved reporting on MACB timestamps"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2260",children:"v.2.26.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-27"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:'New Audit Logs, visible under "Help"'}),"\n",(0,l.jsx)(n.li,{children:"New Date and Time selection for Search"}),"\n",(0,l.jsx)(n.li,{children:"Improved display of Cado Host and Container analysis"}),"\n",(0,l.jsx)(n.li,{children:"Matching content for file detections is now displayed"}),"\n",(0,l.jsx)(n.li,{children:"You can now set a custom Okta SAML Admin Group"}),"\n",(0,l.jsx)(n.li,{children:'Fixed issue where an expired login session can lead to "oops" error. If you can encounter this - Login in Incognito mode or Clear local storage, then Upgrade.'}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2250",children:"v.2.25.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-19"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Support for importing containers from GKE environment"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2240",children:"v.2.24.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-18"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Ability to identify potentially compromised roles that can be isolated as part of Auto-Investigation"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2220",children:"v.2.22.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-14"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Improved support for large uploads and memory collections from Cado Host"}),"\n",(0,l.jsxs)(n.li,{children:['Added support for ECR Based Lambda functions. Requires adding "ecr',":GetAuthorizationToken",'", "ecr',":GetDownloadURLForLayer",'", "ecr',":BatchGetImage",'" to the "RequiredForLambdaImport" section of the Cado role.']}),"\n",(0,l.jsx)(n.li,{children:"Faster processing of the MFT file on Windows systems"}),"\n",(0,l.jsx)(n.li,{children:"More detailed error reporting in the UI"}),"\n",(0,l.jsx)(n.li,{children:"Acquisition logs are now included in the log bundle"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2210",children:"v.2.21.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-04"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2200",children:"v.2.20.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-12-30"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2190",children:"v.2.19.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-12-23"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2180",children:"v.2.18.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-12-22"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2170",children:"v.2.17.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-12-20"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2160",children:"v.2.16.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-12-15"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsxs)(n.li,{children:["Support for automatically monitoring for AWS GuardDuty alerts - ",(0,l.jsx)(n.em,{children:"Settings - Advanced"})]}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2150",children:"v.2.15.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-12-12"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Significant front end performance improvement"}),"\n",(0,l.jsx)(n.li,{children:"Other bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2140",children:"v.2.14.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-11-30"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2120",children:"v.2.12.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-11-28"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2110",children:"v.2.11.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-11-21"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Support for acquiring and processing Azure activity logs"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v290",children:"v.2.9.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-11-14"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Increases the timeout when importing from Azure"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v280",children:"v.2.8.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-11-11"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Display MITRE ATT&CK categories on Auto-investigate tab."}),"\n",(0,l.jsx)(n.li,{children:"Add a button to cycle through the next and previous alarm events."}),"\n",(0,l.jsx)(n.li,{children:"Bug fix to processing systems that were upgraded from v1.x series. Generating Alarms attached to a system could cause processing to exit."}),"\n",(0,l.jsx)(n.li,{children:"Better stability when downloading large sets of logs."}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v270",children:"v2.7.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-11-04"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Native integration with XDR solutions"}),"\n",(0,l.jsxs)(n.li,{children:["Ability to view metadata about acquired AWS EC2 instances collected via ",(0,l.jsx)(n.em,{children:"Alternate Triage Acquisition"})]}),"\n",(0,l.jsxs)(n.li,{children:["Ability to take action against compromised AWS EC2 instances collected via ",(0,l.jsx)(n.em,{children:"Alternate Triage Acquistion"})]}),"\n",(0,l.jsx)(n.li,{children:"Cado host SSM improvements"}),"\n",(0,l.jsx)(n.li,{children:"Allow Cado Host to collect only specified files"}),"\n",(0,l.jsx)(n.li,{children:"Fix bug where successful authentication raises an error"}),"\n",(0,l.jsx)(n.li,{children:"Various other bug fixes and improvements"}),"\n",(0,l.jsx)(n.li,{children:(0,l.jsxs)(n.em,{children:["Note: In order to use ",(0,l.jsx)(n.code,{children:"Use Alternate Triage Acquisition"})," in EC2 acquisition or take actions against a compromised asset role update will be required"]})}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v260",children:"v.2.6.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-10-11"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Ability to re-run IoCs and Yara rules on existing evidence item"}),"\n",(0,l.jsx)(n.li,{children:"Better display of zipped e0X files"}),"\n",(0,l.jsx)(n.li,{children:"Fix bug where old/bad task defs could stop workers from starting"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v250",children:"v.2.5.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-10-07"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Ability to perform triage collection EC2 instances using Cado Host"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v240",children:"v.2.4.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-10-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Fixes to allow for AWS Role requirements changes"}),"\n",(0,l.jsx)(n.li,{children:"Cado Host now includes volatile data, presenting the collected process.json file as a graph of running processes"}),"\n",(0,l.jsx)(n.li,{children:"New icons and clearer presentation of the project and evidence graph"}),"\n",(0,l.jsx)(n.li,{children:"Improved auto-investigate algorithm, which better filters to only the most relevant events"}),"\n",(0,l.jsx)(n.li,{children:(0,l.jsx)(n.em,{children:"Note: This release requires an updated IAM role"})}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v220",children:"v.2.2.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-09-16"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Improvements to identify date and timestamp on events, reducing the number of events with unknown timestamp"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v211",children:"v.2.1.1"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-09-12"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Hotfix for single sign on"}),"\n",(0,l.jsxs)(n.li,{children:["Improved navigation and filtering for key events. Automated Investigation tab now shows 50 most relevant events. To recreate deprecated Key Events tab use search term ",(0,l.jsx)(n.code,{children:"alarm_severity: [1 TO 3]"})]}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21",children:"v2.1"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-09-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Multiple performance improvements and bugfixes"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v202",children:"v2.0.2"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-08-16"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Hotfix for processing and deletion speed improvements and bugfix."}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v201",children:"v2.0.1"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-08-09"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Speed and worker management improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v200",children:"v2.0.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-08-09"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Cross cloud-data import and analysis"}),"\n",(0,l.jsx)(n.li,{children:"Collecting data from Google Cloud environments"}),"\n",(0,l.jsx)(n.li,{children:"Interconnected event analysis"}),"\n",(0,l.jsx)(n.li,{children:"Data performance and footprint improvements"}),"\n",(0,l.jsx)(n.li,{children:"Cloud asset landscape"}),"\n",(0,l.jsx)(n.li,{children:"New storage architecture"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v165",children:"v1.6.5"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-07-28"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes to Cado Host"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v164",children:"v1.6.4"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-07-26"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fix in Cado Host which could error out on some files."}),"\n",(0,l.jsx)(n.li,{children:"Additional notifications on Okta misconfigurations."}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v163",children:"v1.6.3"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-07-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Faster processing engine, backported from an upcoming 2.0 release."}),"\n",(0,l.jsxs)(n.li,{children:["When uploading memory, Cado Response will now attempt to grant the kms",":Decrypt"," for certain S3 configurations."]}),"\n",(0,l.jsx)(n.li,{children:"Fix to large log exports."}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v162",children:"v1.6.2"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-06-30"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsxs)(n.li,{children:["When acquiring memory, Cado Response will now attempt to grant the kms",":GenerateDataKey"," permission to enable saving memory to more KMS encrypted S3 configurations."]}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v161",children:"v1.6.1"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-06-28"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Speed and stability improvements to importing large AWS Disks"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v160",children:"v1.6.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-06-28"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Pre-Release of GCP Imports"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"older-release-notes",children:"Older Release Notes"}),"\n",(0,l.jsxs)(n.p,{children:["Please contact ",(0,l.jsx)(n.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," for a copy of release notes prior to v1.6.0."]})]})}function o(e={}){const{wrapper:n}={...(0,s.a)(),...e.components};return n?(0,l.jsx)(n,{...e,children:(0,l.jsx)(v,{...e})}):v(e)}},1151:(e,n,i)=>{i.d(n,{Z:()=>c,a:()=>r});var l=i(7294);const s={},d=l.createContext(s);function r(e){const n=l.useContext(d);return l.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),l.createElement(d.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4745e9e4.7d1d5bdc.js b/assets/js/4745e9e4.7d1d5bdc.js deleted file mode 100644 index 94e580e06..000000000 --- a/assets/js/4745e9e4.7d1d5bdc.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8935],{6347:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>a,contentTitle:()=>r,default:()=>o,frontMatter:()=>d,metadata:()=>c,toc:()=>h});var l=i(5893),s=i(1151);const d={title:"Release Notes",hide_title:!0,sidebar_position:1},r="Cado Release Notes",c={id:"release-notes/release-notes",title:"Release Notes",description:"Latest release notes",source:"@site/docs/release-notes/release-notes.md",sourceDirName:"release-notes",slug:"/release-notes/",permalink:"/release-notes/",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/release-notes/release-notes.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Release Notes",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Sep 23 2022 - AWS Role Update",permalink:"/support-bulletins/role-update"}},a={},h=[{value:"Latest release notes",id:"latest-release-notes",level:2},{value:"v.2.112.0",id:"v21120",level:2},{value:"v.2.111.0",id:"v21110",level:2},{value:"v.2.110.0",id:"v21100",level:2},{value:"v.2.109.0",id:"v21090",level:2},{value:"v.2.108.0",id:"v21080",level:2},{value:"v.2.107.0",id:"v21070",level:2},{value:"v.2.106.0",id:"v21060",level:2},{value:"v.2.105.0",id:"v21050",level:2},{value:"v.2.104.0",id:"v21040",level:2},{value:"v.2.103.0",id:"v21030",level:2},{value:"v.2.103.0",id:"v21030-1",level:2},{value:"v.2.102.0",id:"v21020",level:2},{value:"v.2.101.0",id:"v21010",level:2},{value:"v.2.100.0",id:"v21000",level:2},{value:"v.2.99.0",id:"v2990",level:2},{value:"v.2.98.0",id:"v2980",level:2},{value:"v.2.97.0",id:"v2970",level:2},{value:"v.2.96.0",id:"v2960",level:2},{value:"v.2.95.0",id:"v2950",level:2},{value:"v.2.94.0",id:"v2940",level:2},{value:"v.2.93.0",id:"v2930",level:2},{value:"v.2.92.0",id:"v2920",level:2},{value:"v.2.91.0",id:"v2910",level:2},{value:"v.2.90.0",id:"v2900",level:2},{value:"v.2.89.0",id:"v2890",level:2},{value:"v.2.88.0",id:"v2880",level:2},{value:"v.2.87.0",id:"v2870",level:2},{value:"v.2.86.0",id:"v2860",level:2},{value:"v.2.85.0",id:"v2850",level:2},{value:"v.2.84.0",id:"v2840",level:2},{value:"v.2.83.0",id:"v2830",level:2},{value:"v.2.82.0",id:"v2820",level:2},{value:"v.2.81.0",id:"v2810",level:2},{value:"v.2.80.0",id:"v2800",level:2},{value:"v.2.79.0",id:"v2790",level:2},{value:"v.2.78.0",id:"v2780",level:2},{value:"v.2.77.0",id:"v2770",level:2},{value:"v.2.76.0",id:"v2760",level:2},{value:"v.2.75.0",id:"v2750",level:2},{value:"v.2.74.0",id:"v2740",level:2},{value:"v.2.72.0",id:"v2720",level:2},{value:"v.2.71.0",id:"v2710",level:2},{value:"v.2.70.0",id:"v2700",level:2},{value:"v.2.68.0",id:"v2680",level:2},{value:"v.2.66.0",id:"v2660",level:2},{value:"v.2.65.0",id:"v2650",level:2},{value:"v.2.64.0",id:"v2640",level:2},{value:"v.2.63.0",id:"v2630",level:2},{value:"v.2.62.0",id:"v2620",level:2},{value:"v.2.61.0",id:"v2610",level:2},{value:"v.2.60.0",id:"v2600",level:2},{value:"v.2.59.0",id:"v2590",level:2},{value:"v.2.58.0",id:"v2580",level:2},{value:"v.2.57.0",id:"v2570",level:2},{value:"v.2.56.0",id:"v2560",level:2},{value:"v.2.55.0",id:"v2550",level:2},{value:"v.2.52.0",id:"v2520",level:2},{value:"v.2.51.0",id:"v2510",level:2},{value:"v.2.49.0",id:"v2490",level:2},{value:"v.2.47.0",id:"v2470",level:2},{value:"v.2.46.0",id:"v2460",level:2},{value:"v.2.45.0",id:"v2450",level:2},{value:"v.2.44.0",id:"v2440",level:2},{value:"v.2.43.0",id:"v2430",level:2},{value:"v.2.42.0",id:"v2420",level:2},{value:"v.2.41.0",id:"v2410",level:2},{value:"v.2.40.0",id:"v2400",level:2},{value:"v.2.39.0",id:"v2390",level:2},{value:"v.2.38.0",id:"v2380",level:2},{value:"v.2.37.0",id:"v2370",level:2},{value:"v.2.35.0",id:"v2350",level:2},{value:"v.2.34.0",id:"v2340",level:2},{value:"v.2.33.0",id:"v2330",level:2},{value:"v.2.32.0",id:"v2320",level:2},{value:"v.2.31.0",id:"v2310",level:2},{value:"v.2.29.0",id:"v2290",level:2},{value:"v.2.28.0",id:"v2280",level:2},{value:"v.2.26.0",id:"v2260",level:2},{value:"v.2.25.0",id:"v2250",level:2},{value:"v.2.24.0",id:"v2240",level:2},{value:"v.2.22.0",id:"v2220",level:2},{value:"v.2.21.0",id:"v2210",level:2},{value:"v.2.20.0",id:"v2200",level:2},{value:"v.2.19.0",id:"v2190",level:2},{value:"v.2.18.0",id:"v2180",level:2},{value:"v.2.17.0",id:"v2170",level:2},{value:"v.2.16.0",id:"v2160",level:2},{value:"v.2.15.0",id:"v2150",level:2},{value:"v.2.14.0",id:"v2140",level:2},{value:"v.2.12.0",id:"v2120",level:2},{value:"v.2.11.0",id:"v2110",level:2},{value:"v.2.9.0",id:"v290",level:2},{value:"v.2.8.0",id:"v280",level:2},{value:"v2.7.0",id:"v270",level:2},{value:"v.2.6.0",id:"v260",level:2},{value:"v.2.5.0",id:"v250",level:2},{value:"v.2.4.0",id:"v240",level:2},{value:"v.2.2.0",id:"v220",level:2},{value:"v.2.1.1",id:"v211",level:2},{value:"v2.1",id:"v21",level:2},{value:"v2.0.2",id:"v202",level:2},{value:"v2.0.1",id:"v201",level:2},{value:"v2.0.0",id:"v200",level:2},{value:"v1.6.5",id:"v165",level:2},{value:"v1.6.4",id:"v164",level:2},{value:"v1.6.3",id:"v163",level:2},{value:"v1.6.2",id:"v162",level:2},{value:"v1.6.1",id:"v161",level:2},{value:"v1.6.0",id:"v160",level:2},{value:"Older Release Notes",id:"older-release-notes",level:2}];function v(e){const n={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",li:"li",p:"p",ul:"ul",...(0,s.a)(),...e.components};return(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(n.h1,{id:"cado-release-notes",children:"Cado Release Notes"}),"\n",(0,l.jsx)(n.h2,{id:"latest-release-notes",children:"Latest release notes"}),"\n",(0,l.jsx)(n.h2,{id:"v21120",children:"v.2.112.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-24"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21110",children:"v.2.111.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-23"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21100",children:"v.2.110.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-22"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21090",children:"v.2.109.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-19"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21080",children:"v.2.108.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-17"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21070",children:"v.2.107.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-16"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"AI Investigator in beta"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21060",children:"v.2.106.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-16"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21050",children:"v.2.105.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-07"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Deprecate support for Intelix integration"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21040",children:"v.2.104.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21030",children:"v.2.103.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-23"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21030-1",children:"v.2.103.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-23"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21020",children:"v.2.102.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-22"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21010",children:"v.2.101.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-21"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21000",children:"v.2.100.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-20"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2990",children:"v.2.99.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-18"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2980",children:"v.2.98.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-14"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Limit on number of alarms and suspicions for a given project"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2970",children:"v.2.97.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-14"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Moved 'Saved Searches' capability from Experiments to Generally Available"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2960",children:"v.2.96.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-11"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2950",children:"v.2.95.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-08"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2940",children:"v.2.94.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-07"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsxs)(n.li,{children:["Option to convert EC2 imports from DD to E01 format (requires ",(0,l.jsx)(n.code,{children:"Settings - Preservation"})," to be set)"]}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2930",children:"v.2.93.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-12-01"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2920",children:"v.2.92.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-30"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2910",children:"v.2.91.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-29"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Scoping down of required KMS permissions for proper operation (required role change)"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2900",children:"v.2.90.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-23"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2890",children:"v.2.89.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-20"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2880",children:"v.2.88.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-17"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Increase default instance size to m5.4xlarge for new installs in AWS"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2870",children:"v.2.87.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-14"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2860",children:"v.2.86.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-13"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"New project overview page (beta)"}),"\n",(0,l.jsx)(n.li,{children:"CloudFormation Template for deployment with Private IP addresses"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2850",children:"v.2.85.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-09"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2840",children:"v.2.84.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-11-07"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2830",children:"v.2.83.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-07"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2820",children:"v.2.82.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-30"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2810",children:"v.2.81.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-25"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2800",children:"v.2.80.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-18"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2790",children:"v.2.79.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-16"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2780",children:"v.2.78.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-13"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Readiness testing in beta"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2770",children:"v.2.77.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-12"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"CrowdStrike integration in beta"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2760",children:"v.2.76.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-09"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2750",children:"v.2.75.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2740",children:"v.2.74.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-10-05"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Improvements to search within facet filters"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2720",children:"v.2.72.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-09-29"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Ability to sort items within facet filters"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2710",children:"v.2.71.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-09-27"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2700",children:"v.2.70.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-09-20"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Additional Health Checks leveraging Role Policy Simulation (NOTE: Role change required)"}),"\n",(0,l.jsx)(n.li,{children:"New, consistent import experience across evidence types"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2680",children:"v.2.68.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-09-11"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2660",children:"v.2.66.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-09-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Deprecated graph view and Overview tab"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2650",children:"v.2.65.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-31"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2640",children:"v.2.64.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-25"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Additional health checks"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2630",children:"v.2.63.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-21"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2620",children:"v.2.62.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-18"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2610",children:"v.2.61.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-07"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2600",children:"v.2.60.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-03"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2590",children:"v.2.59.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-02"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Improved ability to display deleted files during investigations"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2580",children:"v.2.58.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-08-01"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2570",children:"v.2.57.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-07-25"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2560",children:"v.2.56.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-07-20"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2550",children:"v.2.55.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-07-18"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Support acquiring GCP systems from Azure-based Cado platform"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2520",children:"v.2.52.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-06-27"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Ability to add groups of users to projects"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2510",children:"v.2.51.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-06-21"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"New tabular timeline view"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2490",children:"v.2.49.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-06-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Changes to the way Azure subscriptions and display names appear"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2470",children:"v.2.47.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-05-30"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2460",children:"v.2.46.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-05-15"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2450",children:"v.2.45.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-05-13"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2440",children:"v.2.44.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-05-05"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Ability to automatically upload logs to Cado as part of support process"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2430",children:"v.2.43.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-04-25"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Improvements in handling multiple GCP projects"}),"\n",(0,l.jsx)(n.li,{children:"Temporarily suspending support for PCAP processing due to unpatched vulnerability in Debian package"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2420",children:"v.2.42.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-04-20"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2410",children:"v.2.41.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-04-11"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"New UI and API for managing roles across multiple AWS Accounts"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n",(0,l.jsx)(n.li,{children:(0,l.jsx)(n.em,{children:"(NOTE: This is a required update release - upgrades to any subsquent releases must first upgrade to this release)"})}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2400",children:"v.2.40.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-04-03"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2390",children:"v.2.39.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-03-30"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2380",children:"v.2.38.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-03-28"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Support for High Availability deployment in AWS"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2370",children:"v.2.37.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-03-16"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Manage Azure resources from tenant root or management group levels"}),"\n",(0,l.jsx)(n.li,{children:"Improved Audit logs UI"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2350",children:"v.2.35.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-03-10"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsxs)(n.li,{children:['Improved support of KMS encrpyted volumes (NOTE: requires add "iam',":CreateServiceLinkedRole",'" role permission)']}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2340",children:"v.2.34.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-02-23"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Ability to set customer AWS EBS snapshot tag and prefix to monitor and automatically import"}),"\n",(0,l.jsx)(n.li,{children:"Improved import page"}),"\n",(0,l.jsx)(n.li,{children:"Improved tabluar view of timeline events (beta)"}),"\n",(0,l.jsx)(n.li,{children:"More detail around context of imported evidence"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2330",children:"v.2.33.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-02-17"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Legacy memory acquisition capability deprecated"}),"\n",(0,l.jsx)(n.li,{children:"Added project ID and evidence ID to audit log table"}),"\n",(0,l.jsxs)(n.li,{children:['Asset metadata available for all acquired EC2 instances (NOTE: requires additional "iam',":GetInstanceProfile",'" role permission)']}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2320",children:"v.2.32.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-02-09"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:'Support for acquiring AWS volumes encrypted using default key (NOTE: requires additional "ReplicateKey" role permission)'}),"\n",(0,l.jsx)(n.li,{children:"Bug fixed and perfomance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2310",children:"v.2.31.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-02-08"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2290",children:"v.2.29.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-02-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Additional file attributes in file browser view"}),"\n",(0,l.jsx)(n.li,{children:"Display more AWS tags/metadata for cloud native acquisitions"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2280",children:"v.2.28.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-02-03"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Improved import navigation for newly created projects"}),"\n",(0,l.jsx)(n.li,{children:"Improved search for MITRE ATT&ACK IDs"}),"\n",(0,l.jsx)(n.li,{children:"Improved reporting on MACB timestamps"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2260",children:"v.2.26.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-27"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:'New Audit Logs, visible under "Help"'}),"\n",(0,l.jsx)(n.li,{children:"New Date and Time selection for Search"}),"\n",(0,l.jsx)(n.li,{children:"Improved display of Cado Host and Container analysis"}),"\n",(0,l.jsx)(n.li,{children:"Matching content for file detections is now displayed"}),"\n",(0,l.jsx)(n.li,{children:"You can now set a custom Okta SAML Admin Group"}),"\n",(0,l.jsx)(n.li,{children:'Fixed issue where an expired login session can lead to "oops" error. If you can encounter this - Login in Incognito mode or Clear local storage, then Upgrade.'}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2250",children:"v.2.25.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-19"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Support for importing containers from GKE environment"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2240",children:"v.2.24.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-18"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Ability to identify potentially compromised roles that can be isolated as part of Auto-Investigation"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2220",children:"v.2.22.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-14"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Improved support for large uploads and memory collections from Cado Host"}),"\n",(0,l.jsxs)(n.li,{children:['Added support for ECR Based Lambda functions. Requires adding "ecr',":GetAuthorizationToken",'", "ecr',":GetDownloadURLForLayer",'", "ecr',":BatchGetImage",'" to the "RequiredForLambdaImport" section of the Cado role.']}),"\n",(0,l.jsx)(n.li,{children:"Faster processing of the MFT file on Windows systems"}),"\n",(0,l.jsx)(n.li,{children:"More detailed error reporting in the UI"}),"\n",(0,l.jsx)(n.li,{children:"Acquisition logs are now included in the log bundle"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2210",children:"v.2.21.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2023-01-04"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2200",children:"v.2.20.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-12-30"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2190",children:"v.2.19.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-12-23"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2180",children:"v.2.18.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-12-22"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2170",children:"v.2.17.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-12-20"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2160",children:"v.2.16.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-12-15"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsxs)(n.li,{children:["Support for automatically monitoring for AWS GuardDuty alerts - ",(0,l.jsx)(n.em,{children:"Settings - Advanced"})]}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2150",children:"v.2.15.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-12-12"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Significant front end performance improvement"}),"\n",(0,l.jsx)(n.li,{children:"Other bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2140",children:"v.2.14.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-11-30"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2120",children:"v.2.12.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-11-28"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v2110",children:"v.2.11.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-11-21"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Support for acquiring and processing Azure activity logs"}),"\n",(0,l.jsx)(n.li,{children:"Bug fixes and performance improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v290",children:"v.2.9.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-11-14"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Increases the timeout when importing from Azure"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v280",children:"v.2.8.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-11-11"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Display MITRE ATT&CK categories on Auto-investigate tab."}),"\n",(0,l.jsx)(n.li,{children:"Add a button to cycle through the next and previous alarm events."}),"\n",(0,l.jsx)(n.li,{children:"Bug fix to processing systems that were upgraded from v1.x series. Generating Alarms attached to a system could cause processing to exit."}),"\n",(0,l.jsx)(n.li,{children:"Better stability when downloading large sets of logs."}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v270",children:"v2.7.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-11-04"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Native integration with XDR solutions"}),"\n",(0,l.jsxs)(n.li,{children:["Ability to view metadata about acquired AWS EC2 instances collected via ",(0,l.jsx)(n.em,{children:"Alternate Triage Acquisition"})]}),"\n",(0,l.jsxs)(n.li,{children:["Ability to take action against compromised AWS EC2 instances collected via ",(0,l.jsx)(n.em,{children:"Alternate Triage Acquistion"})]}),"\n",(0,l.jsx)(n.li,{children:"Cado host SSM improvements"}),"\n",(0,l.jsx)(n.li,{children:"Allow Cado Host to collect only specified files"}),"\n",(0,l.jsx)(n.li,{children:"Fix bug where successful authentication raises an error"}),"\n",(0,l.jsx)(n.li,{children:"Various other bug fixes and improvements"}),"\n",(0,l.jsx)(n.li,{children:(0,l.jsxs)(n.em,{children:["Note: In order to use ",(0,l.jsx)(n.code,{children:"Use Alternate Triage Acquisition"})," in EC2 acquisition or take actions against a compromised asset role update will be required"]})}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v260",children:"v.2.6.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-10-11"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Ability to re-run IoCs and Yara rules on existing evidence item"}),"\n",(0,l.jsx)(n.li,{children:"Better display of zipped e0X files"}),"\n",(0,l.jsx)(n.li,{children:"Fix bug where old/bad task defs could stop workers from starting"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v250",children:"v.2.5.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-10-07"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Ability to perform triage collection EC2 instances using Cado Host"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v240",children:"v.2.4.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-10-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Fixes to allow for AWS Role requirements changes"}),"\n",(0,l.jsx)(n.li,{children:"Cado Host now includes volatile data, presenting the collected process.json file as a graph of running processes"}),"\n",(0,l.jsx)(n.li,{children:"New icons and clearer presentation of the project and evidence graph"}),"\n",(0,l.jsx)(n.li,{children:"Improved auto-investigate algorithm, which better filters to only the most relevant events"}),"\n",(0,l.jsx)(n.li,{children:(0,l.jsx)(n.em,{children:"Note: This release requires an updated IAM role"})}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v220",children:"v.2.2.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-09-16"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Improvements to identify date and timestamp on events, reducing the number of events with unknown timestamp"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v211",children:"v.2.1.1"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-09-12"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Hotfix for single sign on"}),"\n",(0,l.jsxs)(n.li,{children:["Improved navigation and filtering for key events. Automated Investigation tab now shows 50 most relevant events. To recreate deprecated Key Events tab use search term ",(0,l.jsx)(n.code,{children:"alarm_severity: [1 TO 3]"})]}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v21",children:"v2.1"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released 2022-09-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Multiple performance improvements and bugfixes"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v202",children:"v2.0.2"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-08-16"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Hotfix for processing and deletion speed improvements and bugfix."}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v201",children:"v2.0.1"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-08-09"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Speed and worker management improvements"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v200",children:"v2.0.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-08-09"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Cross cloud-data import and analysis"}),"\n",(0,l.jsx)(n.li,{children:"Collecting data from Google Cloud environments"}),"\n",(0,l.jsx)(n.li,{children:"Interconnected event analysis"}),"\n",(0,l.jsx)(n.li,{children:"Data performance and footprint improvements"}),"\n",(0,l.jsx)(n.li,{children:"Cloud asset landscape"}),"\n",(0,l.jsx)(n.li,{children:"New storage architecture"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v165",children:"v1.6.5"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-07-28"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fixes to Cado Host"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v164",children:"v1.6.4"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-07-26"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Bug fix in Cado Host which could error out on some files."}),"\n",(0,l.jsx)(n.li,{children:"Additional notifications on Okta misconfigurations."}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v163",children:"v1.6.3"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-07-06"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Faster processing engine, backported from an upcoming 2.0 release."}),"\n",(0,l.jsxs)(n.li,{children:["When uploading memory, Cado Response will now attempt to grant the kms",":Decrypt"," for certain S3 configurations."]}),"\n",(0,l.jsx)(n.li,{children:"Fix to large log exports."}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v162",children:"v1.6.2"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-06-30"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsxs)(n.li,{children:["When acquiring memory, Cado Response will now attempt to grant the kms",":GenerateDataKey"," permission to enable saving memory to more KMS encrypted S3 configurations."]}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v161",children:"v1.6.1"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-06-28"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Speed and stability improvements to importing large AWS Disks"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"v160",children:"v1.6.0"}),"\n",(0,l.jsx)(n.p,{children:(0,l.jsx)(n.code,{children:"Released: 2022-06-28"})}),"\n",(0,l.jsxs)(n.ul,{children:["\n",(0,l.jsx)(n.li,{children:"Pre-Release of GCP Imports"}),"\n"]}),"\n",(0,l.jsx)(n.h2,{id:"older-release-notes",children:"Older Release Notes"}),"\n",(0,l.jsxs)(n.p,{children:["Please contact ",(0,l.jsx)(n.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," for a copy of release notes prior to v1.6.0."]})]})}function o(e={}){const{wrapper:n}={...(0,s.a)(),...e.components};return n?(0,l.jsx)(n,{...e,children:(0,l.jsx)(v,{...e})}):v(e)}},1151:(e,n,i)=>{i.d(n,{Z:()=>c,a:()=>r});var l=i(7294);const s={},d=l.createContext(s);function r(e){const n=l.useContext(d);return l.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),l.createElement(d.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/49bed03d.1b4018c5.js b/assets/js/49bed03d.1b4018c5.js deleted file mode 100644 index 45ffef2ba..000000000 --- a/assets/js/49bed03d.1b4018c5.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1432],{140:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>d,contentTitle:()=>r,default:()=>h,frontMatter:()=>a,metadata:()=>s,toc:()=>c});var i=t(5893),o=t(1151);const a={title:"SentinelOne",hide_title:!0,sidebar_position:3},r="SentinelOne Integration",s={id:"cado-response/manage/integrations/xdr/sentinelone",title:"SentinelOne",description:"SentinelOne Singularity provides comprehensive visibility across your environment - giving you the breadth you need to detect malicious activity as soon as it occurs. Cado streamlines forensic analysis to quickly deliver essential historical context and depth to your investigation allowing you to quickly identify the root cause. Combined, the SentinelOne and Cado integration empowers organizations to detect, investigate, and remediate breaches with unmatched speed.",source:"@site/docs/cado-response/manage/integrations/xdr/sentinelone.md",sourceDirName:"cado-response/manage/integrations/xdr",slug:"/cado-response/manage/integrations/xdr/sentinelone",permalink:"/cado-response/manage/integrations/xdr/sentinelone",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/xdr/sentinelone.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:3,frontMatter:{title:"SentinelOne",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"SophosLabs Intelix",permalink:"/cado-response/manage/integrations/sandbox/intelix"},next:{title:"CrowdStrike",permalink:"/cado-response/manage/integrations/xdr/crowdstrike"}},d={},c=[{value:"Leveraging Cado & SentinelOne Integration",id:"leveraging-cado--sentinelone-integration",level:2}];function l(e){const n={a:"a",admonition:"admonition",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,o.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"sentinelone-integration",children:"SentinelOne Integration"}),"\n",(0,i.jsx)(n.p,{children:"SentinelOne Singularity provides comprehensive visibility across your environment - giving you the breadth you need to detect malicious activity as soon as it occurs. Cado streamlines forensic analysis to quickly deliver essential historical context and depth to your investigation allowing you to quickly identify the root cause. Combined, the SentinelOne and Cado integration empowers organizations to detect, investigate, and remediate breaches with unmatched speed."}),"\n",(0,i.jsx)(n.admonition,{type:"tip",children:(0,i.jsxs)(n.p,{children:["To leverage the integration between SentinelOne and Cado, you must have the SentinelOne Remote Script Orchestration feature (RSO) enabled in addition to access to the Cado platform. To get access to the Cado platform contact the Cado Security team ",(0,i.jsx)(n.strong,{children:(0,i.jsx)(n.a,{href:"http://offers.cadosecurity.com/cado-s1-integration-get-in-touch",children:"here"})}),"."]})}),"\n",(0,i.jsx)(n.h2,{id:"leveraging-cado--sentinelone-integration",children:"Leveraging Cado & SentinelOne Integration"}),"\n",(0,i.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/iIJjp28G6sk",title:"Integrating SentinelOne with Cado Response",frameborder:"0",allowfullscreen:!0}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["In the SentinelOne console, navigate to ",(0,i.jsx)(n.strong,{children:"Settings - Users - Service Users - Actions - Create New Service User"})]}),"\n",(0,i.jsx)(n.li,{children:"Specify a name, expiration period, and specify the scope for which you want to enable integration"}),"\n",(0,i.jsx)(n.li,{children:"Copy or download the API Token"}),"\n",(0,i.jsxs)(n.li,{children:["In the Cado platform, navigate to ",(0,i.jsx)(n.strong,{children:"Settings - Integrations - XDR"})]}),"\n",(0,i.jsx)(n.li,{children:"Specify the URL of the SentinelOne server and paste in the API key"}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"SentinelOne Integration",src:t(9878).Z+"",width:"728",height:"542"})}),"\n",(0,i.jsxs)(n.p,{children:["You can now import data into Cado using the ",(0,i.jsx)(n.a,{href:"/cado-response/discovery-import/import/intro#importing-from-xdr",children:"Import from XDR capability"})]})]})}function h(e={}){const{wrapper:n}={...(0,o.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},9878:(e,n,t)=>{t.d(n,{Z:()=>i});const i=t.p+"assets/images/s1-integration-ac7f6f693fa1a9bef6503859ddf49c48.png"},1151:(e,n,t)=>{t.d(n,{Z:()=>s,a:()=>r});var i=t(7294);const o={},a=i.createContext(o);function r(e){const n=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function s(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),i.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/49bed03d.d2be90b5.js b/assets/js/49bed03d.d2be90b5.js new file mode 100644 index 000000000..5c3645329 --- /dev/null +++ b/assets/js/49bed03d.d2be90b5.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1432],{140:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>d,contentTitle:()=>r,default:()=>h,frontMatter:()=>a,metadata:()=>s,toc:()=>c});var i=t(5893),o=t(1151);const a={title:"SentinelOne",hide_title:!0,sidebar_position:3},r="SentinelOne Integration",s={id:"cado-response/manage/integrations/xdr/sentinelone",title:"SentinelOne",description:"SentinelOne Singularity provides comprehensive visibility across your environment - giving you the breadth you need to detect malicious activity as soon as it occurs. Cado streamlines forensic analysis to quickly deliver essential historical context and depth to your investigation allowing you to quickly identify the root cause. Combined, the SentinelOne and Cado integration empowers organizations to detect, investigate, and remediate breaches with unmatched speed.",source:"@site/docs/cado-response/manage/integrations/xdr/sentinelone.md",sourceDirName:"cado-response/manage/integrations/xdr",slug:"/cado-response/manage/integrations/xdr/sentinelone",permalink:"/cado-response/manage/integrations/xdr/sentinelone",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/xdr/sentinelone.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:3,frontMatter:{title:"SentinelOne",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"SophosLabs Intelix",permalink:"/cado-response/manage/integrations/sandbox/intelix"},next:{title:"CrowdStrike",permalink:"/cado-response/manage/integrations/xdr/crowdstrike"}},d={},c=[{value:"Leveraging Cado & SentinelOne Integration",id:"leveraging-cado--sentinelone-integration",level:2}];function l(e){const n={a:"a",admonition:"admonition",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,o.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"sentinelone-integration",children:"SentinelOne Integration"}),"\n",(0,i.jsx)(n.p,{children:"SentinelOne Singularity provides comprehensive visibility across your environment - giving you the breadth you need to detect malicious activity as soon as it occurs. Cado streamlines forensic analysis to quickly deliver essential historical context and depth to your investigation allowing you to quickly identify the root cause. Combined, the SentinelOne and Cado integration empowers organizations to detect, investigate, and remediate breaches with unmatched speed."}),"\n",(0,i.jsx)(n.admonition,{type:"tip",children:(0,i.jsxs)(n.p,{children:["To leverage the integration between SentinelOne and Cado, you must have the SentinelOne Remote Script Orchestration feature (RSO) enabled in addition to access to the Cado platform. To get access to the Cado platform contact the Cado Security team ",(0,i.jsx)(n.strong,{children:(0,i.jsx)(n.a,{href:"http://offers.cadosecurity.com/cado-s1-integration-get-in-touch",children:"here"})}),"."]})}),"\n",(0,i.jsx)(n.h2,{id:"leveraging-cado--sentinelone-integration",children:"Leveraging Cado & SentinelOne Integration"}),"\n",(0,i.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/iIJjp28G6sk",title:"Integrating SentinelOne with Cado Response",frameborder:"0",allowfullscreen:!0}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["In the SentinelOne console, navigate to ",(0,i.jsx)(n.strong,{children:"Settings - Users - Service Users - Actions - Create New Service User"})]}),"\n",(0,i.jsx)(n.li,{children:"Specify a name, expiration period, and specify the scope for which you want to enable integration"}),"\n",(0,i.jsx)(n.li,{children:"Copy or download the API Token"}),"\n",(0,i.jsxs)(n.li,{children:["In the Cado platform, navigate to ",(0,i.jsx)(n.strong,{children:"Settings - Integrations - XDR"})]}),"\n",(0,i.jsx)(n.li,{children:"Specify the URL of the SentinelOne server and paste in the API key"}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"SentinelOne Integration",src:t(9878).Z+"",width:"728",height:"542"})}),"\n",(0,i.jsxs)(n.p,{children:["You can now import data into Cado using the ",(0,i.jsx)(n.a,{href:"/cado-response/discovery-import/import/intro#importing-from-xdr",children:"Import from XDR capability"})]})]})}function h(e={}){const{wrapper:n}={...(0,o.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},9878:(e,n,t)=>{t.d(n,{Z:()=>i});const i=t.p+"assets/images/s1-integration-ac7f6f693fa1a9bef6503859ddf49c48.png"},1151:(e,n,t)=>{t.d(n,{Z:()=>s,a:()=>r});var i=t(7294);const o={},a=i.createContext(o);function r(e){const n=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function s(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),i.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4b19fcdc.5e3bb6c7.js b/assets/js/4b19fcdc.5e3bb6c7.js new file mode 100644 index 000000000..48a0b453c --- /dev/null +++ b/assets/js/4b19fcdc.5e3bb6c7.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5971],{5337:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>h,frontMatter:()=>s,metadata:()=>o,toc:()=>l});var n=r(5893),a=r(1151);const s={title:"Azure Credentials",hide_title:!0,sidebar_position:4},i="Creating Secure Azure Credentials",o={id:"cado-host/azure-credentials",title:"Azure Credentials",description:"We now recommend using the automatically created temporary credentials generated by Cado Response. See our documentation here for more details.",source:"@site/docs/cado-host/azure-credentials.md",sourceDirName:"cado-host",slug:"/cado-host/azure-credentials",permalink:"/cado-host/azure-credentials",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-host/azure-credentials.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:4,frontMatter:{title:"Azure Credentials",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"AWS Credentials",permalink:"/cado-host/aws-credentials"},next:{title:"Google Cloud Credentials",permalink:"/cado-host/google-credentials"}},c={},l=[{value:"Creating Blog Storage",id:"creating-blog-storage",level:2},{value:"Generating a Shared Access Signature",id:"generating-a-shared-access-signature",level:2},{value:"Generating a Shared Access Signature with Azure Storage Explorer",id:"generating-a-shared-access-signature-with-azure-storage-explorer",level:2}];function d(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,a.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.admonition,{type:"warning",children:(0,n.jsxs)(t.p,{children:["We now recommend using the automatically created temporary credentials generated by Cado Response. See our documentation ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"deploy#deploy-through-cado-response-platform",children:"here"})})," for more details."]})}),"\n",(0,n.jsx)(t.h1,{id:"creating-secure-azure-credentials",children:"Creating Secure Azure Credentials"}),"\n",(0,n.jsx)(t.p,{children:"In order to securely write to Azure, you'll need to create a limited access key called a Shared Access Signature."}),"\n",(0,n.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/FQoAnYVPRLo",title:"YouTube video player",frameborder:"0",allowfullscreen:!0}),"\n",(0,n.jsx)(t.h2,{id:"creating-blog-storage",children:"Creating Blog Storage"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["If you haven't already, ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://docs.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-portal",children:"Create a Blob storage container"})})," for your data in Azure."]}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"generating-a-shared-access-signature",children:"Generating a Shared Access Signature"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Browse to your Storage Account, and click Shared Access Signature to generate credentials to write to the Storage Containers in the Storage Account."}),"\n",(0,n.jsx)(t.li,{children:"Remove the ability to Read, List or Delete files, and click Generate SAS."}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"generating-a-shared-access-signature-with-azure-storage-explorer",children:"Generating a Shared Access Signature with Azure Storage Explorer"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["Alternatively you can create a Shared Access Signature with the ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://azure.microsoft.com/en-us/features/storage-explorer/",children:"Azure Storage Explorer"})}),"."]}),"\n",(0,n.jsx)(t.li,{children:"Right click the blob container you wish to use, and select Get Shared Access Signature."}),"\n",(0,n.jsx)(t.li,{children:"Select the time period you will be using these credentials for, and untick all permissions except for Write."}),"\n",(0,n.jsx)(t.li,{children:"Click Next, then Copy the Query string. This will be used for authentication"}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"When you are ready for the imaging process you will have:"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsx)(t.li,{children:'The account name (the account name that owns the new or existing container and that the access signature was generated, under "storage accounts")'}),"\n",(0,n.jsx)(t.li,{children:"The container name (set up to store the data)"}),"\n",(0,n.jsx)(t.li,{children:"And the generated long access signature (the query string, similar to the above diagram)"}),"\n"]}),"\n",(0,n.jsx)(t.admonition,{type:"warning",children:(0,n.jsx)(t.p,{children:"We recommend that you keep this information safe. Treat this information just as you would for a sensitive password or similar. Once access is no longer required, we recommend removing access."})}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsx)(t.p,{children:"Where possible with containers, we recommend setting up IP whitelisting as an extra layer of security. Please ensure that read and list access are never granted. This prevents unauthorised access to the data uploaded in the case your access signature has been lost or exposed."})})]})}function h(e={}){const{wrapper:t}={...(0,a.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},1151:(e,t,r)=>{r.d(t,{Z:()=>o,a:()=>i});var n=r(7294);const a={},s=n.createContext(a);function i(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:i(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4b19fcdc.8988ab03.js b/assets/js/4b19fcdc.8988ab03.js deleted file mode 100644 index 416d3a325..000000000 --- a/assets/js/4b19fcdc.8988ab03.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5971],{5337:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>h,frontMatter:()=>s,metadata:()=>o,toc:()=>l});var n=r(5893),a=r(1151);const s={title:"Azure Credentials",hide_title:!0,sidebar_position:4},i="Creating Secure Azure Credentials",o={id:"cado-host/azure-credentials",title:"Azure Credentials",description:"We now recommend using the automatically created temporary credentials generated by Cado Response. See our documentation here for more details.",source:"@site/docs/cado-host/azure-credentials.md",sourceDirName:"cado-host",slug:"/cado-host/azure-credentials",permalink:"/cado-host/azure-credentials",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-host/azure-credentials.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:4,frontMatter:{title:"Azure Credentials",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"AWS Credentials",permalink:"/cado-host/aws-credentials"},next:{title:"Google Cloud Credentials",permalink:"/cado-host/google-credentials"}},c={},l=[{value:"Creating Blog Storage",id:"creating-blog-storage",level:2},{value:"Generating a Shared Access Signature",id:"generating-a-shared-access-signature",level:2},{value:"Generating a Shared Access Signature with Azure Storage Explorer",id:"generating-a-shared-access-signature-with-azure-storage-explorer",level:2}];function d(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,a.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.admonition,{type:"warning",children:(0,n.jsxs)(t.p,{children:["We now recommend using the automatically created temporary credentials generated by Cado Response. See our documentation ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"deploy#deploy-through-cado-response-platform",children:"here"})})," for more details."]})}),"\n",(0,n.jsx)(t.h1,{id:"creating-secure-azure-credentials",children:"Creating Secure Azure Credentials"}),"\n",(0,n.jsx)(t.p,{children:"In order to securely write to Azure, you'll need to create a limited access key called a Shared Access Signature."}),"\n",(0,n.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/FQoAnYVPRLo",title:"YouTube video player",frameborder:"0",allowfullscreen:!0}),"\n",(0,n.jsx)(t.h2,{id:"creating-blog-storage",children:"Creating Blog Storage"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["If you haven't already, ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://docs.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-portal",children:"Create a Blob storage container"})})," for your data in Azure."]}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"generating-a-shared-access-signature",children:"Generating a Shared Access Signature"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Browse to your Storage Account, and click Shared Access Signature to generate credentials to write to the Storage Containers in the Storage Account."}),"\n",(0,n.jsx)(t.li,{children:"Remove the ability to Read, List or Delete files, and click Generate SAS."}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"generating-a-shared-access-signature-with-azure-storage-explorer",children:"Generating a Shared Access Signature with Azure Storage Explorer"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["Alternatively you can create a Shared Access Signature with the ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://azure.microsoft.com/en-us/features/storage-explorer/",children:"Azure Storage Explorer"})}),"."]}),"\n",(0,n.jsx)(t.li,{children:"Right click the blob container you wish to use, and select Get Shared Access Signature."}),"\n",(0,n.jsx)(t.li,{children:"Select the time period you will be using these credentials for, and untick all permissions except for Write."}),"\n",(0,n.jsx)(t.li,{children:"Click Next, then Copy the Query string. This will be used for authentication"}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"When you are ready for the imaging process you will have:"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsx)(t.li,{children:'The account name (the account name that owns the new or existing container and that the access signature was generated, under "storage accounts")'}),"\n",(0,n.jsx)(t.li,{children:"The container name (set up to store the data)"}),"\n",(0,n.jsx)(t.li,{children:"And the generated long access signature (the query string, similar to the above diagram)"}),"\n"]}),"\n",(0,n.jsx)(t.admonition,{type:"warning",children:(0,n.jsx)(t.p,{children:"We recommend that you keep this information safe. Treat this information just as you would for a sensitive password or similar. Once access is no longer required, we recommend removing access."})}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsx)(t.p,{children:"Where possible with containers, we recommend setting up IP whitelisting as an extra layer of security. Please ensure that read and list access are never granted. This prevents unauthorised access to the data uploaded in the case your access signature has been lost or exposed."})})]})}function h(e={}){const{wrapper:t}={...(0,a.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},1151:(e,t,r)=>{r.d(t,{Z:()=>o,a:()=>i});var n=r(7294);const a={},s=n.createContext(a);function i(e){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:i(e.components),n.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4b281177.6bfb14ee.js b/assets/js/4b281177.6bfb14ee.js deleted file mode 100644 index e0d9222c3..000000000 --- a/assets/js/4b281177.6bfb14ee.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[444],{402:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>a,contentTitle:()=>r,default:()=>u,frontMatter:()=>i,metadata:()=>l,toc:()=>c});var t=n(5893),o=n(1151);const i={title:"Logging",hide_title:!0,sidebar_position:4},r="AWS Logging Best Practices",l={id:"cado-response/deploy/aws/logging",title:"Logging",description:"We recommend customers follow AWS best practices regarding logging (https",source:"@site/docs/cado-response/deploy/aws/logging.md",sourceDirName:"cado-response/deploy/aws",slug:"/cado-response/deploy/aws/logging",permalink:"/cado-response/deploy/aws/logging",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/logging.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:4,frontMatter:{title:"Logging",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"KMS Support",permalink:"/cado-response/deploy/aws/data-encryption/aws-kms"},next:{title:"Load Balancer",permalink:"/cado-response/deploy/aws/networking/aws-load-balancer"}},a={},c=[];function d(e){const s={a:"a",h1:"h1",li:"li",p:"p",ul:"ul",...(0,o.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"aws-logging-best-practices",children:"AWS Logging Best Practices"}),"\n",(0,t.jsxs)(s.p,{children:["We recommend customers follow AWS best practices regarding logging (",(0,t.jsx)(s.a,{href:"https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls.html",children:"https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls.html"}),") which includes the following:"]}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"Ensure CloudTrail is enabled in all regions"}),"\n",(0,t.jsx)(s.li,{children:"Ensure CloudTrail log file validation is enabled"}),"\n",(0,t.jsx)(s.li,{children:"Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible"}),"\n",(0,t.jsx)(s.li,{children:"Ensure CloudTrail trails are integrated with CloudWatch Logs"}),"\n",(0,t.jsx)(s.li,{children:"Ensure AWS Config is enabled in all regions"}),"\n",(0,t.jsx)(s.li,{children:"Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket"}),"\n",(0,t.jsx)(s.li,{children:"Ensure CloudTrail logs are encrypted at rest using KMS CMKs"}),"\n",(0,t.jsx)(s.li,{children:"Ensure rotation for customer created CMKs is enabled"}),"\n",(0,t.jsx)(s.li,{children:"Ensure VPC flow logging is enabled in all VPCs"}),"\n"]})]})}function u(e={}){const{wrapper:s}={...(0,o.a)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},1151:(e,s,n)=>{n.d(s,{Z:()=>l,a:()=>r});var t=n(7294);const o={},i=t.createContext(o);function r(e){const s=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function l(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),t.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4b281177.a40732a2.js b/assets/js/4b281177.a40732a2.js new file mode 100644 index 000000000..1b6f870d3 --- /dev/null +++ b/assets/js/4b281177.a40732a2.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[444],{402:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>a,contentTitle:()=>r,default:()=>u,frontMatter:()=>i,metadata:()=>l,toc:()=>c});var t=n(5893),o=n(1151);const i={title:"Logging",hide_title:!0,sidebar_position:4},r="AWS Logging Best Practices",l={id:"cado-response/deploy/aws/logging",title:"Logging",description:"We recommend customers follow AWS best practices regarding logging (https",source:"@site/docs/cado-response/deploy/aws/logging.md",sourceDirName:"cado-response/deploy/aws",slug:"/cado-response/deploy/aws/logging",permalink:"/cado-response/deploy/aws/logging",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/logging.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:4,frontMatter:{title:"Logging",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"KMS Support",permalink:"/cado-response/deploy/aws/data-encryption/aws-kms"},next:{title:"Load Balancer",permalink:"/cado-response/deploy/aws/networking/aws-load-balancer"}},a={},c=[];function d(e){const s={a:"a",h1:"h1",li:"li",p:"p",ul:"ul",...(0,o.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"aws-logging-best-practices",children:"AWS Logging Best Practices"}),"\n",(0,t.jsxs)(s.p,{children:["We recommend customers follow AWS best practices regarding logging (",(0,t.jsx)(s.a,{href:"https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls.html",children:"https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls.html"}),") which includes the following:"]}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsx)(s.li,{children:"Ensure CloudTrail is enabled in all regions"}),"\n",(0,t.jsx)(s.li,{children:"Ensure CloudTrail log file validation is enabled"}),"\n",(0,t.jsx)(s.li,{children:"Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible"}),"\n",(0,t.jsx)(s.li,{children:"Ensure CloudTrail trails are integrated with CloudWatch Logs"}),"\n",(0,t.jsx)(s.li,{children:"Ensure AWS Config is enabled in all regions"}),"\n",(0,t.jsx)(s.li,{children:"Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket"}),"\n",(0,t.jsx)(s.li,{children:"Ensure CloudTrail logs are encrypted at rest using KMS CMKs"}),"\n",(0,t.jsx)(s.li,{children:"Ensure rotation for customer created CMKs is enabled"}),"\n",(0,t.jsx)(s.li,{children:"Ensure VPC flow logging is enabled in all VPCs"}),"\n"]})]})}function u(e={}){const{wrapper:s}={...(0,o.a)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},1151:(e,s,n)=>{n.d(s,{Z:()=>l,a:()=>r});var t=n(7294);const o={},i=t.createContext(o);function r(e){const s=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function l(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),t.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4c34ab8e.70b3b576.js b/assets/js/4c34ab8e.70b3b576.js new file mode 100644 index 000000000..90c9488f0 --- /dev/null +++ b/assets/js/4c34ab8e.70b3b576.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9280],{7493:(e,t,a)=>{a.r(t),a.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>l,frontMatter:()=>o,metadata:()=>i,toc:()=>d});var n=a(5893),s=a(1151);const o={title:"Overview",hide_title:!0,sidebar_position:1},r="Data Encryption and Security",i={id:"cado-response/deploy/aws/data-encryption/data-encryption-overview",title:"Overview",description:"During deployment, by default, an S3 bucket, a VPC and a Subnet are created for use by the Cado solution. From an access and security perspective, the S3 Bucket is encrypted with server-side encryption using AES256 and attached volumes are also encrypted using KMS. We recommend you enable key rotation as well (https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html). The default VPC and Subnet create an isolated environment to which customers can control access rights. When processing data, the Cado worker instances are launched within the same VPC as the main Cado instance. Worker instances are started using the same AMI as the main Cado instance as well.",source:"@site/docs/cado-response/deploy/aws/data-encryption/data-encryption-overview.md",sourceDirName:"cado-response/deploy/aws/data-encryption",slug:"/cado-response/deploy/aws/data-encryption/data-encryption-overview",permalink:"/cado-response/deploy/aws/data-encryption/data-encryption-overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/data-encryption/data-encryption-overview.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Overview",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Cross Account Creation",permalink:"/cado-response/deploy/aws/iam/cross-account-creation"},next:{title:"KMS Support",permalink:"/cado-response/deploy/aws/data-encryption/aws-kms"}},c={},d=[];function p(e){const t={a:"a",h1:"h1",p:"p",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"data-encryption-and-security",children:"Data Encryption and Security"}),"\n",(0,n.jsxs)(t.p,{children:["During deployment, by default, an S3 bucket, a VPC and a Subnet are created for use by the Cado solution. From an access and security perspective, the S3 Bucket is encrypted with server-side encryption using AES256 and attached volumes are also encrypted using KMS. We recommend you enable key rotation as well (",(0,n.jsx)(t.a,{href:"https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html",children:"https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html"}),"). The default VPC and Subnet create an isolated environment to which customers can control access rights. When processing data, the Cado worker instances are launched within the same VPC as the main Cado instance. Worker instances are started using the same AMI as the main Cado instance as well."]})]})}function l(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(p,{...e})}):p(e)}},1151:(e,t,a)=>{a.d(t,{Z:()=>i,a:()=>r});var n=a(7294);const s={},o=n.createContext(s);function r(e){const t=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),n.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4c34ab8e.9ceaa129.js b/assets/js/4c34ab8e.9ceaa129.js deleted file mode 100644 index 442b1b77c..000000000 --- a/assets/js/4c34ab8e.9ceaa129.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9280],{7493:(e,t,a)=>{a.r(t),a.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>l,frontMatter:()=>o,metadata:()=>i,toc:()=>d});var n=a(5893),s=a(1151);const o={title:"Overview",hide_title:!0,sidebar_position:1},r="Data Encryption and Security",i={id:"cado-response/deploy/aws/data-encryption/data-encryption-overview",title:"Overview",description:"During deployment, by default, an S3 bucket, a VPC and a Subnet are created for use by the Cado solution. From an access and security perspective, the S3 Bucket is encrypted with server-side encryption using AES256 and attached volumes are also encrypted using KMS. We recommend you enable key rotation as well (https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html). The default VPC and Subnet create an isolated environment to which customers can control access rights. When processing data, the Cado worker instances are launched within the same VPC as the main Cado instance. Worker instances are started using the same AMI as the main Cado instance as well.",source:"@site/docs/cado-response/deploy/aws/data-encryption/data-encryption-overview.md",sourceDirName:"cado-response/deploy/aws/data-encryption",slug:"/cado-response/deploy/aws/data-encryption/data-encryption-overview",permalink:"/cado-response/deploy/aws/data-encryption/data-encryption-overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/data-encryption/data-encryption-overview.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Overview",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Cross Account Creation",permalink:"/cado-response/deploy/aws/iam/cross-account-creation"},next:{title:"KMS Support",permalink:"/cado-response/deploy/aws/data-encryption/aws-kms"}},c={},d=[];function p(e){const t={a:"a",h1:"h1",p:"p",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"data-encryption-and-security",children:"Data Encryption and Security"}),"\n",(0,n.jsxs)(t.p,{children:["During deployment, by default, an S3 bucket, a VPC and a Subnet are created for use by the Cado solution. From an access and security perspective, the S3 Bucket is encrypted with server-side encryption using AES256 and attached volumes are also encrypted using KMS. We recommend you enable key rotation as well (",(0,n.jsx)(t.a,{href:"https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html",children:"https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html"}),"). The default VPC and Subnet create an isolated environment to which customers can control access rights. When processing data, the Cado worker instances are launched within the same VPC as the main Cado instance. Worker instances are started using the same AMI as the main Cado instance as well."]})]})}function l(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(p,{...e})}):p(e)}},1151:(e,t,a)=>{a.d(t,{Z:()=>i,a:()=>r});var n=a(7294);const s={},o=n.createContext(s);function r(e){const t=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),n.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4dd9ac21.9c887fd4.js b/assets/js/4dd9ac21.9c887fd4.js new file mode 100644 index 000000000..c0e9f1216 --- /dev/null +++ b/assets/js/4dd9ac21.9c887fd4.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9715],{4242:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>r,contentTitle:()=>i,default:()=>h,frontMatter:()=>o,metadata:()=>d,toc:()=>l});var a=n(5893),s=n(1151);const o={title:"Data Management",hide_title:!0,sidebar_position:8},i="Data Management",d={id:"cado-response/manage/data",title:"Data Management",description:"There are several considerations for managing data from the Cado platform",source:"@site/docs/cado-response/manage/data.md",sourceDirName:"cado-response/manage",slug:"/cado-response/manage/data",permalink:"/cado-response/manage/data",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/data.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:8,frontMatter:{title:"Data Management",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Worker Management",permalink:"/cado-response/manage/workers"},next:{title:"Updating",permalink:"/cado-response/manage/updating"}},r={},l=[{value:"Controlling the lifecycle of data stored by the Cado platform",id:"controlling-the-lifecycle-of-data-stored-by-the-cado-platform",level:2},{value:"Storing sensitive customer data",id:"storing-sensitive-customer-data",level:2},{value:"Expanding available data storage within the Cado platform in AWS",id:"expanding-available-data-storage-within-the-cado-platform-in-aws",level:2}];function c(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.h1,{id:"data-management",children:"Data Management"}),"\n",(0,a.jsx)(t.p,{children:"There are several considerations for managing data from the Cado platform"}),"\n",(0,a.jsx)(t.h2,{id:"controlling-the-lifecycle-of-data-stored-by-the-cado-platform",children:"Controlling the lifecycle of data stored by the Cado platform"}),"\n",(0,a.jsxs)(t.p,{children:["AWS supports this through ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html",children:"Object Locks"})})," and ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/console/s3/lifecyclerules",children:"Lifecycle Rules"})})," associated with your S3 bucket. Please see the AWS documentation for more details."]}),"\n",(0,a.jsxs)(t.p,{children:["Azure supports this through ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(t.a,{href:"https://docs.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview",children:"Life Cycle Management Policies"})})," for your blob storage. Please see the Azure documentation for more details."]}),"\n",(0,a.jsx)(t.h2,{id:"storing-sensitive-customer-data",children:"Storing sensitive customer data"}),"\n",(0,a.jsx)(t.p,{children:"Whether sensitive customer data is stored within the Cado platform is completely dependent on what data sources and evidence is imported into the software. In all cases, data is either stored within the database on the main Cado instance, within EFS, within a customers' S3 bucket or Azure storage. Since the Cado platform is deployed within the customers' cloud environment, the customer has control over the life cycle management of the data (example: using Life Cycle management policies) as well as who has access to potential sensitive data via VPC and Subnet rules."}),"\n",(0,a.jsx)(t.h2,{id:"expanding-available-data-storage-within-the-cado-platform-in-aws",children:"Expanding available data storage within the Cado platform in AWS"}),"\n",(0,a.jsxs)(t.p,{children:["Below are the steps for expanding the Cado data storage volume after deployment. This follows the steps as outline by AWS' documentation: ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/recognize-expanded-volume-linux.html",children:"Extend a Linux file system after resizing a volume"})})]}),"\n",(0,a.jsx)(t.admonition,{type:"warning",children:(0,a.jsxs)(t.p,{children:["Before continuing, create a snapshot of the ",(0,a.jsx)(t.code,{children:"CadoResponseDataVolume"})," volume which has the device name ",(0,a.jsx)(t.code,{children:"/dev/sdh"}),". This will ensure you have a backup of the data volume to restore, in case you encounter an issue. ",(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html",children:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html"})]})}),"\n",(0,a.jsxs)(t.ol,{children:["\n",(0,a.jsxs)(t.li,{children:["Extend the ",(0,a.jsx)(t.code,{children:"/dev/sdh"})," storage volume via the AWS Console by:","\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsx)(t.li,{children:"Navigating to your Cado instance"}),"\n",(0,a.jsxs)(t.li,{children:["Click the ",(0,a.jsx)(t.strong,{children:"Storage"})," tab"]}),"\n",(0,a.jsxs)(t.li,{children:["Click on the volume instance ID for Device Name ",(0,a.jsx)(t.code,{children:"/dev/sdh"})]}),"\n",(0,a.jsxs)(t.li,{children:["Select the ",(0,a.jsx)(t.code,{children:"CadoResponseDataVolume"})]}),"\n",(0,a.jsxs)(t.li,{children:["Click ",(0,a.jsx)(t.strong,{children:"Actions"})]}),"\n",(0,a.jsxs)(t.li,{children:["Select ",(0,a.jsx)(t.strong,{children:"Modify Volume"})]}),"\n",(0,a.jsx)(t.li,{children:"Enter the new volume size"}),"\n",(0,a.jsxs)(t.li,{children:["Click ",(0,a.jsx)(t.strong,{children:"Modify"})]}),"\n"]}),"\n"]}),"\n",(0,a.jsxs)(t.li,{children:["SSH into the Cado instance. example: ",(0,a.jsx)(t.code,{children:'ssh -i "us-east-2.pem" admin@ec2-55-234-10-9.compute-1.amazonaws.com'})]}),"\n",(0,a.jsxs)(t.li,{children:["Run ",(0,a.jsx)(t.code,{children:"df -hT"}),". Note the Avail space for the ",(0,a.jsx)(t.code,{children:"/dev/nvme1n1"})," filesystem mounted on ",(0,a.jsx)(t.code,{children:"/home/admin/data"}),". This should display the old volume size."]}),"\n",(0,a.jsxs)(t.li,{children:["Run ",(0,a.jsx)(t.code,{children:"lsblk"})," and note the ",(0,a.jsx)(t.code,{children:"nvme1n1"})," volume SIZE mounted on ",(0,a.jsx)(t.code,{children:"/home/admin/data"}),". This should display the new volume size."]}),"\n",(0,a.jsxs)(t.li,{children:["To extend the volume and make it available to the OS, run ",(0,a.jsx)(t.code,{children:"sudo xfs_growfs -d /home/admin/data"})]}),"\n",(0,a.jsxs)(t.li,{children:["Run ",(0,a.jsx)(t.code,{children:"df -hT"})," again and note the Avail space for the ",(0,a.jsx)(t.code,{children:"/dev/nvme1n1"})," filesystem mounted on ",(0,a.jsx)(t.code,{children:"/home/admin/data"})," This should now display the new volume size."]}),"\n"]})]})}function h(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(c,{...e})}):c(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>d,a:()=>i});var a=n(7294);const s={},o=a.createContext(s);function i(e){const t=a.useContext(o);return a.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),a.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4dd9ac21.a2291263.js b/assets/js/4dd9ac21.a2291263.js deleted file mode 100644 index 1992a1756..000000000 --- a/assets/js/4dd9ac21.a2291263.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9715],{4242:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>r,contentTitle:()=>i,default:()=>h,frontMatter:()=>o,metadata:()=>d,toc:()=>l});var a=n(5893),s=n(1151);const o={title:"Data Management",hide_title:!0,sidebar_position:8},i="Data Management",d={id:"cado-response/manage/data",title:"Data Management",description:"There are several considerations for managing data from the Cado platform",source:"@site/docs/cado-response/manage/data.md",sourceDirName:"cado-response/manage",slug:"/cado-response/manage/data",permalink:"/cado-response/manage/data",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/data.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:8,frontMatter:{title:"Data Management",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"Worker Management",permalink:"/cado-response/manage/workers"},next:{title:"Updating",permalink:"/cado-response/manage/updating"}},r={},l=[{value:"Controlling the lifecycle of data stored by the Cado platform",id:"controlling-the-lifecycle-of-data-stored-by-the-cado-platform",level:2},{value:"Storing sensitive customer data",id:"storing-sensitive-customer-data",level:2},{value:"Expanding available data storage within the Cado platform in AWS",id:"expanding-available-data-storage-within-the-cado-platform-in-aws",level:2}];function c(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.h1,{id:"data-management",children:"Data Management"}),"\n",(0,a.jsx)(t.p,{children:"There are several considerations for managing data from the Cado platform"}),"\n",(0,a.jsx)(t.h2,{id:"controlling-the-lifecycle-of-data-stored-by-the-cado-platform",children:"Controlling the lifecycle of data stored by the Cado platform"}),"\n",(0,a.jsxs)(t.p,{children:["AWS supports this through ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html",children:"Object Locks"})})," and ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/console/s3/lifecyclerules",children:"Lifecycle Rules"})})," associated with your S3 bucket. Please see the AWS documentation for more details."]}),"\n",(0,a.jsxs)(t.p,{children:["Azure supports this through ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(t.a,{href:"https://docs.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview",children:"Life Cycle Management Policies"})})," for your blob storage. Please see the Azure documentation for more details."]}),"\n",(0,a.jsx)(t.h2,{id:"storing-sensitive-customer-data",children:"Storing sensitive customer data"}),"\n",(0,a.jsx)(t.p,{children:"Whether sensitive customer data is stored within the Cado platform is completely dependent on what data sources and evidence is imported into the software. In all cases, data is either stored within the database on the main Cado instance, within EFS, within a customers' S3 bucket or Azure storage. Since the Cado platform is deployed within the customers' cloud environment, the customer has control over the life cycle management of the data (example: using Life Cycle management policies) as well as who has access to potential sensitive data via VPC and Subnet rules."}),"\n",(0,a.jsx)(t.h2,{id:"expanding-available-data-storage-within-the-cado-platform-in-aws",children:"Expanding available data storage within the Cado platform in AWS"}),"\n",(0,a.jsxs)(t.p,{children:["Below are the steps for expanding the Cado data storage volume after deployment. This follows the steps as outline by AWS' documentation: ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/recognize-expanded-volume-linux.html",children:"Extend a Linux file system after resizing a volume"})})]}),"\n",(0,a.jsx)(t.admonition,{type:"warning",children:(0,a.jsxs)(t.p,{children:["Before continuing, create a snapshot of the ",(0,a.jsx)(t.code,{children:"CadoResponseDataVolume"})," volume which has the device name ",(0,a.jsx)(t.code,{children:"/dev/sdh"}),". This will ensure you have a backup of the data volume to restore, in case you encounter an issue. ",(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html",children:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html"})]})}),"\n",(0,a.jsxs)(t.ol,{children:["\n",(0,a.jsxs)(t.li,{children:["Extend the ",(0,a.jsx)(t.code,{children:"/dev/sdh"})," storage volume via the AWS Console by:","\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsx)(t.li,{children:"Navigating to your Cado instance"}),"\n",(0,a.jsxs)(t.li,{children:["Click the ",(0,a.jsx)(t.strong,{children:"Storage"})," tab"]}),"\n",(0,a.jsxs)(t.li,{children:["Click on the volume instance ID for Device Name ",(0,a.jsx)(t.code,{children:"/dev/sdh"})]}),"\n",(0,a.jsxs)(t.li,{children:["Select the ",(0,a.jsx)(t.code,{children:"CadoResponseDataVolume"})]}),"\n",(0,a.jsxs)(t.li,{children:["Click ",(0,a.jsx)(t.strong,{children:"Actions"})]}),"\n",(0,a.jsxs)(t.li,{children:["Select ",(0,a.jsx)(t.strong,{children:"Modify Volume"})]}),"\n",(0,a.jsx)(t.li,{children:"Enter the new volume size"}),"\n",(0,a.jsxs)(t.li,{children:["Click ",(0,a.jsx)(t.strong,{children:"Modify"})]}),"\n"]}),"\n"]}),"\n",(0,a.jsxs)(t.li,{children:["SSH into the Cado instance. example: ",(0,a.jsx)(t.code,{children:'ssh -i "us-east-2.pem" admin@ec2-55-234-10-9.compute-1.amazonaws.com'})]}),"\n",(0,a.jsxs)(t.li,{children:["Run ",(0,a.jsx)(t.code,{children:"df -hT"}),". Note the Avail space for the ",(0,a.jsx)(t.code,{children:"/dev/nvme1n1"})," filesystem mounted on ",(0,a.jsx)(t.code,{children:"/home/admin/data"}),". This should display the old volume size."]}),"\n",(0,a.jsxs)(t.li,{children:["Run ",(0,a.jsx)(t.code,{children:"lsblk"})," and note the ",(0,a.jsx)(t.code,{children:"nvme1n1"})," volume SIZE mounted on ",(0,a.jsx)(t.code,{children:"/home/admin/data"}),". This should display the new volume size."]}),"\n",(0,a.jsxs)(t.li,{children:["To extend the volume and make it available to the OS, run ",(0,a.jsx)(t.code,{children:"sudo xfs_growfs -d /home/admin/data"})]}),"\n",(0,a.jsxs)(t.li,{children:["Run ",(0,a.jsx)(t.code,{children:"df -hT"})," again and note the Avail space for the ",(0,a.jsx)(t.code,{children:"/dev/nvme1n1"})," filesystem mounted on ",(0,a.jsx)(t.code,{children:"/home/admin/data"})," This should now display the new volume size."]}),"\n"]})]})}function h(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(c,{...e})}):c(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>d,a:()=>i});var a=n(7294);const s={},o=a.createContext(s);function i(e){const t=a.useContext(o);return a.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),a.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/55865376.1a2d648b.js b/assets/js/55865376.1a2d648b.js deleted file mode 100644 index 32134fd5d..000000000 --- a/assets/js/55865376.1a2d648b.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8669],{6270:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>d,frontMatter:()=>o,metadata:()=>s,toc:()=>c});var r=n(5893),i=n(1151);const o={title:"Commercial EULA",hide_title:!0,sidebar_position:1},a="DOCUMENT A",s={id:"eula/commercial-eula",title:"Commercial EULA",description:"FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, DOCUMENT A - END USER LICENSE AGREEMENT SHALL APPLY.",source:"@site/docs/eula/commercial-eula.md",sourceDirName:"eula",slug:"/eula/commercial-eula",permalink:"/eula/commercial-eula",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/eula/commercial-eula.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Commercial EULA",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"FAQs",permalink:"/troubleshooting/faq"},next:{title:"Community Edition EULA",permalink:"/eula/community-eula"}},l={},c=[{value:"End User License Agreement",id:"end-user-license-agreement",level:2}];function h(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",hr:"hr",li:"li",ol:"ol",p:"p",strong:"strong",...(0,i.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"document-a",children:"DOCUMENT A"}),"\n",(0,r.jsxs)(t.admonition,{type:"info",children:[(0,r.jsxs)(t.p,{children:["FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, ",(0,r.jsx)(t.a,{href:"/eula/commercial-eula#end-user-license-agreement",children:(0,r.jsx)(t.strong,{children:"DOCUMENT A - END USER LICENSE AGREEMENT"})})," SHALL APPLY."]}),(0,r.jsxs)(t.p,{children:["FOR ALL COMMUNITY EDITION USERS OF CADO SOFTWARE, ",(0,r.jsx)(t.a,{href:"/eula/community-eula#community-edition-license-agreement",children:(0,r.jsx)(t.strong,{children:"DOCUMENT B - COMMUNITY EDITION LICENSE AGREEMENT"})})," SHALL APPLY."]})]}),"\n",(0,r.jsx)(t.hr,{}),"\n",(0,r.jsx)(t.h2,{id:"end-user-license-agreement",children:"End User License Agreement"}),"\n",(0,r.jsx)(t.p,{children:'BEFORE USING THE CADO SECURITY SOFTWARE, YOU SHOULD CAREFULLY READ THE FOLLOWING USER AGREEMENT THAT APPLIES TO THE SOFTWARE UNLESS USER AND COMPANY HAVE NEGOTIATED AND ENTERED INTO A SEPARATE, VALID WRITTEN AND MUTUALLY EXECUTED AGREEMENT PERTAINING TO USER\u2019S USE OF THE SOFTWARE. BY PROCEEDING WITH ANY INSTALLATION AND/OR USE OF THE SOFTWARE, YOU FULLY ACCEPT AND AGREE TO ALL OF THE PROVISIONS OF THIS USER AGREEMENT, ESTABLISHING A BINDING AGREEMENT BETWEEN YOU AS THE PERSON USING THE SOFTWARE (THE "USER") AND CADO SECURITY LIMITED, A COMPANY INCORPORATED IN ENGLAND AND WALES (NUMBER 12552987) HAVING ITS REGISTERED OFFICE AT 3RD FLOOR, 1 ASHLEY ROAD, ALTRINCHAM, CHESHIRE, WA14 2DT ("COMPANY").'}),"\n",(0,r.jsx)(t.p,{children:'This End User License Agreement governs use of the Software (as defined below) provided by Cado Security Limited, , a company incorporated in England and Wales (Number 12552987) having its registered office at 3rd Floor, 1 Ashley Road, Altrincham, Cheshire, or its subsidiaries or affiliates (collectively, the \u201cCompany\u201d). This Agreement sets out the terms on which Company makes the Software available to you ("You\u201d or \u201cCustomer\u201d) and your authorized Users (as defined below).'}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Proprietary Rights"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"The Cado Security software including any (a) software that the Company uses to make the Software available; and (b) any published documentation that Company generally makes available to its customers (\u201cDocumentation\u201d) (collectively, the \u201cSoftware\u201d), is subject to the protection of copyright laws, which prohibit unauthorized copying and distribution of copyrighted works. The Software incorporates Company\u2019s proprietary and confidential algorithms and techniques that are subject to legal protection as know-how and trade secrets. All right, title and interest to any intellectual property rights included but not limited to patents, copyright works, know how, trade secrets and trade marks in the Software are owned by the Company. The employees, consultants, or other persons authorized by Customer to use the Software (each a \u201cUser\u201d) are granted only those rights expressly conferred by clause 2 of this Agreement. Customer shall remain liable to Company at all times for any acts or omissions of its Users."}),"\n",(0,r.jsxs)(t.ol,{start:"2",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Grant of Rights; Reservation of Rights"})}),"\n"]}),"\n",(0,r.jsxs)(t.p,{children:["Subject to payment in full by the Customer of the applicable subscription fee as detailed in the applicable invoice (\u201cInvoice\u201d), Company grants the Customer and its authorized Users a limited, non-sublicensable, non-exclusive, non-transferable right during the applicable subscription term stated in the Invoice (\u201cSubscription Plan\u201d) and pursuant to the terms of this Agreement to access, install, download and use the Software in object code form only, exclusively within the Customer\u2019s cloud based environment, for internal business and non-commercial purposes only unless otherwise agreed in writing. The Customer must install the Software as prescribed in the Company\u2019s manual available at ",(0,r.jsx)(t.a,{href:"https://docs.cadosecurity.com",children:"https://docs.cadosecurity.com"}),", unless otherwise agreed by the Company in writing. The Customer is permitted to make one additional copy of the Software solely for back-up or archival purposes only. The Software shall be used or accessed strictly in accordance with, and subject to any restrictions under the User\u2019s Subscription Plan and the applicable Invoice. This Agreement can be updated from time to time in Company's sole discretion and such changes will be made available at ",(0,r.jsx)(t.a,{href:"http://www.cadosecurity.com",children:"www.cadosecurity.com"}),"."]}),"\n",(0,r.jsxs)(t.ol,{start:"3",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Restrictions"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"3.1\tThe Customer and its Users may not:"}),"\n",(0,r.jsx)(t.p,{children:"copy the Software or any part of it, except as expressly permitted in this Agreement;\nrent, sell, lease, sublicense, distribute, pledge, assign or otherwise transfer, or commercially exploit, or encumber rights to, the Software or any part of it in any manner or for any purpose, or make the Software available for use by any third party in any manner including provide commercial hosting services, time-sharing, service bureau or similar arrangement;\naccess the Software for the purpose of building a competitive product or service or copying its features or user interface;\nremove, delete, obscure, alter or add to any copyright or proprietary notices appearing within the Software;\nDisassemble, decrypt, extract, reverse engineer or reverse compile the Software, or otherwise attempt to discover the confidential algorithms and techniques incorporated in the Software, or disclose or use any confidential information of Company in any manner, other than to the extent such actions cannot be prohibited under applicable law; or\nmodify, translate, adapt, or create derivative works from the Software."}),"\n",(0,r.jsx)(t.p,{children:"3.2\tCustomer and its Users have no right under any circumstances to obtain or have access to the source code or systems and programming documentation of the Software or any part thereof."}),"\n",(0,r.jsxs)(t.ol,{start:"4",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Evaluation License"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"If Customer registers for an evaluation version of the Software (\u201cEvaluation Version\u201d), at no additional charge, Company will make the Evaluation Version available to Customer and its authorized Users on a trial basis, free of charge, until the earlier of (a) the end of the 14 day free trial period unless agreed otherwise in writing, or (b) the start date of any license subscription purchased by the Customer corresponding to such Evaluation Version. Notwithstanding anything to the contrary, (i) the Evaluation Version is provided \u201cas-is\u201d without any representation, warranty or indemnity, or any support service, and (ii) the Evaluation Version not intended to house or contain any sensitive or production data. Company shall not be liable or responsible under any circumstances for any sensitive or production data input into such environment by Customer or any resulting loss or damage thereto."}),"\n",(0,r.jsxs)(t.ol,{start:"5",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Support"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Customer will be solely responsible for installing any updates and modifications that the Company may make available from time to time. Company will only support the most recent version of the Software."}),"\n",(0,r.jsxs)(t.ol,{start:"6",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Audit"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"During the term of this Agreement and for a period of one year thereafter, Company may, during normal business hours and upon reasonable prior notice to User, inspect the User\u2019s records, equipment and facilities relating to its use of the Software to verify Customer and its User's compliance with this Agreement."}),"\n",(0,r.jsxs)(t.ol,{start:"7",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Data"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Company may collect, process, aggregate, and use certain information, analysis, statistics, and other data generated by Customer\u2019s use of the Software (a) to confirm that the Software is being used in accordance with the rights granted under this Agreement, and (b) to drive improvements in the Software, and Company will retain ownership of such Software use data. Company agrees not to publish any of this information in a form that identifies Customer or any User. In the event Company processes personal data as a processor, such personal data will be processed by Company in accordance with applicable data protection laws."}),"\n",(0,r.jsxs)(t.ol,{start:"8",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Term"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Unless specified in your Subscription Plan and/or Invoice, this Agreement is effective for one (1) year, unless earlier terminated in accordance with the terms of this Agreement and may be renewed for successive periods of one (1) year upon timely payment of the applicable subscription fee. This Agreement and the User\u2019s right to use the Software will automatically terminate without notice in the event of (a) any failure by the User to pay fees due under this Agreement; (b) any failure by the User to comply with any of the above restrictions or any term of this Agreement. Upon expiration or earlier termination of this Agreement, the User will cease using the Software and expunge and destroy all copies of the Software in the User\u2019s possession. All provisions of clauses 3, 6, 8, 9, 10, 12 and 14 of this Agreement will survive termination."}),"\n",(0,r.jsxs)(t.ol,{start:"9",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Warranty and Disclaimer"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Each party warrants to the other that it has the required authority to enter into this Agreement. The Company warrants the Software shall perform materially in accordance with published specifications in the Documentation upon installation. To the fullest extent permitted by law, Company disclaims all warranties, express or implied, including without limitation any implied warranties of merchantability, fitness for a particular purpose, or title or noninfringement of third parties\u2019 intellectual property rights. No oral or written information or advice given by the Company or any third party in relation to the Software shall create any additional warranty."}),"\n",(0,r.jsxs)(t.ol,{start:"10",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Limitation of Liability"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Subject to the remainder of this clause, the aggregate liability of Company under or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, in respect of any and all claims, will not exceed the aggregate of the subscription fees actually paid to Company by the User in the year of the claim. In no event will Company be liable under or in connection with this Agreement for (a) any lost profits, loss of revenue, loss of business, loss of contract, loss of goodwill or loss of anticipated savings (whether direct or indirect); (b) error or interruption of use, loss or inaccuracy or corruption of data; or (c) any incidental, special, punitive, exemplary, indirect or consequential damages, arising out of or related to the Software, or the use thereof, even if Company has been advised, or is otherwise aware, of the possibility of such damages. Nothing in this Agreement will exclude or limit a party\u2019s liability to the other party for: (a) death or personal injury caused by that party\u2019s negligence; (b) wilful misconduct, fraud or fraudulent misrepresentation; (c) payment of fees or any sums due to the other party; or (d) any other matter for which it would be unlawful to exclude or attempt to exclude its liabilities."}),"\n",(0,r.jsxs)(t.ol,{start:"11",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Insurance"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"During the term of this Agreement, Company shall, at all times and at its own expense, and in amounts in accordance with industry standard for the software and services provided under this Agreement, maintain in full force and effect adequate insurance coverages"}),"\n",(0,r.jsxs)(t.ol,{start:"12",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Intellectual Property Rights"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"As between the User and Company, all right, title and interest in and to the Software and Company\u2019s trade marks and service marks are owned exclusively by Company and its licensors. To the extent that the User obtains any ownership interest in or to any derivative work or modification to the Software, the User hereby assigns (including without limitation by way of present assignment of future copyright) to Company all right, title and interest in and to such derivative works and/or modifications upon creation. The User shall, if requested by Company, do all things and execute all documents required to give effect the foregoing assignment. Other than as expressly set forth in this Agreement, no license or other rights in or to the Software thereto are granted to the User, and all such licenses and rights are hereby expressly reserved."}),"\n",(0,r.jsxs)(t.ol,{start:"13",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Publicity"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Customer hereby grants to Company the right to use its logo, service mark, and name in Company\u2019s marketing materials, including on its website. Such use by Company shall be limited to a statement that Customer is a user of specific Company Software. Any other use of a party\u2019s trade names, service marks, logos, or any other Intellectual Property right related thereto, for advertising or any other purposes, requires the express prior written consent of the other party."}),"\n",(0,r.jsxs)(t.ol,{start:"14",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Miscellaneous"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"This Agreement does not create any agency or partnership relationship between the parties hereto. This\nAgreement, and any dispute arising out of or in connection with it or its subject matter, whether of a contractual\nor non-contractual nature, shall be governed by and construed in accordance with the laws of Delaware (if\nCustomer is located in the United States), or England (if Customer is located outside of the United States). The\nsole and exclusive jurisdiction and venue for any litigation arising out of this Agreement shall be the courts of\nDelaware (if Customer is located in the United States), or England (if Customer is located outside of the United\nStates). Except with respect to any current valid written and mutually executed agreement between Customer and Company pertaining to Customer\u2019s use of the Software, this Agreement constitutes the entire agreement between the parties with respect to the subject matter\nhereof and supersedes all prior agreements and understandings whether written or oral, express or implied. If\nany provision of this Agreement is held invalid, illegal or unenforceable by a court of competent jurisdiction,\nsuch shall not affect any other provision of this Agreement, which shall remain in full force and effect. No\namendment or alteration of the terms of this Agreement shall be effective unless made in writing and executed\nby both parties hereto. A failure or delay in exercising any right in respect to this Agreement will not be\npresumed to operate as a waiver, and a single or partial exercise of any right will not be presumed to preclude\nany subsequent or further exercise of that right or the exercise of any other right. Any modification or waiver of\nany provision of this Agreement shall not be effective unless made in writing. Any such waiver shall be\neffective only in the specific instance and for the purpose given."})]})}function d(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(h,{...e})}):h(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>s,a:()=>a});var r=n(7294);const i={},o=r.createContext(i);function a(e){const t=r.useContext(o);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),r.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/55865376.930b3d93.js b/assets/js/55865376.930b3d93.js new file mode 100644 index 000000000..320f00978 --- /dev/null +++ b/assets/js/55865376.930b3d93.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8669],{6270:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>d,frontMatter:()=>o,metadata:()=>s,toc:()=>c});var r=n(5893),i=n(1151);const o={title:"Commercial EULA",hide_title:!0,sidebar_position:1},a="DOCUMENT A",s={id:"eula/commercial-eula",title:"Commercial EULA",description:"FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, DOCUMENT A - END USER LICENSE AGREEMENT SHALL APPLY.",source:"@site/docs/eula/commercial-eula.md",sourceDirName:"eula",slug:"/eula/commercial-eula",permalink:"/eula/commercial-eula",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/eula/commercial-eula.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Commercial EULA",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"FAQs",permalink:"/troubleshooting/faq"},next:{title:"Community Edition EULA",permalink:"/eula/community-eula"}},l={},c=[{value:"End User License Agreement",id:"end-user-license-agreement",level:2}];function h(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",hr:"hr",li:"li",ol:"ol",p:"p",strong:"strong",...(0,i.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"document-a",children:"DOCUMENT A"}),"\n",(0,r.jsxs)(t.admonition,{type:"info",children:[(0,r.jsxs)(t.p,{children:["FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, ",(0,r.jsx)(t.a,{href:"/eula/commercial-eula#end-user-license-agreement",children:(0,r.jsx)(t.strong,{children:"DOCUMENT A - END USER LICENSE AGREEMENT"})})," SHALL APPLY."]}),(0,r.jsxs)(t.p,{children:["FOR ALL COMMUNITY EDITION USERS OF CADO SOFTWARE, ",(0,r.jsx)(t.a,{href:"/eula/community-eula#community-edition-license-agreement",children:(0,r.jsx)(t.strong,{children:"DOCUMENT B - COMMUNITY EDITION LICENSE AGREEMENT"})})," SHALL APPLY."]})]}),"\n",(0,r.jsx)(t.hr,{}),"\n",(0,r.jsx)(t.h2,{id:"end-user-license-agreement",children:"End User License Agreement"}),"\n",(0,r.jsx)(t.p,{children:'BEFORE USING THE CADO SECURITY SOFTWARE, YOU SHOULD CAREFULLY READ THE FOLLOWING USER AGREEMENT THAT APPLIES TO THE SOFTWARE UNLESS USER AND COMPANY HAVE NEGOTIATED AND ENTERED INTO A SEPARATE, VALID WRITTEN AND MUTUALLY EXECUTED AGREEMENT PERTAINING TO USER\u2019S USE OF THE SOFTWARE. BY PROCEEDING WITH ANY INSTALLATION AND/OR USE OF THE SOFTWARE, YOU FULLY ACCEPT AND AGREE TO ALL OF THE PROVISIONS OF THIS USER AGREEMENT, ESTABLISHING A BINDING AGREEMENT BETWEEN YOU AS THE PERSON USING THE SOFTWARE (THE "USER") AND CADO SECURITY LIMITED, A COMPANY INCORPORATED IN ENGLAND AND WALES (NUMBER 12552987) HAVING ITS REGISTERED OFFICE AT 3RD FLOOR, 1 ASHLEY ROAD, ALTRINCHAM, CHESHIRE, WA14 2DT ("COMPANY").'}),"\n",(0,r.jsx)(t.p,{children:'This End User License Agreement governs use of the Software (as defined below) provided by Cado Security Limited, , a company incorporated in England and Wales (Number 12552987) having its registered office at 3rd Floor, 1 Ashley Road, Altrincham, Cheshire, or its subsidiaries or affiliates (collectively, the \u201cCompany\u201d). This Agreement sets out the terms on which Company makes the Software available to you ("You\u201d or \u201cCustomer\u201d) and your authorized Users (as defined below).'}),"\n",(0,r.jsxs)(t.ol,{children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Proprietary Rights"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"The Cado Security software including any (a) software that the Company uses to make the Software available; and (b) any published documentation that Company generally makes available to its customers (\u201cDocumentation\u201d) (collectively, the \u201cSoftware\u201d), is subject to the protection of copyright laws, which prohibit unauthorized copying and distribution of copyrighted works. The Software incorporates Company\u2019s proprietary and confidential algorithms and techniques that are subject to legal protection as know-how and trade secrets. All right, title and interest to any intellectual property rights included but not limited to patents, copyright works, know how, trade secrets and trade marks in the Software are owned by the Company. The employees, consultants, or other persons authorized by Customer to use the Software (each a \u201cUser\u201d) are granted only those rights expressly conferred by clause 2 of this Agreement. Customer shall remain liable to Company at all times for any acts or omissions of its Users."}),"\n",(0,r.jsxs)(t.ol,{start:"2",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Grant of Rights; Reservation of Rights"})}),"\n"]}),"\n",(0,r.jsxs)(t.p,{children:["Subject to payment in full by the Customer of the applicable subscription fee as detailed in the applicable invoice (\u201cInvoice\u201d), Company grants the Customer and its authorized Users a limited, non-sublicensable, non-exclusive, non-transferable right during the applicable subscription term stated in the Invoice (\u201cSubscription Plan\u201d) and pursuant to the terms of this Agreement to access, install, download and use the Software in object code form only, exclusively within the Customer\u2019s cloud based environment, for internal business and non-commercial purposes only unless otherwise agreed in writing. The Customer must install the Software as prescribed in the Company\u2019s manual available at ",(0,r.jsx)(t.a,{href:"https://docs.cadosecurity.com",children:"https://docs.cadosecurity.com"}),", unless otherwise agreed by the Company in writing. The Customer is permitted to make one additional copy of the Software solely for back-up or archival purposes only. The Software shall be used or accessed strictly in accordance with, and subject to any restrictions under the User\u2019s Subscription Plan and the applicable Invoice. This Agreement can be updated from time to time in Company's sole discretion and such changes will be made available at ",(0,r.jsx)(t.a,{href:"http://www.cadosecurity.com",children:"www.cadosecurity.com"}),"."]}),"\n",(0,r.jsxs)(t.ol,{start:"3",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Restrictions"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"3.1\tThe Customer and its Users may not:"}),"\n",(0,r.jsx)(t.p,{children:"copy the Software or any part of it, except as expressly permitted in this Agreement;\nrent, sell, lease, sublicense, distribute, pledge, assign or otherwise transfer, or commercially exploit, or encumber rights to, the Software or any part of it in any manner or for any purpose, or make the Software available for use by any third party in any manner including provide commercial hosting services, time-sharing, service bureau or similar arrangement;\naccess the Software for the purpose of building a competitive product or service or copying its features or user interface;\nremove, delete, obscure, alter or add to any copyright or proprietary notices appearing within the Software;\nDisassemble, decrypt, extract, reverse engineer or reverse compile the Software, or otherwise attempt to discover the confidential algorithms and techniques incorporated in the Software, or disclose or use any confidential information of Company in any manner, other than to the extent such actions cannot be prohibited under applicable law; or\nmodify, translate, adapt, or create derivative works from the Software."}),"\n",(0,r.jsx)(t.p,{children:"3.2\tCustomer and its Users have no right under any circumstances to obtain or have access to the source code or systems and programming documentation of the Software or any part thereof."}),"\n",(0,r.jsxs)(t.ol,{start:"4",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Evaluation License"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"If Customer registers for an evaluation version of the Software (\u201cEvaluation Version\u201d), at no additional charge, Company will make the Evaluation Version available to Customer and its authorized Users on a trial basis, free of charge, until the earlier of (a) the end of the 14 day free trial period unless agreed otherwise in writing, or (b) the start date of any license subscription purchased by the Customer corresponding to such Evaluation Version. Notwithstanding anything to the contrary, (i) the Evaluation Version is provided \u201cas-is\u201d without any representation, warranty or indemnity, or any support service, and (ii) the Evaluation Version not intended to house or contain any sensitive or production data. Company shall not be liable or responsible under any circumstances for any sensitive or production data input into such environment by Customer or any resulting loss or damage thereto."}),"\n",(0,r.jsxs)(t.ol,{start:"5",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Support"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Customer will be solely responsible for installing any updates and modifications that the Company may make available from time to time. Company will only support the most recent version of the Software."}),"\n",(0,r.jsxs)(t.ol,{start:"6",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Audit"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"During the term of this Agreement and for a period of one year thereafter, Company may, during normal business hours and upon reasonable prior notice to User, inspect the User\u2019s records, equipment and facilities relating to its use of the Software to verify Customer and its User's compliance with this Agreement."}),"\n",(0,r.jsxs)(t.ol,{start:"7",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Data"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Company may collect, process, aggregate, and use certain information, analysis, statistics, and other data generated by Customer\u2019s use of the Software (a) to confirm that the Software is being used in accordance with the rights granted under this Agreement, and (b) to drive improvements in the Software, and Company will retain ownership of such Software use data. Company agrees not to publish any of this information in a form that identifies Customer or any User. In the event Company processes personal data as a processor, such personal data will be processed by Company in accordance with applicable data protection laws."}),"\n",(0,r.jsxs)(t.ol,{start:"8",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Term"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Unless specified in your Subscription Plan and/or Invoice, this Agreement is effective for one (1) year, unless earlier terminated in accordance with the terms of this Agreement and may be renewed for successive periods of one (1) year upon timely payment of the applicable subscription fee. This Agreement and the User\u2019s right to use the Software will automatically terminate without notice in the event of (a) any failure by the User to pay fees due under this Agreement; (b) any failure by the User to comply with any of the above restrictions or any term of this Agreement. Upon expiration or earlier termination of this Agreement, the User will cease using the Software and expunge and destroy all copies of the Software in the User\u2019s possession. All provisions of clauses 3, 6, 8, 9, 10, 12 and 14 of this Agreement will survive termination."}),"\n",(0,r.jsxs)(t.ol,{start:"9",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Warranty and Disclaimer"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Each party warrants to the other that it has the required authority to enter into this Agreement. The Company warrants the Software shall perform materially in accordance with published specifications in the Documentation upon installation. To the fullest extent permitted by law, Company disclaims all warranties, express or implied, including without limitation any implied warranties of merchantability, fitness for a particular purpose, or title or noninfringement of third parties\u2019 intellectual property rights. No oral or written information or advice given by the Company or any third party in relation to the Software shall create any additional warranty."}),"\n",(0,r.jsxs)(t.ol,{start:"10",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Limitation of Liability"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Subject to the remainder of this clause, the aggregate liability of Company under or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, in respect of any and all claims, will not exceed the aggregate of the subscription fees actually paid to Company by the User in the year of the claim. In no event will Company be liable under or in connection with this Agreement for (a) any lost profits, loss of revenue, loss of business, loss of contract, loss of goodwill or loss of anticipated savings (whether direct or indirect); (b) error or interruption of use, loss or inaccuracy or corruption of data; or (c) any incidental, special, punitive, exemplary, indirect or consequential damages, arising out of or related to the Software, or the use thereof, even if Company has been advised, or is otherwise aware, of the possibility of such damages. Nothing in this Agreement will exclude or limit a party\u2019s liability to the other party for: (a) death or personal injury caused by that party\u2019s negligence; (b) wilful misconduct, fraud or fraudulent misrepresentation; (c) payment of fees or any sums due to the other party; or (d) any other matter for which it would be unlawful to exclude or attempt to exclude its liabilities."}),"\n",(0,r.jsxs)(t.ol,{start:"11",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Insurance"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"During the term of this Agreement, Company shall, at all times and at its own expense, and in amounts in accordance with industry standard for the software and services provided under this Agreement, maintain in full force and effect adequate insurance coverages"}),"\n",(0,r.jsxs)(t.ol,{start:"12",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Intellectual Property Rights"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"As between the User and Company, all right, title and interest in and to the Software and Company\u2019s trade marks and service marks are owned exclusively by Company and its licensors. To the extent that the User obtains any ownership interest in or to any derivative work or modification to the Software, the User hereby assigns (including without limitation by way of present assignment of future copyright) to Company all right, title and interest in and to such derivative works and/or modifications upon creation. The User shall, if requested by Company, do all things and execute all documents required to give effect the foregoing assignment. Other than as expressly set forth in this Agreement, no license or other rights in or to the Software thereto are granted to the User, and all such licenses and rights are hereby expressly reserved."}),"\n",(0,r.jsxs)(t.ol,{start:"13",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Publicity"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Customer hereby grants to Company the right to use its logo, service mark, and name in Company\u2019s marketing materials, including on its website. Such use by Company shall be limited to a statement that Customer is a user of specific Company Software. Any other use of a party\u2019s trade names, service marks, logos, or any other Intellectual Property right related thereto, for advertising or any other purposes, requires the express prior written consent of the other party."}),"\n",(0,r.jsxs)(t.ol,{start:"14",children:["\n",(0,r.jsx)(t.li,{children:(0,r.jsx)(t.strong,{children:"Miscellaneous"})}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"This Agreement does not create any agency or partnership relationship between the parties hereto. This\nAgreement, and any dispute arising out of or in connection with it or its subject matter, whether of a contractual\nor non-contractual nature, shall be governed by and construed in accordance with the laws of Delaware (if\nCustomer is located in the United States), or England (if Customer is located outside of the United States). The\nsole and exclusive jurisdiction and venue for any litigation arising out of this Agreement shall be the courts of\nDelaware (if Customer is located in the United States), or England (if Customer is located outside of the United\nStates). Except with respect to any current valid written and mutually executed agreement between Customer and Company pertaining to Customer\u2019s use of the Software, this Agreement constitutes the entire agreement between the parties with respect to the subject matter\nhereof and supersedes all prior agreements and understandings whether written or oral, express or implied. If\nany provision of this Agreement is held invalid, illegal or unenforceable by a court of competent jurisdiction,\nsuch shall not affect any other provision of this Agreement, which shall remain in full force and effect. No\namendment or alteration of the terms of this Agreement shall be effective unless made in writing and executed\nby both parties hereto. A failure or delay in exercising any right in respect to this Agreement will not be\npresumed to operate as a waiver, and a single or partial exercise of any right will not be presumed to preclude\nany subsequent or further exercise of that right or the exercise of any other right. Any modification or waiver of\nany provision of this Agreement shall not be effective unless made in writing. Any such waiver shall be\neffective only in the specific instance and for the purpose given."})]})}function d(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(h,{...e})}):h(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>s,a:()=>a});var r=n(7294);const i={},o=r.createContext(i);function a(e){const t=r.useContext(o);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),r.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/56c19fd2.2d92af0a.js b/assets/js/56c19fd2.2d92af0a.js new file mode 100644 index 000000000..1ae539521 --- /dev/null +++ b/assets/js/56c19fd2.2d92af0a.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5339],{5576:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>l,contentTitle:()=>i,default:()=>h,frontMatter:()=>a,metadata:()=>r,toc:()=>d});var n=t(5893),s=t(1151);const a={title:"FAQs",hide_title:!0,sidebar_position:1},i="Frequently Asked Questions",r={id:"troubleshooting/faq",title:"FAQs",description:"Solutions to some common questions can be found here. If you can't find your answer, please reach out to support@cadosecurity.com and let us know.",source:"@site/docs/troubleshooting/faq.md",sourceDirName:"troubleshooting",slug:"/troubleshooting/faq",permalink:"/troubleshooting/faq",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/troubleshooting/faq.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"FAQs",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Google Cloud Credentials",permalink:"/cado-host/google-credentials"},next:{title:"Commercial EULA",permalink:"/eula/commercial-eula"}},l={},d=[{value:"Which cloud providers does Cado support?",id:"which-cloud-providers-does-cado-support",level:3},{value:"Does Cado support memory capture?",id:"does-cado-support-memory-capture",level:3},{value:"Why do I see "Installing Cado Response" instead of the login page?",id:"why-do-i-see-installing-cado-response-instead-of-the-login-page",level:3},{value:"I deployed the Cado platform. How do I log in?",id:"i-deployed-the-cado-platform-how-do-i-log-in",level:3},{value:"Can I allow or restrict IP ranges from accessing my Cado instance?",id:"can-i-allow-or-restrict-ip-ranges-from-accessing-my-cado-instance",level:3},{value:"How can I control the lifecycle of data stored by the Cado platform?",id:"how-can-i-control-the-lifecycle-of-data-stored-by-the-cado-platform",level:3},{value:"Does the Cado platform store sensitive customer data?",id:"does-the-cado-platform-store-sensitive-customer-data",level:3},{value:"Can I monitor the health and proper function of the Cado platform?",id:"can-i-monitor-the-health-and-proper-function-of-the-cado-platform",level:3},{value:"Can I estimate the costs for running the Cado platform in AWS?",id:"can-i-estimate-the-costs-for-running-the-cado-platform-in-aws",level:3},{value:"How can I capture Logs or a Support Bundle from the Cado platform?",id:"how-can-i-capture-logs-or-a-support-bundle-from-the-cado-platform",level:3},{value:"How do I contact Support?",id:"how-do-i-contact-support",level:3},{value:"What are the Cado Service Level Agreements?",id:"what-are-the-cado-service-level-agreements",level:3},{value:"Does the Cado platform support processing of EC2s or AMIs with EBS Encryption?",id:"does-the-cado-platform-support-processing-of-ec2s-or-amis-with-ebs-encryption",level:3},{value:"If vulnerabilities are discovered within your software, are customers notified?",id:"if-vulnerabilities-are-discovered-within-your-software-are-customers-notified",level:3},{value:"How do I expand my available data storage within the Cado platform in AWS?",id:"how-do-i-expand-my-available-data-storage-within-the-cado-platform-in-aws",level:3}];function c(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(o.h1,{id:"frequently-asked-questions",children:"Frequently Asked Questions"}),"\n",(0,n.jsxs)(o.p,{children:["Solutions to some common questions can be found here. If you can't find your answer, please reach out to ",(0,n.jsx)(o.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," and let us know."]}),"\n",(0,n.jsx)(o.h3,{id:"which-cloud-providers-does-cado-support",children:"Which cloud providers does Cado support?"}),"\n",(0,n.jsx)(o.p,{children:"Cado supports native deployments in AWS and Azure. If deployed in AWS, Cado supports AWS as well as cross-cloud acquisitions from GCP and Azure."}),"\n",(0,n.jsx)(o.h3,{id:"does-cado-support-memory-capture",children:"Does Cado support memory capture?"}),"\n",(0,n.jsxs)(o.p,{children:["Yes. See ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"/cado-response/discovery-import/import/data-types/memory",children:"Memory"})})," for more details."]}),"\n",(0,n.jsx)(o.h3,{id:"why-do-i-see-installing-cado-response-instead-of-the-login-page",children:'Why do I see "Installing Cado Response" instead of the login page?'}),"\n",(0,n.jsx)(o.p,{children:'On first boot, the platform will take about 10 minutes to install. During that time, you will see "Installing Cado Response". After the one-time installation process completes, you will be presented with a login screen. During an upgrade, you will also see "Installing Cado Response" until the upgrade is complete.'}),"\n",(0,n.jsx)(o.h3,{id:"i-deployed-the-cado-platform-how-do-i-log-in",children:"I deployed the Cado platform. How do I log in?"}),"\n",(0,n.jsxs)(o.p,{children:["Navigate to the Cado instance IP ",(0,n.jsx)(o.code,{children:"https://"}),". You can initially login with the username ",(0,n.jsx)(o.code,{children:"admin"})," and the password ",(0,n.jsx)(o.code,{children:"i-xxx"})," where ",(0,n.jsx)(o.code,{children:"i-xxx"})," is the ID of your instance. After first login, you will be asked to change your password. Note that for Azure, the password is the very long Resource ID. The Resource ID can be found within your Azure Portal by navigating to ",(0,n.jsx)(o.code,{children:"Home > Virtual Machines"}),", clicking on the Cado VM name, then clicking ",(0,n.jsx)(o.code,{children:"Properties"})," on the left navigation bar. Scroll down to find the ",(0,n.jsx)(o.code,{children:"Resource ID"}),"."]}),"\n",(0,n.jsx)(o.h3,{id:"can-i-allow-or-restrict-ip-ranges-from-accessing-my-cado-instance",children:"Can I allow or restrict IP ranges from accessing my Cado instance?"}),"\n",(0,n.jsxs)(o.p,{children:["Yes, and it is strongly recommended to follow the principle of least privilege and restrict access to only those IPs which require access. In AWS, navigate to your ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://console.aws.amazon.com/ec2",children:"AWS EC2 Console"})}),', click on your Cado Instance ID, navigate to the Security tab, then click on the "Security Group" link, then "Edit Inbound Rules". Here you can add and remove access rules for the Cado instance. Note that you can also restrict access to HTTPS and SSH during the deployment process via the CloudFormation Template. In Azure, navigate to your ',(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://portal.azure.com/",children:"Azure Portal"})}),' and find the Network Security Group where your Cado VM is deployed. From there, click "Inbound security rules" and you can Add and Delete access rules. If you have deployed with an ALB then you\'ll need to update the inbound rules for the ALB secuirty group intead. Please note that the ALB will only allow HTTP/HTTPS access - SSH rules will need to be configured in the EC2 security group.']}),"\n",(0,n.jsx)(o.h3,{id:"how-can-i-control-the-lifecycle-of-data-stored-by-the-cado-platform",children:"How can I control the lifecycle of data stored by the Cado platform?"}),"\n",(0,n.jsxs)(o.p,{children:["AWS supports this through ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html",children:"Object Locks"})})," and ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://docs.aws.amazon.com/console/s3/lifecyclerules",children:"Lifecycle Rules"})})," associated with your S3 bucket. Please see the AWS documentation for more details."]}),"\n",(0,n.jsxs)(o.p,{children:["Azure supports this through ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://docs.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview",children:"Life Cycle Management Policies"})})," for your blob storage. Please see the Azure documentation for more details."]}),"\n",(0,n.jsx)(o.h3,{id:"does-the-cado-platform-store-sensitive-customer-data",children:"Does the Cado platform store sensitive customer data?"}),"\n",(0,n.jsx)(o.p,{children:"Whether sensitive customer data is stored within the Cado platform is completely dependent on what data sources and evidence is imported into the software. In all cases, data is either stored within the database on the main Cado instance, within EFS, within a customers' S3 bucket or Azure storage. Since the Cado platform is deployed within the customers' cloud environment, the customer has control over the life cycle management of the data (example: using Life Cycle management policies) as well as who has access to potential sensitive data via VPC and Subnet rules."}),"\n",(0,n.jsx)(o.h3,{id:"can-i-monitor-the-health-and-proper-function-of-the-cado-platform",children:"Can I monitor the health and proper function of the Cado platform?"}),"\n",(0,n.jsxs)(o.p,{children:['Yes. Within Cado, you can see the platform health and statistics by navigating to the "Platform" tab. This list Free Disk Space, Available Memory, Total Memory, CPU Usage and pipeline processing details. In addition, roundtrip response latency for the API ',(0,n.jsx)(o.code,{children:"/api/v2/status"})," endpoint should be less than or equal to 200ms."]}),"\n",(0,n.jsx)(o.h3,{id:"can-i-estimate-the-costs-for-running-the-cado-platform-in-aws",children:"Can I estimate the costs for running the Cado platform in AWS?"}),"\n",(0,n.jsxs)(o.p,{children:["Yes. You can view the AWS Cost Calculator for a typical Cado installation at ",(0,n.jsx)(o.a,{href:"https://calculator.s3.amazonaws.com/index.html#r=IAD&key=files/calc-bca484373bcb2d07322fd6716a197d1cdc629534&v=ver20210903uJ",children:"https://calculator.s3.amazonaws.com/index.html#r=IAD&key=files/calc-bca484373bcb2d07322fd6716a197d1cdc629534&v=ver20210903uJ"})]}),"\n",(0,n.jsx)(o.p,{children:"This includes:"}),"\n",(0,n.jsxs)(o.ul,{children:["\n",(0,n.jsx)(o.li,{children:"A central platform server running permanently with 500 GB of space for hot data access"}),"\n",(0,n.jsx)(o.li,{children:"36.5 hours (5% of the time) worker usage to process data"}),"\n",(0,n.jsx)(o.li,{children:"500 GB of permanent S3 Storage used for forensic images"}),"\n",(0,n.jsx)(o.li,{children:"50 GB of Elastic File System Storage used for file transfer downloads"}),"\n"]}),"\n",(0,n.jsx)(o.h3,{id:"how-can-i-capture-logs-or-a-support-bundle-from-the-cado-platform",children:"How can I capture Logs or a Support Bundle from the Cado platform?"}),"\n",(0,n.jsx)(o.p,{children:"The following methods for getting Logs to Cado are available, in order of ease:"}),"\n",(0,n.jsxs)(o.ol,{children:["\n",(0,n.jsxs)(o.li,{children:["Try sending logs to Cado automatically through the UI by navigating to the Help screen. Click on ",(0,n.jsx)(o.code,{children:"Send Logs to Cado"})," and this will automatically package up a bundle of logs and send them directly to Cado over HTTPS"]}),"\n",(0,n.jsxs)(o.li,{children:["If that fails, click on ",(0,n.jsx)(o.code,{children:"Download Logs"})," and upload the zip file to the Customer Portal"]}),"\n",(0,n.jsxs)(o.li,{children:["If 1 and 2 fail, or you cannot log into the platform then open an SSH session to the Cado Platform (you'll need the key you used during deployment) and execute the command ",(0,n.jsx)(o.code,{children:"sudo tar -cvzf /var/log/cado_logs.tar.gz /var/log"})," then upload the zip file to the Customer Portal."]}),"\n"]}),"\n",(0,n.jsx)(o.h3,{id:"how-do-i-contact-support",children:"How do I contact Support?"}),"\n",(0,n.jsxs)(o.p,{children:["You can contact Cado Support via email at ",(0,n.jsx)(o.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," or reach out to your account manager for more details."]}),"\n",(0,n.jsx)(o.h3,{id:"what-are-the-cado-service-level-agreements",children:"What are the Cado Service Level Agreements?"}),"\n",(0,n.jsx)(o.p,{children:"The Cado Service Level Agreements (SLAs) are part of customers' end-user license agreement. Please refer to your EULA for more details."}),"\n",(0,n.jsx)(o.h3,{id:"does-the-cado-platform-support-processing-of-ec2s-or-amis-with-ebs-encryption",children:"Does the Cado platform support processing of EC2s or AMIs with EBS Encryption?"}),"\n",(0,n.jsxs)(o.p,{children:["Yes. As of build 0.9.2.4, the ",(0,n.jsx)(o.code,{children:"kms:CreateGrant"})," and ",(0,n.jsx)(o.code,{children:"kms:Decrypt"})," permissions are enabled within the Cado role by default. If you upgraded from a build earlier than 0.9.2.4, you may need to add these permissions manually."]}),"\n",(0,n.jsx)(o.h3,{id:"if-vulnerabilities-are-discovered-within-your-software-are-customers-notified",children:"If vulnerabilities are discovered within your software, are customers notified?"}),"\n",(0,n.jsx)(o.p,{children:"Yes. Updates and notifications are provided to customers if vulnerablities or vulnerable packages are identified within our software."}),"\n",(0,n.jsx)(o.h3,{id:"how-do-i-expand-my-available-data-storage-within-the-cado-platform-in-aws",children:"How do I expand my available data storage within the Cado platform in AWS?"}),"\n",(0,n.jsxs)(o.p,{children:["Below are the steps for expanding the Cado platform data storage volume after deployment. This follows the steps as outline by AWS' documentation: ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/recognize-expanded-volume-linux.html",children:"Extend a Linux file system after resizing a volume"})})]}),"\n",(0,n.jsx)(o.admonition,{type:"warning",children:(0,n.jsxs)(o.p,{children:["Before continuing, create a snapshot of the ",(0,n.jsx)(o.code,{children:"CadoResponseDataVolume"})," volume which has the device name ",(0,n.jsx)(o.code,{children:"/dev/sdh"}),". This will ensure you have a backup of the data volume to restore, in case you encounter an issue. ",(0,n.jsx)(o.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html",children:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html"})]})}),"\n",(0,n.jsxs)(o.ol,{children:["\n",(0,n.jsxs)(o.li,{children:["Extend the ",(0,n.jsx)(o.code,{children:"/dev/sdh"})," storage volume via the AWS Console by:","\n",(0,n.jsxs)(o.ul,{children:["\n",(0,n.jsx)(o.li,{children:"Navigating to your Cado instance"}),"\n",(0,n.jsxs)(o.li,{children:["Click the ",(0,n.jsx)(o.strong,{children:"Storage"})," tab"]}),"\n",(0,n.jsxs)(o.li,{children:["Click on the volume instance ID for Device Name ",(0,n.jsx)(o.code,{children:"/dev/sdh"})]}),"\n",(0,n.jsxs)(o.li,{children:["Select the ",(0,n.jsx)(o.code,{children:"CadoResponseDataVolume"})]}),"\n",(0,n.jsxs)(o.li,{children:["Click ",(0,n.jsx)(o.strong,{children:"Actions"})]}),"\n",(0,n.jsxs)(o.li,{children:["Select ",(0,n.jsx)(o.strong,{children:"Modify Volume"})]}),"\n",(0,n.jsx)(o.li,{children:"Enter the new volume size"}),"\n",(0,n.jsxs)(o.li,{children:["Click ",(0,n.jsx)(o.strong,{children:"Modify"})]}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(o.li,{children:["SSH into the Cado instance. example: ",(0,n.jsx)(o.code,{children:'ssh -i "us-east-2.pem" admin@ec2-55-234-10-9.compute-1.amazonaws.com'})]}),"\n",(0,n.jsxs)(o.li,{children:["Run ",(0,n.jsx)(o.code,{children:"df -hT"}),". Note the Avail space for the ",(0,n.jsx)(o.code,{children:"/dev/nvme1n1"})," filesystem mounted on ",(0,n.jsx)(o.code,{children:"/home/admin/data"}),". This should display the old volume size."]}),"\n",(0,n.jsxs)(o.li,{children:["Run ",(0,n.jsx)(o.code,{children:"lsblk"})," and note the ",(0,n.jsx)(o.code,{children:"nvme1n1"})," volume SIZE mounted on ",(0,n.jsx)(o.code,{children:"/home/admin/data"}),". This should display the new volume size."]}),"\n",(0,n.jsxs)(o.li,{children:["To extend the volume and make it available to the OS, run ",(0,n.jsx)(o.code,{children:"sudo xfs_growfs -d /home/admin/data"})]}),"\n",(0,n.jsxs)(o.li,{children:["Run ",(0,n.jsx)(o.code,{children:"df -hT"})," again and note the Avail space for the ",(0,n.jsx)(o.code,{children:"/dev/nvme1n1"})," filesystem mounted on ",(0,n.jsx)(o.code,{children:"/home/admin/data"})," This should now display the new volume size."]}),"\n"]})]})}function h(e={}){const{wrapper:o}={...(0,s.a)(),...e.components};return o?(0,n.jsx)(o,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},1151:(e,o,t)=>{t.d(o,{Z:()=>r,a:()=>i});var n=t(7294);const s={},a=n.createContext(s);function i(e){const o=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),n.createElement(a.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/56c19fd2.7892d41c.js b/assets/js/56c19fd2.7892d41c.js deleted file mode 100644 index e3951d960..000000000 --- a/assets/js/56c19fd2.7892d41c.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5339],{5576:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>l,contentTitle:()=>i,default:()=>h,frontMatter:()=>a,metadata:()=>r,toc:()=>d});var n=t(5893),s=t(1151);const a={title:"FAQs",hide_title:!0,sidebar_position:1},i="Frequently Asked Questions",r={id:"troubleshooting/faq",title:"FAQs",description:"Solutions to some common questions can be found here. If you can't find your answer, please reach out to support@cadosecurity.com and let us know.",source:"@site/docs/troubleshooting/faq.md",sourceDirName:"troubleshooting",slug:"/troubleshooting/faq",permalink:"/troubleshooting/faq",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/troubleshooting/faq.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"FAQs",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Google Cloud Credentials",permalink:"/cado-host/google-credentials"},next:{title:"Commercial EULA",permalink:"/eula/commercial-eula"}},l={},d=[{value:"Which cloud providers does Cado support?",id:"which-cloud-providers-does-cado-support",level:3},{value:"Does Cado support memory capture?",id:"does-cado-support-memory-capture",level:3},{value:"Why do I see "Installing Cado Response" instead of the login page?",id:"why-do-i-see-installing-cado-response-instead-of-the-login-page",level:3},{value:"I deployed the Cado platform. How do I log in?",id:"i-deployed-the-cado-platform-how-do-i-log-in",level:3},{value:"Can I allow or restrict IP ranges from accessing my Cado instance?",id:"can-i-allow-or-restrict-ip-ranges-from-accessing-my-cado-instance",level:3},{value:"How can I control the lifecycle of data stored by the Cado platform?",id:"how-can-i-control-the-lifecycle-of-data-stored-by-the-cado-platform",level:3},{value:"Does the Cado platform store sensitive customer data?",id:"does-the-cado-platform-store-sensitive-customer-data",level:3},{value:"Can I monitor the health and proper function of the Cado platform?",id:"can-i-monitor-the-health-and-proper-function-of-the-cado-platform",level:3},{value:"Can I estimate the costs for running the Cado platform in AWS?",id:"can-i-estimate-the-costs-for-running-the-cado-platform-in-aws",level:3},{value:"How can I capture Logs or a Support Bundle from the Cado platform?",id:"how-can-i-capture-logs-or-a-support-bundle-from-the-cado-platform",level:3},{value:"How do I contact Support?",id:"how-do-i-contact-support",level:3},{value:"What are the Cado Service Level Agreements?",id:"what-are-the-cado-service-level-agreements",level:3},{value:"Does the Cado platform support processing of EC2s or AMIs with EBS Encryption?",id:"does-the-cado-platform-support-processing-of-ec2s-or-amis-with-ebs-encryption",level:3},{value:"If vulnerabilities are discovered within your software, are customers notified?",id:"if-vulnerabilities-are-discovered-within-your-software-are-customers-notified",level:3},{value:"How do I expand my available data storage within the Cado platform in AWS?",id:"how-do-i-expand-my-available-data-storage-within-the-cado-platform-in-aws",level:3}];function c(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(o.h1,{id:"frequently-asked-questions",children:"Frequently Asked Questions"}),"\n",(0,n.jsxs)(o.p,{children:["Solutions to some common questions can be found here. If you can't find your answer, please reach out to ",(0,n.jsx)(o.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," and let us know."]}),"\n",(0,n.jsx)(o.h3,{id:"which-cloud-providers-does-cado-support",children:"Which cloud providers does Cado support?"}),"\n",(0,n.jsx)(o.p,{children:"Cado supports native deployments in AWS and Azure. If deployed in AWS, Cado supports AWS as well as cross-cloud acquisitions from GCP and Azure."}),"\n",(0,n.jsx)(o.h3,{id:"does-cado-support-memory-capture",children:"Does Cado support memory capture?"}),"\n",(0,n.jsxs)(o.p,{children:["Yes. See ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"/cado-response/discovery-import/import/data-types/memory",children:"Memory"})})," for more details."]}),"\n",(0,n.jsx)(o.h3,{id:"why-do-i-see-installing-cado-response-instead-of-the-login-page",children:'Why do I see "Installing Cado Response" instead of the login page?'}),"\n",(0,n.jsx)(o.p,{children:'On first boot, the platform will take about 10 minutes to install. During that time, you will see "Installing Cado Response". After the one-time installation process completes, you will be presented with a login screen. During an upgrade, you will also see "Installing Cado Response" until the upgrade is complete.'}),"\n",(0,n.jsx)(o.h3,{id:"i-deployed-the-cado-platform-how-do-i-log-in",children:"I deployed the Cado platform. How do I log in?"}),"\n",(0,n.jsxs)(o.p,{children:["Navigate to the Cado instance IP ",(0,n.jsx)(o.code,{children:"https://"}),". You can initially login with the username ",(0,n.jsx)(o.code,{children:"admin"})," and the password ",(0,n.jsx)(o.code,{children:"i-xxx"})," where ",(0,n.jsx)(o.code,{children:"i-xxx"})," is the ID of your instance. After first login, you will be asked to change your password. Note that for Azure, the password is the very long Resource ID. The Resource ID can be found within your Azure Portal by navigating to ",(0,n.jsx)(o.code,{children:"Home > Virtual Machines"}),", clicking on the Cado VM name, then clicking ",(0,n.jsx)(o.code,{children:"Properties"})," on the left navigation bar. Scroll down to find the ",(0,n.jsx)(o.code,{children:"Resource ID"}),"."]}),"\n",(0,n.jsx)(o.h3,{id:"can-i-allow-or-restrict-ip-ranges-from-accessing-my-cado-instance",children:"Can I allow or restrict IP ranges from accessing my Cado instance?"}),"\n",(0,n.jsxs)(o.p,{children:["Yes, and it is strongly recommended to follow the principle of least privilege and restrict access to only those IPs which require access. In AWS, navigate to your ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://console.aws.amazon.com/ec2",children:"AWS EC2 Console"})}),', click on your Cado Instance ID, navigate to the Security tab, then click on the "Security Group" link, then "Edit Inbound Rules". Here you can add and remove access rules for the Cado instance. Note that you can also restrict access to HTTPS and SSH during the deployment process via the CloudFormation Template. In Azure, navigate to your ',(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://portal.azure.com/",children:"Azure Portal"})}),' and find the Network Security Group where your Cado VM is deployed. From there, click "Inbound security rules" and you can Add and Delete access rules. If you have deployed with an ALB then you\'ll need to update the inbound rules for the ALB secuirty group intead. Please note that the ALB will only allow HTTP/HTTPS access - SSH rules will need to be configured in the EC2 security group.']}),"\n",(0,n.jsx)(o.h3,{id:"how-can-i-control-the-lifecycle-of-data-stored-by-the-cado-platform",children:"How can I control the lifecycle of data stored by the Cado platform?"}),"\n",(0,n.jsxs)(o.p,{children:["AWS supports this through ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html",children:"Object Locks"})})," and ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://docs.aws.amazon.com/console/s3/lifecyclerules",children:"Lifecycle Rules"})})," associated with your S3 bucket. Please see the AWS documentation for more details."]}),"\n",(0,n.jsxs)(o.p,{children:["Azure supports this through ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://docs.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview",children:"Life Cycle Management Policies"})})," for your blob storage. Please see the Azure documentation for more details."]}),"\n",(0,n.jsx)(o.h3,{id:"does-the-cado-platform-store-sensitive-customer-data",children:"Does the Cado platform store sensitive customer data?"}),"\n",(0,n.jsx)(o.p,{children:"Whether sensitive customer data is stored within the Cado platform is completely dependent on what data sources and evidence is imported into the software. In all cases, data is either stored within the database on the main Cado instance, within EFS, within a customers' S3 bucket or Azure storage. Since the Cado platform is deployed within the customers' cloud environment, the customer has control over the life cycle management of the data (example: using Life Cycle management policies) as well as who has access to potential sensitive data via VPC and Subnet rules."}),"\n",(0,n.jsx)(o.h3,{id:"can-i-monitor-the-health-and-proper-function-of-the-cado-platform",children:"Can I monitor the health and proper function of the Cado platform?"}),"\n",(0,n.jsxs)(o.p,{children:['Yes. Within Cado, you can see the platform health and statistics by navigating to the "Platform" tab. This list Free Disk Space, Available Memory, Total Memory, CPU Usage and pipeline processing details. In addition, roundtrip response latency for the API ',(0,n.jsx)(o.code,{children:"/api/v2/status"})," endpoint should be less than or equal to 200ms."]}),"\n",(0,n.jsx)(o.h3,{id:"can-i-estimate-the-costs-for-running-the-cado-platform-in-aws",children:"Can I estimate the costs for running the Cado platform in AWS?"}),"\n",(0,n.jsxs)(o.p,{children:["Yes. You can view the AWS Cost Calculator for a typical Cado installation at ",(0,n.jsx)(o.a,{href:"https://calculator.s3.amazonaws.com/index.html#r=IAD&key=files/calc-bca484373bcb2d07322fd6716a197d1cdc629534&v=ver20210903uJ",children:"https://calculator.s3.amazonaws.com/index.html#r=IAD&key=files/calc-bca484373bcb2d07322fd6716a197d1cdc629534&v=ver20210903uJ"})]}),"\n",(0,n.jsx)(o.p,{children:"This includes:"}),"\n",(0,n.jsxs)(o.ul,{children:["\n",(0,n.jsx)(o.li,{children:"A central platform server running permanently with 500 GB of space for hot data access"}),"\n",(0,n.jsx)(o.li,{children:"36.5 hours (5% of the time) worker usage to process data"}),"\n",(0,n.jsx)(o.li,{children:"500 GB of permanent S3 Storage used for forensic images"}),"\n",(0,n.jsx)(o.li,{children:"50 GB of Elastic File System Storage used for file transfer downloads"}),"\n"]}),"\n",(0,n.jsx)(o.h3,{id:"how-can-i-capture-logs-or-a-support-bundle-from-the-cado-platform",children:"How can I capture Logs or a Support Bundle from the Cado platform?"}),"\n",(0,n.jsx)(o.p,{children:"The following methods for getting Logs to Cado are available, in order of ease:"}),"\n",(0,n.jsxs)(o.ol,{children:["\n",(0,n.jsxs)(o.li,{children:["Try sending logs to Cado automatically through the UI by navigating to the Help screen. Click on ",(0,n.jsx)(o.code,{children:"Send Logs to Cado"})," and this will automatically package up a bundle of logs and send them directly to Cado over HTTPS"]}),"\n",(0,n.jsxs)(o.li,{children:["If that fails, click on ",(0,n.jsx)(o.code,{children:"Download Logs"})," and upload the zip file to the Customer Portal"]}),"\n",(0,n.jsxs)(o.li,{children:["If 1 and 2 fail, or you cannot log into the platform then open an SSH session to the Cado Platform (you'll need the key you used during deployment) and execute the command ",(0,n.jsx)(o.code,{children:"sudo tar -cvzf /var/log/cado_logs.tar.gz /var/log"})," then upload the zip file to the Customer Portal."]}),"\n"]}),"\n",(0,n.jsx)(o.h3,{id:"how-do-i-contact-support",children:"How do I contact Support?"}),"\n",(0,n.jsxs)(o.p,{children:["You can contact Cado Support via email at ",(0,n.jsx)(o.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," or reach out to your account manager for more details."]}),"\n",(0,n.jsx)(o.h3,{id:"what-are-the-cado-service-level-agreements",children:"What are the Cado Service Level Agreements?"}),"\n",(0,n.jsx)(o.p,{children:"The Cado Service Level Agreements (SLAs) are part of customers' end-user license agreement. Please refer to your EULA for more details."}),"\n",(0,n.jsx)(o.h3,{id:"does-the-cado-platform-support-processing-of-ec2s-or-amis-with-ebs-encryption",children:"Does the Cado platform support processing of EC2s or AMIs with EBS Encryption?"}),"\n",(0,n.jsxs)(o.p,{children:["Yes. As of build 0.9.2.4, the ",(0,n.jsx)(o.code,{children:"kms:CreateGrant"})," and ",(0,n.jsx)(o.code,{children:"kms:Decrypt"})," permissions are enabled within the Cado role by default. If you upgraded from a build earlier than 0.9.2.4, you may need to add these permissions manually."]}),"\n",(0,n.jsx)(o.h3,{id:"if-vulnerabilities-are-discovered-within-your-software-are-customers-notified",children:"If vulnerabilities are discovered within your software, are customers notified?"}),"\n",(0,n.jsx)(o.p,{children:"Yes. Updates and notifications are provided to customers if vulnerablities or vulnerable packages are identified within our software."}),"\n",(0,n.jsx)(o.h3,{id:"how-do-i-expand-my-available-data-storage-within-the-cado-platform-in-aws",children:"How do I expand my available data storage within the Cado platform in AWS?"}),"\n",(0,n.jsxs)(o.p,{children:["Below are the steps for expanding the Cado platform data storage volume after deployment. This follows the steps as outline by AWS' documentation: ",(0,n.jsx)(o.strong,{children:(0,n.jsx)(o.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/recognize-expanded-volume-linux.html",children:"Extend a Linux file system after resizing a volume"})})]}),"\n",(0,n.jsx)(o.admonition,{type:"warning",children:(0,n.jsxs)(o.p,{children:["Before continuing, create a snapshot of the ",(0,n.jsx)(o.code,{children:"CadoResponseDataVolume"})," volume which has the device name ",(0,n.jsx)(o.code,{children:"/dev/sdh"}),". This will ensure you have a backup of the data volume to restore, in case you encounter an issue. ",(0,n.jsx)(o.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html",children:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-creating-snapshot.html"})]})}),"\n",(0,n.jsxs)(o.ol,{children:["\n",(0,n.jsxs)(o.li,{children:["Extend the ",(0,n.jsx)(o.code,{children:"/dev/sdh"})," storage volume via the AWS Console by:","\n",(0,n.jsxs)(o.ul,{children:["\n",(0,n.jsx)(o.li,{children:"Navigating to your Cado instance"}),"\n",(0,n.jsxs)(o.li,{children:["Click the ",(0,n.jsx)(o.strong,{children:"Storage"})," tab"]}),"\n",(0,n.jsxs)(o.li,{children:["Click on the volume instance ID for Device Name ",(0,n.jsx)(o.code,{children:"/dev/sdh"})]}),"\n",(0,n.jsxs)(o.li,{children:["Select the ",(0,n.jsx)(o.code,{children:"CadoResponseDataVolume"})]}),"\n",(0,n.jsxs)(o.li,{children:["Click ",(0,n.jsx)(o.strong,{children:"Actions"})]}),"\n",(0,n.jsxs)(o.li,{children:["Select ",(0,n.jsx)(o.strong,{children:"Modify Volume"})]}),"\n",(0,n.jsx)(o.li,{children:"Enter the new volume size"}),"\n",(0,n.jsxs)(o.li,{children:["Click ",(0,n.jsx)(o.strong,{children:"Modify"})]}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(o.li,{children:["SSH into the Cado instance. example: ",(0,n.jsx)(o.code,{children:'ssh -i "us-east-2.pem" admin@ec2-55-234-10-9.compute-1.amazonaws.com'})]}),"\n",(0,n.jsxs)(o.li,{children:["Run ",(0,n.jsx)(o.code,{children:"df -hT"}),". Note the Avail space for the ",(0,n.jsx)(o.code,{children:"/dev/nvme1n1"})," filesystem mounted on ",(0,n.jsx)(o.code,{children:"/home/admin/data"}),". This should display the old volume size."]}),"\n",(0,n.jsxs)(o.li,{children:["Run ",(0,n.jsx)(o.code,{children:"lsblk"})," and note the ",(0,n.jsx)(o.code,{children:"nvme1n1"})," volume SIZE mounted on ",(0,n.jsx)(o.code,{children:"/home/admin/data"}),". This should display the new volume size."]}),"\n",(0,n.jsxs)(o.li,{children:["To extend the volume and make it available to the OS, run ",(0,n.jsx)(o.code,{children:"sudo xfs_growfs -d /home/admin/data"})]}),"\n",(0,n.jsxs)(o.li,{children:["Run ",(0,n.jsx)(o.code,{children:"df -hT"})," again and note the Avail space for the ",(0,n.jsx)(o.code,{children:"/dev/nvme1n1"})," filesystem mounted on ",(0,n.jsx)(o.code,{children:"/home/admin/data"})," This should now display the new volume size."]}),"\n"]})]})}function h(e={}){const{wrapper:o}={...(0,s.a)(),...e.components};return o?(0,n.jsx)(o,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},1151:(e,o,t)=>{t.d(o,{Z:()=>r,a:()=>i});var n=t(7294);const s={},a=n.createContext(s);function i(e){const o=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),n.createElement(a.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/587867c6.042dbd59.js b/assets/js/587867c6.042dbd59.js new file mode 100644 index 000000000..ffedf6974 --- /dev/null +++ b/assets/js/587867c6.042dbd59.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3142],{5604:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>n,default:()=>p,frontMatter:()=>r,metadata:()=>a,toc:()=>m});var s=o(5893),i=o(1151);const r={title:"AWS Memory Analysis",hide_title:!0,sidebar_position:7},n="AWS Memory Analysis",a={id:"cado-response/discovery-import/import/aws/memory",title:"AWS Memory Analysis",description:'You can acquire memory of Linux systems in EC2 by using the "Triage Acquisition" option under Import > EC2:',source:"@site/docs/cado-response/discovery-import/import/aws/memory.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/memory",permalink:"/cado-response/discovery-import/import/aws/memory",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/memory.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:7,frontMatter:{title:"AWS Memory Analysis",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Lambda",permalink:"/cado-response/discovery-import/import/aws/aws-lambda"},next:{title:"Lightsail",permalink:"/cado-response/discovery-import/import/aws/aws-lightsail"}},c={},m=[];function d(e){const t={h1:"h1",img:"img",p:"p",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"aws-memory-analysis",children:"AWS Memory Analysis"}),"\n",(0,s.jsx)(t.p,{children:'You can acquire memory of Linux systems in EC2 by using the "Triage Acquisition" option under Import > EC2:'}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"AWS Memory",src:o(877).Z+"",width:"1648",height:"284"})}),"\n",(0,s.jsx)(t.p,{children:"This requires the AWS SSM agent to be running on the EC2 and registered within the AWS Systems Manager. If it is not, you can acquire memory by connecting to the machine over SSH or RDP and executing Cado Host from Import > Forensic Artifacts. You can also use this method to acquire from Windows systems."}),"\n",(0,s.jsx)(t.p,{children:"Any acquisition from ECS and EKS will attempt to collect memory by default."})]})}function p(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},877:(e,t,o)=>{o.d(t,{Z:()=>s});const s=o.p+"assets/images/alternate-ec2-1d44379783163049a09c15fbf9a92565.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>a,a:()=>n});var s=o(7294);const i={},r=s.createContext(i);function n(e){const t=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:n(e.components),s.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/587867c6.75218c37.js b/assets/js/587867c6.75218c37.js deleted file mode 100644 index a2d92ddb0..000000000 --- a/assets/js/587867c6.75218c37.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3142],{5604:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>n,default:()=>p,frontMatter:()=>r,metadata:()=>a,toc:()=>m});var s=o(5893),i=o(1151);const r={title:"AWS Memory Analysis",hide_title:!0,sidebar_position:7},n="AWS Memory Analysis",a={id:"cado-response/discovery-import/import/aws/memory",title:"AWS Memory Analysis",description:'You can acquire memory of Linux systems in EC2 by using the "Triage Acquisition" option under Import > EC2:',source:"@site/docs/cado-response/discovery-import/import/aws/memory.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/memory",permalink:"/cado-response/discovery-import/import/aws/memory",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/memory.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:7,frontMatter:{title:"AWS Memory Analysis",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Lambda",permalink:"/cado-response/discovery-import/import/aws/aws-lambda"},next:{title:"Lightsail",permalink:"/cado-response/discovery-import/import/aws/aws-lightsail"}},c={},m=[];function d(e){const t={h1:"h1",img:"img",p:"p",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"aws-memory-analysis",children:"AWS Memory Analysis"}),"\n",(0,s.jsx)(t.p,{children:'You can acquire memory of Linux systems in EC2 by using the "Triage Acquisition" option under Import > EC2:'}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"AWS Memory",src:o(877).Z+"",width:"1648",height:"284"})}),"\n",(0,s.jsx)(t.p,{children:"This requires the AWS SSM agent to be running on the EC2 and registered within the AWS Systems Manager. If it is not, you can acquire memory by connecting to the machine over SSH or RDP and executing Cado Host from Import > Forensic Artifacts. You can also use this method to acquire from Windows systems."}),"\n",(0,s.jsx)(t.p,{children:"Any acquisition from ECS and EKS will attempt to collect memory by default."})]})}function p(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},877:(e,t,o)=>{o.d(t,{Z:()=>s});const s=o.p+"assets/images/alternate-ec2-1d44379783163049a09c15fbf9a92565.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>a,a:()=>n});var s=o(7294);const i={},r=s.createContext(i);function n(e){const t=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:n(e.components),s.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/58f8757e.8006ab77.js b/assets/js/58f8757e.8006ab77.js deleted file mode 100644 index 73f6cd6bd..000000000 --- a/assets/js/58f8757e.8006ab77.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7305],{6104:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>n,default:()=>l,frontMatter:()=>a,metadata:()=>r,toc:()=>p});var o=s(5893),i=s(1151);const a={title:"EC2 and EBS",hide_title:!0,sidebar_position:1},n="AWS EC2 and EBS Support",r={id:"cado-response/discovery-import/import/aws/aws-ec2",title:"EC2 and EBS",description:"Cado supports acquisition of EC2 instances. Select the region, and this will populate a list of EC2 instances available. You can filter the list of instances and buckets by instance ID, name, state or public IP address. Select the instance you wish to acquire.",source:"@site/docs/cado-response/discovery-import/import/aws/aws-ec2.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/aws-ec2",permalink:"/cado-response/discovery-import/import/aws/aws-ec2",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/aws-ec2.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"EC2 and EBS",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Supported Import Types",permalink:"/cado-response/discovery-import/import/data-types/import-types"},next:{title:"S3",permalink:"/cado-response/discovery-import/import/aws/aws-s3"}},c={},p=[{value:"Capture Options",id:"capture-options",level:2},{value:"Triage Capture",id:"triage-capture",level:3}];function d(e){const t={a:"a",h1:"h1",h2:"h2",h3:"h3",img:"img",p:"p",...(0,i.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"aws-ec2-and-ebs-support",children:"AWS EC2 and EBS Support"}),"\n",(0,o.jsx)(t.p,{children:"Cado supports acquisition of EC2 instances. Select the region, and this will populate a list of EC2 instances available. You can filter the list of instances and buckets by instance ID, name, state or public IP address. Select the instance you wish to acquire."}),"\n",(0,o.jsx)(t.p,{children:(0,o.jsx)(t.img,{alt:"AWS EC2 Import",src:s(120).Z+"",width:"1782",height:"682"})}),"\n",(0,o.jsx)(t.p,{children:'Click on "Continue" .'}),"\n",(0,o.jsx)(t.h2,{id:"capture-options",children:"Capture Options"}),"\n",(0,o.jsx)(t.p,{children:"For volume capture, set the options for what data you want to capture."}),"\n",(0,o.jsx)(t.h3,{id:"triage-capture",children:"Triage Capture"}),"\n",(0,o.jsx)(t.p,{children:'To perform a faster triage collection on an EC2 instance using Cado Host, select the button "Use Alternate Triage Acquisition". Please note that this requires that SSM be enabled on the target instance. This will also collect memory from Linux systems.'}),"\n",(0,o.jsxs)(t.p,{children:["For more information about about what Cado Host collects see ",(0,o.jsx)(t.a,{href:"/cado-host/artifacts",children:"Collected Artifacts"})]}),"\n",(0,o.jsx)(t.p,{children:(0,o.jsx)(t.img,{alt:"AWS EC2 details",src:s(1688).Z+"",width:"1802",height:"698"})}),"\n",(0,o.jsx)(t.p,{children:"Click 'Continue', review your selections and click 'Start Import'."})]})}function l(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},1688:(e,t,s)=>{s.d(t,{Z:()=>o});const o=s.p+"assets/images/aws-ec2-options-6ed97f87d0be5572de87c513ede46304.png"},120:(e,t,s)=>{s.d(t,{Z:()=>o});const o=s.p+"assets/images/aws-ec2-90029871d7a092c458840a666b860193.png"},1151:(e,t,s)=>{s.d(t,{Z:()=>r,a:()=>n});var o=s(7294);const i={},a=o.createContext(i);function n(e){const t=o.useContext(a);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:n(e.components),o.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/58f8757e.be9846df.js b/assets/js/58f8757e.be9846df.js new file mode 100644 index 000000000..9e2fc0ed1 --- /dev/null +++ b/assets/js/58f8757e.be9846df.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7305],{6104:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>n,default:()=>l,frontMatter:()=>a,metadata:()=>r,toc:()=>p});var o=s(5893),i=s(1151);const a={title:"EC2 and EBS",hide_title:!0,sidebar_position:1},n="AWS EC2 and EBS Support",r={id:"cado-response/discovery-import/import/aws/aws-ec2",title:"EC2 and EBS",description:"Cado supports acquisition of EC2 instances. Select the region, and this will populate a list of EC2 instances available. You can filter the list of instances and buckets by instance ID, name, state or public IP address. Select the instance you wish to acquire.",source:"@site/docs/cado-response/discovery-import/import/aws/aws-ec2.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/aws-ec2",permalink:"/cado-response/discovery-import/import/aws/aws-ec2",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/aws-ec2.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"EC2 and EBS",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Supported Import Types",permalink:"/cado-response/discovery-import/import/data-types/import-types"},next:{title:"S3",permalink:"/cado-response/discovery-import/import/aws/aws-s3"}},c={},p=[{value:"Capture Options",id:"capture-options",level:2},{value:"Triage Capture",id:"triage-capture",level:3}];function d(e){const t={a:"a",h1:"h1",h2:"h2",h3:"h3",img:"img",p:"p",...(0,i.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"aws-ec2-and-ebs-support",children:"AWS EC2 and EBS Support"}),"\n",(0,o.jsx)(t.p,{children:"Cado supports acquisition of EC2 instances. Select the region, and this will populate a list of EC2 instances available. You can filter the list of instances and buckets by instance ID, name, state or public IP address. Select the instance you wish to acquire."}),"\n",(0,o.jsx)(t.p,{children:(0,o.jsx)(t.img,{alt:"AWS EC2 Import",src:s(120).Z+"",width:"1782",height:"682"})}),"\n",(0,o.jsx)(t.p,{children:'Click on "Continue" .'}),"\n",(0,o.jsx)(t.h2,{id:"capture-options",children:"Capture Options"}),"\n",(0,o.jsx)(t.p,{children:"For volume capture, set the options for what data you want to capture."}),"\n",(0,o.jsx)(t.h3,{id:"triage-capture",children:"Triage Capture"}),"\n",(0,o.jsx)(t.p,{children:'To perform a faster triage collection on an EC2 instance using Cado Host, select the button "Use Alternate Triage Acquisition". Please note that this requires that SSM be enabled on the target instance. This will also collect memory from Linux systems.'}),"\n",(0,o.jsxs)(t.p,{children:["For more information about about what Cado Host collects see ",(0,o.jsx)(t.a,{href:"/cado-host/artifacts",children:"Collected Artifacts"})]}),"\n",(0,o.jsx)(t.p,{children:(0,o.jsx)(t.img,{alt:"AWS EC2 details",src:s(1688).Z+"",width:"1802",height:"698"})}),"\n",(0,o.jsx)(t.p,{children:"Click 'Continue', review your selections and click 'Start Import'."})]})}function l(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},1688:(e,t,s)=>{s.d(t,{Z:()=>o});const o=s.p+"assets/images/aws-ec2-options-6ed97f87d0be5572de87c513ede46304.png"},120:(e,t,s)=>{s.d(t,{Z:()=>o});const o=s.p+"assets/images/aws-ec2-90029871d7a092c458840a666b860193.png"},1151:(e,t,s)=>{s.d(t,{Z:()=>r,a:()=>n});var o=s(7294);const i={},a=o.createContext(i);function n(e){const t=o.useContext(a);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:n(e.components),o.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5a1b009a.18757579.js b/assets/js/5a1b009a.18757579.js deleted file mode 100644 index 56f71863e..000000000 --- a/assets/js/5a1b009a.18757579.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8320],{4776:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>c,contentTitle:()=>o,default:()=>h,frontMatter:()=>l,metadata:()=>r,toc:()=>a});var s=i(5893),t=i(1151);const l={title:"Collected Artifacts",hide_title:!0,sidebar_position:3},o="Collected Artifacts",r={id:"cado-host/artifacts",title:"Collected Artifacts",description:"Cado Host collects a number of artifacts by default, based on the operating system. Note that you can configure additonal files and folders to be collected by defining the --additionalfiles parameter when running Cado Host. See the --additionalfiles Command Line Parameters for more details.",source:"@site/docs/cado-host/artifacts.md",sourceDirName:"cado-host",slug:"/cado-host/artifacts",permalink:"/cado-host/artifacts",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-host/artifacts.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:3,frontMatter:{title:"Collected Artifacts",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Deploying",permalink:"/cado-host/deploy"},next:{title:"AWS Credentials",permalink:"/cado-host/aws-credentials"}},c={},a=[{value:"Volatile Data",id:"volatile-data",level:3},{value:"Linux and OSX",id:"linux-and-osx",level:3},{value:"Windows",id:"windows",level:3}];function d(e){const n={a:"a",code:"code",em:"em",h1:"h1",h3:"h3",li:"li",p:"p",strong:"strong",ul:"ul",...(0,t.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"collected-artifacts",children:"Collected Artifacts"}),"\n",(0,s.jsxs)(n.p,{children:["Cado Host collects a number of artifacts by default, based on the operating system. Note that you can configure additonal files and folders to be collected by defining the --additional_files parameter when running Cado Host. See the ",(0,s.jsx)(n.code,{children:"--additional_files"})," ",(0,s.jsx)(n.strong,{children:(0,s.jsx)(n.a,{href:"deploy#command-line-parameters",children:"Command Line Parameters"})})," for more details."]}),"\n",(0,s.jsx)(n.h3,{id:"volatile-data",children:"Volatile Data"}),"\n",(0,s.jsx)(n.p,{children:"Cado Host collects the following volatile data available at the time Cado Host is executed"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Data about running processes"}),"\n",(0,s.jsxs)(n.li,{children:["Memory of running proccesses on a per-process basis ",(0,s.jsxs)(n.em,{children:["(note - memory collection on Windows is disabled by default; ",(0,s.jsx)(n.a,{href:"deploy#command-line-parameters",children:"see Command Line Parameters"})," )"]})]}),"\n",(0,s.jsx)(n.li,{children:"Netstat data of active connections"}),"\n",(0,s.jsx)(n.li,{children:"The contents of open files - for example running binaries"}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"linux-and-osx",children:"Linux and OSX"}),"\n",(0,s.jsx)(n.p,{children:"Cado Host collects the following artifacts on Linux and OSX, when available:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:".bash_history"}),"\n",(0,s.jsx)(n.li,{children:".ssh/known_hosts"}),"\n",(0,s.jsx)(n.li,{children:"/.fseventsd"}),"\n",(0,s.jsx)(n.li,{children:"/Library/LaunchAgents"}),"\n",(0,s.jsx)(n.li,{children:"/Library/LaunchDaemons"}),"\n",(0,s.jsx)(n.li,{children:"/Library/Preferences/SystemConfiguration"}),"\n",(0,s.jsx)(n.li,{children:"/Library/Receipts/InstallHistory.plist"}),"\n",(0,s.jsx)(n.li,{children:"/Library/StartupItems"}),"\n",(0,s.jsx)(n.li,{children:"/System/Library/LaunchAgents"}),"\n",(0,s.jsx)(n.li,{children:"/System/Library/LaunchDaemons"}),"\n",(0,s.jsx)(n.li,{children:"/System/Library/StartupItems"}),"\n",(0,s.jsx)(n.li,{children:"/etc/group"}),"\n",(0,s.jsx)(n.li,{children:"/etc/hosts"}),"\n",(0,s.jsx)(n.li,{children:"/etc/hosts.allow"}),"\n",(0,s.jsx)(n.li,{children:"/etc/hosts.deny"}),"\n",(0,s.jsx)(n.li,{children:"/etc/httpd/logs/"}),"\n",(0,s.jsx)(n.li,{children:"/etc/passwd"}),"\n",(0,s.jsx)(n.li,{children:"/etc/rc.d"}),"\n",(0,s.jsx)(n.li,{children:"/etc/utmp"}),"\n",(0,s.jsx)(n.li,{children:"/private/var/log/"}),"\n",(0,s.jsx)(n.li,{children:"/root/.bash_history"}),"\n",(0,s.jsx)(n.li,{children:"/var/adm/wtmp"}),"\n",(0,s.jsx)(n.li,{children:"/var/db/application_usage.sqlite"}),"\n",(0,s.jsx)(n.li,{children:"/var/log"}),"\n",(0,s.jsx)(n.li,{children:"/var/run/utmp"}),"\n",(0,s.jsx)(n.li,{children:"/var/run/wtmp"}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"windows",children:"Windows"}),"\n",(0,s.jsx)(n.p,{children:"Cado Host collects the following artifacts on Windows, when available:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Running Processes"}),"\n",(0,s.jsx)(n.li,{children:"Active Network Connections"}),"\n",(0,s.jsx)(n.li,{children:"$MFT"}),"\n",(0,s.jsx)(n.li,{children:"ALLUSERSPROFILE\\McAfee\\DesktopProtection\\AccessProtectionLog.txt"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Apple Computer\\Safari\\Cookies\\Cookies.binarycookies"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\ConnectedDevicesPlatform"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Google\\Chrome\\User Data\\Default\\Extensions"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Google\\Chrome\\User Data\\Default\\History"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Microsoft\\Windows\\Explorer"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Microsoft\\Windows\\FileHistory\\Configuration"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Microsoft\\Windows\\UsrClass.dat"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Microsoft\\Windows\\WebCache"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Roaming\\Microsoft\\Windows\\Recent"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Roaming\\Mozilla\\Firefox\\Profiles\\"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Roaming\\Opera\\Opera\\global_history.dat"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Roaming\\Opera\\Opera\\typed_history.xml"}),"\n",(0,s.jsx)(n.li,{children:"NTUSER.DAT"}),"\n",(0,s.jsx)(n.li,{children:"NTUSER.DAT.LOG1"}),"\n",(0,s.jsx)(n.li,{children:"NTUSER.DAT.LOG2"}),"\n",(0,s.jsx)(n.li,{children:"PROGRAMDATA\\McAfee\\DesktopProtection\\AccessProtectionLog.txt"}),"\n",(0,s.jsx)(n.li,{children:"PROGRAMDATA\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\AppCompat\\Programs\\AmCache.hve"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\Prefetch"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\SchedLgU.Txt"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\Config\\AppEvent.evt"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\Config\\SecEvent.evt"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\Config\\SysEvent.evt"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\LogFiles\\W3SVC1"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\Tasks"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SAM"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SAM.LOG1"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SAM.LOG2"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SECURITY"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SECURITY.LOG1"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SECURITY.LOG2"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SOFTWARE"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SOFTWARE.LOG1"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SOFTWARE.LOG2"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SYSTEM"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SYSTEM.LOG1"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SYSTEM.LOG2"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\drivers\\etc\\hosts"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\sru"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\winevt\\logs"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\Tasks"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\inf\\setupapi.dev.log"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\inf\\setupapi.log"}),"\n",(0,s.jsx)(n.li,{children:"inetpub\\logs\\LogFiles"}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},1151:(e,n,i)=>{i.d(n,{Z:()=>r,a:()=>o});var s=i(7294);const t={},l=s.createContext(t);function o(e){const n=s.useContext(l);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),s.createElement(l.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5a1b009a.9359a2c9.js b/assets/js/5a1b009a.9359a2c9.js new file mode 100644 index 000000000..0fecae643 --- /dev/null +++ b/assets/js/5a1b009a.9359a2c9.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8320],{4776:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>c,contentTitle:()=>o,default:()=>h,frontMatter:()=>l,metadata:()=>r,toc:()=>a});var s=i(5893),t=i(1151);const l={title:"Collected Artifacts",hide_title:!0,sidebar_position:3},o="Collected Artifacts",r={id:"cado-host/artifacts",title:"Collected Artifacts",description:"Cado Host collects a number of artifacts by default, based on the operating system. Note that you can configure additonal files and folders to be collected by defining the --additionalfiles parameter when running Cado Host. See the --additionalfiles Command Line Parameters for more details.",source:"@site/docs/cado-host/artifacts.md",sourceDirName:"cado-host",slug:"/cado-host/artifacts",permalink:"/cado-host/artifacts",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-host/artifacts.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:3,frontMatter:{title:"Collected Artifacts",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Deploying",permalink:"/cado-host/deploy"},next:{title:"AWS Credentials",permalink:"/cado-host/aws-credentials"}},c={},a=[{value:"Volatile Data",id:"volatile-data",level:3},{value:"Linux and OSX",id:"linux-and-osx",level:3},{value:"Windows",id:"windows",level:3}];function d(e){const n={a:"a",code:"code",em:"em",h1:"h1",h3:"h3",li:"li",p:"p",strong:"strong",ul:"ul",...(0,t.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"collected-artifacts",children:"Collected Artifacts"}),"\n",(0,s.jsxs)(n.p,{children:["Cado Host collects a number of artifacts by default, based on the operating system. Note that you can configure additonal files and folders to be collected by defining the --additional_files parameter when running Cado Host. See the ",(0,s.jsx)(n.code,{children:"--additional_files"})," ",(0,s.jsx)(n.strong,{children:(0,s.jsx)(n.a,{href:"deploy#command-line-parameters",children:"Command Line Parameters"})})," for more details."]}),"\n",(0,s.jsx)(n.h3,{id:"volatile-data",children:"Volatile Data"}),"\n",(0,s.jsx)(n.p,{children:"Cado Host collects the following volatile data available at the time Cado Host is executed"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Data about running processes"}),"\n",(0,s.jsxs)(n.li,{children:["Memory of running proccesses on a per-process basis ",(0,s.jsxs)(n.em,{children:["(note - memory collection on Windows is disabled by default; ",(0,s.jsx)(n.a,{href:"deploy#command-line-parameters",children:"see Command Line Parameters"})," )"]})]}),"\n",(0,s.jsx)(n.li,{children:"Netstat data of active connections"}),"\n",(0,s.jsx)(n.li,{children:"The contents of open files - for example running binaries"}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"linux-and-osx",children:"Linux and OSX"}),"\n",(0,s.jsx)(n.p,{children:"Cado Host collects the following artifacts on Linux and OSX, when available:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:".bash_history"}),"\n",(0,s.jsx)(n.li,{children:".ssh/known_hosts"}),"\n",(0,s.jsx)(n.li,{children:"/.fseventsd"}),"\n",(0,s.jsx)(n.li,{children:"/Library/LaunchAgents"}),"\n",(0,s.jsx)(n.li,{children:"/Library/LaunchDaemons"}),"\n",(0,s.jsx)(n.li,{children:"/Library/Preferences/SystemConfiguration"}),"\n",(0,s.jsx)(n.li,{children:"/Library/Receipts/InstallHistory.plist"}),"\n",(0,s.jsx)(n.li,{children:"/Library/StartupItems"}),"\n",(0,s.jsx)(n.li,{children:"/System/Library/LaunchAgents"}),"\n",(0,s.jsx)(n.li,{children:"/System/Library/LaunchDaemons"}),"\n",(0,s.jsx)(n.li,{children:"/System/Library/StartupItems"}),"\n",(0,s.jsx)(n.li,{children:"/etc/group"}),"\n",(0,s.jsx)(n.li,{children:"/etc/hosts"}),"\n",(0,s.jsx)(n.li,{children:"/etc/hosts.allow"}),"\n",(0,s.jsx)(n.li,{children:"/etc/hosts.deny"}),"\n",(0,s.jsx)(n.li,{children:"/etc/httpd/logs/"}),"\n",(0,s.jsx)(n.li,{children:"/etc/passwd"}),"\n",(0,s.jsx)(n.li,{children:"/etc/rc.d"}),"\n",(0,s.jsx)(n.li,{children:"/etc/utmp"}),"\n",(0,s.jsx)(n.li,{children:"/private/var/log/"}),"\n",(0,s.jsx)(n.li,{children:"/root/.bash_history"}),"\n",(0,s.jsx)(n.li,{children:"/var/adm/wtmp"}),"\n",(0,s.jsx)(n.li,{children:"/var/db/application_usage.sqlite"}),"\n",(0,s.jsx)(n.li,{children:"/var/log"}),"\n",(0,s.jsx)(n.li,{children:"/var/run/utmp"}),"\n",(0,s.jsx)(n.li,{children:"/var/run/wtmp"}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"windows",children:"Windows"}),"\n",(0,s.jsx)(n.p,{children:"Cado Host collects the following artifacts on Windows, when available:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Running Processes"}),"\n",(0,s.jsx)(n.li,{children:"Active Network Connections"}),"\n",(0,s.jsx)(n.li,{children:"$MFT"}),"\n",(0,s.jsx)(n.li,{children:"ALLUSERSPROFILE\\McAfee\\DesktopProtection\\AccessProtectionLog.txt"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Apple Computer\\Safari\\Cookies\\Cookies.binarycookies"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\ConnectedDevicesPlatform"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Google\\Chrome\\User Data\\Default\\Extensions"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Google\\Chrome\\User Data\\Default\\History"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Microsoft\\Windows\\Explorer"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Microsoft\\Windows\\FileHistory\\Configuration"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Microsoft\\Windows\\UsrClass.dat"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Local\\Microsoft\\Windows\\WebCache"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Roaming\\Microsoft\\Windows\\Recent"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Roaming\\Mozilla\\Firefox\\Profiles\\"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Roaming\\Opera\\Opera\\global_history.dat"}),"\n",(0,s.jsx)(n.li,{children:"APPDATA\\Roaming\\Opera\\Opera\\typed_history.xml"}),"\n",(0,s.jsx)(n.li,{children:"NTUSER.DAT"}),"\n",(0,s.jsx)(n.li,{children:"NTUSER.DAT.LOG1"}),"\n",(0,s.jsx)(n.li,{children:"NTUSER.DAT.LOG2"}),"\n",(0,s.jsx)(n.li,{children:"PROGRAMDATA\\McAfee\\DesktopProtection\\AccessProtectionLog.txt"}),"\n",(0,s.jsx)(n.li,{children:"PROGRAMDATA\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\AppCompat\\Programs\\AmCache.hve"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\Prefetch"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\SchedLgU.Txt"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\Config\\AppEvent.evt"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\Config\\SecEvent.evt"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\Config\\SysEvent.evt"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\LogFiles\\W3SVC1"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\Tasks"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SAM"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SAM.LOG1"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SAM.LOG2"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SECURITY"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SECURITY.LOG1"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SECURITY.LOG2"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SOFTWARE"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SOFTWARE.LOG1"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SOFTWARE.LOG2"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SYSTEM"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SYSTEM.LOG1"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\config\\SYSTEM.LOG2"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\drivers\\etc\\hosts"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\sru"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\System32\\winevt\\logs"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\Tasks"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\inf\\setupapi.dev.log"}),"\n",(0,s.jsx)(n.li,{children:"SYSTEMROOT\\inf\\setupapi.log"}),"\n",(0,s.jsx)(n.li,{children:"inetpub\\logs\\LogFiles"}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},1151:(e,n,i)=>{i.d(n,{Z:()=>r,a:()=>o});var s=i(7294);const t={},l=s.createContext(t);function o(e){const n=s.useContext(l);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),s.createElement(l.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5b106f4a.136b086e.js b/assets/js/5b106f4a.136b086e.js deleted file mode 100644 index ff083945b..000000000 --- a/assets/js/5b106f4a.136b086e.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4827],{2261:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>r,default:()=>p,frontMatter:()=>i,metadata:()=>s,toc:()=>c});var o=n(5893),a=n(1151);const i={title:"Health Monitoring",hide_title:!0,sidebar_position:10},r="Monitoring the Health and Proper Function of the Cado platform",s={id:"cado-response/manage/monitoring",title:"Health Monitoring",description:'Within the Cado platform, you can see the platform health and statistics by navigating to the "Platform" tab. This list Free Disk Space, Available Memory, Total Memory, CPU Usage and pipeline processing details. In addition, roundtrip response latency for the API /api/v2/status endpoint should be less than or equal to 200ms.',source:"@site/docs/cado-response/manage/monitoring.md",sourceDirName:"cado-response/manage",slug:"/cado-response/manage/monitoring",permalink:"/cado-response/manage/monitoring",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/monitoring.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:10,frontMatter:{title:"Health Monitoring",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"Updating",permalink:"/cado-response/manage/updating"},next:{title:"Cost Management",permalink:"/cado-response/manage/cost-management"}},d={},c=[];function l(e){const t={code:"code",h1:"h1",p:"p",...(0,a.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"monitoring-the-health-and-proper-function-of-the-cado-platform",children:"Monitoring the Health and Proper Function of the Cado platform"}),"\n",(0,o.jsxs)(t.p,{children:['Within the Cado platform, you can see the platform health and statistics by navigating to the "Platform" tab. This list Free Disk Space, Available Memory, Total Memory, CPU Usage and pipeline processing details. In addition, roundtrip response latency for the API ',(0,o.jsx)(t.code,{children:"/api/v2/status"})," endpoint should be less than or equal to 200ms."]})]})}function p(e={}){const{wrapper:t}={...(0,a.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(l,{...e})}):l(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>s,a:()=>r});var o=n(7294);const a={},i=o.createContext(a);function r(e){const t=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:r(e.components),o.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5b106f4a.28e68b28.js b/assets/js/5b106f4a.28e68b28.js new file mode 100644 index 000000000..6462d296b --- /dev/null +++ b/assets/js/5b106f4a.28e68b28.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4827],{2261:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>r,default:()=>p,frontMatter:()=>i,metadata:()=>s,toc:()=>c});var o=n(5893),a=n(1151);const i={title:"Health Monitoring",hide_title:!0,sidebar_position:10},r="Monitoring the Health and Proper Function of the Cado platform",s={id:"cado-response/manage/monitoring",title:"Health Monitoring",description:'Within the Cado platform, you can see the platform health and statistics by navigating to the "Platform" tab. This list Free Disk Space, Available Memory, Total Memory, CPU Usage and pipeline processing details. In addition, roundtrip response latency for the API /api/v2/status endpoint should be less than or equal to 200ms.',source:"@site/docs/cado-response/manage/monitoring.md",sourceDirName:"cado-response/manage",slug:"/cado-response/manage/monitoring",permalink:"/cado-response/manage/monitoring",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/monitoring.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:10,frontMatter:{title:"Health Monitoring",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"Updating",permalink:"/cado-response/manage/updating"},next:{title:"Cost Management",permalink:"/cado-response/manage/cost-management"}},d={},c=[];function l(e){const t={code:"code",h1:"h1",p:"p",...(0,a.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"monitoring-the-health-and-proper-function-of-the-cado-platform",children:"Monitoring the Health and Proper Function of the Cado platform"}),"\n",(0,o.jsxs)(t.p,{children:['Within the Cado platform, you can see the platform health and statistics by navigating to the "Platform" tab. This list Free Disk Space, Available Memory, Total Memory, CPU Usage and pipeline processing details. In addition, roundtrip response latency for the API ',(0,o.jsx)(t.code,{children:"/api/v2/status"})," endpoint should be less than or equal to 200ms."]})]})}function p(e={}){const{wrapper:t}={...(0,a.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(l,{...e})}):l(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>s,a:()=>r});var o=n(7294);const a={},i=o.createContext(a);function r(e){const t=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:r(e.components),o.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5cd525ef.17079aae.js b/assets/js/5cd525ef.17079aae.js deleted file mode 100644 index 90f941228..000000000 --- a/assets/js/5cd525ef.17079aae.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7997],{4166:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>c,default:()=>p,frontMatter:()=>i,metadata:()=>r,toc:()=>d});var n=o(5893),s=o(1151);const i={title:"Key Concepts",hide_title:!0,sidebar_position:2},c="Key Concepts",r={id:"cado-response/key-concepts",title:"Key Concepts",description:"Below we describe some of the key concepts in the Cado platform.",source:"@site/docs/cado-response/key-concepts.md",sourceDirName:"cado-response",slug:"/cado-response/key-concepts",permalink:"/cado-response/key-concepts",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/key-concepts.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"Key Concepts",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Summary",permalink:"/cado-response/intro"},next:{title:"Deployment Options",permalink:"/cado-response/deploy/intro"}},a={},d=[{value:"Evidence",id:"evidence",level:3},{value:"Projects",id:"projects",level:3},{value:"Events",id:"events",level:3}];function l(e){const t={code:"code",h1:"h1",h3:"h3",p:"p",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"key-concepts",children:"Key Concepts"}),"\n",(0,n.jsx)(t.p,{children:"Below we describe some of the key concepts in the Cado platform."}),"\n",(0,n.jsx)(t.h3,{id:"evidence",children:"Evidence"}),"\n",(0,n.jsx)(t.p,{children:"An evidence item is a source of data. It may be a single file, or a folder or archive containing many files."}),"\n",(0,n.jsx)(t.h3,{id:"projects",children:"Projects"}),"\n",(0,n.jsx)(t.p,{children:"A project is a grouping of different evidence items, and also holds information such as notes users have made."}),"\n",(0,n.jsx)(t.h3,{id:"events",children:"Events"}),"\n",(0,n.jsxs)(t.p,{children:["Cado parses events from evidence items. These events may have times associated with them. They may also be tagged as ",(0,n.jsx)(t.code,{children:"Alarm"}),", which indicates a high likelihood of malicious activity, or ",(0,n.jsx)(t.code,{children:"Suspicious"}),", which indicates a lower likelihood of malicious activity."]})]})}function p(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},1151:(e,t,o)=>{o.d(t,{Z:()=>r,a:()=>c});var n=o(7294);const s={},i=n.createContext(s);function c(e){const t=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:c(e.components),n.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5cd525ef.6460c387.js b/assets/js/5cd525ef.6460c387.js new file mode 100644 index 000000000..0fa84ab24 --- /dev/null +++ b/assets/js/5cd525ef.6460c387.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7997],{4166:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>c,default:()=>p,frontMatter:()=>i,metadata:()=>r,toc:()=>d});var n=o(5893),s=o(1151);const i={title:"Key Concepts",hide_title:!0,sidebar_position:2},c="Key Concepts",r={id:"cado-response/key-concepts",title:"Key Concepts",description:"Below we describe some of the key concepts in the Cado platform.",source:"@site/docs/cado-response/key-concepts.md",sourceDirName:"cado-response",slug:"/cado-response/key-concepts",permalink:"/cado-response/key-concepts",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/key-concepts.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"Key Concepts",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Summary",permalink:"/cado-response/intro"},next:{title:"Deployment Options",permalink:"/cado-response/deploy/intro"}},a={},d=[{value:"Evidence",id:"evidence",level:3},{value:"Projects",id:"projects",level:3},{value:"Events",id:"events",level:3}];function l(e){const t={code:"code",h1:"h1",h3:"h3",p:"p",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"key-concepts",children:"Key Concepts"}),"\n",(0,n.jsx)(t.p,{children:"Below we describe some of the key concepts in the Cado platform."}),"\n",(0,n.jsx)(t.h3,{id:"evidence",children:"Evidence"}),"\n",(0,n.jsx)(t.p,{children:"An evidence item is a source of data. It may be a single file, or a folder or archive containing many files."}),"\n",(0,n.jsx)(t.h3,{id:"projects",children:"Projects"}),"\n",(0,n.jsx)(t.p,{children:"A project is a grouping of different evidence items, and also holds information such as notes users have made."}),"\n",(0,n.jsx)(t.h3,{id:"events",children:"Events"}),"\n",(0,n.jsxs)(t.p,{children:["Cado parses events from evidence items. These events may have times associated with them. They may also be tagged as ",(0,n.jsx)(t.code,{children:"Alarm"}),", which indicates a high likelihood of malicious activity, or ",(0,n.jsx)(t.code,{children:"Suspicious"}),", which indicates a lower likelihood of malicious activity."]})]})}function p(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},1151:(e,t,o)=>{o.d(t,{Z:()=>r,a:()=>c});var n=o(7294);const s={},i=n.createContext(s);function c(e){const t=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:c(e.components),n.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5d9d5fe7.34a3db5f.js b/assets/js/5d9d5fe7.34a3db5f.js new file mode 100644 index 000000000..acabda307 --- /dev/null +++ b/assets/js/5d9d5fe7.34a3db5f.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7245],{8011:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>d,contentTitle:()=>s,default:()=>p,frontMatter:()=>t,metadata:()=>r,toc:()=>l});var a=i(5893),o=i(1151);const t={sidebar_position:1,id:"intro",title:"Summary"},s="Cado Platform",r={id:"cado-response/intro",title:"Summary",description:"Data is moving to the cloud. Cyber attackers are moving to the cloud. Yet when security teams need to investigate a threat in a modern environment, it\u2019s incredibly complex and time consuming. The Cado platform leverages the scale, speed and automation of the cloud to expedite investigation and response.",source:"@site/docs/cado-response/intro.md",sourceDirName:"cado-response",slug:"/cado-response/intro",permalink:"/cado-response/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/intro.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{sidebar_position:1,id:"intro",title:"Summary"},sidebar:"tutorialSidebar",next:{title:"Key Concepts",permalink:"/cado-response/key-concepts"}},d={},l=[{value:"Core Features",id:"core-features",level:3},{value:"Benefits",id:"benefits",level:3},{value:"Getting a license",id:"getting-a-license",level:2},{value:"Deploy and Manage Cado in your cloud environment",id:"deploy-and-manage-cado-in-your-cloud-environment",level:2},{value:"Processing Data",id:"processing-data",level:3},{value:"Analyzing Evidence",id:"analyzing-evidence",level:3}];function c(e){const n={a:"a",h1:"h1",h2:"h2",h3:"h3",hr:"hr",li:"li",p:"p",strong:"strong",ul:"ul",...(0,o.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(n.h1,{id:"cado-platform",children:"Cado Platform"}),"\n",(0,a.jsx)(n.p,{children:"Data is moving to the cloud. Cyber attackers are moving to the cloud. Yet when security teams need to investigate a threat in a modern environment, it\u2019s incredibly complex and time consuming. The Cado platform leverages the scale, speed and automation of the cloud to expedite investigation and response."}),"\n",(0,a.jsx)(n.h3,{id:"core-features",children:"Core Features"}),"\n",(0,a.jsxs)(n.ul,{children:["\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Automated data capture"})," - Cado enables automated data capture across multi-cloud and ephemeral container environments, while also supporting investigations across on-premises systems."]}),"\n"]}),"\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Parallel processing"})," - Cado is powered by a patent-pending cloud-native architecture that automatically scales up and down to provide rapid parallel data processing."]}),"\n"]}),"\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Powerful analytics"})," - The Cado analytics engine is powered by threat intelligence, machine learning, and built-in YARA rules to automatically flag malicious activity and potential risks."]}),"\n"]}),"\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Single pane of glass"})," - Cado presents hundreds of data sources across cloud-provider logs, disk, memory, and more in a single timeline so security teams can quickly determine scope and impact."]}),"\n"]}),"\n"]}),"\n",(0,a.jsx)(n.h3,{id:"benefits",children:"Benefits"}),"\n",(0,a.jsxs)(n.ul,{children:["\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Cloud Scale"})," - Automate data capture across complex and multi-cloud environments. No agents required."]}),"\n"]}),"\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Cloud Speed"})," - Take advantage of rapid, parallel processing to normalize massive amounts of disparate data in minutes, not days."]}),"\n"]}),"\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Cloud Visibility"})," - Investigate hundreds of data sources across cloud-provider logs, disk, memory, and more, in a single pane of glass."]}),"\n"]}),"\n"]}),"\n",(0,a.jsx)(n.hr,{}),"\n",(0,a.jsx)(n.h2,{id:"getting-a-license",children:"Getting a license"}),"\n",(0,a.jsxs)(n.ul,{children:["\n",(0,a.jsxs)(n.li,{children:["If you do not have a license, please contact ",(0,a.jsx)(n.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})]}),"\n",(0,a.jsxs)(n.li,{children:["We also have a free edition of the Cado platform, ",(0,a.jsx)(n.a,{href:"community-edition/community-intro",children:"Cado Community Edition"})]}),"\n"]}),"\n",(0,a.jsx)(n.h2,{id:"deploy-and-manage-cado-in-your-cloud-environment",children:"Deploy and Manage Cado in your cloud environment"}),"\n",(0,a.jsx)(n.p,{children:"You can deploy and manage Cado in either your AWS, Azure or GCP environment"}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsx)(n.strong,{children:(0,a.jsx)(n.a,{href:"/cado-response/deploy/aws/overview",children:"Learn how in AWS >"})})}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsx)(n.strong,{children:(0,a.jsx)(n.a,{href:"/cado-response/deploy/azure/azure-deploy",children:"Learn how in Azure >"})})}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsx)(n.strong,{children:(0,a.jsx)(n.a,{href:"/cado-response/deploy/gcp/gcp-deploy",children:"Learn how in GCP (Beta) >"})})}),"\n",(0,a.jsx)(n.h3,{id:"processing-data",children:"Processing Data"}),"\n",(0,a.jsx)(n.p,{children:"After deploying Cado, data can be automatically acquired from the cloud or imported from a number of supported sources."}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsx)(n.strong,{children:(0,a.jsx)(n.a,{href:"/cado-response/discovery-import/import/intro",children:"Learn how >"})})}),"\n",(0,a.jsx)(n.h3,{id:"analyzing-evidence",children:"Analyzing Evidence"}),"\n",(0,a.jsx)(n.p,{children:"Data which is imported is automatically processed, analyzed and added to the platform. Automatic detections, timeline of events and more are available for investigation."}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsx)(n.strong,{children:(0,a.jsx)(n.a,{href:"/cado-response/investigate/intro",children:"Learn how >"})})})]})}function p(e={}){const{wrapper:n}={...(0,o.a)(),...e.components};return n?(0,a.jsx)(n,{...e,children:(0,a.jsx)(c,{...e})}):c(e)}},1151:(e,n,i)=>{i.d(n,{Z:()=>r,a:()=>s});var a=i(7294);const o={},t=a.createContext(o);function s(e){const n=a.useContext(t);return a.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),a.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5d9d5fe7.b7a8daad.js b/assets/js/5d9d5fe7.b7a8daad.js deleted file mode 100644 index 64b7f93f1..000000000 --- a/assets/js/5d9d5fe7.b7a8daad.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7245],{8011:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>d,contentTitle:()=>s,default:()=>p,frontMatter:()=>t,metadata:()=>r,toc:()=>l});var a=i(5893),o=i(1151);const t={sidebar_position:1,id:"intro",title:"Summary"},s="Cado Platform",r={id:"cado-response/intro",title:"Summary",description:"Data is moving to the cloud. Cyber attackers are moving to the cloud. Yet when security teams need to investigate a threat in a modern environment, it\u2019s incredibly complex and time consuming. The Cado platform leverages the scale, speed and automation of the cloud to expedite investigation and response.",source:"@site/docs/cado-response/intro.md",sourceDirName:"cado-response",slug:"/cado-response/intro",permalink:"/cado-response/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/intro.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{sidebar_position:1,id:"intro",title:"Summary"},sidebar:"tutorialSidebar",next:{title:"Key Concepts",permalink:"/cado-response/key-concepts"}},d={},l=[{value:"Core Features",id:"core-features",level:3},{value:"Benefits",id:"benefits",level:3},{value:"Getting a license",id:"getting-a-license",level:2},{value:"Deploy and Manage Cado in your cloud environment",id:"deploy-and-manage-cado-in-your-cloud-environment",level:2},{value:"Processing Data",id:"processing-data",level:3},{value:"Analyzing Evidence",id:"analyzing-evidence",level:3}];function c(e){const n={a:"a",h1:"h1",h2:"h2",h3:"h3",hr:"hr",li:"li",p:"p",strong:"strong",ul:"ul",...(0,o.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(n.h1,{id:"cado-platform",children:"Cado Platform"}),"\n",(0,a.jsx)(n.p,{children:"Data is moving to the cloud. Cyber attackers are moving to the cloud. Yet when security teams need to investigate a threat in a modern environment, it\u2019s incredibly complex and time consuming. The Cado platform leverages the scale, speed and automation of the cloud to expedite investigation and response."}),"\n",(0,a.jsx)(n.h3,{id:"core-features",children:"Core Features"}),"\n",(0,a.jsxs)(n.ul,{children:["\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Automated data capture"})," - Cado enables automated data capture across multi-cloud and ephemeral container environments, while also supporting investigations across on-premises systems."]}),"\n"]}),"\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Parallel processing"})," - Cado is powered by a patent-pending cloud-native architecture that automatically scales up and down to provide rapid parallel data processing."]}),"\n"]}),"\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Powerful analytics"})," - The Cado analytics engine is powered by threat intelligence, machine learning, and built-in YARA rules to automatically flag malicious activity and potential risks."]}),"\n"]}),"\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Single pane of glass"})," - Cado presents hundreds of data sources across cloud-provider logs, disk, memory, and more in a single timeline so security teams can quickly determine scope and impact."]}),"\n"]}),"\n"]}),"\n",(0,a.jsx)(n.h3,{id:"benefits",children:"Benefits"}),"\n",(0,a.jsxs)(n.ul,{children:["\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Cloud Scale"})," - Automate data capture across complex and multi-cloud environments. No agents required."]}),"\n"]}),"\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Cloud Speed"})," - Take advantage of rapid, parallel processing to normalize massive amounts of disparate data in minutes, not days."]}),"\n"]}),"\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Cloud Visibility"})," - Investigate hundreds of data sources across cloud-provider logs, disk, memory, and more, in a single pane of glass."]}),"\n"]}),"\n"]}),"\n",(0,a.jsx)(n.hr,{}),"\n",(0,a.jsx)(n.h2,{id:"getting-a-license",children:"Getting a license"}),"\n",(0,a.jsxs)(n.ul,{children:["\n",(0,a.jsxs)(n.li,{children:["If you do not have a license, please contact ",(0,a.jsx)(n.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})]}),"\n",(0,a.jsxs)(n.li,{children:["We also have a free edition of the Cado platform, ",(0,a.jsx)(n.a,{href:"community-edition/community-intro",children:"Cado Community Edition"})]}),"\n"]}),"\n",(0,a.jsx)(n.h2,{id:"deploy-and-manage-cado-in-your-cloud-environment",children:"Deploy and Manage Cado in your cloud environment"}),"\n",(0,a.jsx)(n.p,{children:"You can deploy and manage Cado in either your AWS, Azure or GCP environment"}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsx)(n.strong,{children:(0,a.jsx)(n.a,{href:"/cado-response/deploy/aws/overview",children:"Learn how in AWS >"})})}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsx)(n.strong,{children:(0,a.jsx)(n.a,{href:"/cado-response/deploy/azure/azure-deploy",children:"Learn how in Azure >"})})}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsx)(n.strong,{children:(0,a.jsx)(n.a,{href:"/cado-response/deploy/gcp/gcp-deploy",children:"Learn how in GCP (Beta) >"})})}),"\n",(0,a.jsx)(n.h3,{id:"processing-data",children:"Processing Data"}),"\n",(0,a.jsx)(n.p,{children:"After deploying Cado, data can be automatically acquired from the cloud or imported from a number of supported sources."}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsx)(n.strong,{children:(0,a.jsx)(n.a,{href:"/cado-response/discovery-import/import/intro",children:"Learn how >"})})}),"\n",(0,a.jsx)(n.h3,{id:"analyzing-evidence",children:"Analyzing Evidence"}),"\n",(0,a.jsx)(n.p,{children:"Data which is imported is automatically processed, analyzed and added to the platform. Automatic detections, timeline of events and more are available for investigation."}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsx)(n.strong,{children:(0,a.jsx)(n.a,{href:"/cado-response/investigate/intro",children:"Learn how >"})})})]})}function p(e={}){const{wrapper:n}={...(0,o.a)(),...e.components};return n?(0,a.jsx)(n,{...e,children:(0,a.jsx)(c,{...e})}):c(e)}},1151:(e,n,i)=>{i.d(n,{Z:()=>r,a:()=>s});var a=i(7294);const o={},t=a.createContext(o);function s(e){const n=a.useContext(t);return a.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),a.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/60efa465.41f62c0b.js b/assets/js/60efa465.41f62c0b.js deleted file mode 100644 index c19d318d7..000000000 --- a/assets/js/60efa465.41f62c0b.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[745],{956:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>r,contentTitle:()=>a,default:()=>u,frontMatter:()=>c,metadata:()=>i,toc:()=>d});var n=o(5893),s=o(1151);const c={title:"Overview",hide_title:!0,sidebar_position:1},a="Deployment IAM Considerations",i={id:"cado-response/deploy/aws/iam/deployment-iam-considerations",title:"Overview",description:"There are several AWS Identity & Access Management best practices to consider when deploying the Cado platform",source:"@site/docs/cado-response/deploy/aws/iam/deployment-iam-considerations.md",sourceDirName:"cado-response/deploy/aws/iam",slug:"/cado-response/deploy/aws/iam/deployment-iam-considerations",permalink:"/cado-response/deploy/aws/iam/deployment-iam-considerations",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/iam/deployment-iam-considerations.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Overview",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Overview",permalink:"/cado-response/deploy/aws/overview"},next:{title:"Removing and Tightening IAM Permissions",permalink:"/cado-response/deploy/aws/iam/tightening-iam"}},r={},d=[{value:"Dedicated Forensics Account",id:"dedicated-forensics-account",level:2},{value:"Cross-Account Access without the Cross-Account Role",id:"cross-account-access-without-the-cross-account-role",level:2}];function l(e){const t={h1:"h1",h2:"h2",p:"p",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"deployment-iam-considerations",children:"Deployment IAM Considerations"}),"\n",(0,n.jsx)(t.p,{children:"There are several AWS Identity & Access Management best practices to consider when deploying the Cado platform"}),"\n",(0,n.jsx)(t.h2,{id:"dedicated-forensics-account",children:"Dedicated Forensics Account"}),"\n",(0,n.jsx)(t.p,{children:"You may choose to deploy into an AWS account dedicated to storing forensics data securely. You can then use cross-account roles to bring data into the forensics account. Cado copies data back into the forensics account, and performs processing there."}),"\n",(0,n.jsx)(t.h2,{id:"cross-account-access-without-the-cross-account-role",children:"Cross-Account Access without the Cross-Account Role"}),"\n",(0,n.jsx)(t.p,{children:"By default, we recommend creating a role in each account that you want Cado to access. This enables one click acquisition of data.\nHowever, if you cannot create roles in other accounts you can still use the AMI import functionality to import EC2 resources from other accounts without the need to create any cross-account roles. This requires you to create the AMI of any instance you want to import yourself and share it with the AWS account that Cado resides in."})]})}function u(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},1151:(e,t,o)=>{o.d(t,{Z:()=>i,a:()=>a});var n=o(7294);const s={},c=n.createContext(s);function a(e){const t=n.useContext(c);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),n.createElement(c.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/60efa465.ecebe8bf.js b/assets/js/60efa465.ecebe8bf.js new file mode 100644 index 000000000..6ef1b9751 --- /dev/null +++ b/assets/js/60efa465.ecebe8bf.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[745],{956:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>r,contentTitle:()=>i,default:()=>u,frontMatter:()=>c,metadata:()=>a,toc:()=>d});var n=o(5893),s=o(1151);const c={title:"Overview",hide_title:!0,sidebar_position:1},i="Deployment IAM Considerations",a={id:"cado-response/deploy/aws/iam/deployment-iam-considerations",title:"Overview",description:"There are several AWS Identity & Access Management best practices to consider when deploying the Cado platform",source:"@site/docs/cado-response/deploy/aws/iam/deployment-iam-considerations.md",sourceDirName:"cado-response/deploy/aws/iam",slug:"/cado-response/deploy/aws/iam/deployment-iam-considerations",permalink:"/cado-response/deploy/aws/iam/deployment-iam-considerations",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/iam/deployment-iam-considerations.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Overview",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Overview",permalink:"/cado-response/deploy/aws/overview"},next:{title:"Removing and Tightening IAM Permissions",permalink:"/cado-response/deploy/aws/iam/tightening-iam"}},r={},d=[{value:"Dedicated Forensics Account",id:"dedicated-forensics-account",level:2},{value:"Cross-Account Access without the Cross-Account Role",id:"cross-account-access-without-the-cross-account-role",level:2}];function l(e){const t={h1:"h1",h2:"h2",p:"p",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"deployment-iam-considerations",children:"Deployment IAM Considerations"}),"\n",(0,n.jsx)(t.p,{children:"There are several AWS Identity & Access Management best practices to consider when deploying the Cado platform"}),"\n",(0,n.jsx)(t.h2,{id:"dedicated-forensics-account",children:"Dedicated Forensics Account"}),"\n",(0,n.jsx)(t.p,{children:"You may choose to deploy into an AWS account dedicated to storing forensics data securely. You can then use cross-account roles to bring data into the forensics account. Cado copies data back into the forensics account, and performs processing there."}),"\n",(0,n.jsx)(t.h2,{id:"cross-account-access-without-the-cross-account-role",children:"Cross-Account Access without the Cross-Account Role"}),"\n",(0,n.jsx)(t.p,{children:"By default, we recommend creating a role in each account that you want Cado to access. This enables one click acquisition of data.\nHowever, if you cannot create roles in other accounts you can still use the AMI import functionality to import EC2 resources from other accounts without the need to create any cross-account roles. This requires you to create the AMI of any instance you want to import yourself and share it with the AWS account that Cado resides in."})]})}function u(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},1151:(e,t,o)=>{o.d(t,{Z:()=>a,a:()=>i});var n=o(7294);const s={},c=n.createContext(s);function i(e){const t=n.useContext(c);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),n.createElement(c.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/6408d69a.438e6df4.js b/assets/js/6408d69a.438e6df4.js new file mode 100644 index 000000000..7c5a3cd57 --- /dev/null +++ b/assets/js/6408d69a.438e6df4.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1619],{116:(e,o,r)=>{r.r(o),r.d(o,{assets:()=>a,contentTitle:()=>n,default:()=>p,frontMatter:()=>i,metadata:()=>c,toc:()=>d});var t=r(5893),s=r(1151);const i={title:"Import from Cloud",hide_title:!0,sidebar_position:2},n="Importing from the Cloud",c={id:"cado-response/discovery-import/import/import-from-cloud",title:"Import from Cloud",description:"To import data from the cloud you need to have access configured to the cloud account/subscription/project where the data resides. Learn more on how to add credentials to the Cado Platform for AWS, Azure, and GCP.",source:"@site/docs/cado-response/discovery-import/import/import-from-cloud.md",sourceDirName:"cado-response/discovery-import/import",slug:"/cado-response/discovery-import/import/import-from-cloud",permalink:"/cado-response/discovery-import/import/import-from-cloud",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/import-from-cloud.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"Import from Cloud",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Overview",permalink:"/cado-response/discovery-import/import/intro"},next:{title:"File Types",permalink:"/cado-response/discovery-import/import/data-types/filetypes"}},a={},d=[{value:"AWS",id:"aws",level:3},{value:"Azure",id:"azure",level:3},{value:"GCP",id:"gcp",level:3}];function l(e){const o={a:"a",h1:"h1",h3:"h3",img:"img",li:"li",p:"p",ul:"ul",...(0,s.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"importing-from-the-cloud",children:"Importing from the Cloud"}),"\n",(0,t.jsxs)(o.p,{children:["To import data from the cloud you need to have access configured to the cloud account/subscription/project where the data resides. Learn more on how to add credentials to the Cado Platform for ",(0,t.jsx)(o.a,{href:"/cado-response/deploy/aws/iam/cross-account-creation#adding-the-role-to-cado",children:"AWS"}),", ",(0,t.jsx)(o.a,{href:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions#registering-credentials-within-cado",children:"Azure"}),", and ",(0,t.jsx)(o.a,{href:"/cado-response/deploy/gcp/gcp-settings#entering-settings",children:"GCP"}),"."]}),"\n",(0,t.jsxs)(o.p,{children:["You also need to be assigned a Cado role that has acccess to a cloud role that can access the data to import. For more information read about Cado ",(0,t.jsx)(o.a,{href:"/cado-response/manage/users-authentication/users#managing-roles",children:"users and roles"}),"."]}),"\n",(0,t.jsx)(o.p,{children:"First select the Cloud Role you will use to import the data. You can filter the list by provider, or search for a specific account, subscription or project."}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Importing from cloud",src:r(6723).Z+"",width:"1832",height:"632"})}),"\n",(0,t.jsx)(o.p,{children:"To learn about collecting from each cloud service go to the relevant import page"}),"\n",(0,t.jsx)(o.h3,{id:"aws",children:"AWS"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/aws/aws-ec2",children:"EC2"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/aws/aws-s3",children:"S3"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/aws/aws-ami",children:"AMI and EBS Snapshot"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/aws/aws-ecs",children:"ECS"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/aws/aws-eks",children:"EKS"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/aws/aws-lambda",children:"Lambda"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"azure",children:"Azure"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/azure/azure-compute",children:"Azure Compute"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/azure/azure-storage",children:"Azure Storage"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/azure/azure-aks",children:"Azure AKS"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"gcp",children:"GCP"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/gcp/engine-instance",children:"Google Compute Engine"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/gcp/storage",children:"Google Cloud Storage"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/gcp/kubernetes-engine",children:"Google Kubernetes Engine"})}),"\n"]})]})}function p(e={}){const{wrapper:o}={...(0,s.a)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},6723:(e,o,r)=>{r.d(o,{Z:()=>t});const t=r.p+"assets/images/import-cloud-6754420b4e7cc81d73642d1671355124.png"},1151:(e,o,r)=>{r.d(o,{Z:()=>c,a:()=>n});var t=r(7294);const s={},i=t.createContext(s);function n(e){const o=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function c(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:n(e.components),t.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/6408d69a.d646125f.js b/assets/js/6408d69a.d646125f.js deleted file mode 100644 index 5d9288cdc..000000000 --- a/assets/js/6408d69a.d646125f.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1619],{116:(e,o,r)=>{r.r(o),r.d(o,{assets:()=>a,contentTitle:()=>n,default:()=>p,frontMatter:()=>i,metadata:()=>c,toc:()=>d});var t=r(5893),s=r(1151);const i={title:"Import from Cloud",hide_title:!0,sidebar_position:2},n="Importing from the Cloud",c={id:"cado-response/discovery-import/import/import-from-cloud",title:"Import from Cloud",description:"To import data from the cloud you need to have access configured to the cloud account/subscription/project where the data resides. Learn more on how to add credentials to the Cado Platform for AWS, Azure, and GCP.",source:"@site/docs/cado-response/discovery-import/import/import-from-cloud.md",sourceDirName:"cado-response/discovery-import/import",slug:"/cado-response/discovery-import/import/import-from-cloud",permalink:"/cado-response/discovery-import/import/import-from-cloud",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/import-from-cloud.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"Import from Cloud",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Overview",permalink:"/cado-response/discovery-import/import/intro"},next:{title:"File Types",permalink:"/cado-response/discovery-import/import/data-types/filetypes"}},a={},d=[{value:"AWS",id:"aws",level:3},{value:"Azure",id:"azure",level:3},{value:"GCP",id:"gcp",level:3}];function l(e){const o={a:"a",h1:"h1",h3:"h3",img:"img",li:"li",p:"p",ul:"ul",...(0,s.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"importing-from-the-cloud",children:"Importing from the Cloud"}),"\n",(0,t.jsxs)(o.p,{children:["To import data from the cloud you need to have access configured to the cloud account/subscription/project where the data resides. Learn more on how to add credentials to the Cado Platform for ",(0,t.jsx)(o.a,{href:"/cado-response/deploy/aws/iam/cross-account-creation#adding-the-role-to-cado",children:"AWS"}),", ",(0,t.jsx)(o.a,{href:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions#registering-credentials-within-cado",children:"Azure"}),", and ",(0,t.jsx)(o.a,{href:"/cado-response/deploy/gcp/gcp-settings#entering-settings",children:"GCP"}),"."]}),"\n",(0,t.jsxs)(o.p,{children:["You also need to be assigned a Cado role that has acccess to a cloud role that can access the data to import. For more information read about Cado ",(0,t.jsx)(o.a,{href:"/cado-response/manage/users-authentication/users#managing-roles",children:"users and roles"}),"."]}),"\n",(0,t.jsx)(o.p,{children:"First select the Cloud Role you will use to import the data. You can filter the list by provider, or search for a specific account, subscription or project."}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Importing from cloud",src:r(6723).Z+"",width:"1832",height:"632"})}),"\n",(0,t.jsx)(o.p,{children:"To learn about collecting from each cloud service go to the relevant import page"}),"\n",(0,t.jsx)(o.h3,{id:"aws",children:"AWS"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/aws/aws-ec2",children:"EC2"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/aws/aws-s3",children:"S3"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/aws/aws-ami",children:"AMI and EBS Snapshot"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/aws/aws-ecs",children:"ECS"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/aws/aws-eks",children:"EKS"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/aws/aws-lambda",children:"Lambda"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"azure",children:"Azure"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/azure/azure-compute",children:"Azure Compute"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/azure/azure-storage",children:"Azure Storage"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/azure/azure-aks",children:"Azure AKS"})}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"gcp",children:"GCP"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/gcp/engine-instance",children:"Google Compute Engine"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/gcp/storage",children:"Google Cloud Storage"})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.a,{href:"/cado-response/discovery-import/import/gcp/kubernetes-engine",children:"Google Kubernetes Engine"})}),"\n"]})]})}function p(e={}){const{wrapper:o}={...(0,s.a)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},6723:(e,o,r)=>{r.d(o,{Z:()=>t});const t=r.p+"assets/images/import-cloud-6754420b4e7cc81d73642d1671355124.png"},1151:(e,o,r)=>{r.d(o,{Z:()=>c,a:()=>n});var t=r(7294);const s={},i=t.createContext(s);function n(e){const o=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function c(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:n(e.components),t.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/6c7fca99.3b01d475.js b/assets/js/6c7fca99.3b01d475.js deleted file mode 100644 index 35328b211..000000000 --- a/assets/js/6c7fca99.3b01d475.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2376],{1424:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>o,metadata:()=>r,toc:()=>d});var s=n(5893),i=n(1151);const o={title:"Detections",hide_title:!0,sidebar_position:9},a=void 0,r={id:"cado-response/investigate/detections",title:"Detections",description:"Setting Up Detections",source:"@site/docs/cado-response/investigate/detections.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/detections",permalink:"/cado-response/investigate/detections",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/detections.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:9,frontMatter:{title:"Detections",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Network",permalink:"/cado-response/investigate/network"},next:{title:"AI Investigator",permalink:"/cado-response/investigate/ai investigator"}},c={},d=[{value:"Setting Up Detections",id:"setting-up-detections",level:2}];function l(e){const t={code:"code",em:"em",h2:"h2",p:"p",strong:"strong",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h2,{id:"setting-up-detections",children:"Setting Up Detections"}),"\n",(0,s.jsxs)(t.p,{children:["The Cado platform can integrate with a number of systems as well as incorporate custom Indicators of Compromise. These can be defined in ",(0,s.jsx)(t.em,{children:"Settings - General Settings - Detection"})]}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.strong,{children:"VirusTotal API Key"})," is used to enhance the analysis of already detected files by checking their file-hash against the VirusTotal database. It is not used to detect files."]}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.strong,{children:"Yara Rules"})," text-box allows you to run your own set of Yara rules against files. These are run in addition to a set built-in to Cado. Rules that match will trigger a ",(0,s.jsx)(t.code,{children:"Malicious"})," detection, unless the yara rule name starts with the keyword suspicious - in which case it will create a ",(0,s.jsx)(t.code,{children:"Suspicious"})," detection."]}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.strong,{children:"Indicators of Compromise"})," are matched against the contents of files and events, for example connections from network logs. Enter one indicator on each line. You can enter any keyword such as a filename, IP address or Domain name. If you enter a SHA256 filehash, it will be matched against files too. You can optionally enter a title for an indicator, preceded by the ';' character. For example \"Domain.com;A bad domain\""]})]})}function u(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>r,a:()=>a});var s=n(7294);const i={},o=s.createContext(i);function a(e){const t=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),s.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/6c7fca99.4150702f.js b/assets/js/6c7fca99.4150702f.js new file mode 100644 index 000000000..c16e2420f --- /dev/null +++ b/assets/js/6c7fca99.4150702f.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2376],{1424:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>o,metadata:()=>r,toc:()=>d});var s=n(5893),i=n(1151);const o={title:"Detections",hide_title:!0,sidebar_position:9},a=void 0,r={id:"cado-response/investigate/detections",title:"Detections",description:"Setting Up Detections",source:"@site/docs/cado-response/investigate/detections.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/detections",permalink:"/cado-response/investigate/detections",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/detections.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:9,frontMatter:{title:"Detections",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Network",permalink:"/cado-response/investigate/network"},next:{title:"AI Investigator",permalink:"/cado-response/investigate/ai investigator"}},c={},d=[{value:"Setting Up Detections",id:"setting-up-detections",level:2}];function l(e){const t={code:"code",em:"em",h2:"h2",p:"p",strong:"strong",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h2,{id:"setting-up-detections",children:"Setting Up Detections"}),"\n",(0,s.jsxs)(t.p,{children:["The Cado platform can integrate with a number of systems as well as incorporate custom Indicators of Compromise. These can be defined in ",(0,s.jsx)(t.em,{children:"Settings - General Settings - Detection"})]}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.strong,{children:"VirusTotal API Key"})," is used to enhance the analysis of already detected files by checking their file-hash against the VirusTotal database. It is not used to detect files."]}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.strong,{children:"Yara Rules"})," text-box allows you to run your own set of Yara rules against files. These are run in addition to a set built-in to Cado. Rules that match will trigger a ",(0,s.jsx)(t.code,{children:"Malicious"})," detection, unless the yara rule name starts with the keyword suspicious - in which case it will create a ",(0,s.jsx)(t.code,{children:"Suspicious"})," detection."]}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.strong,{children:"Indicators of Compromise"})," are matched against the contents of files and events, for example connections from network logs. Enter one indicator on each line. You can enter any keyword such as a filename, IP address or Domain name. If you enter a SHA256 filehash, it will be matched against files too. You can optionally enter a title for an indicator, preceded by the ';' character. For example \"Domain.com;A bad domain\""]})]})}function u(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>r,a:()=>a});var s=n(7294);const i={},o=s.createContext(i);function a(e){const t=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),s.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/706d580c.cc9b0afe.js b/assets/js/706d580c.cc9b0afe.js deleted file mode 100644 index 5251ea50a..000000000 --- a/assets/js/706d580c.cc9b0afe.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3474],{1366:(t,e,s)=>{s.r(e),s.d(e,{assets:()=>p,contentTitle:()=>r,default:()=>l,frontMatter:()=>a,metadata:()=>n,toc:()=>c});var i=s(5893),o=s(1151);const a={title:"Lightsail",hide_title:!0,sidebar_position:8},r="AWS Lightsail",n={id:"cado-response/discovery-import/import/aws/aws-lightsail",title:"Lightsail",description:"First create a snapshot of the Lightsail instance you want to import:",source:"@site/docs/cado-response/discovery-import/import/aws/aws-lightsail.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/aws-lightsail",permalink:"/cado-response/discovery-import/import/aws/aws-lightsail",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/aws-lightsail.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:8,frontMatter:{title:"Lightsail",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"AWS Memory Analysis",permalink:"/cado-response/discovery-import/import/aws/memory"},next:{title:"Monitoring for Snapshots and Volumes",permalink:"/cado-response/discovery-import/import/aws/monitoring"}},p={},c=[];function d(t){const e={a:"a",h1:"h1",img:"img",p:"p",...(0,o.a)(),...t.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(e.h1,{id:"aws-lightsail",children:"AWS Lightsail"}),"\n",(0,i.jsxs)(e.p,{children:["First create a snapshot of the Lightsail instance you want to import:\n",(0,i.jsx)(e.img,{alt:"Make Lightsail Snapshot",src:s(277).Z+"",width:"1726",height:"754"})]}),"\n",(0,i.jsxs)(e.p,{children:["Then select \u201cExport to Amazon EC2\u201d:\n",(0,i.jsx)(e.img,{alt:"Export to EC2",src:s(2938).Z+"",width:"792",height:"400"})]}),"\n",(0,i.jsxs)(e.p,{children:["You can then import the ",(0,i.jsx)(e.a,{href:"/cado-response/discovery-import/import/aws/aws-ami",children:"EC2 EBS"})," Snapshot as usual."]})]})}function l(t={}){const{wrapper:e}={...(0,o.a)(),...t.components};return e?(0,i.jsx)(e,{...t,children:(0,i.jsx)(d,{...t})}):d(t)}},2938:(t,e,s)=>{s.d(e,{Z:()=>i});const i=s.p+"assets/images/export-to-ec2-28bf4e19122563214af45e4db3a70dd7.png"},277:(t,e,s)=>{s.d(e,{Z:()=>i});const i=s.p+"assets/images/make-lightsail-snapshot-c1d3631f217aea655bd89c2e7afe23ab.png"},1151:(t,e,s)=>{s.d(e,{Z:()=>n,a:()=>r});var i=s(7294);const o={},a=i.createContext(o);function r(t){const e=i.useContext(a);return i.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function n(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(o):t.components||o:r(t.components),i.createElement(a.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/706d580c.dffc4694.js b/assets/js/706d580c.dffc4694.js new file mode 100644 index 000000000..be7da8e46 --- /dev/null +++ b/assets/js/706d580c.dffc4694.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3474],{1366:(t,e,s)=>{s.r(e),s.d(e,{assets:()=>p,contentTitle:()=>r,default:()=>l,frontMatter:()=>a,metadata:()=>n,toc:()=>c});var i=s(5893),o=s(1151);const a={title:"Lightsail",hide_title:!0,sidebar_position:8},r="AWS Lightsail",n={id:"cado-response/discovery-import/import/aws/aws-lightsail",title:"Lightsail",description:"First create a snapshot of the Lightsail instance you want to import:",source:"@site/docs/cado-response/discovery-import/import/aws/aws-lightsail.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/aws-lightsail",permalink:"/cado-response/discovery-import/import/aws/aws-lightsail",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/aws-lightsail.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:8,frontMatter:{title:"Lightsail",hide_title:!0,sidebar_position:8},sidebar:"tutorialSidebar",previous:{title:"AWS Memory Analysis",permalink:"/cado-response/discovery-import/import/aws/memory"},next:{title:"Monitoring for Snapshots and Volumes",permalink:"/cado-response/discovery-import/import/aws/monitoring"}},p={},c=[];function d(t){const e={a:"a",h1:"h1",img:"img",p:"p",...(0,o.a)(),...t.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(e.h1,{id:"aws-lightsail",children:"AWS Lightsail"}),"\n",(0,i.jsxs)(e.p,{children:["First create a snapshot of the Lightsail instance you want to import:\n",(0,i.jsx)(e.img,{alt:"Make Lightsail Snapshot",src:s(277).Z+"",width:"1726",height:"754"})]}),"\n",(0,i.jsxs)(e.p,{children:["Then select \u201cExport to Amazon EC2\u201d:\n",(0,i.jsx)(e.img,{alt:"Export to EC2",src:s(2938).Z+"",width:"792",height:"400"})]}),"\n",(0,i.jsxs)(e.p,{children:["You can then import the ",(0,i.jsx)(e.a,{href:"/cado-response/discovery-import/import/aws/aws-ami",children:"EC2 EBS"})," Snapshot as usual."]})]})}function l(t={}){const{wrapper:e}={...(0,o.a)(),...t.components};return e?(0,i.jsx)(e,{...t,children:(0,i.jsx)(d,{...t})}):d(t)}},2938:(t,e,s)=>{s.d(e,{Z:()=>i});const i=s.p+"assets/images/export-to-ec2-28bf4e19122563214af45e4db3a70dd7.png"},277:(t,e,s)=>{s.d(e,{Z:()=>i});const i=s.p+"assets/images/make-lightsail-snapshot-c1d3631f217aea655bd89c2e7afe23ab.png"},1151:(t,e,s)=>{s.d(e,{Z:()=>n,a:()=>r});var i=s(7294);const o={},a=i.createContext(o);function r(t){const e=i.useContext(a);return i.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function n(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(o):t.components||o:r(t.components),i.createElement(a.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/73b7c9ed.49076ea8.js b/assets/js/73b7c9ed.49076ea8.js new file mode 100644 index 000000000..a20d26e72 --- /dev/null +++ b/assets/js/73b7c9ed.49076ea8.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7688],{2137:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var n=i(5893),s=i(1151);const r={title:"Investigate",hide_title:!0,sidebar_position:1},o="Investigating a Project",a={id:"cado-response/investigate/intro",title:"Investigate",description:"Evidence is processed into Projects and investigation starts by analyzing the project evidence. The project view provides an overview of the key information for all evidence items in a given project.",source:"@site/docs/cado-response/investigate/intro.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/intro",permalink:"/cado-response/investigate/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/intro.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Investigate",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Exporting Data",permalink:"/cado-response/export/intro"},next:{title:"Evidence",permalink:"/cado-response/investigate/evidence"}},c={},d=[{value:"System View",id:"system-view",level:3},{value:"Browsing Files",id:"browsing-files",level:3},{value:"Searching",id:"searching",level:3},{value:"Indicators / Detections",id:"indicators--detections",level:3}];function l(e){const t={a:"a",h1:"h1",h3:"h3",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"investigating-a-project",children:"Investigating a Project"}),"\n",(0,n.jsx)(t.p,{children:"Evidence is processed into Projects and investigation starts by analyzing the project evidence. The project view provides an overview of the key information for all evidence items in a given project."}),"\n",(0,n.jsx)(t.p,{children:"The tabs available on the Project Overview page are:"}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Tab Name"}),(0,n.jsx)(t.th,{children:"Description"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.a,{href:"/cado-response/investigate/timeline-search",children:"Timeline"})}),(0,n.jsx)(t.td,{children:"A timeline of key events."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.a,{href:"/cado-response/investigate/key-events",children:"Alarms"})}),(0,n.jsx)(t.td,{children:"Malicious events."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.a,{href:"/cado-response/investigate/key-events",children:"Suspicious"})}),(0,n.jsx)(t.td,{children:"Possibly malicious events."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.a,{href:"/cado-response/investigate/network",children:"Network"})}),(0,n.jsx)(t.td,{children:"Network connections."})]})]})]}),"\n",(0,n.jsx)(t.h3,{id:"system-view",children:"System View"}),"\n",(0,n.jsx)(t.p,{children:"By clicking on an individual Evidence item, you bring up the System View. The System View provides the same details as the Project View, but limited to a single evidence item."}),"\n",(0,n.jsx)(t.h3,{id:"browsing-files",children:"Browsing Files"}),"\n",(0,n.jsxs)(t.p,{children:["You can browse the filesystem of certain evidence items. When browsing a ",(0,n.jsx)(t.strong,{children:"Disk"})," folders with a red dot indicate the presence of a known malicious file. You can browse the folder structure of a disk by clicking on individual folders."]}),"\n",(0,n.jsx)(t.h3,{id:"searching",children:"Searching"}),"\n",(0,n.jsx)(t.p,{children:"The search interface allows you to search both file and event contents."}),"\n",(0,n.jsxs)(t.p,{children:["Click ",(0,n.jsx)(t.strong,{children:"Investigate"})," then ",(0,n.jsx)(t.strong,{children:"Search"})," to open the search interface. Cado uses specialized indexing to provide fast searches across files and events. Due to the way this indexing works, you may get fewer results than if you performed a traditional slow byte by byte search of each file."]}),"\n",(0,n.jsx)(t.h3,{id:"indicators--detections",children:"Indicators / Detections"}),"\n",(0,n.jsx)(t.p,{children:"The Indicators or Detections page provides a summary of indicators of compromise detected within a project, and which systems they matched."}),"\n",(0,n.jsxs)(t.p,{children:["Click ",(0,n.jsx)(t.strong,{children:"Investigate"})," then ",(0,n.jsx)(t.strong,{children:"Indicators"}),"."]})]})}function h(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},1151:(e,t,i)=>{i.d(t,{Z:()=>a,a:()=>o});var n=i(7294);const s={},r=n.createContext(s);function o(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/73b7c9ed.f77f55c0.js b/assets/js/73b7c9ed.f77f55c0.js deleted file mode 100644 index f20f37369..000000000 --- a/assets/js/73b7c9ed.f77f55c0.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7688],{2137:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var n=i(5893),s=i(1151);const r={title:"Investigate",hide_title:!0,sidebar_position:1},o="Investigating a Project",a={id:"cado-response/investigate/intro",title:"Investigate",description:"Evidence is processed into Projects and investigation starts by analyzing the project evidence. The project view provides an overview of the key information for all evidence items in a given project.",source:"@site/docs/cado-response/investigate/intro.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/intro",permalink:"/cado-response/investigate/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/intro.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Investigate",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Exporting Data",permalink:"/cado-response/export/intro"},next:{title:"Evidence",permalink:"/cado-response/investigate/evidence"}},c={},d=[{value:"System View",id:"system-view",level:3},{value:"Browsing Files",id:"browsing-files",level:3},{value:"Searching",id:"searching",level:3},{value:"Indicators / Detections",id:"indicators--detections",level:3}];function l(e){const t={a:"a",h1:"h1",h3:"h3",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"investigating-a-project",children:"Investigating a Project"}),"\n",(0,n.jsx)(t.p,{children:"Evidence is processed into Projects and investigation starts by analyzing the project evidence. The project view provides an overview of the key information for all evidence items in a given project."}),"\n",(0,n.jsx)(t.p,{children:"The tabs available on the Project Overview page are:"}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Tab Name"}),(0,n.jsx)(t.th,{children:"Description"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.a,{href:"/cado-response/investigate/timeline-search",children:"Timeline"})}),(0,n.jsx)(t.td,{children:"A timeline of key events."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.a,{href:"/cado-response/investigate/key-events",children:"Alarms"})}),(0,n.jsx)(t.td,{children:"Malicious events."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.a,{href:"/cado-response/investigate/key-events",children:"Suspicious"})}),(0,n.jsx)(t.td,{children:"Possibly malicious events."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.a,{href:"/cado-response/investigate/network",children:"Network"})}),(0,n.jsx)(t.td,{children:"Network connections."})]})]})]}),"\n",(0,n.jsx)(t.h3,{id:"system-view",children:"System View"}),"\n",(0,n.jsx)(t.p,{children:"By clicking on an individual Evidence item, you bring up the System View. The System View provides the same details as the Project View, but limited to a single evidence item."}),"\n",(0,n.jsx)(t.h3,{id:"browsing-files",children:"Browsing Files"}),"\n",(0,n.jsxs)(t.p,{children:["You can browse the filesystem of certain evidence items. When browsing a ",(0,n.jsx)(t.strong,{children:"Disk"})," folders with a red dot indicate the presence of a known malicious file. You can browse the folder structure of a disk by clicking on individual folders."]}),"\n",(0,n.jsx)(t.h3,{id:"searching",children:"Searching"}),"\n",(0,n.jsx)(t.p,{children:"The search interface allows you to search both file and event contents."}),"\n",(0,n.jsxs)(t.p,{children:["Click ",(0,n.jsx)(t.strong,{children:"Investigate"})," then ",(0,n.jsx)(t.strong,{children:"Search"})," to open the search interface. Cado uses specialized indexing to provide fast searches across files and events. Due to the way this indexing works, you may get fewer results than if you performed a traditional slow byte by byte search of each file."]}),"\n",(0,n.jsx)(t.h3,{id:"indicators--detections",children:"Indicators / Detections"}),"\n",(0,n.jsx)(t.p,{children:"The Indicators or Detections page provides a summary of indicators of compromise detected within a project, and which systems they matched."}),"\n",(0,n.jsxs)(t.p,{children:["Click ",(0,n.jsx)(t.strong,{children:"Investigate"})," then ",(0,n.jsx)(t.strong,{children:"Indicators"}),"."]})]})}function h(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},1151:(e,t,i)=>{i.d(t,{Z:()=>a,a:()=>o});var n=i(7294);const s={},r=n.createContext(s);function o(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/75771170.851c0abd.js b/assets/js/75771170.851c0abd.js deleted file mode 100644 index 3a46846fb..000000000 --- a/assets/js/75771170.851c0abd.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9615],{8561:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>l,default:()=>h,frontMatter:()=>i,metadata:()=>s,toc:()=>a});var o=n(5893),r=n(1151);const i={title:"Google Cloud Credentials",hide_title:!0,sidebar_position:5},l="Creating Google Cloud Credentials",s={id:"cado-host/google-credentials",title:"Google Cloud Credentials",description:"To create secure credentials for Google Cloud Storage, perform the following. You can also watch the embedded video, which walks through the process.\u200b",source:"@site/docs/cado-host/google-credentials.md",sourceDirName:"cado-host",slug:"/cado-host/google-credentials",permalink:"/cado-host/google-credentials",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-host/google-credentials.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:5,frontMatter:{title:"Google Cloud Credentials",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Azure Credentials",permalink:"/cado-host/azure-credentials"},next:{title:"FAQs",permalink:"/troubleshooting/faq"}},c={},a=[{value:"Creating a Bucket",id:"creating-a-bucket",level:2},{value:"Creating Credentials",id:"creating-credentials",level:2}];function d(e){const t={h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",ul:"ul",...(0,r.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"creating-google-cloud-credentials",children:"Creating Google Cloud Credentials"}),"\n",(0,o.jsx)(t.p,{children:"To create secure credentials for Google Cloud Storage, perform the following. You can also watch the embedded video, which walks through the process.\u200b"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsx)(t.li,{children:"Create a Bucket"}),"\n",(0,o.jsx)(t.li,{children:"Create credentials for write-only access to the bucket"}),"\n"]}),"\n",(0,o.jsx)("iframe",{width:"100%",height:"536",src:"https://www.youtube.com/embed/VQxzJ1V8ArE",title:"YouTube video player",frameborder:"0",allowfullscreen:!0}),"\n",(0,o.jsx)(t.h2,{id:"creating-a-bucket",children:"Creating a Bucket"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsx)(t.li,{children:"Open the Storage Browser."}),"\n",(0,o.jsx)(t.li,{children:"Click Create Bucket."}),"\n",(0,o.jsx)(t.li,{children:"Create the bucket using your desired settings."}),"\n"]}),"\n",(0,o.jsx)(t.h2,{id:"creating-credentials",children:"Creating Credentials"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsx)(t.li,{children:"Go to Storage Settings."}),"\n",(0,o.jsx)(t.li,{children:"Select your project, then select Interoperability."}),"\n",(0,o.jsx)(t.li,{children:"Click Create a Key for a service Account."}),"\n",(0,o.jsx)(t.li,{children:"Click Create a New Account."}),"\n",(0,o.jsx)(t.li,{children:"Type the name of the account, then grant the Storage Object Creator permission."}),"\n",(0,o.jsx)(t.li,{children:"This grants permission to write objects to a storage bucket, but not list or download objects."}),"\n",(0,o.jsx)(t.li,{children:"Click through to create the account, and copy the Secret Key and Access Key."}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"In the end, you are ready to go when you have:"}),"\n",(0,o.jsxs)(t.ol,{children:["\n",(0,o.jsx)(t.li,{children:"The Access Key"}),"\n",(0,o.jsx)(t.li,{children:"The Secret Key"}),"\n",(0,o.jsx)(t.li,{children:"The Bucket Name"}),"\n"]})]})}function h(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>s,a:()=>l});var o=n(7294);const r={},i=o.createContext(r);function l(e){const t=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:l(e.components),o.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/75771170.b9a80edb.js b/assets/js/75771170.b9a80edb.js new file mode 100644 index 000000000..5baa7f64e --- /dev/null +++ b/assets/js/75771170.b9a80edb.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9615],{8561:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>l,default:()=>h,frontMatter:()=>i,metadata:()=>s,toc:()=>a});var o=n(5893),r=n(1151);const i={title:"Google Cloud Credentials",hide_title:!0,sidebar_position:5},l="Creating Google Cloud Credentials",s={id:"cado-host/google-credentials",title:"Google Cloud Credentials",description:"To create secure credentials for Google Cloud Storage, perform the following. You can also watch the embedded video, which walks through the process.\u200b",source:"@site/docs/cado-host/google-credentials.md",sourceDirName:"cado-host",slug:"/cado-host/google-credentials",permalink:"/cado-host/google-credentials",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-host/google-credentials.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:5,frontMatter:{title:"Google Cloud Credentials",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Azure Credentials",permalink:"/cado-host/azure-credentials"},next:{title:"FAQs",permalink:"/troubleshooting/faq"}},c={},a=[{value:"Creating a Bucket",id:"creating-a-bucket",level:2},{value:"Creating Credentials",id:"creating-credentials",level:2}];function d(e){const t={h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",ul:"ul",...(0,r.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"creating-google-cloud-credentials",children:"Creating Google Cloud Credentials"}),"\n",(0,o.jsx)(t.p,{children:"To create secure credentials for Google Cloud Storage, perform the following. You can also watch the embedded video, which walks through the process.\u200b"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsx)(t.li,{children:"Create a Bucket"}),"\n",(0,o.jsx)(t.li,{children:"Create credentials for write-only access to the bucket"}),"\n"]}),"\n",(0,o.jsx)("iframe",{width:"100%",height:"536",src:"https://www.youtube.com/embed/VQxzJ1V8ArE",title:"YouTube video player",frameborder:"0",allowfullscreen:!0}),"\n",(0,o.jsx)(t.h2,{id:"creating-a-bucket",children:"Creating a Bucket"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsx)(t.li,{children:"Open the Storage Browser."}),"\n",(0,o.jsx)(t.li,{children:"Click Create Bucket."}),"\n",(0,o.jsx)(t.li,{children:"Create the bucket using your desired settings."}),"\n"]}),"\n",(0,o.jsx)(t.h2,{id:"creating-credentials",children:"Creating Credentials"}),"\n",(0,o.jsxs)(t.ul,{children:["\n",(0,o.jsx)(t.li,{children:"Go to Storage Settings."}),"\n",(0,o.jsx)(t.li,{children:"Select your project, then select Interoperability."}),"\n",(0,o.jsx)(t.li,{children:"Click Create a Key for a service Account."}),"\n",(0,o.jsx)(t.li,{children:"Click Create a New Account."}),"\n",(0,o.jsx)(t.li,{children:"Type the name of the account, then grant the Storage Object Creator permission."}),"\n",(0,o.jsx)(t.li,{children:"This grants permission to write objects to a storage bucket, but not list or download objects."}),"\n",(0,o.jsx)(t.li,{children:"Click through to create the account, and copy the Secret Key and Access Key."}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"In the end, you are ready to go when you have:"}),"\n",(0,o.jsxs)(t.ol,{children:["\n",(0,o.jsx)(t.li,{children:"The Access Key"}),"\n",(0,o.jsx)(t.li,{children:"The Secret Key"}),"\n",(0,o.jsx)(t.li,{children:"The Bucket Name"}),"\n"]})]})}function h(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>s,a:()=>l});var o=n(7294);const r={},i=o.createContext(r);function l(e){const t=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:l(e.components),o.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/77ebc470.901a8cdb.js b/assets/js/77ebc470.901a8cdb.js deleted file mode 100644 index 8708cae8a..000000000 --- a/assets/js/77ebc470.901a8cdb.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4514],{7975:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>d,contentTitle:()=>s,default:()=>g,frontMatter:()=>a,metadata:()=>r,toc:()=>c});var o=t(5893),i=t(1151);const a={title:"Logging In",hide_title:!0,sidebar_position:1},s="Logging In",r={id:"cado-response/manage/logging-in",title:"Logging In",description:"Depending on the cloud provider in which you deployed the Cado platform, navigate to either your AWS Console or your Azure Portal and find the Public IPv4 address of your running Cado instance. Open a browser and navigate to https:// where `` is the IPv4 of the Cado instance. You will now be able to log into the platform.",source:"@site/docs/cado-response/manage/logging-in.md",sourceDirName:"cado-response/manage",slug:"/cado-response/manage/logging-in",permalink:"/cado-response/manage/logging-in",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/logging-in.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Logging In",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"AI Investigator",permalink:"/cado-response/investigate/ai investigator"},next:{title:"Applying a License",permalink:"/cado-response/manage/licenses"}},d={},c=[{value:"Default Login",id:"default-login",level:3}];function l(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",mdxAdmonitionTitle:"mdxAdmonitionTitle",p:"p",strong:"strong",...(0,i.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(n.h1,{id:"logging-in",children:"Logging In"}),"\n",(0,o.jsxs)(n.p,{children:["Depending on the cloud provider in which you deployed the Cado platform, navigate to either your ",(0,o.jsx)(n.strong,{children:(0,o.jsx)(n.a,{href:"https://console.aws.amazon.com",children:"AWS Console"})})," or your ",(0,o.jsx)(n.strong,{children:(0,o.jsx)(n.a,{href:"https://portal.azure.com",children:"Azure Portal"})})," and find the Public IPv4 address of your running Cado instance. Open a browser and navigate to ",(0,o.jsx)(n.code,{children:"https://"})," where ",(0,o.jsx)(n.code,{children:""})," is the IPv4 of the Cado instance. You will now be able to log into the platform."]}),"\n",(0,o.jsxs)(n.admonition,{type:"tip",children:[(0,o.jsx)(n.mdxAdmonitionTitle,{}),(0,o.jsxs)(n.p,{children:['You will see a browser notification stating that "Your connection is not private". Cado is unable to automatically generate SSL certificates. In AWS, if you require a valid SSL certificate, the easiest way to create one for the encrypted HTTPS connection is to ',(0,o.jsx)(n.strong,{children:(0,o.jsx)(n.a,{href:"/cado-response/deploy/aws/networking/aws-load-balancer",children:"create your own ELB"})})]})]}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.img,{alt:"Login Page",src:t(9308).Z+"",width:"456",height:"528"})}),"\n",(0,o.jsx)(n.h3,{id:"default-login",children:"Default Login"}),"\n",(0,o.jsxs)(n.p,{children:['On first boot, the platform will take about 10 minutes to install, during which time, on the login URL page, you will see a message indicating that the system is "Installing Cado Response ...". After initial install, you can login with the username ',(0,o.jsx)(n.code,{children:"admin"}),". For AWS, the password is ",(0,o.jsx)(n.code,{children:"i-xxx"}),", where ",(0,o.jsx)(n.code,{children:"i-xxx"})," is the Instance ID of your Cado instance. For Azure, the password is the very long instance id ",(0,o.jsx)(n.code,{children:"/subscription/.../cado-main-vm"})," where ",(0,o.jsx)(n.code,{children:"/subscription/.../cado-main-vm"})," is the full instance id. After initial login, you will be asked to accept the EULA and change your password."]})]})}function g(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,o.jsx)(n,{...e,children:(0,o.jsx)(l,{...e})}):l(e)}},9308:(e,n,t)=>{t.d(n,{Z:()=>o});const o=t.p+"assets/images/login-7194fb115da3e43cb1d8ca36b1ace509.png"},1151:(e,n,t)=>{t.d(n,{Z:()=>r,a:()=>s});var o=t(7294);const i={},a=o.createContext(i);function s(e){const n=o.useContext(a);return o.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:s(e.components),o.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/77ebc470.ba14064a.js b/assets/js/77ebc470.ba14064a.js new file mode 100644 index 000000000..da4c8681b --- /dev/null +++ b/assets/js/77ebc470.ba14064a.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4514],{7975:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>d,contentTitle:()=>s,default:()=>g,frontMatter:()=>a,metadata:()=>r,toc:()=>c});var o=t(5893),i=t(1151);const a={title:"Logging In",hide_title:!0,sidebar_position:1},s="Logging In",r={id:"cado-response/manage/logging-in",title:"Logging In",description:"Depending on the cloud provider in which you deployed the Cado platform, navigate to either your AWS Console or your Azure Portal and find the Public IPv4 address of your running Cado instance. Open a browser and navigate to https:// where `` is the IPv4 of the Cado instance. You will now be able to log into the platform.",source:"@site/docs/cado-response/manage/logging-in.md",sourceDirName:"cado-response/manage",slug:"/cado-response/manage/logging-in",permalink:"/cado-response/manage/logging-in",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/logging-in.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Logging In",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"AI Investigator",permalink:"/cado-response/investigate/ai investigator"},next:{title:"Applying a License",permalink:"/cado-response/manage/licenses"}},d={},c=[{value:"Default Login",id:"default-login",level:3}];function l(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",mdxAdmonitionTitle:"mdxAdmonitionTitle",p:"p",strong:"strong",...(0,i.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(n.h1,{id:"logging-in",children:"Logging In"}),"\n",(0,o.jsxs)(n.p,{children:["Depending on the cloud provider in which you deployed the Cado platform, navigate to either your ",(0,o.jsx)(n.strong,{children:(0,o.jsx)(n.a,{href:"https://console.aws.amazon.com",children:"AWS Console"})})," or your ",(0,o.jsx)(n.strong,{children:(0,o.jsx)(n.a,{href:"https://portal.azure.com",children:"Azure Portal"})})," and find the Public IPv4 address of your running Cado instance. Open a browser and navigate to ",(0,o.jsx)(n.code,{children:"https://"})," where ",(0,o.jsx)(n.code,{children:""})," is the IPv4 of the Cado instance. You will now be able to log into the platform."]}),"\n",(0,o.jsxs)(n.admonition,{type:"tip",children:[(0,o.jsx)(n.mdxAdmonitionTitle,{}),(0,o.jsxs)(n.p,{children:['You will see a browser notification stating that "Your connection is not private". Cado is unable to automatically generate SSL certificates. In AWS, if you require a valid SSL certificate, the easiest way to create one for the encrypted HTTPS connection is to ',(0,o.jsx)(n.strong,{children:(0,o.jsx)(n.a,{href:"/cado-response/deploy/aws/networking/aws-load-balancer",children:"create your own ELB"})})]})]}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.img,{alt:"Login Page",src:t(9308).Z+"",width:"456",height:"528"})}),"\n",(0,o.jsx)(n.h3,{id:"default-login",children:"Default Login"}),"\n",(0,o.jsxs)(n.p,{children:['On first boot, the platform will take about 10 minutes to install, during which time, on the login URL page, you will see a message indicating that the system is "Installing Cado Response ...". After initial install, you can login with the username ',(0,o.jsx)(n.code,{children:"admin"}),". For AWS, the password is ",(0,o.jsx)(n.code,{children:"i-xxx"}),", where ",(0,o.jsx)(n.code,{children:"i-xxx"})," is the Instance ID of your Cado instance. For Azure, the password is the very long instance id ",(0,o.jsx)(n.code,{children:"/subscription/.../cado-main-vm"})," where ",(0,o.jsx)(n.code,{children:"/subscription/.../cado-main-vm"})," is the full instance id. After initial login, you will be asked to accept the EULA and change your password."]})]})}function g(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,o.jsx)(n,{...e,children:(0,o.jsx)(l,{...e})}):l(e)}},9308:(e,n,t)=>{t.d(n,{Z:()=>o});const o=t.p+"assets/images/login-7194fb115da3e43cb1d8ca36b1ace509.png"},1151:(e,n,t)=>{t.d(n,{Z:()=>r,a:()=>s});var o=t(7294);const i={},a=o.createContext(i);function s(e){const n=o.useContext(a);return o.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:s(e.components),o.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/7aefa8e1.bceba087.js b/assets/js/7aefa8e1.bceba087.js new file mode 100644 index 000000000..5fd8a5d52 --- /dev/null +++ b/assets/js/7aefa8e1.bceba087.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4084],{9730:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>c,default:()=>p,frontMatter:()=>r,metadata:()=>s,toc:()=>l});var n=o(5893),i=o(1151);const r={title:"GCP Settings",hide_title:!0,sidebar_position:2},c="Setting up Import from GCP",s={id:"cado-response/deploy/gcp/gcp-settings",title:"GCP Settings",description:"You can acquire compute and storage resources from GCP with the Cado platform by",source:"@site/docs/cado-response/deploy/gcp/gcp-settings.md",sourceDirName:"cado-response/deploy/gcp",slug:"/cado-response/deploy/gcp/gcp-settings",permalink:"/cado-response/deploy/gcp/gcp-settings",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/gcp/gcp-settings.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"GCP Settings",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"GCP Deployment (Beta)",permalink:"/cado-response/deploy/gcp/gcp-deploy"},next:{title:"Automated Setup",permalink:"/cado-response/deploy/gcp/gcp-auto-setup"}},a={},l=[{value:"Setting up the Primary Google Project for Cado collection",id:"setting-up-the-primary-google-project-for-cado-collection",level:2},{value:"Creating a Cado Role",id:"creating-a-cado-role",level:3},{value:"Enabling the Cloud Build API for the project",id:"enabling-the-cloud-build-api-for-the-project",level:3},{value:"Defining a bucket for the Primary GCP Project",id:"defining-a-bucket-for-the-primary-gcp-project",level:3},{value:"Setting up a Service Account in Primary GCP Project",id:"setting-up-a-service-account-in-primary-gcp-project",level:2},{value:"Required Access",id:"required-access",level:3},{value:"Getting GCP Credentials",id:"getting-gcp-credentials",level:3},{value:"Service Account Credentials",id:"service-account-credentials",level:4},{value:"Workload Identity Federation",id:"workload-identity-federation",level:4},{value:"Entering Settings",id:"entering-settings",level:2},{value:"Collecting from multiple GCP Projects",id:"collecting-from-multiple-gcp-projects",level:2}];function d(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"setting-up-import-from-gcp",children:"Setting up Import from GCP"}),"\n",(0,n.jsx)(t.p,{children:"You can acquire compute and storage resources from GCP with the Cado platform by"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsx)(t.li,{children:"Setting up the primary GCP project for Cado collection"}),"\n",(0,n.jsx)(t.li,{children:"Setting up a Service Account in GCP"}),"\n",(0,n.jsx)(t.li,{children:"Entering credentials into Cado"}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"The below guide walks through this process."}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsxs)(t.p,{children:["This setup can be automated using our ",(0,n.jsx)(t.a,{href:"/cado-response/deploy/gcp/gcp-auto-setup",children:"GCP Automated Setup"})]})}),"\n",(0,n.jsx)(t.h2,{id:"setting-up-the-primary-google-project-for-cado-collection",children:"Setting up the Primary Google Project for Cado collection"}),"\n",(0,n.jsx)(t.p,{children:"In order to set up the project for Cado collection you need to"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Enable the Cloud Build API for the project"}),"\n",(0,n.jsx)(t.li,{children:"Define a bucket for the Primary GCP Project where images will be stored and imported into Cado."}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.em,{children:(0,n.jsxs)(t.strong,{children:["Note - if you are importing from more than one Google project you will need to designate one of those projects as the Primary GCP Project and ",(0,n.jsx)(t.a,{href:"/cado-response/deploy/gcp/gcp-settings#defining-a-bucket-for-the-primary-gcp-project",children:"create a bucket in that project"})," to enable collection across the multiple Google projects"]})})}),"\n",(0,n.jsx)(t.h3,{id:"creating-a-cado-role",children:"Creating a Cado Role"}),"\n",(0,n.jsxs)(t.p,{children:["To appropriately scope a service account for Cado to operate, creating a custom GCP role allows specifying individual permissions. To achieve this, navigate to the ",(0,n.jsx)(t.strong,{children:"Role"})," section un the ",(0,n.jsx)(t.strong,{children:"IAM and Admin"})," tab. Create a custom role and add the following permissions:"]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:" cloudbuild.builds.create\n cloudbuild.builds.get\n compute.disks.get\n compute.disks.useReadOnly\n compute.globalOperations.get\n compute.images.create\n compute.instances.get\n compute.instances.list\n container.clusters.get\n container.clusters.list\n container.pods.exec\n container.pods.get\n container.pods.list\n iam.serviceAccounts.getAccessToken\n iam.serviceAccounts.implicitDelegation\n resourcemanager.projects.get\n storage.buckets.get\n storage.buckets.list\n storage.objects.get\n storage.objects.list\n"})}),"\n",(0,n.jsx)(t.p,{children:"If you'll be wanting to use this Role across multiple projects, you can create it at the Organization level- this is required if you'll be wanting to acquire assets from multiple projects under one service account."}),"\n",(0,n.jsx)(t.h3,{id:"enabling-the-cloud-build-api-for-the-project",children:"Enabling the Cloud Build API for the project"}),"\n",(0,n.jsxs)(t.p,{children:["To enable Cloud Build API for a Google project, see the documentation at ",(0,n.jsx)(t.a,{href:"https://console.cloud.google.com/cloud-build/",children:"https://console.cloud.google.com/cloud-build/"}),"."]}),"\n",(0,n.jsxs)(t.p,{children:["Once Cloud Build is enabled, a principal will have been created in ",(0,n.jsx)(t.strong,{children:"'IAM and Admin > IAM'"})," called ",(0,n.jsx)(t.code,{children:"xxxxxxxxxxxx@cloudbuild.gserviceaccount.com"}),", we also need this principal to have the custom role we created in the previous step ",(0,n.jsx)(t.strong,{children:"'Customer -> '"}),". Do this by editing the principal with the pen icon on the right and selecting the appropriate role."]}),"\n",(0,n.jsx)(t.h3,{id:"defining-a-bucket-for-the-primary-gcp-project",children:"Defining a bucket for the Primary GCP Project"}),"\n",(0,n.jsxs)(t.p,{children:["Create a bucket in the project that will store the captured raw data from across all GCP projects. For more information ",(0,n.jsx)(t.a,{href:"https://cloud.google.com/storage/docs/creating-buckets",children:"https://cloud.google.com/storage/docs/creating-buckets"})]}),"\n",(0,n.jsx)(t.h2,{id:"setting-up-a-service-account-in-primary-gcp-project",children:"Setting up a Service Account in Primary GCP Project"}),"\n",(0,n.jsx)(t.p,{children:"Next, you need to set up a Service Account in GCP. For information on how to do this more see:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://console.cloud.google.com/iam-admin/serviceaccounts",children:"https://console.cloud.google.com/iam-admin/serviceaccounts"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://cloud.google.com/iam/docs/service-accounts",children:"https://cloud.google.com/iam/docs/service-accounts"})}),"\n"]}),"\n",(0,n.jsx)(t.h3,{id:"required-access",children:"Required Access"}),"\n",(0,n.jsx)(t.p,{children:"Both the Cado service account and the service account for the Cloud API need the custom role's permissions 'Custom -> ' role:"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Custom Role",src:o(6486).Z+"",width:"1440",height:"958"})}),"\n",(0,n.jsxs)(t.p,{children:["To import GKE containers, the Cado service account also needs the ",(0,n.jsx)(t.code,{children:"iam.serviceAccounts.implicitDelegation"})," IAM permission."]}),"\n",(0,n.jsx)(t.h3,{id:"getting-gcp-credentials",children:"Getting GCP Credentials"}),"\n",(0,n.jsx)(t.p,{children:"When you add credentials to Cado you are creating a mapping from a set of credentials (in GCP json format) to a project name."}),"\n",(0,n.jsx)(t.p,{children:"Any time a user then attempts to access that particular GCP project name, the credentials that you registered in settings will be used. This keeps non-admin users from having to managing credentials themselves, while also alllowing access to as many different GCP projects as you want."}),"\n",(0,n.jsx)(t.p,{children:"There are two ways to achieve this:"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"Service Account Credentials"})," - this is a simpler but less secure approach. ",(0,n.jsx)(t.em,{children:"Note - Cado running in Azure only supports the use of Service Account Credentials"})]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"Workload Identity Federation"})," - This requires more expertise but is the recommended, more secure approach."]}),"\n"]}),"\n",(0,n.jsx)(t.h4,{id:"service-account-credentials",children:"Service Account Credentials"}),"\n",(0,n.jsx)(t.p,{children:"The simplest method to add GCP credentials to Cado is to use a service account, which will give you a permanent key. These are very sensitive credentials but they are easy to manage and simple to set up. Adding GCP credentials for service accounts is supported by Cado when deployed in both AWS and Azure."}),"\n",(0,n.jsx)(t.p,{children:"GCP credentials come in a json format that wraps around a \u2018regular\u2019 credential. It can be treated as functionally no different to how you would handle any type of password or key."}),"\n",(0,n.jsxs)(t.p,{children:["For example, a service account key would come in a structure such as the below. The \u2018credential\u2019 is a literal RSA key as a string in the ",(0,n.jsx)(t.code,{children:"private_key"})," field, all other fields are metadata for the benefit of the application that uses it:"]}),"\n",(0,n.jsxs)(t.p,{children:['{\n"type": "service_account",\n"project_id": "cool-project",\n"private_key_id": "22c14ac5b63...",\n"private_key": "-----BEGIN PRIVATE KEY-----\\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKg...wggSkA.\\n-----END PRIVATE KEY-----\\n",\n"client_email": "cool-project.iam.gserviceaccount.com",\n"client_id": "...",\n"auth_uri": "',(0,n.jsx)(t.a,{href:"https://accounts.google.com/o/oauth2/auth",children:"https://accounts.google.com/o/oauth2/auth"}),'",\n"token_uri": "',(0,n.jsx)(t.a,{href:"https://oauth2.googleapis.com/token",children:"https://oauth2.googleapis.com/token"}),'",\n"auth_provider_x509_cert_url": "',(0,n.jsx)(t.a,{href:"https://www.googleapis.com/oauth2/v1/certs",children:"https://www.googleapis.com/oauth2/v1/certs"}),'",\n"client_x509_cert_url": "..."\n}']}),"\n",(0,n.jsx)(t.h4,{id:"workload-identity-federation",children:"Workload Identity Federation"}),"\n",(0,n.jsxs)(t.p,{children:["The GCP recommended best practice, is to use Workload Identity Federation, which allows credentials from another app to impersonate a GCP account. ",(0,n.jsx)(t.em,{children:"Note: Cado running in Azure does not support Workload Identity Federation credentials to import from GCP"})]}),"\n",(0,n.jsx)(t.p,{children:"Workload Identity Federation is more secure since the credentials are nothing but metadata telling the app where to go, while the validation is handled on the server side. Adding GCP credentials via Workload Identity Federation is currently only supported for Cado when deployed in AWS."}),"\n",(0,n.jsxs)(t.p,{children:["Rather than give out the key to a service account, you instead register the permission with GCP to allow AWS credentials for account ",(0,n.jsx)(t.code,{children:"123"})," to act as if they were the given GCP service account."]}),"\n",(0,n.jsxs)(t.p,{children:["You can download existing credentials by clicking the display name of the ",(0,n.jsx)(t.strong,{children:"Identity Pool > Connected Service Accounts > Download"}),", which will then ask you which identity\u2019s credentials you would like to download."]}),"\n",(0,n.jsx)(t.p,{children:"For example:"}),"\n",(0,n.jsxs)(t.p,{children:['{\n"type": "external_account",\n"audience": "//iam.googleapis.com/projects/...",\n"subject_token_type": "urn:ietf:params:aws:token-type',":aws4_request",'",\n"service_account_impersonation_url": "',(0,n.jsx)(t.a,{href:"https://...ount.comgenerateAccessToken",children:"https://...ount.comgenerateAccessToken"}),'",','\n"token_url": "',(0,n.jsx)(t.a,{href:"https://sts.googleapis.com/v1/token",children:"https://sts.googleapis.com/v1/token"}),'",\n"credential_source": {\n"environment_id": "...",\n"region_url": "',(0,n.jsx)(t.a,{href:"http://169.254.169.254/latest/meta-data/placement/availability-zone",children:"http://169.254.169.254/latest/meta-data/placement/availability-zone"}),'",\n"url": "',(0,n.jsx)(t.a,{href:"http://169.254.169.254/latest/meta-data/iam/security-credentials",children:"http://169.254.169.254/latest/meta-data/iam/security-credentials"}),'",\n"regional_cred_verification_url": "',(0,n.jsx)(t.a,{href:"https://sts.%7Bregion%7D.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15",children:"https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15"}),'"\n}\n}']}),"\n",(0,n.jsx)(t.p,{children:"For more information about GCP Workload Identity Federation see:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://console.cloud.google.com/iam-admin/workload-identity-pools",children:"https://console.cloud.google.com/iam-admin/workload-identity-pools"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://cloud.google.com/iam/docs/workload-identity-federation",children:"https://cloud.google.com/iam/docs/workload-identity-federation"})}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"entering-settings",children:"Entering Settings"}),"\n",(0,n.jsxs)(t.p,{children:["You can add GCP Credentials to Cado in the ",(0,n.jsx)(t.strong,{children:"Settings > Cloud > GCP"}),' page.\nYou will be asked for a "GCP Project Name" and the "GCP Credentials". These credentials will be a JSON either directly containing the service account credentials, or the Workload Identity Federation credentials']}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"GCP Credentials",src:o(345).Z+"",width:"537",height:"305"})}),"\n",(0,n.jsx)(t.h2,{id:"collecting-from-multiple-gcp-projects",children:"Collecting from multiple GCP Projects"}),"\n",(0,n.jsxs)(t.p,{children:["After setting up your Primary GCP Project, to collect from multiple GCP projects follow the instructions in ",(0,n.jsx)(t.a,{href:"/cado-response/deploy/gcp/gcp-cross-project",children:"GCP Cross-Project Setup"})]})]})}function p(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},345:(e,t,o)=>{o.d(t,{Z:()=>n});const n=o.p+"assets/images/gcp-credentials-816d3bf0d3bb101ce25c109263ae445e.png"},6486:(e,t,o)=>{o.d(t,{Z:()=>n});const n=o.p+"assets/images/gcp-custom-role-f3f82ab1a1055d898f01c12abf8efcc9.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>s,a:()=>c});var n=o(7294);const i={},r=n.createContext(i);function c(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:c(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/7aefa8e1.e11781b5.js b/assets/js/7aefa8e1.e11781b5.js deleted file mode 100644 index 490a14f96..000000000 --- a/assets/js/7aefa8e1.e11781b5.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4084],{9730:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>c,default:()=>p,frontMatter:()=>r,metadata:()=>s,toc:()=>l});var n=o(5893),i=o(1151);const r={title:"GCP Settings",hide_title:!0,sidebar_position:2},c="Setting up Import from GCP",s={id:"cado-response/deploy/gcp/gcp-settings",title:"GCP Settings",description:"You can acquire compute and storage resources from GCP with the Cado platform by",source:"@site/docs/cado-response/deploy/gcp/gcp-settings.md",sourceDirName:"cado-response/deploy/gcp",slug:"/cado-response/deploy/gcp/gcp-settings",permalink:"/cado-response/deploy/gcp/gcp-settings",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/gcp/gcp-settings.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"GCP Settings",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"GCP Deployment (Beta)",permalink:"/cado-response/deploy/gcp/gcp-deploy"},next:{title:"Automated Setup",permalink:"/cado-response/deploy/gcp/gcp-auto-setup"}},a={},l=[{value:"Setting up the Primary Google Project for Cado collection",id:"setting-up-the-primary-google-project-for-cado-collection",level:2},{value:"Creating a Cado Role",id:"creating-a-cado-role",level:3},{value:"Enabling the Cloud Build API for the project",id:"enabling-the-cloud-build-api-for-the-project",level:3},{value:"Defining a bucket for the Primary GCP Project",id:"defining-a-bucket-for-the-primary-gcp-project",level:3},{value:"Setting up a Service Account in Primary GCP Project",id:"setting-up-a-service-account-in-primary-gcp-project",level:2},{value:"Required Access",id:"required-access",level:3},{value:"Getting GCP Credentials",id:"getting-gcp-credentials",level:3},{value:"Service Account Credentials",id:"service-account-credentials",level:4},{value:"Workload Identity Federation",id:"workload-identity-federation",level:4},{value:"Entering Settings",id:"entering-settings",level:2},{value:"Collecting from multiple GCP Projects",id:"collecting-from-multiple-gcp-projects",level:2}];function d(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"setting-up-import-from-gcp",children:"Setting up Import from GCP"}),"\n",(0,n.jsx)(t.p,{children:"You can acquire compute and storage resources from GCP with the Cado platform by"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsx)(t.li,{children:"Setting up the primary GCP project for Cado collection"}),"\n",(0,n.jsx)(t.li,{children:"Setting up a Service Account in GCP"}),"\n",(0,n.jsx)(t.li,{children:"Entering credentials into Cado"}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"The below guide walks through this process."}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsxs)(t.p,{children:["This setup can be automated using our ",(0,n.jsx)(t.a,{href:"/cado-response/deploy/gcp/gcp-auto-setup",children:"GCP Automated Setup"})]})}),"\n",(0,n.jsx)(t.h2,{id:"setting-up-the-primary-google-project-for-cado-collection",children:"Setting up the Primary Google Project for Cado collection"}),"\n",(0,n.jsx)(t.p,{children:"In order to set up the project for Cado collection you need to"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"Enable the Cloud Build API for the project"}),"\n",(0,n.jsx)(t.li,{children:"Define a bucket for the Primary GCP Project where images will be stored and imported into Cado."}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.em,{children:(0,n.jsxs)(t.strong,{children:["Note - if you are importing from more than one Google project you will need to designate one of those projects as the Primary GCP Project and ",(0,n.jsx)(t.a,{href:"/cado-response/deploy/gcp/gcp-settings#defining-a-bucket-for-the-primary-gcp-project",children:"create a bucket in that project"})," to enable collection across the multiple Google projects"]})})}),"\n",(0,n.jsx)(t.h3,{id:"creating-a-cado-role",children:"Creating a Cado Role"}),"\n",(0,n.jsxs)(t.p,{children:["To appropriately scope a service account for Cado to operate, creating a custom GCP role allows specifying individual permissions. To achieve this, navigate to the ",(0,n.jsx)(t.strong,{children:"Role"})," section un the ",(0,n.jsx)(t.strong,{children:"IAM and Admin"})," tab. Create a custom role and add the following permissions:"]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{children:" cloudbuild.builds.create\n cloudbuild.builds.get\n compute.disks.get\n compute.disks.useReadOnly\n compute.globalOperations.get\n compute.images.create\n compute.instances.get\n compute.instances.list\n container.clusters.get\n container.clusters.list\n container.pods.exec\n container.pods.get\n container.pods.list\n iam.serviceAccounts.getAccessToken\n iam.serviceAccounts.implicitDelegation\n resourcemanager.projects.get\n storage.buckets.get\n storage.buckets.list\n storage.objects.get\n storage.objects.list\n"})}),"\n",(0,n.jsx)(t.p,{children:"If you'll be wanting to use this Role across multiple projects, you can create it at the Organization level- this is required if you'll be wanting to acquire assets from multiple projects under one service account."}),"\n",(0,n.jsx)(t.h3,{id:"enabling-the-cloud-build-api-for-the-project",children:"Enabling the Cloud Build API for the project"}),"\n",(0,n.jsxs)(t.p,{children:["To enable Cloud Build API for a Google project, see the documentation at ",(0,n.jsx)(t.a,{href:"https://console.cloud.google.com/cloud-build/",children:"https://console.cloud.google.com/cloud-build/"}),"."]}),"\n",(0,n.jsxs)(t.p,{children:["Once Cloud Build is enabled, a principal will have been created in ",(0,n.jsx)(t.strong,{children:"'IAM and Admin > IAM'"})," called ",(0,n.jsx)(t.code,{children:"xxxxxxxxxxxx@cloudbuild.gserviceaccount.com"}),", we also need this principal to have the custom role we created in the previous step ",(0,n.jsx)(t.strong,{children:"'Customer -> '"}),". Do this by editing the principal with the pen icon on the right and selecting the appropriate role."]}),"\n",(0,n.jsx)(t.h3,{id:"defining-a-bucket-for-the-primary-gcp-project",children:"Defining a bucket for the Primary GCP Project"}),"\n",(0,n.jsxs)(t.p,{children:["Create a bucket in the project that will store the captured raw data from across all GCP projects. For more information ",(0,n.jsx)(t.a,{href:"https://cloud.google.com/storage/docs/creating-buckets",children:"https://cloud.google.com/storage/docs/creating-buckets"})]}),"\n",(0,n.jsx)(t.h2,{id:"setting-up-a-service-account-in-primary-gcp-project",children:"Setting up a Service Account in Primary GCP Project"}),"\n",(0,n.jsx)(t.p,{children:"Next, you need to set up a Service Account in GCP. For information on how to do this more see:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://console.cloud.google.com/iam-admin/serviceaccounts",children:"https://console.cloud.google.com/iam-admin/serviceaccounts"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://cloud.google.com/iam/docs/service-accounts",children:"https://cloud.google.com/iam/docs/service-accounts"})}),"\n"]}),"\n",(0,n.jsx)(t.h3,{id:"required-access",children:"Required Access"}),"\n",(0,n.jsx)(t.p,{children:"Both the Cado service account and the service account for the Cloud API need the custom role's permissions 'Custom -> ' role:"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Custom Role",src:o(6486).Z+"",width:"1440",height:"958"})}),"\n",(0,n.jsxs)(t.p,{children:["To import GKE containers, the Cado service account also needs the ",(0,n.jsx)(t.code,{children:"iam.serviceAccounts.implicitDelegation"})," IAM permission."]}),"\n",(0,n.jsx)(t.h3,{id:"getting-gcp-credentials",children:"Getting GCP Credentials"}),"\n",(0,n.jsx)(t.p,{children:"When you add credentials to Cado you are creating a mapping from a set of credentials (in GCP json format) to a project name."}),"\n",(0,n.jsx)(t.p,{children:"Any time a user then attempts to access that particular GCP project name, the credentials that you registered in settings will be used. This keeps non-admin users from having to managing credentials themselves, while also alllowing access to as many different GCP projects as you want."}),"\n",(0,n.jsx)(t.p,{children:"There are two ways to achieve this:"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"Service Account Credentials"})," - this is a simpler but less secure approach. ",(0,n.jsx)(t.em,{children:"Note - Cado running in Azure only supports the use of Service Account Credentials"})]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.strong,{children:"Workload Identity Federation"})," - This requires more expertise but is the recommended, more secure approach."]}),"\n"]}),"\n",(0,n.jsx)(t.h4,{id:"service-account-credentials",children:"Service Account Credentials"}),"\n",(0,n.jsx)(t.p,{children:"The simplest method to add GCP credentials to Cado is to use a service account, which will give you a permanent key. These are very sensitive credentials but they are easy to manage and simple to set up. Adding GCP credentials for service accounts is supported by Cado when deployed in both AWS and Azure."}),"\n",(0,n.jsx)(t.p,{children:"GCP credentials come in a json format that wraps around a \u2018regular\u2019 credential. It can be treated as functionally no different to how you would handle any type of password or key."}),"\n",(0,n.jsxs)(t.p,{children:["For example, a service account key would come in a structure such as the below. The \u2018credential\u2019 is a literal RSA key as a string in the ",(0,n.jsx)(t.code,{children:"private_key"})," field, all other fields are metadata for the benefit of the application that uses it:"]}),"\n",(0,n.jsxs)(t.p,{children:['{\n"type": "service_account",\n"project_id": "cool-project",\n"private_key_id": "22c14ac5b63...",\n"private_key": "-----BEGIN PRIVATE KEY-----\\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKg...wggSkA.\\n-----END PRIVATE KEY-----\\n",\n"client_email": "cool-project.iam.gserviceaccount.com",\n"client_id": "...",\n"auth_uri": "',(0,n.jsx)(t.a,{href:"https://accounts.google.com/o/oauth2/auth",children:"https://accounts.google.com/o/oauth2/auth"}),'",\n"token_uri": "',(0,n.jsx)(t.a,{href:"https://oauth2.googleapis.com/token",children:"https://oauth2.googleapis.com/token"}),'",\n"auth_provider_x509_cert_url": "',(0,n.jsx)(t.a,{href:"https://www.googleapis.com/oauth2/v1/certs",children:"https://www.googleapis.com/oauth2/v1/certs"}),'",\n"client_x509_cert_url": "..."\n}']}),"\n",(0,n.jsx)(t.h4,{id:"workload-identity-federation",children:"Workload Identity Federation"}),"\n",(0,n.jsxs)(t.p,{children:["The GCP recommended best practice, is to use Workload Identity Federation, which allows credentials from another app to impersonate a GCP account. ",(0,n.jsx)(t.em,{children:"Note: Cado running in Azure does not support Workload Identity Federation credentials to import from GCP"})]}),"\n",(0,n.jsx)(t.p,{children:"Workload Identity Federation is more secure since the credentials are nothing but metadata telling the app where to go, while the validation is handled on the server side. Adding GCP credentials via Workload Identity Federation is currently only supported for Cado when deployed in AWS."}),"\n",(0,n.jsxs)(t.p,{children:["Rather than give out the key to a service account, you instead register the permission with GCP to allow AWS credentials for account ",(0,n.jsx)(t.code,{children:"123"})," to act as if they were the given GCP service account."]}),"\n",(0,n.jsxs)(t.p,{children:["You can download existing credentials by clicking the display name of the ",(0,n.jsx)(t.strong,{children:"Identity Pool > Connected Service Accounts > Download"}),", which will then ask you which identity\u2019s credentials you would like to download."]}),"\n",(0,n.jsx)(t.p,{children:"For example:"}),"\n",(0,n.jsxs)(t.p,{children:['{\n"type": "external_account",\n"audience": "//iam.googleapis.com/projects/...",\n"subject_token_type": "urn:ietf:params:aws:token-type',":aws4_request",'",\n"service_account_impersonation_url": "',(0,n.jsx)(t.a,{href:"https://...ount.comgenerateAccessToken",children:"https://...ount.comgenerateAccessToken"}),'",','\n"token_url": "',(0,n.jsx)(t.a,{href:"https://sts.googleapis.com/v1/token",children:"https://sts.googleapis.com/v1/token"}),'",\n"credential_source": {\n"environment_id": "...",\n"region_url": "',(0,n.jsx)(t.a,{href:"http://169.254.169.254/latest/meta-data/placement/availability-zone",children:"http://169.254.169.254/latest/meta-data/placement/availability-zone"}),'",\n"url": "',(0,n.jsx)(t.a,{href:"http://169.254.169.254/latest/meta-data/iam/security-credentials",children:"http://169.254.169.254/latest/meta-data/iam/security-credentials"}),'",\n"regional_cred_verification_url": "',(0,n.jsx)(t.a,{href:"https://sts.%7Bregion%7D.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15",children:"https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15"}),'"\n}\n}']}),"\n",(0,n.jsx)(t.p,{children:"For more information about GCP Workload Identity Federation see:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://console.cloud.google.com/iam-admin/workload-identity-pools",children:"https://console.cloud.google.com/iam-admin/workload-identity-pools"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://cloud.google.com/iam/docs/workload-identity-federation",children:"https://cloud.google.com/iam/docs/workload-identity-federation"})}),"\n"]}),"\n",(0,n.jsx)(t.h2,{id:"entering-settings",children:"Entering Settings"}),"\n",(0,n.jsxs)(t.p,{children:["You can add GCP Credentials to Cado in the ",(0,n.jsx)(t.strong,{children:"Settings > Cloud > GCP"}),' page.\nYou will be asked for a "GCP Project Name" and the "GCP Credentials". These credentials will be a JSON either directly containing the service account credentials, or the Workload Identity Federation credentials']}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"GCP Credentials",src:o(345).Z+"",width:"537",height:"305"})}),"\n",(0,n.jsx)(t.h2,{id:"collecting-from-multiple-gcp-projects",children:"Collecting from multiple GCP Projects"}),"\n",(0,n.jsxs)(t.p,{children:["After setting up your Primary GCP Project, to collect from multiple GCP projects follow the instructions in ",(0,n.jsx)(t.a,{href:"/cado-response/deploy/gcp/gcp-cross-project",children:"GCP Cross-Project Setup"})]})]})}function p(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},345:(e,t,o)=>{o.d(t,{Z:()=>n});const n=o.p+"assets/images/gcp-credentials-816d3bf0d3bb101ce25c109263ae445e.png"},6486:(e,t,o)=>{o.d(t,{Z:()=>n});const n=o.p+"assets/images/gcp-custom-role-f3f82ab1a1055d898f01c12abf8efcc9.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>s,a:()=>c});var n=o(7294);const i={},r=n.createContext(i);function c(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:c(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/7e4ce108.ca651e0d.js b/assets/js/7e4ce108.ca651e0d.js deleted file mode 100644 index c65bdc77d..000000000 --- a/assets/js/7e4ce108.ca651e0d.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2666],{4282:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>o,default:()=>p,frontMatter:()=>a,metadata:()=>r,toc:()=>c});var s=n(5893),i=n(1151);const a={title:"SophosLabs Intelix",hide_title:!0,sidebar_position:1},o="Overview",r={id:"cado-response/manage/integrations/sandbox/intelix",title:"SophosLabs Intelix",description:"The Cado platform automates the acquisition of cloud systems with zero impact. When combined with a malware analysis platform, like SophosLabs Intelix, security analysts can submit files for analysis and use malware findings as an investigation pivot point.",source:"@site/docs/cado-response/manage/integrations/sandbox/intelix.md",sourceDirName:"cado-response/manage/integrations/sandbox",slug:"/cado-response/manage/integrations/sandbox/intelix",permalink:"/cado-response/manage/integrations/sandbox/intelix",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/sandbox/intelix.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"SophosLabs Intelix",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Webhooks",permalink:"/cado-response/manage/integrations/webhooks"},next:{title:"SentinelOne",permalink:"/cado-response/manage/integrations/xdr/sentinelone"}},d={},c=[{value:"Setup",id:"setup",level:3}];function l(e){const t={a:"a",h1:"h1",h3:"h3",img:"img",p:"p",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"overview",children:"Overview"}),"\n",(0,s.jsx)(t.p,{children:"The Cado platform automates the acquisition of cloud systems with zero impact. When combined with a malware analysis platform, like SophosLabs Intelix, security analysts can submit files for analysis and use malware findings as an investigation pivot point."}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Intelix",src:n(7802).Z+"",width:"1999",height:"975"})}),"\n",(0,s.jsx)(t.h3,{id:"setup",children:"Setup"}),"\n",(0,s.jsx)(t.p,{children:"Add the credentials to the Cado Platform in the SophosLabs Intelix Integration settings page:"}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Setup",src:n(8892).Z+"",width:"1365",height:"852"})}),"\n",(0,s.jsxs)(t.p,{children:["For more, see our ",(0,s.jsx)(t.a,{href:"https://www.cadosecurity.com/intelligence-driven-cloud-incident-response-with-cado-response-and-sophoslabs-intelix/",children:"blog on the integration"}),"."]})]})}function p(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},7802:(e,t,n)=>{n.d(t,{Z:()=>s});const s=n.p+"assets/images/intelix_screenshot-d2cd654c991082cbd3e2baf1d88faeb6.png"},8892:(e,t,n)=>{n.d(t,{Z:()=>s});const s=n.p+"assets/images/intelix_setup-631969720b2dc14c87f55493e0f6e171.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>r,a:()=>o});var s=n(7294);const i={},a=s.createContext(i);function o(e){const t=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),s.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/7e4ce108.ef08cc24.js b/assets/js/7e4ce108.ef08cc24.js new file mode 100644 index 000000000..982d45821 --- /dev/null +++ b/assets/js/7e4ce108.ef08cc24.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2666],{4282:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>o,default:()=>p,frontMatter:()=>a,metadata:()=>r,toc:()=>c});var s=n(5893),i=n(1151);const a={title:"SophosLabs Intelix",hide_title:!0,sidebar_position:1},o="Overview",r={id:"cado-response/manage/integrations/sandbox/intelix",title:"SophosLabs Intelix",description:"The Cado platform automates the acquisition of cloud systems with zero impact. When combined with a malware analysis platform, like SophosLabs Intelix, security analysts can submit files for analysis and use malware findings as an investigation pivot point.",source:"@site/docs/cado-response/manage/integrations/sandbox/intelix.md",sourceDirName:"cado-response/manage/integrations/sandbox",slug:"/cado-response/manage/integrations/sandbox/intelix",permalink:"/cado-response/manage/integrations/sandbox/intelix",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/sandbox/intelix.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"SophosLabs Intelix",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Webhooks",permalink:"/cado-response/manage/integrations/webhooks"},next:{title:"SentinelOne",permalink:"/cado-response/manage/integrations/xdr/sentinelone"}},d={},c=[{value:"Setup",id:"setup",level:3}];function l(e){const t={a:"a",h1:"h1",h3:"h3",img:"img",p:"p",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"overview",children:"Overview"}),"\n",(0,s.jsx)(t.p,{children:"The Cado platform automates the acquisition of cloud systems with zero impact. When combined with a malware analysis platform, like SophosLabs Intelix, security analysts can submit files for analysis and use malware findings as an investigation pivot point."}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Intelix",src:n(7802).Z+"",width:"1999",height:"975"})}),"\n",(0,s.jsx)(t.h3,{id:"setup",children:"Setup"}),"\n",(0,s.jsx)(t.p,{children:"Add the credentials to the Cado Platform in the SophosLabs Intelix Integration settings page:"}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Setup",src:n(8892).Z+"",width:"1365",height:"852"})}),"\n",(0,s.jsxs)(t.p,{children:["For more, see our ",(0,s.jsx)(t.a,{href:"https://www.cadosecurity.com/intelligence-driven-cloud-incident-response-with-cado-response-and-sophoslabs-intelix/",children:"blog on the integration"}),"."]})]})}function p(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},7802:(e,t,n)=>{n.d(t,{Z:()=>s});const s=n.p+"assets/images/intelix_screenshot-d2cd654c991082cbd3e2baf1d88faeb6.png"},8892:(e,t,n)=>{n.d(t,{Z:()=>s});const s=n.p+"assets/images/intelix_setup-631969720b2dc14c87f55493e0f6e171.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>r,a:()=>o});var s=n(7294);const i={},a=s.createContext(i);function o(e){const t=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),s.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/88d214b7.572fcb01.js b/assets/js/88d214b7.572fcb01.js deleted file mode 100644 index 45a9380d2..000000000 --- a/assets/js/88d214b7.572fcb01.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8387],{8944:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>r,default:()=>h,frontMatter:()=>d,metadata:()=>c,toc:()=>a});var i=n(5893),s=n(1151);const d={title:"Cortex XSOAR",hide_title:!0,sidebar_position:6},r="XSOAR",c={id:"cado-response/manage/integrations/soar/cortex-xsoar",title:"Cortex XSOAR",description:"Cortex XSOAR is a powerful Security Orchestration, Automation, and Response (SOAR) system. XSOAR allows SoC teams to organize cases, incidents and automate investigation rapidly using a central War Room for collaboration. By integrating Cado with XSOAR, you're going to increase efficiency and productive by automating Cado's powerful data acquisition and processing.",source:"@site/docs/cado-response/manage/integrations/soar/cortex-xsoar.md",sourceDirName:"cado-response/manage/integrations/soar",slug:"/cado-response/manage/integrations/soar/cortex-xsoar",permalink:"/cado-response/manage/integrations/soar/cortex-xsoar",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/soar/cortex-xsoar.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:6,frontMatter:{title:"Cortex XSOAR",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Splunk SOAR",permalink:"/cado-response/manage/integrations/soar/splunk-soar"},next:{title:"Webhooks",permalink:"/cado-response/manage/integrations/webhooks"}},l={},a=[{value:"Getting Started with XSOAR",id:"getting-started-with-xsoar",level:2},{value:"Contents",id:"contents",level:3},{value:"Downloading from Marketplace",id:"downloading-from-marketplace",level:3},{value:"Setup",id:"setup",level:3},{value:"Testing your Settings",id:"testing-your-settings",level:3},{value:"List of Commands",id:"list-of-commands",level:2},{value:"Contents",id:"contents-1",level:3},{value:"List EC2 Instances",id:"list-ec2-instances",level:3},{value:"Arguments",id:"arguments",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output",level:4},{value:"Command example",id:"command-example",level:4},{value:"Context Example",id:"context-example",level:4},{value:"XSOAR Artifiact Output",id:"xsoar-artifiact-output",level:4},{value:"List S3 Buckets",id:"list-s3-buckets",level:3},{value:"Arguments",id:"arguments-1",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-1",level:4},{value:"Command Example",id:"command-example-1",level:4},{value:"Context Example",id:"context-example-1",level:4},{value:"XSOAR Artifiact Output",id:"xsoar-artifiact-output-1",level:4},{value:"List Projects",id:"list-projects",level:3},{value:"Arguments",id:"arguments-2",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-2",level:4},{value:"Command Example",id:"command-example-2",level:4},{value:"Context Example",id:"context-example-2",level:4},{value:"XSOAR Artifiact Output",id:"xsoar-artifiact-output-2",level:4},{value:"List Project Pipelines",id:"list-project-pipelines",level:3},{value:"Arguments",id:"arguments-3",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-3",level:4},{value:"Command Example",id:"command-example-3",level:4},{value:"Context Example",id:"context-example-3",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output",level:4},{value:"Create a Project",id:"create-a-project",level:3},{value:"Arguments",id:"arguments-4",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-4",level:4},{value:"Command Example",id:"command-example-4",level:4},{value:"Context Example",id:"context-example-4",level:4},{value:"XSOAR Artifiact Output",id:"xsoar-artifiact-output-3",level:4},{value:"Acquire a Disk Image From EC2",id:"acquire-a-disk-image-from-ec2",level:3},{value:"Arguments",id:"arguments-5",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-5",level:4},{value:"Command Example",id:"command-example-5",level:4},{value:"Context Example",id:"context-example-5",level:4},{value:"XSOAR Artifiact Output",id:"xsoar-artifiact-output-4",level:4},{value:"Acquire a Disk Image From S3",id:"acquire-a-disk-image-from-s3",level:3},{value:"Arguments",id:"arguments-6",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-6",level:4},{value:"Command Example",id:"command-example-6",level:4},{value:"Context Example",id:"context-example-6",level:4},{value:"XSOAR Artifiact Output",id:"xsoar-artifiact-output-5",level:4}];function o(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"xsoar",children:"XSOAR"}),"\n",(0,i.jsx)(t.p,{children:"Cortex XSOAR is a powerful Security Orchestration, Automation, and Response (SOAR) system. XSOAR allows SoC teams to organize cases, incidents and automate investigation rapidly using a central War Room for collaboration. By integrating Cado with XSOAR, you're going to increase efficiency and productive by automating Cado's powerful data acquisition and processing."}),"\n",(0,i.jsx)(t.admonition,{type:"tip",children:(0,i.jsxs)(t.p,{children:["If you're confused by the terminology mentioned here, or have never used XSOAR before, please consider checking out the ",(0,i.jsx)(t.a,{href:"https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-tutorials.html",children:"XSOAR documentation"}),"."]})}),"\n",(0,i.jsx)(t.h2,{id:"getting-started-with-xsoar",children:"Getting Started with XSOAR"}),"\n",(0,i.jsx)(t.p,{children:"Before properly getting started please see the following for general instructions on setting up the Cado platform for integrating with third-party tools:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado-response/manage/integrations/api-overview",children:"Integrations Overview >"})})}),"\n",(0,i.jsx)(t.h3,{id:"contents",children:"Contents"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#downloading-from-marketplace",children:"Downloading from Marketplace"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#setup",children:"Setup"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#testing-your-settings",children:"Testing your Settings"})})}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"downloading-from-marketplace",children:"Downloading from Marketplace"}),"\n",(0,i.jsxs)(t.p,{children:["In your Cortex XSOAR instance, click on the ",(0,i.jsx)(t.strong,{children:"Marketplace"})," section in the left-hand sidebar and search for ",(0,i.jsx)(t.code,{children:"Cado Response"})," in the search bar."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Cado in the XSOAR marketplace",src:n(4400).Z+"",width:"1218",height:"187"})}),"\n",(0,i.jsx)(t.h3,{id:"setup",children:"Setup"}),"\n",(0,i.jsx)(t.p,{children:"When configuring the Cado integration (which should open up when you install the application), you'll see the following screen to configure the XSOAR application:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Cado XSOAR Setup Wizard",src:n(1318).Z+"",width:"1502",height:"1025"})}),"\n",(0,i.jsx)(t.p,{children:"In this screen, you'll need to setup the following:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"Application Instance Name"}),":"]}),"\n",(0,i.jsx)(t.p,{children:"This will be the name of the Application as it shows in XSOAR. If you're unsure, it's best to leave as default."}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"The URL of your Cado instance"}),":"]}),"\n",(0,i.jsxs)(t.p,{children:["This will the URL of your deployed Cado instance, if you're unsure, please see ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado-response/manage/integrations/api-overview",children:"Integrations Overview >"})})]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"The API key you retrieved from your platform"}),":"]}),"\n",(0,i.jsxs)(t.p,{children:["This will the generated private API key you retrieved earlier, if you're unsure, please see ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado-response/manage/integrations/api-overview",children:"Integrations Overview >"})})]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"The default Project ID"})}),"\n",(0,i.jsxs)(t.p,{children:["Provides a fallback Project ID from Cado if you forget to add an ID to a command. If you're not sure, don't change! ",(0,i.jsx)(t.em,{children:"Defaults to 1"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"The default AWS Region"})}),"\n",(0,i.jsxs)(t.p,{children:["Provides a default AWS region to fallback on if you forget to add it to a command. ",(0,i.jsx)(t.em,{children:"Defaults to us-east-1"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"The default AWS S3 bucket"})}),"\n",(0,i.jsxs)(t.p,{children:["Provides a default AWS bucket to fallback on if you forget to add it to a command. ",(0,i.jsx)(t.em,{children:"Defaults to cado-default-bucket"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"testing-your-settings",children:"Testing your Settings"}),"\n",(0,i.jsxs)(t.p,{children:["To test your settings, click the ",(0,i.jsx)(t.code,{children:"Test"})," button in the setup screen. Ensure the result of the test is green and says ",(0,i.jsx)(t.code,{children:"result ok"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"list-of-commands",children:"List of Commands"}),"\n",(0,i.jsx)(t.h3,{id:"contents-1",children:"Contents"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-ec2-instances",children:"List EC2 Instances"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-s3-buckets",children:"List S3 Buckets"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-projects",children:"List Projects"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-project-pipelines",children:"List Project Pipelines"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#create-a-project",children:"Create a Project"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#retrieve-a-pipeline",children:"Retrieve a Pipeline"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"})})}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"list-ec2-instances",children:"List EC2 Instances"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-list-ec2"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the EC2 instances in an AWS region."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"project_id"})}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"region"})}),(0,i.jsx)(t.td,{children:"The AWS region to list instances from. This is a required parameter."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"limit"})}),(0,i.jsx)(t.td,{children:"Integer value to limit the amount of data retrieved from Response."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"AWS ID of the EC2 Instance"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.instance_name"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"Name of the EC2 Instance"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.instance_type"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"AWS Type of the EC2 instance"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.region"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"AWS region of the EC2 instance"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example",children:"Command example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-list-ec2 project_id=1 region="us-east-1" limit=100'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "EC2Instances": [\n {\n "_placement": "us-east-1c",\n "_state": "stopped",\n "celery_worker_name": null,\n "deployment_id": null,\n "evidence_id": null,\n "id": "i-00000000000",\n "instance_name": "Instance",\n "instance_type": "t3a.2xlarge",\n "ip_address": null,\n "launch_time": "Thu, 25 Mar 2021 18:38:13 GMT",\n "processing_type": null,\n "project_id": null,\n "queue_name": null,\n "region": {\n "name": "us-east-1"\n },\n "worker_used": null\n }\n ]\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifiact-output",children:"XSOAR Artifiact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"_placement"}),(0,i.jsx)(t.th,{children:"_state"}),(0,i.jsx)(t.th,{children:"id"}),(0,i.jsx)(t.th,{children:"instance_name"}),(0,i.jsx)(t.th,{children:"instance_type"}),(0,i.jsx)(t.th,{children:"launch_time"}),(0,i.jsx)(t.th,{children:"region"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"us-east-1c"}),(0,i.jsx)(t.td,{children:"stopped"}),(0,i.jsx)(t.td,{children:"i-00000000000"}),(0,i.jsx)(t.td,{children:"Instance"}),(0,i.jsx)(t.td,{children:"t3a.2xlarge"}),(0,i.jsx)(t.td,{children:"Thu, 25 Mar 2021 18:38:13 GMT"}),(0,i.jsx)(t.td,{children:"name: us-east-1"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"list-s3-buckets",children:"List S3 Buckets"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-list-s3"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the S3 buckets in an AWS account."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-1",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"project_id"})}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"limit"})}),(0,i.jsx)(t.td,{children:"Integer value to limit the amount of data retrieved from Response."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-1",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.S3Buckets.buckets"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"An array of S3 buckets available to the project"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-1",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:"!cado-list-s3 project_id=1 limit=100"})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-1",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "S3Buckets": {\n "buckets": [\n "bucket",\n ]\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifiact-output-1",children:"XSOAR Artifiact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsx)(t.tr,{children:(0,i.jsx)(t.th,{children:"buckets"})})}),(0,i.jsx)(t.tbody,{children:(0,i.jsx)(t.tr,{children:(0,i.jsx)(t.td,{children:"bucket"})})})]}),"\n",(0,i.jsx)(t.h3,{id:"list-projects",children:"List Projects"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-list-project"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the projects, or a single project, in Cado Response."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-2",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"project_id"})}),(0,i.jsx)(t.td,{children:"The ID of the project you want to retrieve."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"limit"})}),(0,i.jsx)(t.td,{children:"Integer value to limit the amount of data retrieved from Response."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-2",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"ID of the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.caseName"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"Name of the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.description"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"Description of the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.users"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"Array of users assigned to the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.created"}),(0,i.jsx)(t.td,{children:"Date"}),(0,i.jsx)(t.td,{children:"Creation date of the project"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-2",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:"!cado-list-project limit=100"})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-2",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "Projects": {\n "caseName": "Project Name_XSOAR",\n "created": "2022-01-17T12:21:46.613814",\n "deleted": false,\n "description": "This is a project in Cado Response created through Cortex XSOAR!",\n "id": 1,\n "status": "Pending",\n "users": [\n {\n "display_name": "admin",\n "id": 1,\n "is_admin": true,\n "login_type": 0,\n "username": "admin"\n }\n ]\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifiact-output-2",children:"XSOAR Artifiact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"caseName"}),(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"deleted"}),(0,i.jsx)(t.th,{children:"description"}),(0,i.jsx)(t.th,{children:"id"}),(0,i.jsx)(t.th,{children:"status"}),(0,i.jsx)(t.th,{children:"users"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Project Name_XSOAR"}),(0,i.jsx)(t.td,{children:"2022-01-17T12:21:46.613814"}),(0,i.jsx)(t.td,{children:"false"}),(0,i.jsx)(t.td,{children:"This is a project in Cado Response created through Cortex XSOAR!"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"Pending"}),(0,i.jsx)(t.td,{children:"{'display_name': 'admin', 'id': 1, 'is_admin': True, 'login_type': 0, 'username': 'admin'}"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"list-project-pipelines",children:"List Project Pipelines"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-get-pipeline"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the pipelines, or a single pipeline, for a given project in Cado."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-3",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"The id of the pipeline to retrieve."}),(0,i.jsx)(t.td,{children:"None"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"The id of the project the pipeline belongs to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"limit"}),(0,i.jsx)(t.td,{children:"Limit results to retrieve."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-3",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.pipeline_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The ID of the retrieved pipeline"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.pipeline_type"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"The type of pipeline that was retrieved"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.created"}),(0,i.jsx)(t.td,{children:"Date"}),(0,i.jsx)(t.td,{children:"The date at which the retrieved pipeline was started"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.evidence_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The evidence ID linked to the retrieved pipeline"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.project_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The ID of the project the pipeline belongs to"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.is_terminated"}),(0,i.jsx)(t.td,{children:"Boolean"}),(0,i.jsx)(t.td,{children:"A boolean which says if the retrieved pipeline has been finished/terminated"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.summary"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"An array of values containing the cancelled, failed, pending, running and successful pipeline subtasks"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.subtask"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"An array of tasks in the retrieved pipeline"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-3",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:"!cado-get-pipeline project_id=1 pipeline_id=1"})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-3",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "Pipeline": {\n \t"pipeline_id": 1,\n\t\t\t"pipeline_type": "processing",\n \t\t"created": "2022-01-17T12:22:00.843869",\n \t\t"evidence_id": 1,\n \t\t"project_id": 1,\n \t\t"is_terminated": false,\n\t\t\t"subtasks": [\n \t\t\t{\n\t\t\t\t\t"execution_duration": 0,\n\t\t\t\t\t"finish_time": 0,\n\t\t\t\t\t"name": "Triage: Attaching disk for local data storage.",\n\t\t\t\t\t"name_key": "infrastructure.check_ssd",\n\t\t\t\t\t"notification_level": "Info",\n\t\t\t\t\t"progress_text": [],\n\t\t\t\t\t"start_time": 0,\n\t\t\t\t\t"state": "PENDING",\n\t\t\t\t\t"task_id": "3699827f-63c4-4408-88a4-0ae899187ed3",\n\t\t\t\t\t"total_stages": null\n\t\t\t\t }\n\t\t\t],\n\t\t\t"summary": {\n\t\t\t "cancelled": 0,\n\t\t\t "failure": 0,\n\t\t\t "pending": 14,\n\t\t\t "running": 0,\n\t\t\t "success": 0,\n\t\t\t "total": 14\n\t\t\t}\n }\n }\n\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"pipeline_id"}),(0,i.jsx)(t.th,{children:"pipeline_type"}),(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"evidence_id"}),(0,i.jsx)(t.th,{children:"project_id"}),(0,i.jsx)(t.th,{children:"is_terminated"}),(0,i.jsx)(t.th,{children:"summary"}),(0,i.jsx)(t.th,{children:"subtask"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"processing"}),(0,i.jsx)(t.td,{children:"2022-01-17T12:22:00.843869"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"false"}),(0,i.jsxs)(t.td,{children:['"execution_duration": 0,',(0,i.jsx)("br",{}),'"finish_time": 0,',(0,i.jsx)("br",{}),'"name": "Triage: attaching disk for local data storage.",',(0,i.jsx)("br",{}),'"name_key": infrastructure.check_ssd",',(0,i.jsx)("br",{}),'"notification_level": "Info",',(0,i.jsx)("br",{}),'"progress_text": [],',(0,i.jsx)("br",{}),'"start_time": 0,',(0,i.jsx)("br",{}),'"state": "PENDING",',(0,i.jsx)("br",{}),'"task_id": "3699827f-63c4-4408-88a4-0ae899187ed3",',(0,i.jsx)("br",{}),'"total_stages": null',(0,i.jsx)("br",{})]}),(0,i.jsxs)(t.td,{children:['"cancelled": 0,',(0,i.jsx)("br",{}),'"failure": 0,',(0,i.jsx)("br",{}),'"pending": 14,',(0,i.jsx)("br",{}),'"running": 0,',(0,i.jsx)("br",{}),'"success": 0,',(0,i.jsx)("br",{}),'"total": 14',(0,i.jsx)("br",{})]})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"create-a-project",children:"Create a Project"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-create-project"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to create a new project in Cado."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-4",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_name"}),(0,i.jsx)(t.td,{children:"Name of the project."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_description"}),(0,i.jsx)(t.td,{children:"Description for the project."}),(0,i.jsx)(t.td,{})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-4",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Project.id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The Project ID of the newly created project"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-4",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-create-project project_name="Project Name" description="Project Description"'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-4",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "Project": {\n "id": 1,\n "msg": "Created"\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifiact-output-3",children:"XSOAR Artifiact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"id"}),(0,i.jsx)(t.th,{children:"msg"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"Created"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-trigger-ec2"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will trigger a disk image acquisition task in Cado for a specified EC2 instance."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-5",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"instance_id"}),(0,i.jsx)(t.td,{children:"ID of the EC2 instance to acquire."}),(0,i.jsx)(t.td,{children:"Required"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"region"}),(0,i.jsx)(t.td,{children:"AWS region in which the EC2 instance is located."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"S3 bucket where the uploaded disk image resides."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"compress"}),(0,i.jsx)(t.td,{children:"Flag indicating if disk compression is enabled."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_disks"}),(0,i.jsx)(t.td,{children:"Flag indicating if we include disk images in the acquisition."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_hash"}),(0,i.jsx)(t.td,{children:"Flag indicating if we calculate the hash of the disk."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_logs"}),(0,i.jsx)(t.td,{children:"Flag indicating if we include system logs in the acquisition."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_screenshot"}),(0,i.jsx)(t.td,{children:"Flag indicating if we include a screenshot of the system in the acquisition."}),(0,i.jsx)(t.td,{})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-5",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Acquisition.pipeline_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"ID of the created pipeline"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-5",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-trigger-ec2 project_id=1 instance_id="i-00000000000" region="us-east-1" bucket="bucket" compress=true include_disks=true include_hash=true include_logs=true include_screenshot=true'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-5",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "EC2Acquistion": {\n "created": "2022-01-17T12:21:59.084282",\n "evidence_id": 0,\n "name": "Acquiring i-00000000000",\n "pipeline_id": 1,\n "pipeline_type": "acquisition",\n "project_id": 1,\n "subtasks": [\n {\n "id": "1587a9c9-c02c-464b-a6f7-d4b7e720bd93"\n },\n {\n "id": "4f798bf8-c7d3-427c-9498-10a85cfe3978"\n },\n {\n "id": "c5fa26f1-e282-47a6-8335-1160766e089b"\n },\n {\n "id": "82ec9a7e-47ac-4539-9623-166a44a59d0f"\n },\n {\n "id": "88151005-a999-422e-b4cb-9e76699d6e42"\n }\n ],\n "user_id": 1\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifiact-output-4",children:"XSOAR Artifiact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"evidence_id"}),(0,i.jsx)(t.th,{children:"name"}),(0,i.jsx)(t.th,{children:"pipeline_id"}),(0,i.jsx)(t.th,{children:"pipeline_type"}),(0,i.jsx)(t.th,{children:"project_id"}),(0,i.jsx)(t.th,{children:"subtasks"}),(0,i.jsx)(t.th,{children:"user_id"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"2022-01-17T12:21:59.084282"}),(0,i.jsx)(t.td,{children:"0"}),(0,i.jsx)(t.td,{children:"Acquiring i-00000000000"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"acquisition"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsxs)(t.td,{children:["{'id': '1587a9c9-c02c-464b-a6f7-d4b7e720bd93'},",(0,i.jsx)("br",{}),"{'id': '4f798bf8-c7d3-427c-9498-10a85cfe3978'},",(0,i.jsx)("br",{}),"{'id': 'c5fa26f1-e282-47a6-8335-1160766e089b'},",(0,i.jsx)("br",{}),"{'id': '82ec9a7e-47ac-4539-9623-166a44a59d0f'},",(0,i.jsx)("br",{}),"{'id': '88151005-a999-422e-b4cb-9e76699d6e42'}"]}),(0,i.jsx)(t.td,{children:"1"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-trigger-s3"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will trigger a disk image acquisition task in Cado from a file in a S3 Bucket."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-6",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"The S3 bucket name containing the file."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"file_name"}),(0,i.jsx)(t.td,{children:"The name of the file to process."}),(0,i.jsx)(t.td,{})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-6",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.S3Acquisition.pipeline_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"ID of the created pipeline"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-6",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-trigger-s3 project_id=1 bucket="bucket" file_name="file"'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-6",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "S3Acquisition": {\n "created": "2022-01-17T12:22:00.843869",\n "evidence_id": 1,\n "name": "",\n "pipeline_id": 2,\n "pipeline_type": "processing",\n "project_id": 1,\n "subtasks": [\n {\n "id": "3699827f-63c4-4408-88a4-0ae899187ed3"\n },\n {\n "id": "727e2072-8bf7-4847-89ea-9447f5fd8fd0"\n },\n {\n "id": "857d48b8-abaf-4ea6-b159-d25c9784b837"\n },\n {\n "id": "533f7deb-74bc-4ffb-b81f-788ed714bead"\n },\n {\n "id": "3f1defde-3986-4292-a423-1bef62d4c52b"\n },\n {\n "id": "e41a0934-266b-4868-9a7d-5f083b1efcc1"\n },\n {\n "id": "75411e10-46e9-41dd-8bf7-9b5fbdc8df71"\n },\n {\n "id": "0afbf2f4-fbf3-4305-ad9f-b19d30f4b17c"\n },\n {\n "id": "ca063c7b-1135-4922-8542-49f40ce71449"\n },\n {\n "id": "67fdb0ea-dcee-4f65-a003-4f40fcd567fb"\n },\n {\n "id": "1437ec33-6af2-4eb8-9c43-e071dcb7e0ac"\n },\n {\n "id": "06db4dcc-57fd-48bc-bb34-5bd8f2da0a0d"\n },\n {\n "id": "e3cc930e-9a60-46c3-97a1-611824c24437"\n },\n {\n "id": "ad2c8877-39e7-4bff-9756-81278802ee76"\n }\n ],\n "user_id": 1\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifiact-output-5",children:"XSOAR Artifiact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"evidence_id"}),(0,i.jsx)(t.th,{children:"name"}),(0,i.jsx)(t.th,{children:"pipeline_id"}),(0,i.jsx)(t.th,{children:"pipeline_type"}),(0,i.jsx)(t.th,{children:"project_id"}),(0,i.jsx)(t.th,{children:"subtasks"}),(0,i.jsx)(t.th,{children:"user_id"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"2022-01-17T12:22:00.843869"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{}),(0,i.jsx)(t.td,{children:"2"}),(0,i.jsx)(t.td,{children:"processing"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsxs)(t.td,{children:["{'id': '3699827f-63c4-4408-88a4-0ae899187ed3'},",(0,i.jsx)("br",{}),"{'id': '727e2072-8bf7-4847-89ea-9447f5fd8fd0'},",(0,i.jsx)("br",{}),"{'id': '857d48b8-abaf-4ea6-b159-d25c9784b837'},",(0,i.jsx)("br",{}),"{'id': '533f7deb-74bc-4ffb-b81f-788ed714bead'},",(0,i.jsx)("br",{}),"{'id': '3f1defde-3986-4292-a423-1bef62d4c52b'},",(0,i.jsx)("br",{}),"{'id': 'e41a0934-266b-4868-9a7d-5f083b1efcc1'},",(0,i.jsx)("br",{}),"{'id': '75411e10-46e9-41dd-8bf7-9b5fbdc8df71'},",(0,i.jsx)("br",{}),"{'id': '0afbf2f4-fbf3-4305-ad9f-b19d30f4b17c'},",(0,i.jsx)("br",{}),"{'id': 'ca063c7b-1135-4922-8542-49f40ce71449'},",(0,i.jsx)("br",{}),"{'id': '67fdb0ea-dcee-4f65-a003-4f40fcd567fb'},",(0,i.jsx)("br",{}),"{'id': '1437ec33-6af2-4eb8-9c43-e071dcb7e0ac'},",(0,i.jsx)("br",{}),"{'id': '06db4dcc-57fd-48bc-bb34-5bd8f2da0a0d'},",(0,i.jsx)("br",{}),"{'id': 'e3cc930e-9a60-46c3-97a1-611824c24437'},",(0,i.jsx)("br",{}),"{'id': 'ad2c8877-39e7-4bff-9756-81278802ee76'}"]}),(0,i.jsx)(t.td,{children:"1"})]})})]})]})}function h(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(o,{...e})}):o(e)}},4400:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/xsoar-market-435c41f4081debcf9f540f815a2c3ac7.png"},1318:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/xsoar-wizard-f207b59a1ea8f2d1a6e0c15186abbc93.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>c,a:()=>r});var i=n(7294);const s={},d=i.createContext(s);function r(e){const t=i.useContext(d);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),i.createElement(d.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/88d214b7.834f715a.js b/assets/js/88d214b7.834f715a.js new file mode 100644 index 000000000..7b3270afc --- /dev/null +++ b/assets/js/88d214b7.834f715a.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8387],{8944:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>r,default:()=>h,frontMatter:()=>d,metadata:()=>c,toc:()=>a});var i=n(5893),s=n(1151);const d={title:"Cortex XSOAR",hide_title:!0,sidebar_position:6},r="XSOAR",c={id:"cado-response/manage/integrations/soar/cortex-xsoar",title:"Cortex XSOAR",description:"Cortex XSOAR is a powerful Security Orchestration, Automation, and Response (SOAR) system. XSOAR allows SoC teams to organize cases, incidents and automate investigation rapidly using a central War Room for collaboration. By integrating Cado with XSOAR, you're going to increase efficiency and productive by automating Cado's powerful data acquisition and processing.",source:"@site/docs/cado-response/manage/integrations/soar/cortex-xsoar.md",sourceDirName:"cado-response/manage/integrations/soar",slug:"/cado-response/manage/integrations/soar/cortex-xsoar",permalink:"/cado-response/manage/integrations/soar/cortex-xsoar",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/soar/cortex-xsoar.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:6,frontMatter:{title:"Cortex XSOAR",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Splunk SOAR",permalink:"/cado-response/manage/integrations/soar/splunk-soar"},next:{title:"Webhooks",permalink:"/cado-response/manage/integrations/webhooks"}},l={},a=[{value:"Getting Started with XSOAR",id:"getting-started-with-xsoar",level:2},{value:"Contents",id:"contents",level:3},{value:"Downloading from Marketplace",id:"downloading-from-marketplace",level:3},{value:"Setup",id:"setup",level:3},{value:"Testing your Settings",id:"testing-your-settings",level:3},{value:"List of Commands",id:"list-of-commands",level:2},{value:"Contents",id:"contents-1",level:3},{value:"List EC2 Instances",id:"list-ec2-instances",level:3},{value:"Arguments",id:"arguments",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output",level:4},{value:"Command example",id:"command-example",level:4},{value:"Context Example",id:"context-example",level:4},{value:"XSOAR Artifiact Output",id:"xsoar-artifiact-output",level:4},{value:"List S3 Buckets",id:"list-s3-buckets",level:3},{value:"Arguments",id:"arguments-1",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-1",level:4},{value:"Command Example",id:"command-example-1",level:4},{value:"Context Example",id:"context-example-1",level:4},{value:"XSOAR Artifiact Output",id:"xsoar-artifiact-output-1",level:4},{value:"List Projects",id:"list-projects",level:3},{value:"Arguments",id:"arguments-2",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-2",level:4},{value:"Command Example",id:"command-example-2",level:4},{value:"Context Example",id:"context-example-2",level:4},{value:"XSOAR Artifiact Output",id:"xsoar-artifiact-output-2",level:4},{value:"List Project Pipelines",id:"list-project-pipelines",level:3},{value:"Arguments",id:"arguments-3",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-3",level:4},{value:"Command Example",id:"command-example-3",level:4},{value:"Context Example",id:"context-example-3",level:4},{value:"XSOAR Artifact Output",id:"xsoar-artifact-output",level:4},{value:"Create a Project",id:"create-a-project",level:3},{value:"Arguments",id:"arguments-4",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-4",level:4},{value:"Command Example",id:"command-example-4",level:4},{value:"Context Example",id:"context-example-4",level:4},{value:"XSOAR Artifiact Output",id:"xsoar-artifiact-output-3",level:4},{value:"Acquire a Disk Image From EC2",id:"acquire-a-disk-image-from-ec2",level:3},{value:"Arguments",id:"arguments-5",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-5",level:4},{value:"Command Example",id:"command-example-5",level:4},{value:"Context Example",id:"context-example-5",level:4},{value:"XSOAR Artifiact Output",id:"xsoar-artifiact-output-4",level:4},{value:"Acquire a Disk Image From S3",id:"acquire-a-disk-image-from-s3",level:3},{value:"Arguments",id:"arguments-6",level:4},{value:"XSOAR Context Output",id:"xsoar-context-output-6",level:4},{value:"Command Example",id:"command-example-6",level:4},{value:"Context Example",id:"context-example-6",level:4},{value:"XSOAR Artifiact Output",id:"xsoar-artifiact-output-5",level:4}];function o(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"xsoar",children:"XSOAR"}),"\n",(0,i.jsx)(t.p,{children:"Cortex XSOAR is a powerful Security Orchestration, Automation, and Response (SOAR) system. XSOAR allows SoC teams to organize cases, incidents and automate investigation rapidly using a central War Room for collaboration. By integrating Cado with XSOAR, you're going to increase efficiency and productive by automating Cado's powerful data acquisition and processing."}),"\n",(0,i.jsx)(t.admonition,{type:"tip",children:(0,i.jsxs)(t.p,{children:["If you're confused by the terminology mentioned here, or have never used XSOAR before, please consider checking out the ",(0,i.jsx)(t.a,{href:"https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-tutorials.html",children:"XSOAR documentation"}),"."]})}),"\n",(0,i.jsx)(t.h2,{id:"getting-started-with-xsoar",children:"Getting Started with XSOAR"}),"\n",(0,i.jsx)(t.p,{children:"Before properly getting started please see the following for general instructions on setting up the Cado platform for integrating with third-party tools:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado-response/manage/integrations/api-overview",children:"Integrations Overview >"})})}),"\n",(0,i.jsx)(t.h3,{id:"contents",children:"Contents"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#downloading-from-marketplace",children:"Downloading from Marketplace"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#setup",children:"Setup"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#testing-your-settings",children:"Testing your Settings"})})}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"downloading-from-marketplace",children:"Downloading from Marketplace"}),"\n",(0,i.jsxs)(t.p,{children:["In your Cortex XSOAR instance, click on the ",(0,i.jsx)(t.strong,{children:"Marketplace"})," section in the left-hand sidebar and search for ",(0,i.jsx)(t.code,{children:"Cado Response"})," in the search bar."]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Cado in the XSOAR marketplace",src:n(4400).Z+"",width:"1218",height:"187"})}),"\n",(0,i.jsx)(t.h3,{id:"setup",children:"Setup"}),"\n",(0,i.jsx)(t.p,{children:"When configuring the Cado integration (which should open up when you install the application), you'll see the following screen to configure the XSOAR application:"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Cado XSOAR Setup Wizard",src:n(1318).Z+"",width:"1502",height:"1025"})}),"\n",(0,i.jsx)(t.p,{children:"In this screen, you'll need to setup the following:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"Application Instance Name"}),":"]}),"\n",(0,i.jsx)(t.p,{children:"This will be the name of the Application as it shows in XSOAR. If you're unsure, it's best to leave as default."}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"The URL of your Cado instance"}),":"]}),"\n",(0,i.jsxs)(t.p,{children:["This will the URL of your deployed Cado instance, if you're unsure, please see ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado-response/manage/integrations/api-overview",children:"Integrations Overview >"})})]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsxs)(t.p,{children:[(0,i.jsx)(t.strong,{children:"The API key you retrieved from your platform"}),":"]}),"\n",(0,i.jsxs)(t.p,{children:["This will the generated private API key you retrieved earlier, if you're unsure, please see ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado-response/manage/integrations/api-overview",children:"Integrations Overview >"})})]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"The default Project ID"})}),"\n",(0,i.jsxs)(t.p,{children:["Provides a fallback Project ID from Cado if you forget to add an ID to a command. If you're not sure, don't change! ",(0,i.jsx)(t.em,{children:"Defaults to 1"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"The default AWS Region"})}),"\n",(0,i.jsxs)(t.p,{children:["Provides a default AWS region to fallback on if you forget to add it to a command. ",(0,i.jsx)(t.em,{children:"Defaults to us-east-1"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:["\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"The default AWS S3 bucket"})}),"\n",(0,i.jsxs)(t.p,{children:["Provides a default AWS bucket to fallback on if you forget to add it to a command. ",(0,i.jsx)(t.em,{children:"Defaults to cado-default-bucket"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"testing-your-settings",children:"Testing your Settings"}),"\n",(0,i.jsxs)(t.p,{children:["To test your settings, click the ",(0,i.jsx)(t.code,{children:"Test"})," button in the setup screen. Ensure the result of the test is green and says ",(0,i.jsx)(t.code,{children:"result ok"}),"."]}),"\n",(0,i.jsx)(t.h2,{id:"list-of-commands",children:"List of Commands"}),"\n",(0,i.jsx)(t.h3,{id:"contents-1",children:"Contents"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-ec2-instances",children:"List EC2 Instances"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-s3-buckets",children:"List S3 Buckets"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-projects",children:"List Projects"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#list-project-pipelines",children:"List Project Pipelines"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#create-a-project",children:"Create a Project"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#retrieve-a-pipeline",children:"Retrieve a Pipeline"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"})})}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"list-ec2-instances",children:"List EC2 Instances"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-list-ec2"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the EC2 instances in an AWS region."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"project_id"})}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"region"})}),(0,i.jsx)(t.td,{children:"The AWS region to list instances from. This is a required parameter."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"limit"})}),(0,i.jsx)(t.td,{children:"Integer value to limit the amount of data retrieved from Response."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"AWS ID of the EC2 Instance"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.instance_name"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"Name of the EC2 Instance"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.instance_type"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"AWS Type of the EC2 instance"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Instances.region"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"AWS region of the EC2 instance"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example",children:"Command example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-list-ec2 project_id=1 region="us-east-1" limit=100'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "EC2Instances": [\n {\n "_placement": "us-east-1c",\n "_state": "stopped",\n "celery_worker_name": null,\n "deployment_id": null,\n "evidence_id": null,\n "id": "i-00000000000",\n "instance_name": "Instance",\n "instance_type": "t3a.2xlarge",\n "ip_address": null,\n "launch_time": "Thu, 25 Mar 2021 18:38:13 GMT",\n "processing_type": null,\n "project_id": null,\n "queue_name": null,\n "region": {\n "name": "us-east-1"\n },\n "worker_used": null\n }\n ]\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifiact-output",children:"XSOAR Artifiact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"_placement"}),(0,i.jsx)(t.th,{children:"_state"}),(0,i.jsx)(t.th,{children:"id"}),(0,i.jsx)(t.th,{children:"instance_name"}),(0,i.jsx)(t.th,{children:"instance_type"}),(0,i.jsx)(t.th,{children:"launch_time"}),(0,i.jsx)(t.th,{children:"region"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"us-east-1c"}),(0,i.jsx)(t.td,{children:"stopped"}),(0,i.jsx)(t.td,{children:"i-00000000000"}),(0,i.jsx)(t.td,{children:"Instance"}),(0,i.jsx)(t.td,{children:"t3a.2xlarge"}),(0,i.jsx)(t.td,{children:"Thu, 25 Mar 2021 18:38:13 GMT"}),(0,i.jsx)(t.td,{children:"name: us-east-1"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"list-s3-buckets",children:"List S3 Buckets"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-list-s3"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the S3 buckets in an AWS account."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-1",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"project_id"})}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"limit"})}),(0,i.jsx)(t.td,{children:"Integer value to limit the amount of data retrieved from Response."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-1",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.S3Buckets.buckets"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"An array of S3 buckets available to the project"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-1",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:"!cado-list-s3 project_id=1 limit=100"})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-1",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "S3Buckets": {\n "buckets": [\n "bucket",\n ]\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifiact-output-1",children:"XSOAR Artifiact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsx)(t.tr,{children:(0,i.jsx)(t.th,{children:"buckets"})})}),(0,i.jsx)(t.tbody,{children:(0,i.jsx)(t.tr,{children:(0,i.jsx)(t.td,{children:"bucket"})})})]}),"\n",(0,i.jsx)(t.h3,{id:"list-projects",children:"List Projects"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-list-project"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the projects, or a single project, in Cado Response."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-2",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"project_id"})}),(0,i.jsx)(t.td,{children:"The ID of the project you want to retrieve."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:(0,i.jsx)(t.code,{children:"limit"})}),(0,i.jsx)(t.td,{children:"Integer value to limit the amount of data retrieved from Response."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-2",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"ID of the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.caseName"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"Name of the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.description"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"Description of the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.users"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"Array of users assigned to the retrieved project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Projects.created"}),(0,i.jsx)(t.td,{children:"Date"}),(0,i.jsx)(t.td,{children:"Creation date of the project"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-2",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:"!cado-list-project limit=100"})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-2",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "Projects": {\n "caseName": "Project Name_XSOAR",\n "created": "2022-01-17T12:21:46.613814",\n "deleted": false,\n "description": "This is a project in Cado Response created through Cortex XSOAR!",\n "id": 1,\n "status": "Pending",\n "users": [\n {\n "display_name": "admin",\n "id": 1,\n "is_admin": true,\n "login_type": 0,\n "username": "admin"\n }\n ]\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifiact-output-2",children:"XSOAR Artifiact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"caseName"}),(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"deleted"}),(0,i.jsx)(t.th,{children:"description"}),(0,i.jsx)(t.th,{children:"id"}),(0,i.jsx)(t.th,{children:"status"}),(0,i.jsx)(t.th,{children:"users"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Project Name_XSOAR"}),(0,i.jsx)(t.td,{children:"2022-01-17T12:21:46.613814"}),(0,i.jsx)(t.td,{children:"false"}),(0,i.jsx)(t.td,{children:"This is a project in Cado Response created through Cortex XSOAR!"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"Pending"}),(0,i.jsx)(t.td,{children:"{'display_name': 'admin', 'id': 1, 'is_admin': True, 'login_type': 0, 'username': 'admin'}"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"list-project-pipelines",children:"List Project Pipelines"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-get-pipeline"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to list all the pipelines, or a single pipeline, for a given project in Cado."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-3",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"The id of the pipeline to retrieve."}),(0,i.jsx)(t.td,{children:"None"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"The id of the project the pipeline belongs to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"limit"}),(0,i.jsx)(t.td,{children:"Limit results to retrieve."}),(0,i.jsx)(t.td,{children:"100"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-3",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.pipeline_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The ID of the retrieved pipeline"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.pipeline_type"}),(0,i.jsx)(t.td,{children:"String"}),(0,i.jsx)(t.td,{children:"The type of pipeline that was retrieved"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.created"}),(0,i.jsx)(t.td,{children:"Date"}),(0,i.jsx)(t.td,{children:"The date at which the retrieved pipeline was started"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.evidence_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The evidence ID linked to the retrieved pipeline"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.project_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The ID of the project the pipeline belongs to"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.is_terminated"}),(0,i.jsx)(t.td,{children:"Boolean"}),(0,i.jsx)(t.td,{children:"A boolean which says if the retrieved pipeline has been finished/terminated"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.summary"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"An array of values containing the cancelled, failed, pending, running and successful pipeline subtasks"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Pipeline.subtask"}),(0,i.jsx)(t.td,{children:"Array"}),(0,i.jsx)(t.td,{children:"An array of tasks in the retrieved pipeline"})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-3",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:"!cado-get-pipeline project_id=1 pipeline_id=1"})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-3",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "Pipeline": {\n \t"pipeline_id": 1,\n\t\t\t"pipeline_type": "processing",\n \t\t"created": "2022-01-17T12:22:00.843869",\n \t\t"evidence_id": 1,\n \t\t"project_id": 1,\n \t\t"is_terminated": false,\n\t\t\t"subtasks": [\n \t\t\t{\n\t\t\t\t\t"execution_duration": 0,\n\t\t\t\t\t"finish_time": 0,\n\t\t\t\t\t"name": "Triage: Attaching disk for local data storage.",\n\t\t\t\t\t"name_key": "infrastructure.check_ssd",\n\t\t\t\t\t"notification_level": "Info",\n\t\t\t\t\t"progress_text": [],\n\t\t\t\t\t"start_time": 0,\n\t\t\t\t\t"state": "PENDING",\n\t\t\t\t\t"task_id": "3699827f-63c4-4408-88a4-0ae899187ed3",\n\t\t\t\t\t"total_stages": null\n\t\t\t\t }\n\t\t\t],\n\t\t\t"summary": {\n\t\t\t "cancelled": 0,\n\t\t\t "failure": 0,\n\t\t\t "pending": 14,\n\t\t\t "running": 0,\n\t\t\t "success": 0,\n\t\t\t "total": 14\n\t\t\t}\n }\n }\n\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifact-output",children:"XSOAR Artifact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"pipeline_id"}),(0,i.jsx)(t.th,{children:"pipeline_type"}),(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"evidence_id"}),(0,i.jsx)(t.th,{children:"project_id"}),(0,i.jsx)(t.th,{children:"is_terminated"}),(0,i.jsx)(t.th,{children:"summary"}),(0,i.jsx)(t.th,{children:"subtask"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"processing"}),(0,i.jsx)(t.td,{children:"2022-01-17T12:22:00.843869"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"false"}),(0,i.jsxs)(t.td,{children:['"execution_duration": 0,',(0,i.jsx)("br",{}),'"finish_time": 0,',(0,i.jsx)("br",{}),'"name": "Triage: attaching disk for local data storage.",',(0,i.jsx)("br",{}),'"name_key": infrastructure.check_ssd",',(0,i.jsx)("br",{}),'"notification_level": "Info",',(0,i.jsx)("br",{}),'"progress_text": [],',(0,i.jsx)("br",{}),'"start_time": 0,',(0,i.jsx)("br",{}),'"state": "PENDING",',(0,i.jsx)("br",{}),'"task_id": "3699827f-63c4-4408-88a4-0ae899187ed3",',(0,i.jsx)("br",{}),'"total_stages": null',(0,i.jsx)("br",{})]}),(0,i.jsxs)(t.td,{children:['"cancelled": 0,',(0,i.jsx)("br",{}),'"failure": 0,',(0,i.jsx)("br",{}),'"pending": 14,',(0,i.jsx)("br",{}),'"running": 0,',(0,i.jsx)("br",{}),'"success": 0,',(0,i.jsx)("br",{}),'"total": 14',(0,i.jsx)("br",{})]})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"create-a-project",children:"Create a Project"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-create-project"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will allow you to create a new project in Cado."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-4",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_name"}),(0,i.jsx)(t.td,{children:"Name of the project."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_description"}),(0,i.jsx)(t.td,{children:"Description for the project."}),(0,i.jsx)(t.td,{})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-4",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.Project.id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"The Project ID of the newly created project"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-4",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-create-project project_name="Project Name" description="Project Description"'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-4",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "Project": {\n "id": 1,\n "msg": "Created"\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifiact-output-3",children:"XSOAR Artifiact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"id"}),(0,i.jsx)(t.th,{children:"msg"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"Created"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-trigger-ec2"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will trigger a disk image acquisition task in Cado for a specified EC2 instance."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-5",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"instance_id"}),(0,i.jsx)(t.td,{children:"ID of the EC2 instance to acquire."}),(0,i.jsx)(t.td,{children:"Required"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"region"}),(0,i.jsx)(t.td,{children:"AWS region in which the EC2 instance is located."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"S3 bucket where the uploaded disk image resides."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"compress"}),(0,i.jsx)(t.td,{children:"Flag indicating if disk compression is enabled."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_disks"}),(0,i.jsx)(t.td,{children:"Flag indicating if we include disk images in the acquisition."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_hash"}),(0,i.jsx)(t.td,{children:"Flag indicating if we calculate the hash of the disk."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_logs"}),(0,i.jsx)(t.td,{children:"Flag indicating if we include system logs in the acquisition."}),(0,i.jsx)(t.td,{})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"include_screenshot"}),(0,i.jsx)(t.td,{children:"Flag indicating if we include a screenshot of the system in the acquisition."}),(0,i.jsx)(t.td,{})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-5",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.EC2Acquisition.pipeline_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"ID of the created pipeline"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-5",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-trigger-ec2 project_id=1 instance_id="i-00000000000" region="us-east-1" bucket="bucket" compress=true include_disks=true include_hash=true include_logs=true include_screenshot=true'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-5",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "EC2Acquistion": {\n "created": "2022-01-17T12:21:59.084282",\n "evidence_id": 0,\n "name": "Acquiring i-00000000000",\n "pipeline_id": 1,\n "pipeline_type": "acquisition",\n "project_id": 1,\n "subtasks": [\n {\n "id": "1587a9c9-c02c-464b-a6f7-d4b7e720bd93"\n },\n {\n "id": "4f798bf8-c7d3-427c-9498-10a85cfe3978"\n },\n {\n "id": "c5fa26f1-e282-47a6-8335-1160766e089b"\n },\n {\n "id": "82ec9a7e-47ac-4539-9623-166a44a59d0f"\n },\n {\n "id": "88151005-a999-422e-b4cb-9e76699d6e42"\n }\n ],\n "user_id": 1\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifiact-output-4",children:"XSOAR Artifiact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"evidence_id"}),(0,i.jsx)(t.th,{children:"name"}),(0,i.jsx)(t.th,{children:"pipeline_id"}),(0,i.jsx)(t.th,{children:"pipeline_type"}),(0,i.jsx)(t.th,{children:"project_id"}),(0,i.jsx)(t.th,{children:"subtasks"}),(0,i.jsx)(t.th,{children:"user_id"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"2022-01-17T12:21:59.084282"}),(0,i.jsx)(t.td,{children:"0"}),(0,i.jsx)(t.td,{children:"Acquiring i-00000000000"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{children:"acquisition"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsxs)(t.td,{children:["{'id': '1587a9c9-c02c-464b-a6f7-d4b7e720bd93'},",(0,i.jsx)("br",{}),"{'id': '4f798bf8-c7d3-427c-9498-10a85cfe3978'},",(0,i.jsx)("br",{}),"{'id': 'c5fa26f1-e282-47a6-8335-1160766e089b'},",(0,i.jsx)("br",{}),"{'id': '82ec9a7e-47ac-4539-9623-166a44a59d0f'},",(0,i.jsx)("br",{}),"{'id': '88151005-a999-422e-b4cb-9e76699d6e42'}"]}),(0,i.jsx)(t.td,{children:"1"})]})})]}),"\n",(0,i.jsx)(t.h3,{id:"acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Command: ",(0,i.jsx)(t.code,{children:"cado-trigger-s3"})]}),"\n",(0,i.jsx)(t.li,{children:"Description: This command will trigger a disk image acquisition task in Cado from a file in a S3 Bucket."}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"arguments-6",children:"Arguments"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Argument Name"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Default Value"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"The ID of the project you wish to attach the acquisition to."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"The S3 bucket name containing the file."}),(0,i.jsx)(t.td,{children:"The value of the pre-configured default."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"file_name"}),(0,i.jsx)(t.td,{children:"The name of the file to process."}),(0,i.jsx)(t.td,{})]})]})]}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-context-output-6",children:"XSOAR Context Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Path"}),(0,i.jsx)(t.th,{children:"Type"}),(0,i.jsx)(t.th,{children:"Description"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"CadoResponse.S3Acquisition.pipeline_id"}),(0,i.jsx)(t.td,{children:"Number"}),(0,i.jsx)(t.td,{children:"ID of the created pipeline"})]})})]}),"\n",(0,i.jsx)(t.h4,{id:"command-example-6",children:"Command Example"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.code,{children:'!cado-trigger-s3 project_id=1 bucket="bucket" file_name="file"'})}),"\n",(0,i.jsx)(t.h4,{id:"context-example-6",children:"Context Example"}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{className:"language-json",children:'{\n "CadoResponse": {\n "S3Acquisition": {\n "created": "2022-01-17T12:22:00.843869",\n "evidence_id": 1,\n "name": "",\n "pipeline_id": 2,\n "pipeline_type": "processing",\n "project_id": 1,\n "subtasks": [\n {\n "id": "3699827f-63c4-4408-88a4-0ae899187ed3"\n },\n {\n "id": "727e2072-8bf7-4847-89ea-9447f5fd8fd0"\n },\n {\n "id": "857d48b8-abaf-4ea6-b159-d25c9784b837"\n },\n {\n "id": "533f7deb-74bc-4ffb-b81f-788ed714bead"\n },\n {\n "id": "3f1defde-3986-4292-a423-1bef62d4c52b"\n },\n {\n "id": "e41a0934-266b-4868-9a7d-5f083b1efcc1"\n },\n {\n "id": "75411e10-46e9-41dd-8bf7-9b5fbdc8df71"\n },\n {\n "id": "0afbf2f4-fbf3-4305-ad9f-b19d30f4b17c"\n },\n {\n "id": "ca063c7b-1135-4922-8542-49f40ce71449"\n },\n {\n "id": "67fdb0ea-dcee-4f65-a003-4f40fcd567fb"\n },\n {\n "id": "1437ec33-6af2-4eb8-9c43-e071dcb7e0ac"\n },\n {\n "id": "06db4dcc-57fd-48bc-bb34-5bd8f2da0a0d"\n },\n {\n "id": "e3cc930e-9a60-46c3-97a1-611824c24437"\n },\n {\n "id": "ad2c8877-39e7-4bff-9756-81278802ee76"\n }\n ],\n "user_id": 1\n }\n }\n}\n'})}),"\n",(0,i.jsx)(t.h4,{id:"xsoar-artifiact-output-5",children:"XSOAR Artifiact Output"}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"created"}),(0,i.jsx)(t.th,{children:"evidence_id"}),(0,i.jsx)(t.th,{children:"name"}),(0,i.jsx)(t.th,{children:"pipeline_id"}),(0,i.jsx)(t.th,{children:"pipeline_type"}),(0,i.jsx)(t.th,{children:"project_id"}),(0,i.jsx)(t.th,{children:"subtasks"}),(0,i.jsx)(t.th,{children:"user_id"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"2022-01-17T12:22:00.843869"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsx)(t.td,{}),(0,i.jsx)(t.td,{children:"2"}),(0,i.jsx)(t.td,{children:"processing"}),(0,i.jsx)(t.td,{children:"1"}),(0,i.jsxs)(t.td,{children:["{'id': '3699827f-63c4-4408-88a4-0ae899187ed3'},",(0,i.jsx)("br",{}),"{'id': '727e2072-8bf7-4847-89ea-9447f5fd8fd0'},",(0,i.jsx)("br",{}),"{'id': '857d48b8-abaf-4ea6-b159-d25c9784b837'},",(0,i.jsx)("br",{}),"{'id': '533f7deb-74bc-4ffb-b81f-788ed714bead'},",(0,i.jsx)("br",{}),"{'id': '3f1defde-3986-4292-a423-1bef62d4c52b'},",(0,i.jsx)("br",{}),"{'id': 'e41a0934-266b-4868-9a7d-5f083b1efcc1'},",(0,i.jsx)("br",{}),"{'id': '75411e10-46e9-41dd-8bf7-9b5fbdc8df71'},",(0,i.jsx)("br",{}),"{'id': '0afbf2f4-fbf3-4305-ad9f-b19d30f4b17c'},",(0,i.jsx)("br",{}),"{'id': 'ca063c7b-1135-4922-8542-49f40ce71449'},",(0,i.jsx)("br",{}),"{'id': '67fdb0ea-dcee-4f65-a003-4f40fcd567fb'},",(0,i.jsx)("br",{}),"{'id': '1437ec33-6af2-4eb8-9c43-e071dcb7e0ac'},",(0,i.jsx)("br",{}),"{'id': '06db4dcc-57fd-48bc-bb34-5bd8f2da0a0d'},",(0,i.jsx)("br",{}),"{'id': 'e3cc930e-9a60-46c3-97a1-611824c24437'},",(0,i.jsx)("br",{}),"{'id': 'ad2c8877-39e7-4bff-9756-81278802ee76'}"]}),(0,i.jsx)(t.td,{children:"1"})]})})]})]})}function h(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(o,{...e})}):o(e)}},4400:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/xsoar-market-435c41f4081debcf9f540f815a2c3ac7.png"},1318:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/xsoar-wizard-f207b59a1ea8f2d1a6e0c15186abbc93.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>c,a:()=>r});var i=n(7294);const s={},d=i.createContext(s);function r(e){const t=i.useContext(d);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),i.createElement(d.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/8cbd68b3.2855139b.js b/assets/js/8cbd68b3.2855139b.js deleted file mode 100644 index 788d97c4e..000000000 --- a/assets/js/8cbd68b3.2855139b.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2978],{173:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>l,contentTitle:()=>i,default:()=>h,frontMatter:()=>t,metadata:()=>c,toc:()=>d});var r=o(5893),s=o(1151);const t={title:"GCP Deployment (Beta)",hide_title:!0,sidebar_position:1},i=void 0,c={id:"cado-response/deploy/gcp/gcp-deploy",title:"GCP Deployment (Beta)",description:"GCP Deployment Overview",source:"@site/docs/cado-response/deploy/gcp/gcp-deploy.md",sourceDirName:"cado-response/deploy/gcp",slug:"/cado-response/deploy/gcp/gcp-deploy",permalink:"/cado-response/deploy/gcp/gcp-deploy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/gcp/gcp-deploy.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"GCP Deployment (Beta)",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Cross Subscription and Tenancy",permalink:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions"},next:{title:"GCP Settings",permalink:"/cado-response/deploy/gcp/gcp-settings"}},l={},d=[{value:"GCP Deployment Overview",id:"gcp-deployment-overview",level:2},{value:"GCP Terraform Script",id:"gcp-terraform-script",level:2}];function a(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.h2,{id:"gcp-deployment-overview",children:"GCP Deployment Overview"}),"\n",(0,r.jsx)(n.p,{children:"You can deploy the Cado platform within your GCP cloud environment via a Terraform Script. When you deploy the platform, it creates its own isolated network in which you can control who has access. From start to finish, you can be up and running in under 25 minutes."}),"\n",(0,r.jsx)(n.h2,{id:"gcp-terraform-script",children:"GCP Terraform Script"}),"\n",(0,r.jsxs)(n.p,{children:["To set up Cado in GCP you can deploy via our Terraform script. The Terraform script automates the process of configuring the platform stack.\nVisit the GCP Marketplace listing ",(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://console.cloud.google.com/marketplace/product/cado-public/cado-response",children:"here"})})," to download the latest Terraform code."]}),"\n",(0,r.jsx)(n.p,{children:"Once you have downloaded the Terraform code from the Marketplace listing above, continue on to the steps below."}),"\n",(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://learn.hashicorp.com/tutorials/terraform/install-cli",children:"Install Terraform"})}),", if you have not already."]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://cloud.google.com/sdk/docs/install",children:"Install GCloud CLI"})}),", if you have not already."]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Create a project and generate some service account credentials for the project, exporting the credentials.json. The service account will need to have the following permissions:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"Compute Admin"}),"\n",(0,r.jsx)(n.li,{children:"Service Account User"}),"\n",(0,r.jsx)(n.li,{children:"Storage Admin"}),"\n",(0,r.jsx)(n.li,{children:"Cloud Filestore Editor"}),"\n",(0,r.jsx)(n.li,{children:"Role Administrator"}),"\n",(0,r.jsx)(n.li,{children:"Security Admin"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Ensure the following ",(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://console.cloud.google.com/apis/library",children:"APIs"})})," are enabled in the project:"]}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://console.cloud.google.com/marketplace/product/google/compute.googleapis.com",children:"Compute Engine"})})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://console.cloud.google.com/marketplace/product/google/cloudbuild.googleapis.com",children:"Cloud Build"})})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://console.cloud.google.com/marketplace/product/google/file.googleapis.com",children:"Cloud Filestore"})})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://console.cloud.google.com/marketplace/product/google/secretmanager.googleapis.com",children:"Secret Manager"})})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://console.cloud.google.com/marketplace/product/google/cloudresourcemanager.googleapis.com",children:"Cloud Resource Manager"})})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://console.cloud.google.com/marketplace/product/google/iamcredentials.googleapis.com",children:"IAM Service Account Credentials"})})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://console.cloud.google.com/marketplace/product/google/storage.googleapis.com",children:"Cloud Storage"})})}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Run ",(0,r.jsx)(n.code,{children:"gcloud auth activate-service-account --key-file "})," where key_file is the path to your GCP service account credentials.json."]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Run ",(0,r.jsx)(n.code,{children:"gcloud config set project "})]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Extract gcp.zip This is the ZIP that was provided by Cado Sales."}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Change directories into gcp/ which was extracted in the previous step."}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Customize the file ",(0,r.jsx)(n.code,{children:"gcpVars.tfvars"})," by filling in values:"]}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Parameter Name"}),(0,r.jsx)(n.th,{children:"Description"}),(0,r.jsx)(n.th,{children:"Example"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"unique_name"})}),(0,r.jsx)(n.td,{children:"A string to ensure that resources created by Cado are unique"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"cado"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"credentials_file"})}),(0,r.jsx)(n.td,{children:"Path to your GCP service account credentials json"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"../credentials.json"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"project_id"})}),(0,r.jsx)(n.td,{children:"ID of the project Cado will be deployed into"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"cado-12839"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"region"})}),(0,r.jsx)(n.td,{children:"The region which Cado will be deployed to"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"us-east1"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"image"})}),(0,r.jsx)(n.td,{children:"The link of the image provided by Cado"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"https://www.googleapis.com/compute/v1/projects/cado-public/global/images/cadoresponse-2-112-0"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"tags"})}),(0,r.jsx)(n.td,{children:"Tags to be applied to your Cado instance"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:'{tag1 = "cado-test"}'})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"vm_size"})}),(0,r.jsx)(n.td,{children:"Size of main instance"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"n2d-standard-8"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"vol_size"})}),(0,r.jsx)(n.td,{children:"Size of main instance local disk in GB"}),(0,r.jsx)(n.td,{children:"This value is dependent on the amount of data you will be processing into the Cado platform. Please speak with the sales or support team for proper sizing."})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"allowed_ips"})}),(0,r.jsx)(n.td,{children:"List of incoming IPs"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"[\u201c1.2.3.6/32\u201d]"})})]})]})]}),"\n",(0,r.jsx)(n.admonition,{type:"tip",children:(0,r.jsxs)(n.p,{children:["We recommend a minimum setting of 500GB for ",(0,r.jsx)(n.code,{children:"vol_size"}),". The instance will roughly need to be sized to be 20% of the amount of data you intend to be on the platform at once. For example, to have 5TB of disk images imported you will need approximately 1000GB of disk space. Projects can always be deleted to recover space."]})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Deploy by running the following commands in the directory ",(0,r.jsx)(n.code,{children:"gcp/"}),"\n",(0,r.jsx)(n.code,{children:"terraform init"})," followed by ",(0,r.jsx)(n.code,{children:"terraform plan -var-file=gcpVars.tfvars"}),". Once you confirm the plan looks correct, you can then run ",(0,r.jsx)(n.code,{children:"terraform apply -var-file=gcpVars.tfvars"})]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Find your Cado instance in the ",(0,r.jsx)(n.a,{href:"https://console.cloud.google.com/compute/instances",children:"Compute Engine portal"}),", navigate to its public IP address in the browser"]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Login with:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"Username: admin"}),"\n",(0,r.jsx)(n.li,{children:"Password: (found in the Compute Engine console for your instance e.g. 8784481508256766876)"}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,s.a)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},1151:(e,n,o)=>{o.d(n,{Z:()=>c,a:()=>i});var r=o(7294);const s={},t=r.createContext(s);function i(e){const n=r.useContext(t);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),r.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/8cbd68b3.53202b01.js b/assets/js/8cbd68b3.53202b01.js new file mode 100644 index 000000000..02ce2c811 --- /dev/null +++ b/assets/js/8cbd68b3.53202b01.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2978],{173:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>l,contentTitle:()=>i,default:()=>h,frontMatter:()=>t,metadata:()=>c,toc:()=>d});var r=n(5893),s=n(1151);const t={title:"GCP Deployment (Beta)",hide_title:!0,sidebar_position:1},i=void 0,c={id:"cado-response/deploy/gcp/gcp-deploy",title:"GCP Deployment (Beta)",description:"GCP Deployment Overview",source:"@site/docs/cado-response/deploy/gcp/gcp-deploy.md",sourceDirName:"cado-response/deploy/gcp",slug:"/cado-response/deploy/gcp/gcp-deploy",permalink:"/cado-response/deploy/gcp/gcp-deploy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/gcp/gcp-deploy.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"GCP Deployment (Beta)",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Cross Subscription and Tenancy",permalink:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions"},next:{title:"GCP Settings",permalink:"/cado-response/deploy/gcp/gcp-settings"}},l={},d=[{value:"GCP Deployment Overview",id:"gcp-deployment-overview",level:2},{value:"GCP Terraform Script",id:"gcp-terraform-script",level:2}];function a(e){const o={a:"a",admonition:"admonition",code:"code",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(o.h2,{id:"gcp-deployment-overview",children:"GCP Deployment Overview"}),"\n",(0,r.jsx)(o.p,{children:"You can deploy the Cado platform within your GCP cloud environment via a Terraform Script. When you deploy the platform, it creates its own isolated network in which you can control who has access. From start to finish, you can be up and running in under 25 minutes."}),"\n",(0,r.jsx)(o.h2,{id:"gcp-terraform-script",children:"GCP Terraform Script"}),"\n",(0,r.jsxs)(o.p,{children:["To set up Cado in GCP you can deploy via our Terraform script. The Terraform script automates the process of configuring the platform stack.\nVisit the GCP Marketplace listing ",(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/cado-public/cado-response",children:"here"})})," to download the latest Terraform code."]}),"\n",(0,r.jsx)(o.p,{children:"Once you have downloaded the Terraform code from the Marketplace listing above, continue on to the steps below."}),"\n",(0,r.jsxs)(o.ol,{children:["\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:[(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://learn.hashicorp.com/tutorials/terraform/install-cli",children:"Install Terraform"})}),", if you have not already."]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:[(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://cloud.google.com/sdk/docs/install",children:"Install GCloud CLI"})}),", if you have not already."]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsx)(o.p,{children:"Create a project and generate some service account credentials for the project, exporting the credentials.json. The service account will need to have the following permissions:"}),"\n",(0,r.jsxs)(o.ul,{children:["\n",(0,r.jsx)(o.li,{children:"Compute Admin"}),"\n",(0,r.jsx)(o.li,{children:"Service Account User"}),"\n",(0,r.jsx)(o.li,{children:"Storage Admin"}),"\n",(0,r.jsx)(o.li,{children:"Cloud Filestore Editor"}),"\n",(0,r.jsx)(o.li,{children:"Role Administrator"}),"\n",(0,r.jsx)(o.li,{children:"Security Admin"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Ensure the following ",(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/apis/library",children:"APIs"})})," are enabled in the project:"]}),"\n",(0,r.jsxs)(o.ul,{children:["\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/compute.googleapis.com",children:"Compute Engine"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/cloudbuild.googleapis.com",children:"Cloud Build"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/file.googleapis.com",children:"Cloud Filestore"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/secretmanager.googleapis.com",children:"Secret Manager"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/cloudresourcemanager.googleapis.com",children:"Cloud Resource Manager"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/iamcredentials.googleapis.com",children:"IAM Service Account Credentials"})})}),"\n",(0,r.jsx)(o.li,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/marketplace/product/google/storage.googleapis.com",children:"Cloud Storage"})})}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Run ",(0,r.jsx)(o.code,{children:"gcloud auth activate-service-account --key-file "})," where key_file is the path to your GCP service account credentials.json."]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Run ",(0,r.jsx)(o.code,{children:"gcloud config set project "})]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsx)(o.p,{children:"Extract gcp.zip This is the ZIP that was provided by Cado Sales."}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsx)(o.p,{children:"Change directories into gcp/ which was extracted in the previous step."}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Customize the file ",(0,r.jsx)(o.code,{children:"gcpVars.tfvars"})," by filling in values:"]}),"\n",(0,r.jsxs)(o.table,{children:[(0,r.jsx)(o.thead,{children:(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.th,{children:"Parameter Name"}),(0,r.jsx)(o.th,{children:"Description"}),(0,r.jsx)(o.th,{children:"Example"})]})}),(0,r.jsxs)(o.tbody,{children:[(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"unique_name"})}),(0,r.jsx)(o.td,{children:"A string to ensure that resources created by Cado are unique"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"cado"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"credentials_file"})}),(0,r.jsx)(o.td,{children:"Path to your GCP service account credentials json"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"../credentials.json"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"project_id"})}),(0,r.jsx)(o.td,{children:"ID of the project Cado will be deployed into"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"cado-12839"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"region"})}),(0,r.jsx)(o.td,{children:"The region which Cado will be deployed to"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"us-east1"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"image"})}),(0,r.jsx)(o.td,{children:"The link of the image provided by Cado"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"https://www.googleapis.com/compute/v1/projects/cado-public/global/images/cadoresponse-2-112-0"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"tags"})}),(0,r.jsx)(o.td,{children:"Tags to be applied to your Cado instance"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:'{tag1 = "cado-test"}'})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"vm_size"})}),(0,r.jsx)(o.td,{children:"Size of main instance"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"n2d-standard-8"})})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"vol_size"})}),(0,r.jsx)(o.td,{children:"Size of main instance local disk in GB"}),(0,r.jsx)(o.td,{children:"This value is dependent on the amount of data you will be processing into the Cado platform. Please speak with the sales or support team for proper sizing."})]}),(0,r.jsxs)(o.tr,{children:[(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"allowed_ips"})}),(0,r.jsx)(o.td,{children:"List of incoming IPs"}),(0,r.jsx)(o.td,{children:(0,r.jsx)(o.code,{children:"[\u201c1.2.3.6/32\u201d]"})})]})]})]}),"\n",(0,r.jsx)(o.admonition,{type:"tip",children:(0,r.jsxs)(o.p,{children:["We recommend a minimum setting of 500GB for ",(0,r.jsx)(o.code,{children:"vol_size"}),". The instance will roughly need to be sized to be 20% of the amount of data you intend to be on the platform at once. For example, to have 5TB of disk images imported you will need approximately 1000GB of disk space. Projects can always be deleted to recover space."]})}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Deploy by running the following commands in the directory ",(0,r.jsx)(o.code,{children:"gcp/"}),"\n",(0,r.jsx)(o.code,{children:"terraform init"})," followed by ",(0,r.jsx)(o.code,{children:"terraform plan -var-file=gcpVars.tfvars"}),". Once you confirm the plan looks correct, you can then run ",(0,r.jsx)(o.code,{children:"terraform apply -var-file=gcpVars.tfvars"})]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsxs)(o.p,{children:["Find your Cado instance in the ",(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/compute/instances",children:"Compute Engine portal"}),", navigate to its public IP address in the browser"]}),"\n"]}),"\n",(0,r.jsxs)(o.li,{children:["\n",(0,r.jsx)(o.p,{children:"Login with:"}),"\n",(0,r.jsxs)(o.ul,{children:["\n",(0,r.jsx)(o.li,{children:"Username: admin"}),"\n",(0,r.jsx)(o.li,{children:"Password: (found in the Compute Engine console for your instance e.g. 8784481508256766876)"}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:o}={...(0,s.a)(),...e.components};return o?(0,r.jsx)(o,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},1151:(e,o,n)=>{n.d(o,{Z:()=>c,a:()=>i});var r=n(7294);const s={},t=r.createContext(s);function i(e){const o=r.useContext(t);return r.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function c(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:i(e.components),r.createElement(t.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/90eb2a60.112638ca.js b/assets/js/90eb2a60.112638ca.js new file mode 100644 index 000000000..e074aa351 --- /dev/null +++ b/assets/js/90eb2a60.112638ca.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9609],{6e3:(t,e,o)=>{o.r(e),o.d(e,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>s,metadata:()=>r,toc:()=>d});var n=o(5893),i=o(1151);const s={title:"Summary",hide_title:!0,sidebar_position:1},a="Cado Host",r={id:"cado-host/intro",title:"Summary",description:"Cado Host is a solution to acquire forensic artifacts from systems and place them into cloud storage, enabling you to perform a quick triage investigation of a target system.",source:"@site/docs/cado-host/intro.md",sourceDirName:"cado-host",slug:"/cado-host/intro",permalink:"/cado-host/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-host/intro.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Summary",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Summary",permalink:"/cado-response/community-edition/community-intro"},next:{title:"Deploying",permalink:"/cado-host/deploy"}},c={},d=[];function l(t){const e={a:"a",h1:"h1",img:"img",li:"li",p:"p",ul:"ul",...(0,i.a)(),...t.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{id:"cado-host",children:"Cado Host"}),"\n",(0,n.jsx)(e.p,{children:"Cado Host is a solution to acquire forensic artifacts from systems and place them into cloud storage, enabling you to perform a quick triage investigation of a target system.\nData is collected and stored in a zip file that can be automatically uploaded to Amazon AWS, Microsoft Azure or Google Cloud Storage. It also supports storing captured files locally.\nOnce collected, these artifacts can be imported, processed and analysed in the Cado Response platform."}),"\n",(0,n.jsx)(e.p,{children:"You can also use Cado Host with the --single_file_unzipped parameter - this may be a good option if you do not have direct access to Azure as Cado Response will generate the credentials at Import > Forensic Artifacts."}),"\n",(0,n.jsx)(e.p,{children:(0,n.jsx)(e.img,{alt:"Cado Host Single File",src:o(8503).Z+"",width:"1179",height:"661"})}),"\n",(0,n.jsx)(e.p,{children:"Cado Host binaries are available for:"}),"\n",(0,n.jsxs)(e.ul,{children:["\n",(0,n.jsx)(e.li,{children:"Microsoft Windows: 7, 8.1, 10 (1607+) and Microsoft Windows Server Server 2012 R2+"}),"\n",(0,n.jsx)(e.li,{children:"Linux: Debian: 9+, Ubuntu: 16.04+, Fedora: 29+, RHEL: 6+, openSUSE: 15+, SUSE Enterprise (SLES): 12 SP2+, Alpine: 3.10+"}),"\n",(0,n.jsx)(e.li,{children:"MacOS (Intel based only): 10.13+"}),"\n"]}),"\n",(0,n.jsx)(e.p,{children:"For older Operating systems we recommend instead acquiring with:"}),"\n",(0,n.jsxs)(e.ul,{children:["\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.a,{href:"https://github.com/tclahr/uac",children:"UAC"})," for Linux"]}),"\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.a,{href:"https://github.com/cado-security/Cado-Batch",children:"Cado Batch"})," for Windows"]}),"\n"]})]})}function u(t={}){const{wrapper:e}={...(0,i.a)(),...t.components};return e?(0,n.jsx)(e,{...t,children:(0,n.jsx)(l,{...t})}):l(t)}},8503:(t,e,o)=>{o.d(e,{Z:()=>n});const n=o.p+"assets/images/cado-host-single-file-5b0898f9ce1f4a6d05662bb36c5d3ba2.png"},1151:(t,e,o)=>{o.d(e,{Z:()=>r,a:()=>a});var n=o(7294);const i={},s=n.createContext(i);function a(t){const e=n.useContext(s);return n.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function r(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(i):t.components||i:a(t.components),n.createElement(s.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/90eb2a60.69425009.js b/assets/js/90eb2a60.69425009.js deleted file mode 100644 index 7d16ba28a..000000000 --- a/assets/js/90eb2a60.69425009.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9609],{6e3:(t,e,o)=>{o.r(e),o.d(e,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>s,metadata:()=>r,toc:()=>d});var n=o(5893),i=o(1151);const s={title:"Summary",hide_title:!0,sidebar_position:1},a="Cado Host",r={id:"cado-host/intro",title:"Summary",description:"Cado Host is a solution to acquire forensic artifacts from systems and place them into cloud storage, enabling you to perform a quick triage investigation of a target system.",source:"@site/docs/cado-host/intro.md",sourceDirName:"cado-host",slug:"/cado-host/intro",permalink:"/cado-host/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-host/intro.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Summary",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Summary",permalink:"/cado-response/community-edition/community-intro"},next:{title:"Deploying",permalink:"/cado-host/deploy"}},c={},d=[];function l(t){const e={a:"a",h1:"h1",img:"img",li:"li",p:"p",ul:"ul",...(0,i.a)(),...t.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{id:"cado-host",children:"Cado Host"}),"\n",(0,n.jsx)(e.p,{children:"Cado Host is a solution to acquire forensic artifacts from systems and place them into cloud storage, enabling you to perform a quick triage investigation of a target system.\nData is collected and stored in a zip file that can be automatically uploaded to Amazon AWS, Microsoft Azure or Google Cloud Storage. It also supports storing captured files locally.\nOnce collected, these artifacts can be imported, processed and analysed in the Cado Response platform."}),"\n",(0,n.jsx)(e.p,{children:"You can also use Cado Host with the --single_file_unzipped parameter - this may be a good option if you do not have direct access to Azure as Cado Response will generate the credentials at Import > Forensic Artifacts."}),"\n",(0,n.jsx)(e.p,{children:(0,n.jsx)(e.img,{alt:"Cado Host Single File",src:o(8503).Z+"",width:"1179",height:"661"})}),"\n",(0,n.jsx)(e.p,{children:"Cado Host binaries are available for:"}),"\n",(0,n.jsxs)(e.ul,{children:["\n",(0,n.jsx)(e.li,{children:"Microsoft Windows: 7, 8.1, 10 (1607+) and Microsoft Windows Server Server 2012 R2+"}),"\n",(0,n.jsx)(e.li,{children:"Linux: Debian: 9+, Ubuntu: 16.04+, Fedora: 29+, RHEL: 6+, openSUSE: 15+, SUSE Enterprise (SLES): 12 SP2+, Alpine: 3.10+"}),"\n",(0,n.jsx)(e.li,{children:"MacOS (Intel based only): 10.13+"}),"\n"]}),"\n",(0,n.jsx)(e.p,{children:"For older Operating systems we recommend instead acquiring with:"}),"\n",(0,n.jsxs)(e.ul,{children:["\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.a,{href:"https://github.com/tclahr/uac",children:"UAC"})," for Linux"]}),"\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.a,{href:"https://github.com/cado-security/Cado-Batch",children:"Cado Batch"})," for Windows"]}),"\n"]})]})}function u(t={}){const{wrapper:e}={...(0,i.a)(),...t.components};return e?(0,n.jsx)(e,{...t,children:(0,n.jsx)(l,{...t})}):l(t)}},8503:(t,e,o)=>{o.d(e,{Z:()=>n});const n=o.p+"assets/images/cado-host-single-file-5b0898f9ce1f4a6d05662bb36c5d3ba2.png"},1151:(t,e,o)=>{o.d(e,{Z:()=>r,a:()=>a});var n=o(7294);const i={},s=n.createContext(i);function a(t){const e=n.useContext(s);return n.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function r(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(i):t.components||i:a(t.components),n.createElement(s.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/9256c05a.449fa24a.js b/assets/js/9256c05a.449fa24a.js deleted file mode 100644 index e7a607b74..000000000 --- a/assets/js/9256c05a.449fa24a.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1084],{3988:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>n,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>d});var i=t(5893),a=t(1151);const o={title:"Browse Disk",hide_title:!0,sidebar_position:4},n="Browse Disk",r={id:"cado-response/investigate/browse-disk",title:"Browse Disk",description:"When you select a piece of disk evidence in the Project Overview tab, a Browse Disk Tab will appear.",source:"@site/docs/cado-response/investigate/browse-disk.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/browse-disk",permalink:"/cado-response/investigate/browse-disk",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/browse-disk.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:4,frontMatter:{title:"Browse Disk",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Automated Investigation",permalink:"/cado-response/investigate/automated-investigation"},next:{title:"Key Events, Alarms & Suspicious",permalink:"/cado-response/investigate/key-events"}},c={},d=[];function l(e){const s={a:"a",h1:"h1",img:"img",p:"p",...(0,a.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"browse-disk",children:"Browse Disk"}),"\n",(0,i.jsx)(s.p,{children:"When you select a piece of disk evidence in the Project Overview tab, a Browse Disk Tab will appear."}),"\n",(0,i.jsx)(s.p,{children:"Browse Disk shows a hierarchical view of the file system. Cado marks directory structures where Cado has found Alarms or Suspicions with red or yellow dots respectively. Clicking on a folder allows you to drill down into that structure."}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Browse Disk",src:t(4e3).Z+"",width:"1573",height:"736"})}),"\n",(0,i.jsxs)(s.p,{children:["Clicking on a file takes you to the details for that file, including links to search Open Threat Exchange (OTX) and VirusTotal if you have those ",(0,i.jsx)(s.a,{href:"/cado-response/investigate/detections",children:"set up"}),". Cado will index and show a preview of the text in a file, up to the first 1000 lines. You can download the full contents of the file."]}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"File Details 1",src:t(5452).Z+"",width:"1577",height:"762"})}),"\n",(0,i.jsx)(s.p,{children:"This tab also shows any key events (alarms, suspicions) associated with this file."}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"File Details 2",src:t(9107).Z+"",width:"1460",height:"592"})}),"\n",(0,i.jsxs)(s.p,{children:["For ",(0,i.jsx)(s.a,{href:"/cado-host/artifacts#volatile-data",children:"running processes collected by Cado Host"})," This tab also shows a diagram of information about running processes."]}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Process Data",src:t(7852).Z+"",width:"1590",height:"762"})}),"\n",(0,i.jsx)(s.p,{children:"This data is also available in tabular form"}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Process Table",src:t(6510).Z+"",width:"1478",height:"661"})})]})}function h(e={}){const{wrapper:s}={...(0,a.a)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},4e3:(e,s,t)=>{t.d(s,{Z:()=>i});const i=t.p+"assets/images/browse-disk-e630f76dcfd6c298a60d26e93725b03f.png"},5452:(e,s,t)=>{t.d(s,{Z:()=>i});const i=t.p+"assets/images/file-details-1-294ebd883c535190d1a2eb48b1bbf255.png"},9107:(e,s,t)=>{t.d(s,{Z:()=>i});const i=t.p+"assets/images/file-details-2-772b231ff2af57cea372b7753928903b.png"},7852:(e,s,t)=>{t.d(s,{Z:()=>i});const i=t.p+"assets/images/process-diagram-2780595810b9c5b42785c6aa921509dc.png"},6510:(e,s,t)=>{t.d(s,{Z:()=>i});const i=t.p+"assets/images/processes-table-59cb61f8d3998b5b33aff27aacdd3ce6.png"},1151:(e,s,t)=>{t.d(s,{Z:()=>r,a:()=>n});var i=t(7294);const a={},o=i.createContext(a);function n(e){const s=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function r(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:n(e.components),i.createElement(o.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9256c05a.506f851f.js b/assets/js/9256c05a.506f851f.js new file mode 100644 index 000000000..c1dd5149b --- /dev/null +++ b/assets/js/9256c05a.506f851f.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1084],{3988:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>n,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>d});var i=t(5893),a=t(1151);const o={title:"Browse Disk",hide_title:!0,sidebar_position:4},n="Browse Disk",r={id:"cado-response/investigate/browse-disk",title:"Browse Disk",description:"When you select a piece of disk evidence in the Project Overview tab, a Browse Disk Tab will appear.",source:"@site/docs/cado-response/investigate/browse-disk.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/browse-disk",permalink:"/cado-response/investigate/browse-disk",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/browse-disk.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:4,frontMatter:{title:"Browse Disk",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Automated Investigation",permalink:"/cado-response/investigate/automated-investigation"},next:{title:"Key Events, Alarms & Suspicious",permalink:"/cado-response/investigate/key-events"}},c={},d=[];function l(e){const s={a:"a",h1:"h1",img:"img",p:"p",...(0,a.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"browse-disk",children:"Browse Disk"}),"\n",(0,i.jsx)(s.p,{children:"When you select a piece of disk evidence in the Project Overview tab, a Browse Disk Tab will appear."}),"\n",(0,i.jsx)(s.p,{children:"Browse Disk shows a hierarchical view of the file system. Cado marks directory structures where Cado has found Alarms or Suspicions with red or yellow dots respectively. Clicking on a folder allows you to drill down into that structure."}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Browse Disk",src:t(4e3).Z+"",width:"1573",height:"736"})}),"\n",(0,i.jsxs)(s.p,{children:["Clicking on a file takes you to the details for that file, including links to search Open Threat Exchange (OTX) and VirusTotal if you have those ",(0,i.jsx)(s.a,{href:"/cado-response/investigate/detections",children:"set up"}),". Cado will index and show a preview of the text in a file, up to the first 1000 lines. You can download the full contents of the file."]}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"File Details 1",src:t(5452).Z+"",width:"1577",height:"762"})}),"\n",(0,i.jsx)(s.p,{children:"This tab also shows any key events (alarms, suspicions) associated with this file."}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"File Details 2",src:t(9107).Z+"",width:"1460",height:"592"})}),"\n",(0,i.jsxs)(s.p,{children:["For ",(0,i.jsx)(s.a,{href:"/cado-host/artifacts#volatile-data",children:"running processes collected by Cado Host"})," This tab also shows a diagram of information about running processes."]}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Process Data",src:t(7852).Z+"",width:"1590",height:"762"})}),"\n",(0,i.jsx)(s.p,{children:"This data is also available in tabular form"}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Process Table",src:t(6510).Z+"",width:"1478",height:"661"})})]})}function h(e={}){const{wrapper:s}={...(0,a.a)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},4e3:(e,s,t)=>{t.d(s,{Z:()=>i});const i=t.p+"assets/images/browse-disk-e630f76dcfd6c298a60d26e93725b03f.png"},5452:(e,s,t)=>{t.d(s,{Z:()=>i});const i=t.p+"assets/images/file-details-1-294ebd883c535190d1a2eb48b1bbf255.png"},9107:(e,s,t)=>{t.d(s,{Z:()=>i});const i=t.p+"assets/images/file-details-2-772b231ff2af57cea372b7753928903b.png"},7852:(e,s,t)=>{t.d(s,{Z:()=>i});const i=t.p+"assets/images/process-diagram-2780595810b9c5b42785c6aa921509dc.png"},6510:(e,s,t)=>{t.d(s,{Z:()=>i});const i=t.p+"assets/images/processes-table-59cb61f8d3998b5b33aff27aacdd3ce6.png"},1151:(e,s,t)=>{t.d(s,{Z:()=>r,a:()=>n});var i=t(7294);const a={},o=i.createContext(a);function n(e){const s=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function r(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:n(e.components),i.createElement(o.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/93485a32.56bbf677.js b/assets/js/93485a32.56bbf677.js new file mode 100644 index 000000000..b115d3901 --- /dev/null +++ b/assets/js/93485a32.56bbf677.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3002],{8267:(e,t,a)=>{a.r(t),a.d(t,{assets:()=>d,contentTitle:()=>n,default:()=>l,frontMatter:()=>i,metadata:()=>r,toc:()=>c});var s=a(5893),o=a(1151);const i={title:"Lambda",hide_title:!0,sidebar_position:6},n="AWS Lambda",r={id:"cado-response/discovery-import/import/aws/aws-lambda",title:"Lambda",description:"The Cado platform can acquire AWS Lambda functions which are serverless computing services.",source:"@site/docs/cado-response/discovery-import/import/aws/aws-lambda.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/aws-lambda",permalink:"/cado-response/discovery-import/import/aws/aws-lambda",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/aws-lambda.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:6,frontMatter:{title:"Lambda",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"EKS",permalink:"/cado-response/discovery-import/import/aws/aws-eks"},next:{title:"AWS Memory Analysis",permalink:"/cado-response/discovery-import/import/aws/memory"}},d={},c=[{value:"Output",id:"output",level:2}];function m(e){const t={em:"em",h1:"h1",h2:"h2",img:"img",p:"p",strong:"strong",...(0,o.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"aws-lambda",children:"AWS Lambda"}),"\n",(0,s.jsx)(t.p,{children:"The Cado platform can acquire AWS Lambda functions which are serverless computing services."}),"\n",(0,s.jsx)(t.p,{children:'Select the region the desired function is located in, and you should see a table of functions. Select the function you wisk to acquire, confirm the details and hit "Start Import"'}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Import Lambda Function",src:a(920).Z+"",width:"1820",height:"626"})}),"\n",(0,s.jsx)(t.h2,{id:"output",children:"Output"}),"\n",(0,s.jsxs)(t.p,{children:["Once processing has finished the events will be added to the timeline and the Lambda function code will be available to view in the ",(0,s.jsx)(t.strong,{children:"Browse Disk"})," tab."]}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Lambda Function Code",src:a(9064).Z+"",width:"2150",height:"1291"})}),"\n",(0,s.jsx)(t.p,{children:"Lambda automatically integrates with CloudWatch Logs and pushes all logs from your code to a CloudWatch Logs group associated with a Lambda function. Cado captures these logs and adds them to your timeline, so you can view any logging statements made by the function."}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Cloudwatch Logs",src:a(4826).Z+"",width:"2157",height:"1268"})}),"\n",(0,s.jsxs)(t.p,{children:[(0,s.jsx)(t.em,{children:"Note:"})," Cado imports the image of container-based Lambda functions from the Amazon Elastic Container Registry"]})]})}function l(e={}){const{wrapper:t}={...(0,o.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(m,{...e})}):m(e)}},4826:(e,t,a)=>{a.d(t,{Z:()=>s});const s=a.p+"assets/images/aws-lambda-cloudwatch-14b83ea4fb9a6898a0ceddbab3700544.png"},9064:(e,t,a)=>{a.d(t,{Z:()=>s});const s=a.p+"assets/images/aws-lambda-code-5aa24cb45ec8976f2b96fb2349547767.png"},920:(e,t,a)=>{a.d(t,{Z:()=>s});const s=a.p+"assets/images/import-lambda-362ec6f3fd1bd776b42653b365f199d6.png"},1151:(e,t,a)=>{a.d(t,{Z:()=>r,a:()=>n});var s=a(7294);const o={},i=s.createContext(o);function n(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:n(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/93485a32.580c5c23.js b/assets/js/93485a32.580c5c23.js deleted file mode 100644 index ed6acf60f..000000000 --- a/assets/js/93485a32.580c5c23.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3002],{8267:(e,t,a)=>{a.r(t),a.d(t,{assets:()=>d,contentTitle:()=>n,default:()=>l,frontMatter:()=>i,metadata:()=>r,toc:()=>c});var s=a(5893),o=a(1151);const i={title:"Lambda",hide_title:!0,sidebar_position:6},n="AWS Lambda",r={id:"cado-response/discovery-import/import/aws/aws-lambda",title:"Lambda",description:"The Cado platform can acquire AWS Lambda functions which are serverless computing services.",source:"@site/docs/cado-response/discovery-import/import/aws/aws-lambda.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/aws-lambda",permalink:"/cado-response/discovery-import/import/aws/aws-lambda",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/aws-lambda.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:6,frontMatter:{title:"Lambda",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"EKS",permalink:"/cado-response/discovery-import/import/aws/aws-eks"},next:{title:"AWS Memory Analysis",permalink:"/cado-response/discovery-import/import/aws/memory"}},d={},c=[{value:"Output",id:"output",level:2}];function m(e){const t={em:"em",h1:"h1",h2:"h2",img:"img",p:"p",strong:"strong",...(0,o.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"aws-lambda",children:"AWS Lambda"}),"\n",(0,s.jsx)(t.p,{children:"The Cado platform can acquire AWS Lambda functions which are serverless computing services."}),"\n",(0,s.jsx)(t.p,{children:'Select the region the desired function is located in, and you should see a table of functions. Select the function you wisk to acquire, confirm the details and hit "Start Import"'}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Import Lambda Function",src:a(920).Z+"",width:"1820",height:"626"})}),"\n",(0,s.jsx)(t.h2,{id:"output",children:"Output"}),"\n",(0,s.jsxs)(t.p,{children:["Once processing has finished the events will be added to the timeline and the Lambda function code will be available to view in the ",(0,s.jsx)(t.strong,{children:"Browse Disk"})," tab."]}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Lambda Function Code",src:a(9064).Z+"",width:"2150",height:"1291"})}),"\n",(0,s.jsx)(t.p,{children:"Lambda automatically integrates with CloudWatch Logs and pushes all logs from your code to a CloudWatch Logs group associated with a Lambda function. Cado captures these logs and adds them to your timeline, so you can view any logging statements made by the function."}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Cloudwatch Logs",src:a(4826).Z+"",width:"2157",height:"1268"})}),"\n",(0,s.jsxs)(t.p,{children:[(0,s.jsx)(t.em,{children:"Note:"})," Cado imports the image of container-based Lambda functions from the Amazon Elastic Container Registry"]})]})}function l(e={}){const{wrapper:t}={...(0,o.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(m,{...e})}):m(e)}},4826:(e,t,a)=>{a.d(t,{Z:()=>s});const s=a.p+"assets/images/aws-lambda-cloudwatch-14b83ea4fb9a6898a0ceddbab3700544.png"},9064:(e,t,a)=>{a.d(t,{Z:()=>s});const s=a.p+"assets/images/aws-lambda-code-5aa24cb45ec8976f2b96fb2349547767.png"},920:(e,t,a)=>{a.d(t,{Z:()=>s});const s=a.p+"assets/images/import-lambda-362ec6f3fd1bd776b42653b365f199d6.png"},1151:(e,t,a)=>{a.d(t,{Z:()=>r,a:()=>n});var s=a(7294);const o={},i=s.createContext(o);function n(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:n(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/935f2afb.6bbb7be2.js b/assets/js/935f2afb.6bbb7be2.js deleted file mode 100644 index 1923da0d2..000000000 --- a/assets/js/935f2afb.6bbb7be2.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[53],{1109:e=>{e.exports=JSON.parse('{"pluginId":"default","version":"current","label":"Next","banner":null,"badge":false,"noIndex":false,"className":"docs-version-current","isLast":true,"docsSidebars":{"tutorialSidebar":[{"type":"category","label":"Cado Platform","collapsible":true,"collapsed":false,"items":[{"type":"link","label":"Summary","href":"/cado-response/intro","docId":"cado-response/intro","unlisted":false},{"type":"link","label":"Key Concepts","href":"/cado-response/key-concepts","docId":"cado-response/key-concepts","unlisted":false},{"type":"category","label":"Deployment","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Deployment Options","href":"/cado-response/deploy/intro","docId":"cado-response/deploy/intro","unlisted":false},{"type":"category","label":"AWS","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Overview","href":"/cado-response/deploy/aws/overview","docId":"cado-response/deploy/aws/overview","unlisted":false},{"type":"category","label":"IAM Considerations","collapsible":true,"collapsed":false,"items":[{"type":"link","label":"Overview","href":"/cado-response/deploy/aws/iam/deployment-iam-considerations","docId":"cado-response/deploy/aws/iam/deployment-iam-considerations","unlisted":false},{"type":"link","label":"Removing and Tightening IAM Permissions","href":"/cado-response/deploy/aws/iam/tightening-iam","docId":"cado-response/deploy/aws/iam/tightening-iam","unlisted":false},{"type":"link","label":"Cross Account Creation","href":"/cado-response/deploy/aws/iam/cross-account-creation","docId":"cado-response/deploy/aws/iam/cross-account-creation","unlisted":false}]},{"type":"category","label":"Data Encryption","collapsible":true,"collapsed":false,"items":[{"type":"link","label":"Overview","href":"/cado-response/deploy/aws/data-encryption/data-encryption-overview","docId":"cado-response/deploy/aws/data-encryption/data-encryption-overview","unlisted":false},{"type":"link","label":"KMS Support","href":"/cado-response/deploy/aws/data-encryption/aws-kms","docId":"cado-response/deploy/aws/data-encryption/aws-kms","unlisted":false}]},{"type":"link","label":"Logging","href":"/cado-response/deploy/aws/logging","docId":"cado-response/deploy/aws/logging","unlisted":false},{"type":"category","label":"Networking","collapsible":true,"collapsed":false,"items":[{"type":"link","label":"Load Balancer","href":"/cado-response/deploy/aws/networking/aws-load-balancer","docId":"cado-response/deploy/aws/networking/aws-load-balancer","unlisted":false},{"type":"link","label":"Private IP Addresses","href":"/cado-response/deploy/aws/networking/internet-routable-addresses","docId":"cado-response/deploy/aws/networking/internet-routable-addresses","unlisted":false}]},{"type":"category","label":"Performance and Resiliency","collapsible":true,"collapsed":false,"items":[{"type":"link","label":"Backups and Recovery","href":"/cado-response/deploy/aws/performance-resiliency/aws-backups","docId":"cado-response/deploy/aws/performance-resiliency/aws-backups","unlisted":false},{"type":"link","label":"Large EC2 Imports","href":"/cado-response/deploy/aws/performance-resiliency/large-aws-imports","docId":"cado-response/deploy/aws/performance-resiliency/large-aws-imports","unlisted":false},{"type":"link","label":"High Availability","href":"/cado-response/deploy/aws/performance-resiliency/high-availability","docId":"cado-response/deploy/aws/performance-resiliency/high-availability","unlisted":false}]}]},{"type":"category","label":"Azure","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Overview","href":"/cado-response/deploy/azure/azure-deploy","docId":"cado-response/deploy/azure/azure-deploy","unlisted":false},{"type":"link","label":"Cross Subscription and Tenancy","href":"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions","docId":"cado-response/deploy/azure/azure-cross-tenancy-subscriptions","unlisted":false}]},{"type":"category","label":"GCP","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"GCP Deployment (Beta)","href":"/cado-response/deploy/gcp/gcp-deploy","docId":"cado-response/deploy/gcp/gcp-deploy","unlisted":false},{"type":"link","label":"GCP Settings","href":"/cado-response/deploy/gcp/gcp-settings","docId":"cado-response/deploy/gcp/gcp-settings","unlisted":false},{"type":"link","label":"Automated Setup","href":"/cado-response/deploy/gcp/gcp-auto-setup","docId":"cado-response/deploy/gcp/gcp-auto-setup","unlisted":false},{"type":"link","label":"Cross-Project Setup","href":"/cado-response/deploy/gcp/gcp-cross-project","docId":"cado-response/deploy/gcp/gcp-cross-project","unlisted":false}]}]},{"type":"category","label":"Import","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Overview","href":"/cado-response/discovery-import/intro","docId":"cado-response/discovery-import/intro","unlisted":false},{"type":"link","label":"Managing Projects","href":"/cado-response/discovery-import/projects","docId":"cado-response/discovery-import/projects","unlisted":false},{"type":"link","label":"Automation Rules (Beta)","href":"/cado-response/discovery-import/automation","docId":"cado-response/discovery-import/automation","unlisted":false},{"type":"link","label":"Readiness (Beta)","href":"/cado-response/discovery-import/readiness","docId":"cado-response/discovery-import/readiness","unlisted":false},{"type":"category","label":"Importing Data","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Overview","href":"/cado-response/discovery-import/import/intro","docId":"cado-response/discovery-import/import/intro","unlisted":false},{"type":"link","label":"Import from Cloud","href":"/cado-response/discovery-import/import/import-from-cloud","docId":"cado-response/discovery-import/import/import-from-cloud","unlisted":false},{"type":"category","label":"Data Types","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"File Types","href":"/cado-response/discovery-import/import/data-types/filetypes","docId":"cado-response/discovery-import/import/data-types/filetypes","unlisted":false},{"type":"link","label":"Log Types","href":"/cado-response/discovery-import/import/data-types/logs","docId":"cado-response/discovery-import/import/data-types/logs","unlisted":false},{"type":"link","label":"Memory Analysis","href":"/cado-response/discovery-import/import/data-types/memory","docId":"cado-response/discovery-import/import/data-types/memory","unlisted":false},{"type":"link","label":"Supported Import Types","href":"/cado-response/discovery-import/import/data-types/import-types","docId":"cado-response/discovery-import/import/data-types/import-types","unlisted":false}]},{"type":"category","label":"AWS","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"EC2 and EBS","href":"/cado-response/discovery-import/import/aws/aws-ec2","docId":"cado-response/discovery-import/import/aws/aws-ec2","unlisted":false},{"type":"link","label":"S3","href":"/cado-response/discovery-import/import/aws/aws-s3","docId":"cado-response/discovery-import/import/aws/aws-s3","unlisted":false},{"type":"link","label":"AMI, EBS Snapshot and Volume","href":"/cado-response/discovery-import/import/aws/aws-ami","docId":"cado-response/discovery-import/import/aws/aws-ami","unlisted":false},{"type":"link","label":"ECS","href":"/cado-response/discovery-import/import/aws/aws-ecs","docId":"cado-response/discovery-import/import/aws/aws-ecs","unlisted":false},{"type":"link","label":"EKS","href":"/cado-response/discovery-import/import/aws/aws-eks","docId":"cado-response/discovery-import/import/aws/aws-eks","unlisted":false},{"type":"link","label":"Lambda","href":"/cado-response/discovery-import/import/aws/aws-lambda","docId":"cado-response/discovery-import/import/aws/aws-lambda","unlisted":false},{"type":"link","label":"AWS Memory Analysis","href":"/cado-response/discovery-import/import/aws/memory","docId":"cado-response/discovery-import/import/aws/memory","unlisted":false},{"type":"link","label":"Lightsail","href":"/cado-response/discovery-import/import/aws/aws-lightsail","docId":"cado-response/discovery-import/import/aws/aws-lightsail","unlisted":false},{"type":"link","label":"Monitoring for Snapshots and Volumes","href":"/cado-response/discovery-import/import/aws/monitoring","docId":"cado-response/discovery-import/import/aws/monitoring","unlisted":false}]},{"type":"category","label":"Azure","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Azure Compute","href":"/cado-response/discovery-import/import/azure/azure-compute","docId":"cado-response/discovery-import/import/azure/azure-compute","unlisted":false},{"type":"link","label":"Azure Storage","href":"/cado-response/discovery-import/import/azure/azure-storage","docId":"cado-response/discovery-import/import/azure/azure-storage","unlisted":false},{"type":"link","label":"Azure Kubernetes Service","href":"/cado-response/discovery-import/import/azure/azure-aks","docId":"cado-response/discovery-import/import/azure/azure-aks","unlisted":false}]},{"type":"category","label":"GCP","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Google Compute Engine","href":"/cado-response/discovery-import/import/gcp/engine-instance","docId":"cado-response/discovery-import/import/gcp/engine-instance","unlisted":false},{"type":"link","label":"Google Cloud Storage","href":"/cado-response/discovery-import/import/gcp/storage","docId":"cado-response/discovery-import/import/gcp/storage","unlisted":false},{"type":"link","label":"Google Cloud Kubernetes Engine","href":"/cado-response/discovery-import/import/gcp/kubernetes-engine","docId":"cado-response/discovery-import/import/gcp/kubernetes-engine","unlisted":false}]},{"type":"category","label":"Oracle","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Oracle Cloud Virtual Machines","href":"/cado-response/discovery-import/import/oracle/virtual-machine","docId":"cado-response/discovery-import/import/oracle/virtual-machine","unlisted":false}]}]}]},{"type":"category","label":"Export","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Exporting Data","href":"/cado-response/export/intro","docId":"cado-response/export/intro","unlisted":false}]},{"type":"category","label":"Investigating","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Investigate","href":"/cado-response/investigate/intro","docId":"cado-response/investigate/intro","unlisted":false},{"type":"link","label":"Evidence","href":"/cado-response/investigate/evidence","docId":"cado-response/investigate/evidence","unlisted":false},{"type":"link","label":"Timeline Search","href":"/cado-response/investigate/timeline-search","docId":"cado-response/investigate/timeline-search","unlisted":false},{"type":"link","label":"Automated Investigation","href":"/cado-response/investigate/automated-investigation","docId":"cado-response/investigate/automated-investigation","unlisted":false},{"type":"link","label":"Browse Disk","href":"/cado-response/investigate/browse-disk","docId":"cado-response/investigate/browse-disk","unlisted":false},{"type":"link","label":"Key Events, Alarms & Suspicious","href":"/cado-response/investigate/key-events","docId":"cado-response/investigate/key-events","unlisted":false},{"type":"link","label":"Indicators","href":"/cado-response/investigate/indicators","docId":"cado-response/investigate/indicators","unlisted":false},{"type":"link","label":"Network","href":"/cado-response/investigate/network","docId":"cado-response/investigate/network","unlisted":false},{"type":"link","label":"Detections","href":"/cado-response/investigate/detections","docId":"cado-response/investigate/detections","unlisted":false},{"type":"link","label":"AI Investigator","href":"/cado-response/investigate/ai investigator","docId":"cado-response/investigate/ai investigator","unlisted":false}]},{"type":"category","label":"Manage","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Logging In","href":"/cado-response/manage/logging-in","docId":"cado-response/manage/logging-in","unlisted":false},{"type":"link","label":"Applying a License","href":"/cado-response/manage/licenses","docId":"cado-response/manage/licenses","unlisted":false},{"type":"category","label":"Users and Authentication","collapsible":true,"collapsed":false,"items":[{"type":"link","label":"Managing Users","href":"/cado-response/manage/users-authentication/users","docId":"cado-response/manage/users-authentication/users","unlisted":false},{"type":"category","label":"Single Sign On","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Azure AD","href":"/cado-response/manage/users-authentication/sso/azure-ad","docId":"cado-response/manage/users-authentication/sso/azure-ad","unlisted":false},{"type":"link","label":"Okta OAuth","href":"/cado-response/manage/users-authentication/sso/okta","docId":"cado-response/manage/users-authentication/sso/okta","unlisted":false},{"type":"link","label":"Okta SAML","href":"/cado-response/manage/users-authentication/sso/okta_saml","docId":"cado-response/manage/users-authentication/sso/okta_saml","unlisted":false},{"type":"link","label":"Ping SAML","href":"/cado-response/manage/users-authentication/sso/ping_saml","docId":"cado-response/manage/users-authentication/sso/ping_saml","unlisted":false}]}]},{"type":"category","label":"Integrations","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Overview & API","href":"/cado-response/manage/integrations/api-overview","docId":"cado-response/manage/integrations/api-overview","unlisted":false},{"type":"link","label":"GuardDuty via Lambda","href":"/cado-response/manage/integrations/aws-lambda","docId":"cado-response/manage/integrations/aws-lambda","unlisted":false},{"type":"link","label":"SIEM","href":"/cado-response/manage/integrations/siem","docId":"cado-response/manage/integrations/siem","unlisted":false},{"type":"category","label":"SOAR Platforms","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Tines","href":"/cado-response/manage/integrations/soar/tines","docId":"cado-response/manage/integrations/soar/tines","unlisted":false},{"type":"link","label":"Splunk SOAR","href":"/cado-response/manage/integrations/soar/splunk-soar","docId":"cado-response/manage/integrations/soar/splunk-soar","unlisted":false},{"type":"link","label":"Cortex XSOAR","href":"/cado-response/manage/integrations/soar/cortex-xsoar","docId":"cado-response/manage/integrations/soar/cortex-xsoar","unlisted":false}]},{"type":"link","label":"Webhooks","href":"/cado-response/manage/integrations/webhooks","docId":"cado-response/manage/integrations/webhooks","unlisted":false},{"type":"category","label":"Malware Analysis Sandboxes","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"SophosLabs Intelix","href":"/cado-response/manage/integrations/sandbox/intelix","docId":"cado-response/manage/integrations/sandbox/intelix","unlisted":false}]},{"type":"category","label":"XDR Platforms","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"SentinelOne","href":"/cado-response/manage/integrations/xdr/sentinelone","docId":"cado-response/manage/integrations/xdr/sentinelone","unlisted":false},{"type":"link","label":"CrowdStrike","href":"/cado-response/manage/integrations/xdr/crowdstrike","docId":"cado-response/manage/integrations/xdr/crowdstrike","unlisted":false}]}]},{"type":"link","label":"Worker Management","href":"/cado-response/manage/workers","docId":"cado-response/manage/workers","unlisted":false},{"type":"link","label":"Data Management","href":"/cado-response/manage/data","docId":"cado-response/manage/data","unlisted":false},{"type":"link","label":"Updating","href":"/cado-response/manage/updating","docId":"cado-response/manage/updating","unlisted":false},{"type":"link","label":"Health Monitoring","href":"/cado-response/manage/monitoring","docId":"cado-response/manage/monitoring","unlisted":false},{"type":"link","label":"Cost Management","href":"/cado-response/manage/cost-management","docId":"cado-response/manage/cost-management","unlisted":false}]},{"type":"category","label":"Community Edition","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Summary","href":"/cado-response/community-edition/community-intro","docId":"cado-response/community-edition/community-intro","unlisted":false}]}]},{"type":"category","label":"Cado Host","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Summary","href":"/cado-host/intro","docId":"cado-host/intro","unlisted":false},{"type":"link","label":"Deploying","href":"/cado-host/deploy","docId":"cado-host/deploy","unlisted":false},{"type":"link","label":"Collected Artifacts","href":"/cado-host/artifacts","docId":"cado-host/artifacts","unlisted":false},{"type":"link","label":"AWS Credentials","href":"/cado-host/aws-credentials","docId":"cado-host/aws-credentials","unlisted":false},{"type":"link","label":"Azure Credentials","href":"/cado-host/azure-credentials","docId":"cado-host/azure-credentials","unlisted":false},{"type":"link","label":"Google Cloud Credentials","href":"/cado-host/google-credentials","docId":"cado-host/google-credentials","unlisted":false}]},{"type":"category","label":"Troubleshooting","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"FAQs","href":"/troubleshooting/faq","docId":"troubleshooting/faq","unlisted":false}]},{"type":"category","label":"License Agreements","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Commercial EULA","href":"/eula/commercial-eula","docId":"eula/commercial-eula","unlisted":false},{"type":"link","label":"Community Edition EULA","href":"/eula/community-eula","docId":"eula/community-eula","unlisted":false}]},{"type":"category","label":"Support Bulletins","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Sep 23 2022 - AWS Role Update","href":"/support-bulletins/role-update","docId":"support-bulletins/role-update","unlisted":false}]},{"type":"link","label":"Release Notes","href":"/release-notes/","docId":"release-notes/release-notes","unlisted":false}]},"docs":{"cado-host/artifacts":{"id":"cado-host/artifacts","title":"Collected Artifacts","description":"Cado Host collects a number of artifacts by default, based on the operating system. Note that you can configure additonal files and folders to be collected by defining the --additionalfiles parameter when running Cado Host. See the --additionalfiles Command Line Parameters for more details.","sidebar":"tutorialSidebar"},"cado-host/aws-credentials":{"id":"cado-host/aws-credentials","title":"AWS Credentials","description":"We now recommend using the automatically created temporary credentials generated by Cado Response. See our documentation here for more details.","sidebar":"tutorialSidebar"},"cado-host/azure-credentials":{"id":"cado-host/azure-credentials","title":"Azure Credentials","description":"We now recommend using the automatically created temporary credentials generated by Cado Response. See our documentation here for more details.","sidebar":"tutorialSidebar"},"cado-host/deploy":{"id":"cado-host/deploy","title":"Deploying","description":"You can execute Cado Host individually on a device or you can deploy it to a number of machines that may be compromised, for example through Group Policy or other systems management software.","sidebar":"tutorialSidebar"},"cado-host/google-credentials":{"id":"cado-host/google-credentials","title":"Google Cloud Credentials","description":"To create secure credentials for Google Cloud Storage, perform the following. You can also watch the embedded video, which walks through the process.\u200b","sidebar":"tutorialSidebar"},"cado-host/intro":{"id":"cado-host/intro","title":"Summary","description":"Cado Host is a solution to acquire forensic artifacts from systems and place them into cloud storage, enabling you to perform a quick triage investigation of a target system.","sidebar":"tutorialSidebar"},"cado-response/community-edition/community-intro":{"id":"cado-response/community-edition/community-intro","title":"Summary","description":"The Cado platform platform leverages the scale, speed and automation of the cloud to expedite investigation and response. Cado Community Edition is a free version of the Cado platform that lets you analyze:","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/data-encryption/aws-kms":{"id":"cado-response/deploy/aws/data-encryption/aws-kms","title":"KMS Support","description":"The Cado platform will import EC2 instances with encrypted volumes, provided that the appropriate permissions are given to the CadoResponseRole.","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/data-encryption/data-encryption-overview":{"id":"cado-response/deploy/aws/data-encryption/data-encryption-overview","title":"Overview","description":"During deployment, by default, an S3 bucket, a VPC and a Subnet are created for use by the Cado solution. From an access and security perspective, the S3 Bucket is encrypted with server-side encryption using AES256 and attached volumes are also encrypted using KMS. We recommend you enable key rotation as well (https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html). The default VPC and Subnet create an isolated environment to which customers can control access rights. When processing data, the Cado worker instances are launched within the same VPC as the main Cado instance. Worker instances are started using the same AMI as the main Cado instance as well.","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/iam/cross-account-creation":{"id":"cado-response/deploy/aws/iam/cross-account-creation","title":"Cross Account Creation","description":"The Cado platform can access resources across multiple AWS accounts. For instance, if you manage 100 AWS accounts, you can deploy Cado in a single AWS account and then grant the Cado platform access to all other AWS accounts, enabling the platform to acquire, process, and analyze evidence from all AWS accounts seamlessly.","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/iam/deployment-iam-considerations":{"id":"cado-response/deploy/aws/iam/deployment-iam-considerations","title":"Overview","description":"There are several AWS Identity & Access Management best practices to consider when deploying the Cado platform","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/iam/tightening-iam":{"id":"cado-response/deploy/aws/iam/tightening-iam","title":"Removing and Tightening IAM Permissions","description":"Removing and Tightening IAM Permissions","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/logging":{"id":"cado-response/deploy/aws/logging","title":"Logging","description":"We recommend customers follow AWS best practices regarding logging (https","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/networking/aws-load-balancer":{"id":"cado-response/deploy/aws/networking/aws-load-balancer","title":"Load Balancer","description":"An Application Load Balancer can be placed in front of the Cado web server in order to provide a valid HTTPS connection and add a Web Application Firewall. This can be configured via the provided Terraform or Cloudformation deployment scripts.","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/networking/internet-routable-addresses":{"id":"cado-response/deploy/aws/networking/internet-routable-addresses","title":"Private IP Addresses","description":"By default, the Cado platform deploys into its own VPC with an allow-list of known good IP Addresses set by the user. Public IPv4 addresses are assigned to the main Cado platform to enable a user to connect with their web browser, and are also assigned to workers to allow them to connect to required AWS services e.g. s3.amazonaws.com.","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/overview":{"id":"cado-response/deploy/aws/overview","title":"Overview","description":"AWS Deployment Overview","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/performance-resiliency/aws-backups":{"id":"cado-response/deploy/aws/performance-resiliency/aws-backups","title":"Backups and Recovery","description":"Backup and Recovery","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/performance-resiliency/high-availability":{"id":"cado-response/deploy/aws/performance-resiliency/high-availability","title":"High Availability","description":"The Cado platform can be deployed in AWS in full high availability mode.","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/performance-resiliency/large-aws-imports":{"id":"cado-response/deploy/aws/performance-resiliency/large-aws-imports","title":"Large EC2 Imports","description":"Importing AWS EC2 instances with disks over 500GB can start to reach limitations in AWS.","sidebar":"tutorialSidebar"},"cado-response/deploy/azure/azure-cross-tenancy-subscriptions":{"id":"cado-response/deploy/azure/azure-cross-tenancy-subscriptions","title":"Cross Subscription and Tenancy","description":"Setting up an app registration for cross tenancy/subcription acquisitions","sidebar":"tutorialSidebar"},"cado-response/deploy/azure/azure-deploy":{"id":"cado-response/deploy/azure/azure-deploy","title":"Overview","description":"Azure Deployment Overview","sidebar":"tutorialSidebar"},"cado-response/deploy/gcp/gcp-auto-setup":{"id":"cado-response/deploy/gcp/gcp-auto-setup","title":"Automated Setup","description":"To streamline the process of configuring your GCP environment ready for Cado, this page details how to use our GCP Setup Scripts.","sidebar":"tutorialSidebar"},"cado-response/deploy/gcp/gcp-cross-project":{"id":"cado-response/deploy/gcp/gcp-cross-project","title":"Cross-Project Setup","description":"After creating the service account, enabling Cloud Build and other relevant APIs, and setting up the Primary GCP Project as discussed in the Overview, we can use these principals to import from other GCP projects under the same service acount.","sidebar":"tutorialSidebar"},"cado-response/deploy/gcp/gcp-deploy":{"id":"cado-response/deploy/gcp/gcp-deploy","title":"GCP Deployment (Beta)","description":"GCP Deployment Overview","sidebar":"tutorialSidebar"},"cado-response/deploy/gcp/gcp-settings":{"id":"cado-response/deploy/gcp/gcp-settings","title":"GCP Settings","description":"You can acquire compute and storage resources from GCP with the Cado platform by","sidebar":"tutorialSidebar"},"cado-response/deploy/intro":{"id":"cado-response/deploy/intro","title":"Deployment Options","description":"The Cado platform can be deployed in either AWS or Azure.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/automation":{"id":"cado-response/discovery-import/automation","title":"Automation Rules (Beta)","description":"This feature is currently in beta - to enable this feature go to Settings > Experiments","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/aws-ami":{"id":"cado-response/discovery-import/import/aws/aws-ami","title":"AMI, EBS Snapshot and Volume","description":"The Cado platform supports acquiring AMIs, EBS Snapshots or volumes of machines, either by using a cross account role, or directly sharing the image/snapshot with the Cado AWS account. If sharing an AMI, you will need to select the option to share the underlying Snapshots (\\"Edit AMI Permissions\\" > Tick \\"Add \'Create volume\' permission\\"). For more information, see Share an Amazon EBS snapshot.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/aws-ec2":{"id":"cado-response/discovery-import/import/aws/aws-ec2","title":"EC2 and EBS","description":"Cado supports acquisition of EC2 instances. Select the region, and this will populate a list of EC2 instances available. You can filter the list of instances and buckets by instance ID, name, state or public IP address. Select the instance you wish to acquire.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/aws-ecs":{"id":"cado-response/discovery-import/import/aws/aws-ecs","title":"ECS","description":"The Cado platform will collect key logs and forensic artifacts from AWS ECS systems.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/aws-eks":{"id":"cado-response/discovery-import/import/aws/aws-eks","title":"EKS","description":"The Cado platform will collect key logs and forensic artifacts containers running in an AWS EKS cluster.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/aws-lambda":{"id":"cado-response/discovery-import/import/aws/aws-lambda","title":"Lambda","description":"The Cado platform can acquire AWS Lambda functions which are serverless computing services.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/aws-lightsail":{"id":"cado-response/discovery-import/import/aws/aws-lightsail","title":"Lightsail","description":"First create a snapshot of the Lightsail instance you want to import:","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/aws-s3":{"id":"cado-response/discovery-import/import/aws/aws-s3","title":"S3","description":"The Cado platform supports acquistion of data from AWS S3 buckets. The two main use cases for this are:","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/memory":{"id":"cado-response/discovery-import/import/aws/memory","title":"AWS Memory Analysis","description":"You can acquire memory of Linux systems in EC2 by using the \\"Triage Acquisition\\" option under Import > EC2:","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/monitoring":{"id":"cado-response/discovery-import/import/aws/monitoring","title":"Monitoring for Snapshots and Volumes","description":"You can monitor for Snapshots and Volumes created within an account.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/azure/azure-aks":{"id":"cado-response/discovery-import/import/azure/azure-aks","title":"Azure Kubernetes Service","description":"The Cado platform will collect key logs and forensic artifacts from Azure Kubernetes Service containers.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/azure/azure-compute":{"id":"cado-response/discovery-import/import/azure/azure-compute","title":"Azure Compute","description":"The Cado platform supports acquisition of Azure Compute instances. Select an Azure subscription, and this will populate a list of available instances. Select the instance to import, review the details and click on \'Start Import\'","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/azure/azure-storage":{"id":"cado-response/discovery-import/import/azure/azure-storage","title":"Azure Storage","description":"The Cado platform supports acquistion of data from Azure Blob Storage. The two main use cases for this are:","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/data-types/filetypes":{"id":"cado-response/discovery-import/import/data-types/filetypes","title":"File Types","description":"The Cado platform supports the processing of a wide range of evidence types. These may differ slightly based on your cloud platform.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/data-types/import-types":{"id":"cado-response/discovery-import/import/data-types/import-types","title":"Supported Import Types","description":"Import Types","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/data-types/logs":{"id":"cado-response/discovery-import/import/data-types/logs","title":"Log Types","description":"Cado Response supports the processing of a wide range of evidence types. These may differ slightly based on your cloud platform.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/data-types/memory":{"id":"cado-response/discovery-import/import/data-types/memory","title":"Memory Analysis","description":"You can perform a memory acquisition of a Windows or Linux system using Cado Host by clicking Import > Forensic Artifacts and running the pre-generated script on the host device. Process memory collection is not currently supported on OSX.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/gcp/engine-instance":{"id":"cado-response/discovery-import/import/gcp/engine-instance","title":"Google Compute Engine","description":"The Cado platform supports acquisition of GCP Compute instances. Select the GCP project and bucket where you can upload the image prior to importing it into the Cado platform.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/gcp/kubernetes-engine":{"id":"cado-response/discovery-import/import/gcp/kubernetes-engine","title":"Google Cloud Kubernetes Engine","description":"The Cado platform will collect key logs and forensic artifacts from Google Cloud Kubernetes Engine containers.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/gcp/storage":{"id":"cado-response/discovery-import/import/gcp/storage","title":"Google Cloud Storage","description":"The Cado platform supports acquistion of data from GCP Storage Buckets. The two main use cases for this are:","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/import-from-cloud":{"id":"cado-response/discovery-import/import/import-from-cloud","title":"Import from Cloud","description":"To import data from the cloud you need to have access configured to the cloud account/subscription/project where the data resides. Learn more on how to add credentials to the Cado Platform for AWS, Azure, and GCP.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/intro":{"id":"cado-response/discovery-import/import/intro","title":"Overview","description":"There are a number of options for importing data into the Cado platform. Once you select the data you would like to import, the Cado platform begins processing the data based on the platforms Processing Settings. Check out our help section on Processing Settings for more details.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/oracle/virtual-machine":{"id":"cado-response/discovery-import/import/oracle/virtual-machine","title":"Oracle Cloud Virtual Machines","description":"First, you need to take a clone of the instance boot volume. Note that this will affect the instance as it performs a shutdown task and will restart the instance on completion.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/intro":{"id":"cado-response/discovery-import/intro","title":"Overview","description":"Getting Started with CTF Data","sidebar":"tutorialSidebar"},"cado-response/discovery-import/projects":{"id":"cado-response/discovery-import/projects","title":"Managing Projects","description":"Cado groups evidence items into projects.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/readiness":{"id":"cado-response/discovery-import/readiness","title":"Readiness (Beta)","description":"Readiness is a powerful tool designed to help you identify and address issues related to the acquisition of workloads within your environments. It provides a centralised platform for tracking these issues and assigns a readiness score to each environment, giving you a quick overview of the health of your workload acquisition process.","sidebar":"tutorialSidebar"},"cado-response/export/intro":{"id":"cado-response/export/intro","title":"Exporting Data","description":"Exporting Data from Cado Response","sidebar":"tutorialSidebar"},"cado-response/intro":{"id":"cado-response/intro","title":"Summary","description":"Data is moving to the cloud. Cyber attackers are moving to the cloud. Yet when security teams need to investigate a threat in a modern environment, it\u2019s incredibly complex and time consuming. The Cado platform leverages the scale, speed and automation of the cloud to expedite investigation and response.","sidebar":"tutorialSidebar"},"cado-response/investigate/ai investigator":{"id":"cado-response/investigate/ai investigator","title":"AI Investigator","description":"Cado AI Investigator","sidebar":"tutorialSidebar"},"cado-response/investigate/automated-investigation":{"id":"cado-response/investigate/automated-investigation","title":"Automated Investigation","description":"The Automated Investigation tab provides a summary of what Cado has determined during its investigation.","sidebar":"tutorialSidebar"},"cado-response/investigate/browse-disk":{"id":"cado-response/investigate/browse-disk","title":"Browse Disk","description":"When you select a piece of disk evidence in the Project Overview tab, a Browse Disk Tab will appear.","sidebar":"tutorialSidebar"},"cado-response/investigate/detections":{"id":"cado-response/investigate/detections","title":"Detections","description":"Setting Up Detections","sidebar":"tutorialSidebar"},"cado-response/investigate/evidence":{"id":"cado-response/investigate/evidence","title":"Evidence","description":"The Evidence tab is a focused view of the data that has been collected as part of this project, and the current processing status of that data. Clicking on the menu icon to the right of a piece of evidence allows you to delete that piece of evidence.","sidebar":"tutorialSidebar"},"cado-response/investigate/indicators":{"id":"cado-response/investigate/indicators","title":"Indicators","description":"The Indicators tab shows which Alarms and Suspicious Indicators were found in which piece of evidence","sidebar":"tutorialSidebar"},"cado-response/investigate/intro":{"id":"cado-response/investigate/intro","title":"Investigate","description":"Evidence is processed into Projects and investigation starts by analyzing the project evidence. The project view provides an overview of the key information for all evidence items in a given project.","sidebar":"tutorialSidebar"},"cado-response/investigate/key-events":{"id":"cado-response/investigate/key-events","title":"Key Events, Alarms & Suspicious","description":"Cado parses events from evidence items. These events may have times associated with them. They may also be tagged as Alarm, which indicates a high likelihood of malicious activity, or Suspicious, which indicates a lower likelihood of malicious activity.","sidebar":"tutorialSidebar"},"cado-response/investigate/network":{"id":"cado-response/investigate/network","title":"Network","description":"This tab shows connections between systems identified in processed evidence and the number of timeline events associated with them","sidebar":"tutorialSidebar"},"cado-response/investigate/timeline-search":{"id":"cado-response/investigate/timeline-search","title":"Timeline Search","description":"The Cado platform includes an advanced search interface which supports complex queries.","sidebar":"tutorialSidebar"},"cado-response/key-concepts":{"id":"cado-response/key-concepts","title":"Key Concepts","description":"Below we describe some of the key concepts in the Cado platform.","sidebar":"tutorialSidebar"},"cado-response/manage/cost-management":{"id":"cado-response/manage/cost-management","title":"Cost Management","description":"You can view the AWS Cost Calculator for a typical Cado installation at https://calculator.s3.amazonaws.com/index.html#r=IAD&key=files/calc-bca484373bcb2d07322fd6716a197d1cdc629534&v=ver20210903uJ","sidebar":"tutorialSidebar"},"cado-response/manage/data":{"id":"cado-response/manage/data","title":"Data Management","description":"There are several considerations for managing data from the Cado platform","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/api-overview":{"id":"cado-response/manage/integrations/api-overview","title":"Overview & API","description":"The Cado API enables third party tools and automation scripts to integrate with the Cado platform.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/aws-lambda":{"id":"cado-response/manage/integrations/aws-lambda","title":"GuardDuty via Lambda","description":"The Cado platform can integrate with other AWS Services through AWS Lambda.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/sandbox/intelix":{"id":"cado-response/manage/integrations/sandbox/intelix","title":"SophosLabs Intelix","description":"The Cado platform automates the acquisition of cloud systems with zero impact. When combined with a malware analysis platform, like SophosLabs Intelix, security analysts can submit files for analysis and use malware findings as an investigation pivot point.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/siem":{"id":"cado-response/manage/integrations/siem","title":"SIEM","description":"SIEM (Security Information and Event Management) is a tool that provides real-time analysis of security events generated by applications and network hardware - an essential capability for SecOps teams to correlate events and logs from different systems and manage risks more wisely. The integration with the Cado platform leverages the power of SIEM systems with Cado\u2019s unique forensics value in the cloud.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/soar/cortex-xsoar":{"id":"cado-response/manage/integrations/soar/cortex-xsoar","title":"Cortex XSOAR","description":"Cortex XSOAR is a powerful Security Orchestration, Automation, and Response (SOAR) system. XSOAR allows SoC teams to organize cases, incidents and automate investigation rapidly using a central War Room for collaboration. By integrating Cado with XSOAR, you\'re going to increase efficiency and productive by automating Cado\'s powerful data acquisition and processing.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/soar/splunk-soar":{"id":"cado-response/manage/integrations/soar/splunk-soar","title":"Splunk SOAR","description":"Splunk SOAR is a Security Orchestration, Automation, and Response (SOAR) system. The Splunk SOAR platform combines security infrastructure orchestration, playbook automation, and case management capabilities to integrate your team, processes, and tools together including integrating with Cado.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/soar/tines":{"id":"cado-response/manage/integrations/soar/tines","title":"Tines","description":"Tines is a no-code automation platform for security analysts. Tines allows analysts to spend less time on routine repetitive tasks and allow them to focus on those areas where they can have the most impact. The tools feature pre-configured integrations with a variety of business and security tools, but for more sophisticated users, it also features the ability to hook into any publicly available API, including the Cado API.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/webhooks":{"id":"cado-response/manage/integrations/webhooks","title":"Webhooks","description":"A webhook integration allows you to automatically send information from the Cado platform to another application using a unique URL.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/xdr/crowdstrike":{"id":"cado-response/manage/integrations/xdr/crowdstrike","title":"CrowdStrike","description":"Integrating with CrowdStrike Falcon allows you to select and kick off triage acquisition on hosts with the Falcon Sensor installed using CrowdStrike Real Time Response.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/xdr/sentinelone":{"id":"cado-response/manage/integrations/xdr/sentinelone","title":"SentinelOne","description":"SentinelOne Singularity provides comprehensive visibility across your environment - giving you the breadth you need to detect malicious activity as soon as it occurs. Cado streamlines forensic analysis to quickly deliver essential historical context and depth to your investigation allowing you to quickly identify the root cause. Combined, the SentinelOne and Cado integration empowers organizations to detect, investigate, and remediate breaches with unmatched speed.","sidebar":"tutorialSidebar"},"cado-response/manage/licenses":{"id":"cado-response/manage/licenses","title":"Applying a License","description":"In order to use the Cado platform, you must upload a valid license.","sidebar":"tutorialSidebar"},"cado-response/manage/logging-in":{"id":"cado-response/manage/logging-in","title":"Logging In","description":"Depending on the cloud provider in which you deployed the Cado platform, navigate to either your AWS Console or your Azure Portal and find the Public IPv4 address of your running Cado instance. Open a browser and navigate to https:// where `` is the IPv4 of the Cado instance. You will now be able to log into the platform.","sidebar":"tutorialSidebar"},"cado-response/manage/monitoring":{"id":"cado-response/manage/monitoring","title":"Health Monitoring","description":"Within the Cado platform, you can see the platform health and statistics by navigating to the \\"Platform\\" tab. This list Free Disk Space, Available Memory, Total Memory, CPU Usage and pipeline processing details. In addition, roundtrip response latency for the API /api/v2/status endpoint should be less than or equal to 200ms.","sidebar":"tutorialSidebar"},"cado-response/manage/updating":{"id":"cado-response/manage/updating","title":"Updating","description":"You can view version information and trigger updates by clicking Updates from the Settings menu.","sidebar":"tutorialSidebar"},"cado-response/manage/users-authentication/sso/azure-ad":{"id":"cado-response/manage/users-authentication/sso/azure-ad","title":"Azure AD","description":"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.","sidebar":"tutorialSidebar"},"cado-response/manage/users-authentication/sso/okta":{"id":"cado-response/manage/users-authentication/sso/okta","title":"Okta OAuth","description":"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.","sidebar":"tutorialSidebar"},"cado-response/manage/users-authentication/sso/okta_saml":{"id":"cado-response/manage/users-authentication/sso/okta_saml","title":"Okta SAML","description":"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.","sidebar":"tutorialSidebar"},"cado-response/manage/users-authentication/sso/ping_saml":{"id":"cado-response/manage/users-authentication/sso/ping_saml","title":"Ping SAML","description":"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.","sidebar":"tutorialSidebar"},"cado-response/manage/users-authentication/users":{"id":"cado-response/manage/users-authentication/users","title":"Managing Users","description":"In the Cado platform you can grant access only to the data to which they need access - to both processed data within the platform, and resources or raw data residing in the cloud.","sidebar":"tutorialSidebar"},"cado-response/manage/workers":{"id":"cado-response/manage/workers","title":"Worker Management","description":"This section covers the options available for managing workers spun up during processing jobs. These settings can be accessed under Settings > General Settings","sidebar":"tutorialSidebar"},"eula/commercial-eula":{"id":"eula/commercial-eula","title":"Commercial EULA","description":"FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, DOCUMENT A - END USER LICENSE AGREEMENT SHALL APPLY.","sidebar":"tutorialSidebar"},"eula/community-eula":{"id":"eula/community-eula","title":"Community Edition EULA","description":"FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, DOCUMENT A - END USER LICENSE AGREEMENT SHALL APPLY.","sidebar":"tutorialSidebar"},"release-notes/release-notes":{"id":"release-notes/release-notes","title":"Release Notes","description":"Latest release notes","sidebar":"tutorialSidebar"},"support-bulletins/role-update":{"id":"support-bulletins/role-update","title":"Sep 23 2022 - AWS Role Update","description":"On Sep 21st, 2022 AWS announced a change with immediate effect to AWS roles that affects the operation of the Cado platform. These new changes mean that any Cado installation deployed after June 30th will no longer operate correctly, including not being able to initialize new workers for data acquisition or processing.","sidebar":"tutorialSidebar"},"troubleshooting/faq":{"id":"troubleshooting/faq","title":"FAQs","description":"Solutions to some common questions can be found here. If you can\'t find your answer, please reach out to support@cadosecurity.com and let us know.","sidebar":"tutorialSidebar"}}}')}}]); \ No newline at end of file diff --git a/assets/js/935f2afb.84599293.js b/assets/js/935f2afb.84599293.js new file mode 100644 index 000000000..a93beb054 --- /dev/null +++ b/assets/js/935f2afb.84599293.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[53],{1109:e=>{e.exports=JSON.parse('{"pluginId":"default","version":"current","label":"Next","banner":null,"badge":false,"noIndex":false,"className":"docs-version-current","isLast":true,"docsSidebars":{"tutorialSidebar":[{"type":"category","label":"Cado Platform","collapsible":true,"collapsed":false,"items":[{"type":"link","label":"Summary","href":"/cado-response/intro","docId":"cado-response/intro","unlisted":false},{"type":"link","label":"Key Concepts","href":"/cado-response/key-concepts","docId":"cado-response/key-concepts","unlisted":false},{"type":"category","label":"Deployment","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Deployment Options","href":"/cado-response/deploy/intro","docId":"cado-response/deploy/intro","unlisted":false},{"type":"category","label":"AWS","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Overview","href":"/cado-response/deploy/aws/overview","docId":"cado-response/deploy/aws/overview","unlisted":false},{"type":"category","label":"IAM Considerations","collapsible":true,"collapsed":false,"items":[{"type":"link","label":"Overview","href":"/cado-response/deploy/aws/iam/deployment-iam-considerations","docId":"cado-response/deploy/aws/iam/deployment-iam-considerations","unlisted":false},{"type":"link","label":"Removing and Tightening IAM Permissions","href":"/cado-response/deploy/aws/iam/tightening-iam","docId":"cado-response/deploy/aws/iam/tightening-iam","unlisted":false},{"type":"link","label":"Cross Account Creation","href":"/cado-response/deploy/aws/iam/cross-account-creation","docId":"cado-response/deploy/aws/iam/cross-account-creation","unlisted":false}]},{"type":"category","label":"Data Encryption","collapsible":true,"collapsed":false,"items":[{"type":"link","label":"Overview","href":"/cado-response/deploy/aws/data-encryption/data-encryption-overview","docId":"cado-response/deploy/aws/data-encryption/data-encryption-overview","unlisted":false},{"type":"link","label":"KMS Support","href":"/cado-response/deploy/aws/data-encryption/aws-kms","docId":"cado-response/deploy/aws/data-encryption/aws-kms","unlisted":false}]},{"type":"link","label":"Logging","href":"/cado-response/deploy/aws/logging","docId":"cado-response/deploy/aws/logging","unlisted":false},{"type":"category","label":"Networking","collapsible":true,"collapsed":false,"items":[{"type":"link","label":"Load Balancer","href":"/cado-response/deploy/aws/networking/aws-load-balancer","docId":"cado-response/deploy/aws/networking/aws-load-balancer","unlisted":false},{"type":"link","label":"Private IP Addresses","href":"/cado-response/deploy/aws/networking/internet-routable-addresses","docId":"cado-response/deploy/aws/networking/internet-routable-addresses","unlisted":false}]},{"type":"category","label":"Performance and Resiliency","collapsible":true,"collapsed":false,"items":[{"type":"link","label":"Backups and Recovery","href":"/cado-response/deploy/aws/performance-resiliency/aws-backups","docId":"cado-response/deploy/aws/performance-resiliency/aws-backups","unlisted":false},{"type":"link","label":"Large EC2 Imports","href":"/cado-response/deploy/aws/performance-resiliency/large-aws-imports","docId":"cado-response/deploy/aws/performance-resiliency/large-aws-imports","unlisted":false},{"type":"link","label":"High Availability","href":"/cado-response/deploy/aws/performance-resiliency/high-availability","docId":"cado-response/deploy/aws/performance-resiliency/high-availability","unlisted":false}]}]},{"type":"category","label":"Azure","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Overview","href":"/cado-response/deploy/azure/azure-deploy","docId":"cado-response/deploy/azure/azure-deploy","unlisted":false},{"type":"link","label":"Cross Subscription and Tenancy","href":"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions","docId":"cado-response/deploy/azure/azure-cross-tenancy-subscriptions","unlisted":false}]},{"type":"category","label":"GCP","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"GCP Deployment (Beta)","href":"/cado-response/deploy/gcp/gcp-deploy","docId":"cado-response/deploy/gcp/gcp-deploy","unlisted":false},{"type":"link","label":"GCP Settings","href":"/cado-response/deploy/gcp/gcp-settings","docId":"cado-response/deploy/gcp/gcp-settings","unlisted":false},{"type":"link","label":"Automated Setup","href":"/cado-response/deploy/gcp/gcp-auto-setup","docId":"cado-response/deploy/gcp/gcp-auto-setup","unlisted":false},{"type":"link","label":"Cross-Project Setup","href":"/cado-response/deploy/gcp/gcp-cross-project","docId":"cado-response/deploy/gcp/gcp-cross-project","unlisted":false}]}]},{"type":"category","label":"Import","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Overview","href":"/cado-response/discovery-import/intro","docId":"cado-response/discovery-import/intro","unlisted":false},{"type":"link","label":"Managing Projects","href":"/cado-response/discovery-import/projects","docId":"cado-response/discovery-import/projects","unlisted":false},{"type":"link","label":"Automation Rules (Beta)","href":"/cado-response/discovery-import/automation","docId":"cado-response/discovery-import/automation","unlisted":false},{"type":"link","label":"Readiness (Beta)","href":"/cado-response/discovery-import/readiness","docId":"cado-response/discovery-import/readiness","unlisted":false},{"type":"category","label":"Importing Data","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Overview","href":"/cado-response/discovery-import/import/intro","docId":"cado-response/discovery-import/import/intro","unlisted":false},{"type":"link","label":"Import from Cloud","href":"/cado-response/discovery-import/import/import-from-cloud","docId":"cado-response/discovery-import/import/import-from-cloud","unlisted":false},{"type":"category","label":"Data Types","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"File Types","href":"/cado-response/discovery-import/import/data-types/filetypes","docId":"cado-response/discovery-import/import/data-types/filetypes","unlisted":false},{"type":"link","label":"Log Types","href":"/cado-response/discovery-import/import/data-types/logs","docId":"cado-response/discovery-import/import/data-types/logs","unlisted":false},{"type":"link","label":"Memory Analysis","href":"/cado-response/discovery-import/import/data-types/memory","docId":"cado-response/discovery-import/import/data-types/memory","unlisted":false},{"type":"link","label":"Supported Import Types","href":"/cado-response/discovery-import/import/data-types/import-types","docId":"cado-response/discovery-import/import/data-types/import-types","unlisted":false}]},{"type":"category","label":"AWS","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"EC2 and EBS","href":"/cado-response/discovery-import/import/aws/aws-ec2","docId":"cado-response/discovery-import/import/aws/aws-ec2","unlisted":false},{"type":"link","label":"S3","href":"/cado-response/discovery-import/import/aws/aws-s3","docId":"cado-response/discovery-import/import/aws/aws-s3","unlisted":false},{"type":"link","label":"AMI, EBS Snapshot and Volume","href":"/cado-response/discovery-import/import/aws/aws-ami","docId":"cado-response/discovery-import/import/aws/aws-ami","unlisted":false},{"type":"link","label":"ECS","href":"/cado-response/discovery-import/import/aws/aws-ecs","docId":"cado-response/discovery-import/import/aws/aws-ecs","unlisted":false},{"type":"link","label":"EKS","href":"/cado-response/discovery-import/import/aws/aws-eks","docId":"cado-response/discovery-import/import/aws/aws-eks","unlisted":false},{"type":"link","label":"Lambda","href":"/cado-response/discovery-import/import/aws/aws-lambda","docId":"cado-response/discovery-import/import/aws/aws-lambda","unlisted":false},{"type":"link","label":"AWS Memory Analysis","href":"/cado-response/discovery-import/import/aws/memory","docId":"cado-response/discovery-import/import/aws/memory","unlisted":false},{"type":"link","label":"Lightsail","href":"/cado-response/discovery-import/import/aws/aws-lightsail","docId":"cado-response/discovery-import/import/aws/aws-lightsail","unlisted":false},{"type":"link","label":"Monitoring for Snapshots and Volumes","href":"/cado-response/discovery-import/import/aws/monitoring","docId":"cado-response/discovery-import/import/aws/monitoring","unlisted":false}]},{"type":"category","label":"Azure","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Azure Compute","href":"/cado-response/discovery-import/import/azure/azure-compute","docId":"cado-response/discovery-import/import/azure/azure-compute","unlisted":false},{"type":"link","label":"Azure Storage","href":"/cado-response/discovery-import/import/azure/azure-storage","docId":"cado-response/discovery-import/import/azure/azure-storage","unlisted":false},{"type":"link","label":"Azure Kubernetes Service","href":"/cado-response/discovery-import/import/azure/azure-aks","docId":"cado-response/discovery-import/import/azure/azure-aks","unlisted":false}]},{"type":"category","label":"GCP","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Google Compute Engine","href":"/cado-response/discovery-import/import/gcp/engine-instance","docId":"cado-response/discovery-import/import/gcp/engine-instance","unlisted":false},{"type":"link","label":"Google Cloud Storage","href":"/cado-response/discovery-import/import/gcp/storage","docId":"cado-response/discovery-import/import/gcp/storage","unlisted":false},{"type":"link","label":"Google Cloud Kubernetes Engine","href":"/cado-response/discovery-import/import/gcp/kubernetes-engine","docId":"cado-response/discovery-import/import/gcp/kubernetes-engine","unlisted":false}]},{"type":"category","label":"Oracle","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Oracle Cloud Virtual Machines","href":"/cado-response/discovery-import/import/oracle/virtual-machine","docId":"cado-response/discovery-import/import/oracle/virtual-machine","unlisted":false}]},{"type":"link","label":"OpenShift","href":"/cado-response/discovery-import/import/openshift/","docId":"cado-response/discovery-import/import/openshift/openshift","unlisted":false}]}]},{"type":"category","label":"Export","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Exporting Data","href":"/cado-response/export/intro","docId":"cado-response/export/intro","unlisted":false}]},{"type":"category","label":"Investigating","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Investigate","href":"/cado-response/investigate/intro","docId":"cado-response/investigate/intro","unlisted":false},{"type":"link","label":"Evidence","href":"/cado-response/investigate/evidence","docId":"cado-response/investigate/evidence","unlisted":false},{"type":"link","label":"Timeline Search","href":"/cado-response/investigate/timeline-search","docId":"cado-response/investigate/timeline-search","unlisted":false},{"type":"link","label":"Automated Investigation","href":"/cado-response/investigate/automated-investigation","docId":"cado-response/investigate/automated-investigation","unlisted":false},{"type":"link","label":"Browse Disk","href":"/cado-response/investigate/browse-disk","docId":"cado-response/investigate/browse-disk","unlisted":false},{"type":"link","label":"Key Events, Alarms & Suspicious","href":"/cado-response/investigate/key-events","docId":"cado-response/investigate/key-events","unlisted":false},{"type":"link","label":"Indicators","href":"/cado-response/investigate/indicators","docId":"cado-response/investigate/indicators","unlisted":false},{"type":"link","label":"Network","href":"/cado-response/investigate/network","docId":"cado-response/investigate/network","unlisted":false},{"type":"link","label":"Detections","href":"/cado-response/investigate/detections","docId":"cado-response/investigate/detections","unlisted":false},{"type":"link","label":"AI Investigator","href":"/cado-response/investigate/ai investigator","docId":"cado-response/investigate/ai investigator","unlisted":false}]},{"type":"category","label":"Manage","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Logging In","href":"/cado-response/manage/logging-in","docId":"cado-response/manage/logging-in","unlisted":false},{"type":"link","label":"Applying a License","href":"/cado-response/manage/licenses","docId":"cado-response/manage/licenses","unlisted":false},{"type":"category","label":"Users and Authentication","collapsible":true,"collapsed":false,"items":[{"type":"link","label":"Managing Users","href":"/cado-response/manage/users-authentication/users","docId":"cado-response/manage/users-authentication/users","unlisted":false},{"type":"category","label":"Single Sign On","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Azure AD","href":"/cado-response/manage/users-authentication/sso/azure-ad","docId":"cado-response/manage/users-authentication/sso/azure-ad","unlisted":false},{"type":"link","label":"Okta OAuth","href":"/cado-response/manage/users-authentication/sso/okta","docId":"cado-response/manage/users-authentication/sso/okta","unlisted":false},{"type":"link","label":"Okta SAML","href":"/cado-response/manage/users-authentication/sso/okta_saml","docId":"cado-response/manage/users-authentication/sso/okta_saml","unlisted":false},{"type":"link","label":"Ping SAML","href":"/cado-response/manage/users-authentication/sso/ping_saml","docId":"cado-response/manage/users-authentication/sso/ping_saml","unlisted":false}]}]},{"type":"category","label":"Integrations","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Overview & API","href":"/cado-response/manage/integrations/api-overview","docId":"cado-response/manage/integrations/api-overview","unlisted":false},{"type":"link","label":"GuardDuty via Lambda","href":"/cado-response/manage/integrations/aws-lambda","docId":"cado-response/manage/integrations/aws-lambda","unlisted":false},{"type":"link","label":"SIEM","href":"/cado-response/manage/integrations/siem","docId":"cado-response/manage/integrations/siem","unlisted":false},{"type":"category","label":"SOAR Platforms","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Tines","href":"/cado-response/manage/integrations/soar/tines","docId":"cado-response/manage/integrations/soar/tines","unlisted":false},{"type":"link","label":"Splunk SOAR","href":"/cado-response/manage/integrations/soar/splunk-soar","docId":"cado-response/manage/integrations/soar/splunk-soar","unlisted":false},{"type":"link","label":"Cortex XSOAR","href":"/cado-response/manage/integrations/soar/cortex-xsoar","docId":"cado-response/manage/integrations/soar/cortex-xsoar","unlisted":false}]},{"type":"link","label":"Webhooks","href":"/cado-response/manage/integrations/webhooks","docId":"cado-response/manage/integrations/webhooks","unlisted":false},{"type":"category","label":"Malware Analysis Sandboxes","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"SophosLabs Intelix","href":"/cado-response/manage/integrations/sandbox/intelix","docId":"cado-response/manage/integrations/sandbox/intelix","unlisted":false}]},{"type":"category","label":"XDR Platforms","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"SentinelOne","href":"/cado-response/manage/integrations/xdr/sentinelone","docId":"cado-response/manage/integrations/xdr/sentinelone","unlisted":false},{"type":"link","label":"CrowdStrike","href":"/cado-response/manage/integrations/xdr/crowdstrike","docId":"cado-response/manage/integrations/xdr/crowdstrike","unlisted":false}]}]},{"type":"link","label":"Worker Management","href":"/cado-response/manage/workers","docId":"cado-response/manage/workers","unlisted":false},{"type":"link","label":"Data Management","href":"/cado-response/manage/data","docId":"cado-response/manage/data","unlisted":false},{"type":"link","label":"Updating","href":"/cado-response/manage/updating","docId":"cado-response/manage/updating","unlisted":false},{"type":"link","label":"Health Monitoring","href":"/cado-response/manage/monitoring","docId":"cado-response/manage/monitoring","unlisted":false},{"type":"link","label":"Cost Management","href":"/cado-response/manage/cost-management","docId":"cado-response/manage/cost-management","unlisted":false}]},{"type":"category","label":"Community Edition","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Summary","href":"/cado-response/community-edition/community-intro","docId":"cado-response/community-edition/community-intro","unlisted":false}]}]},{"type":"category","label":"Cado Host","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Summary","href":"/cado-host/intro","docId":"cado-host/intro","unlisted":false},{"type":"link","label":"Deploying","href":"/cado-host/deploy","docId":"cado-host/deploy","unlisted":false},{"type":"link","label":"Collected Artifacts","href":"/cado-host/artifacts","docId":"cado-host/artifacts","unlisted":false},{"type":"link","label":"AWS Credentials","href":"/cado-host/aws-credentials","docId":"cado-host/aws-credentials","unlisted":false},{"type":"link","label":"Azure Credentials","href":"/cado-host/azure-credentials","docId":"cado-host/azure-credentials","unlisted":false},{"type":"link","label":"Google Cloud Credentials","href":"/cado-host/google-credentials","docId":"cado-host/google-credentials","unlisted":false}]},{"type":"category","label":"Troubleshooting","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"FAQs","href":"/troubleshooting/faq","docId":"troubleshooting/faq","unlisted":false}]},{"type":"category","label":"License Agreements","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Commercial EULA","href":"/eula/commercial-eula","docId":"eula/commercial-eula","unlisted":false},{"type":"link","label":"Community Edition EULA","href":"/eula/community-eula","docId":"eula/community-eula","unlisted":false}]},{"type":"category","label":"Support Bulletins","collapsible":true,"collapsed":true,"items":[{"type":"link","label":"Sep 23 2022 - AWS Role Update","href":"/support-bulletins/role-update","docId":"support-bulletins/role-update","unlisted":false}]},{"type":"link","label":"Release Notes","href":"/release-notes/","docId":"release-notes/release-notes","unlisted":false}]},"docs":{"cado-host/artifacts":{"id":"cado-host/artifacts","title":"Collected Artifacts","description":"Cado Host collects a number of artifacts by default, based on the operating system. Note that you can configure additonal files and folders to be collected by defining the --additionalfiles parameter when running Cado Host. See the --additionalfiles Command Line Parameters for more details.","sidebar":"tutorialSidebar"},"cado-host/aws-credentials":{"id":"cado-host/aws-credentials","title":"AWS Credentials","description":"We now recommend using the automatically created temporary credentials generated by Cado Response. See our documentation here for more details.","sidebar":"tutorialSidebar"},"cado-host/azure-credentials":{"id":"cado-host/azure-credentials","title":"Azure Credentials","description":"We now recommend using the automatically created temporary credentials generated by Cado Response. See our documentation here for more details.","sidebar":"tutorialSidebar"},"cado-host/deploy":{"id":"cado-host/deploy","title":"Deploying","description":"You can execute Cado Host individually on a device or you can deploy it to a number of machines that may be compromised, for example through Group Policy or other systems management software.","sidebar":"tutorialSidebar"},"cado-host/google-credentials":{"id":"cado-host/google-credentials","title":"Google Cloud Credentials","description":"To create secure credentials for Google Cloud Storage, perform the following. You can also watch the embedded video, which walks through the process.\u200b","sidebar":"tutorialSidebar"},"cado-host/intro":{"id":"cado-host/intro","title":"Summary","description":"Cado Host is a solution to acquire forensic artifacts from systems and place them into cloud storage, enabling you to perform a quick triage investigation of a target system.","sidebar":"tutorialSidebar"},"cado-response/community-edition/community-intro":{"id":"cado-response/community-edition/community-intro","title":"Summary","description":"The Cado platform platform leverages the scale, speed and automation of the cloud to expedite investigation and response. Cado Community Edition is a free version of the Cado platform that lets you analyze:","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/data-encryption/aws-kms":{"id":"cado-response/deploy/aws/data-encryption/aws-kms","title":"KMS Support","description":"The Cado platform will import EC2 instances with encrypted volumes, provided that the appropriate permissions are given to the CadoResponseRole.","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/data-encryption/data-encryption-overview":{"id":"cado-response/deploy/aws/data-encryption/data-encryption-overview","title":"Overview","description":"During deployment, by default, an S3 bucket, a VPC and a Subnet are created for use by the Cado solution. From an access and security perspective, the S3 Bucket is encrypted with server-side encryption using AES256 and attached volumes are also encrypted using KMS. We recommend you enable key rotation as well (https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html). The default VPC and Subnet create an isolated environment to which customers can control access rights. When processing data, the Cado worker instances are launched within the same VPC as the main Cado instance. Worker instances are started using the same AMI as the main Cado instance as well.","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/iam/cross-account-creation":{"id":"cado-response/deploy/aws/iam/cross-account-creation","title":"Cross Account Creation","description":"The Cado platform can access resources across multiple AWS accounts. For instance, if you manage 100 AWS accounts, you can deploy Cado in a single AWS account and then grant the Cado platform access to all other AWS accounts, enabling the platform to acquire, process, and analyze evidence from all AWS accounts seamlessly.","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/iam/deployment-iam-considerations":{"id":"cado-response/deploy/aws/iam/deployment-iam-considerations","title":"Overview","description":"There are several AWS Identity & Access Management best practices to consider when deploying the Cado platform","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/iam/tightening-iam":{"id":"cado-response/deploy/aws/iam/tightening-iam","title":"Removing and Tightening IAM Permissions","description":"Removing and Tightening IAM Permissions","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/logging":{"id":"cado-response/deploy/aws/logging","title":"Logging","description":"We recommend customers follow AWS best practices regarding logging (https","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/networking/aws-load-balancer":{"id":"cado-response/deploy/aws/networking/aws-load-balancer","title":"Load Balancer","description":"An Application Load Balancer can be placed in front of the Cado web server in order to provide a valid HTTPS connection and add a Web Application Firewall. This can be configured via the provided Terraform or Cloudformation deployment scripts.","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/networking/internet-routable-addresses":{"id":"cado-response/deploy/aws/networking/internet-routable-addresses","title":"Private IP Addresses","description":"By default, the Cado platform deploys into its own VPC with an allow-list of known good IP Addresses set by the user. Public IPv4 addresses are assigned to the main Cado platform to enable a user to connect with their web browser, and are also assigned to workers to allow them to connect to required AWS services e.g. s3.amazonaws.com.","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/overview":{"id":"cado-response/deploy/aws/overview","title":"Overview","description":"AWS Deployment Overview","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/performance-resiliency/aws-backups":{"id":"cado-response/deploy/aws/performance-resiliency/aws-backups","title":"Backups and Recovery","description":"Backup and Recovery","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/performance-resiliency/high-availability":{"id":"cado-response/deploy/aws/performance-resiliency/high-availability","title":"High Availability","description":"The Cado platform can be deployed in AWS in full high availability mode.","sidebar":"tutorialSidebar"},"cado-response/deploy/aws/performance-resiliency/large-aws-imports":{"id":"cado-response/deploy/aws/performance-resiliency/large-aws-imports","title":"Large EC2 Imports","description":"Importing AWS EC2 instances with disks over 500GB can start to reach limitations in AWS.","sidebar":"tutorialSidebar"},"cado-response/deploy/azure/azure-cross-tenancy-subscriptions":{"id":"cado-response/deploy/azure/azure-cross-tenancy-subscriptions","title":"Cross Subscription and Tenancy","description":"Setting up an app registration for cross tenancy/subcription acquisitions","sidebar":"tutorialSidebar"},"cado-response/deploy/azure/azure-deploy":{"id":"cado-response/deploy/azure/azure-deploy","title":"Overview","description":"Azure Deployment Overview","sidebar":"tutorialSidebar"},"cado-response/deploy/gcp/gcp-auto-setup":{"id":"cado-response/deploy/gcp/gcp-auto-setup","title":"Automated Setup","description":"To streamline the process of configuring your GCP environment ready for Cado, this page details how to use our GCP Setup Scripts.","sidebar":"tutorialSidebar"},"cado-response/deploy/gcp/gcp-cross-project":{"id":"cado-response/deploy/gcp/gcp-cross-project","title":"Cross-Project Setup","description":"After creating the service account, enabling Cloud Build and other relevant APIs, and setting up the Primary GCP Project as discussed in the Overview, we can use these principals to import from other GCP projects under the same service acount.","sidebar":"tutorialSidebar"},"cado-response/deploy/gcp/gcp-deploy":{"id":"cado-response/deploy/gcp/gcp-deploy","title":"GCP Deployment (Beta)","description":"GCP Deployment Overview","sidebar":"tutorialSidebar"},"cado-response/deploy/gcp/gcp-settings":{"id":"cado-response/deploy/gcp/gcp-settings","title":"GCP Settings","description":"You can acquire compute and storage resources from GCP with the Cado platform by","sidebar":"tutorialSidebar"},"cado-response/deploy/intro":{"id":"cado-response/deploy/intro","title":"Deployment Options","description":"The Cado platform can be deployed in either AWS or Azure.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/automation":{"id":"cado-response/discovery-import/automation","title":"Automation Rules (Beta)","description":"This feature is currently in beta - to enable this feature go to Settings > Experiments","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/aws-ami":{"id":"cado-response/discovery-import/import/aws/aws-ami","title":"AMI, EBS Snapshot and Volume","description":"The Cado platform supports acquiring AMIs, EBS Snapshots or volumes of machines, either by using a cross account role, or directly sharing the image/snapshot with the Cado AWS account. If sharing an AMI, you will need to select the option to share the underlying Snapshots (\\"Edit AMI Permissions\\" > Tick \\"Add \'Create volume\' permission\\"). For more information, see Share an Amazon EBS snapshot.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/aws-ec2":{"id":"cado-response/discovery-import/import/aws/aws-ec2","title":"EC2 and EBS","description":"Cado supports acquisition of EC2 instances. Select the region, and this will populate a list of EC2 instances available. You can filter the list of instances and buckets by instance ID, name, state or public IP address. Select the instance you wish to acquire.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/aws-ecs":{"id":"cado-response/discovery-import/import/aws/aws-ecs","title":"ECS","description":"The Cado platform will collect key logs and forensic artifacts from AWS ECS systems.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/aws-eks":{"id":"cado-response/discovery-import/import/aws/aws-eks","title":"EKS","description":"The Cado platform will collect key logs and forensic artifacts containers running in an AWS EKS cluster.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/aws-lambda":{"id":"cado-response/discovery-import/import/aws/aws-lambda","title":"Lambda","description":"The Cado platform can acquire AWS Lambda functions which are serverless computing services.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/aws-lightsail":{"id":"cado-response/discovery-import/import/aws/aws-lightsail","title":"Lightsail","description":"First create a snapshot of the Lightsail instance you want to import:","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/aws-s3":{"id":"cado-response/discovery-import/import/aws/aws-s3","title":"S3","description":"The Cado platform supports acquistion of data from AWS S3 buckets. The two main use cases for this are:","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/memory":{"id":"cado-response/discovery-import/import/aws/memory","title":"AWS Memory Analysis","description":"You can acquire memory of Linux systems in EC2 by using the \\"Triage Acquisition\\" option under Import > EC2:","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/aws/monitoring":{"id":"cado-response/discovery-import/import/aws/monitoring","title":"Monitoring for Snapshots and Volumes","description":"You can monitor for Snapshots and Volumes created within an account.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/azure/azure-aks":{"id":"cado-response/discovery-import/import/azure/azure-aks","title":"Azure Kubernetes Service","description":"The Cado platform will collect key logs and forensic artifacts from Azure Kubernetes Service containers.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/azure/azure-compute":{"id":"cado-response/discovery-import/import/azure/azure-compute","title":"Azure Compute","description":"The Cado platform supports acquisition of Azure Compute instances. Select an Azure subscription, and this will populate a list of available instances. Select the instance to import, review the details and click on \'Start Import\'","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/azure/azure-storage":{"id":"cado-response/discovery-import/import/azure/azure-storage","title":"Azure Storage","description":"The Cado platform supports acquistion of data from Azure Blob Storage. The two main use cases for this are:","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/data-types/filetypes":{"id":"cado-response/discovery-import/import/data-types/filetypes","title":"File Types","description":"The Cado platform supports the processing of a wide range of evidence types. These may differ slightly based on your cloud platform.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/data-types/import-types":{"id":"cado-response/discovery-import/import/data-types/import-types","title":"Supported Import Types","description":"Import Types","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/data-types/logs":{"id":"cado-response/discovery-import/import/data-types/logs","title":"Log Types","description":"Cado Response supports the processing of a wide range of evidence types. These may differ slightly based on your cloud platform.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/data-types/memory":{"id":"cado-response/discovery-import/import/data-types/memory","title":"Memory Analysis","description":"You can perform a memory acquisition of a Windows or Linux system using Cado Host by clicking Import > Forensic Artifacts and running the pre-generated script on the host device. Process memory collection is not currently supported on OSX.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/gcp/engine-instance":{"id":"cado-response/discovery-import/import/gcp/engine-instance","title":"Google Compute Engine","description":"The Cado platform supports acquisition of GCP Compute instances. Select the GCP project and bucket where you can upload the image prior to importing it into the Cado platform.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/gcp/kubernetes-engine":{"id":"cado-response/discovery-import/import/gcp/kubernetes-engine","title":"Google Cloud Kubernetes Engine","description":"The Cado platform will collect key logs and forensic artifacts from Google Cloud Kubernetes Engine containers.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/gcp/storage":{"id":"cado-response/discovery-import/import/gcp/storage","title":"Google Cloud Storage","description":"The Cado platform supports acquistion of data from GCP Storage Buckets. The two main use cases for this are:","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/import-from-cloud":{"id":"cado-response/discovery-import/import/import-from-cloud","title":"Import from Cloud","description":"To import data from the cloud you need to have access configured to the cloud account/subscription/project where the data resides. Learn more on how to add credentials to the Cado Platform for AWS, Azure, and GCP.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/intro":{"id":"cado-response/discovery-import/import/intro","title":"Overview","description":"There are a number of options for importing data into the Cado platform. Once you select the data you would like to import, the Cado platform begins processing the data based on the platforms Processing Settings. Check out our help section on Processing Settings for more details.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/openshift/openshift":{"id":"cado-response/discovery-import/import/openshift/openshift","title":"RedHat Openshift","description":"First, generate a collection script using Cado Host under Import > Cado Host.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/import/oracle/virtual-machine":{"id":"cado-response/discovery-import/import/oracle/virtual-machine","title":"Oracle Cloud Virtual Machines","description":"First, you need to take a clone of the instance boot volume. Note that this will affect the instance as it performs a shutdown task and will restart the instance on completion.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/intro":{"id":"cado-response/discovery-import/intro","title":"Overview","description":"Getting Started with CTF Data","sidebar":"tutorialSidebar"},"cado-response/discovery-import/projects":{"id":"cado-response/discovery-import/projects","title":"Managing Projects","description":"Cado groups evidence items into projects.","sidebar":"tutorialSidebar"},"cado-response/discovery-import/readiness":{"id":"cado-response/discovery-import/readiness","title":"Readiness (Beta)","description":"Readiness is a powerful tool designed to help you identify and address issues related to the acquisition of workloads within your environments. It provides a centralised platform for tracking these issues and assigns a readiness score to each environment, giving you a quick overview of the health of your workload acquisition process.","sidebar":"tutorialSidebar"},"cado-response/export/intro":{"id":"cado-response/export/intro","title":"Exporting Data","description":"Exporting Data from Cado Response","sidebar":"tutorialSidebar"},"cado-response/intro":{"id":"cado-response/intro","title":"Summary","description":"Data is moving to the cloud. Cyber attackers are moving to the cloud. Yet when security teams need to investigate a threat in a modern environment, it\u2019s incredibly complex and time consuming. The Cado platform leverages the scale, speed and automation of the cloud to expedite investigation and response.","sidebar":"tutorialSidebar"},"cado-response/investigate/ai investigator":{"id":"cado-response/investigate/ai investigator","title":"AI Investigator","description":"Cado AI Investigator","sidebar":"tutorialSidebar"},"cado-response/investigate/automated-investigation":{"id":"cado-response/investigate/automated-investigation","title":"Automated Investigation","description":"The Automated Investigation tab provides a summary of what Cado has determined during its investigation.","sidebar":"tutorialSidebar"},"cado-response/investigate/browse-disk":{"id":"cado-response/investigate/browse-disk","title":"Browse Disk","description":"When you select a piece of disk evidence in the Project Overview tab, a Browse Disk Tab will appear.","sidebar":"tutorialSidebar"},"cado-response/investigate/detections":{"id":"cado-response/investigate/detections","title":"Detections","description":"Setting Up Detections","sidebar":"tutorialSidebar"},"cado-response/investigate/evidence":{"id":"cado-response/investigate/evidence","title":"Evidence","description":"The Evidence tab is a focused view of the data that has been collected as part of this project, and the current processing status of that data. Clicking on the menu icon to the right of a piece of evidence allows you to delete that piece of evidence.","sidebar":"tutorialSidebar"},"cado-response/investigate/indicators":{"id":"cado-response/investigate/indicators","title":"Indicators","description":"The Indicators tab shows which Alarms and Suspicious Indicators were found in which piece of evidence","sidebar":"tutorialSidebar"},"cado-response/investigate/intro":{"id":"cado-response/investigate/intro","title":"Investigate","description":"Evidence is processed into Projects and investigation starts by analyzing the project evidence. The project view provides an overview of the key information for all evidence items in a given project.","sidebar":"tutorialSidebar"},"cado-response/investigate/key-events":{"id":"cado-response/investigate/key-events","title":"Key Events, Alarms & Suspicious","description":"Cado parses events from evidence items. These events may have times associated with them. They may also be tagged as Alarm, which indicates a high likelihood of malicious activity, or Suspicious, which indicates a lower likelihood of malicious activity.","sidebar":"tutorialSidebar"},"cado-response/investigate/network":{"id":"cado-response/investigate/network","title":"Network","description":"This tab shows connections between systems identified in processed evidence and the number of timeline events associated with them","sidebar":"tutorialSidebar"},"cado-response/investigate/timeline-search":{"id":"cado-response/investigate/timeline-search","title":"Timeline Search","description":"The Cado platform includes an advanced search interface which supports complex queries.","sidebar":"tutorialSidebar"},"cado-response/key-concepts":{"id":"cado-response/key-concepts","title":"Key Concepts","description":"Below we describe some of the key concepts in the Cado platform.","sidebar":"tutorialSidebar"},"cado-response/manage/cost-management":{"id":"cado-response/manage/cost-management","title":"Cost Management","description":"You can view the AWS Cost Calculator for a typical Cado installation at https://calculator.s3.amazonaws.com/index.html#r=IAD&key=files/calc-bca484373bcb2d07322fd6716a197d1cdc629534&v=ver20210903uJ","sidebar":"tutorialSidebar"},"cado-response/manage/data":{"id":"cado-response/manage/data","title":"Data Management","description":"There are several considerations for managing data from the Cado platform","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/api-overview":{"id":"cado-response/manage/integrations/api-overview","title":"Overview & API","description":"The Cado API enables third party tools and automation scripts to integrate with the Cado platform.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/aws-lambda":{"id":"cado-response/manage/integrations/aws-lambda","title":"GuardDuty via Lambda","description":"The Cado platform can integrate with other AWS Services through AWS Lambda.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/sandbox/intelix":{"id":"cado-response/manage/integrations/sandbox/intelix","title":"SophosLabs Intelix","description":"The Cado platform automates the acquisition of cloud systems with zero impact. When combined with a malware analysis platform, like SophosLabs Intelix, security analysts can submit files for analysis and use malware findings as an investigation pivot point.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/siem":{"id":"cado-response/manage/integrations/siem","title":"SIEM","description":"SIEM (Security Information and Event Management) is a tool that provides real-time analysis of security events generated by applications and network hardware - an essential capability for SecOps teams to correlate events and logs from different systems and manage risks more wisely. The integration with the Cado platform leverages the power of SIEM systems with Cado\u2019s unique forensics value in the cloud.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/soar/cortex-xsoar":{"id":"cado-response/manage/integrations/soar/cortex-xsoar","title":"Cortex XSOAR","description":"Cortex XSOAR is a powerful Security Orchestration, Automation, and Response (SOAR) system. XSOAR allows SoC teams to organize cases, incidents and automate investigation rapidly using a central War Room for collaboration. By integrating Cado with XSOAR, you\'re going to increase efficiency and productive by automating Cado\'s powerful data acquisition and processing.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/soar/splunk-soar":{"id":"cado-response/manage/integrations/soar/splunk-soar","title":"Splunk SOAR","description":"Splunk SOAR is a Security Orchestration, Automation, and Response (SOAR) system. The Splunk SOAR platform combines security infrastructure orchestration, playbook automation, and case management capabilities to integrate your team, processes, and tools together including integrating with Cado.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/soar/tines":{"id":"cado-response/manage/integrations/soar/tines","title":"Tines","description":"Tines is a no-code automation platform for security analysts. Tines allows analysts to spend less time on routine repetitive tasks and allow them to focus on those areas where they can have the most impact. The tools feature pre-configured integrations with a variety of business and security tools, but for more sophisticated users, it also features the ability to hook into any publicly available API, including the Cado API.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/webhooks":{"id":"cado-response/manage/integrations/webhooks","title":"Webhooks","description":"A webhook integration allows you to automatically send information from the Cado platform to another application using a unique URL.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/xdr/crowdstrike":{"id":"cado-response/manage/integrations/xdr/crowdstrike","title":"CrowdStrike","description":"Integrating with CrowdStrike Falcon allows you to select and kick off triage acquisition on hosts with the Falcon Sensor installed using CrowdStrike Real Time Response.","sidebar":"tutorialSidebar"},"cado-response/manage/integrations/xdr/sentinelone":{"id":"cado-response/manage/integrations/xdr/sentinelone","title":"SentinelOne","description":"SentinelOne Singularity provides comprehensive visibility across your environment - giving you the breadth you need to detect malicious activity as soon as it occurs. Cado streamlines forensic analysis to quickly deliver essential historical context and depth to your investigation allowing you to quickly identify the root cause. Combined, the SentinelOne and Cado integration empowers organizations to detect, investigate, and remediate breaches with unmatched speed.","sidebar":"tutorialSidebar"},"cado-response/manage/licenses":{"id":"cado-response/manage/licenses","title":"Applying a License","description":"In order to use the Cado platform, you must upload a valid license.","sidebar":"tutorialSidebar"},"cado-response/manage/logging-in":{"id":"cado-response/manage/logging-in","title":"Logging In","description":"Depending on the cloud provider in which you deployed the Cado platform, navigate to either your AWS Console or your Azure Portal and find the Public IPv4 address of your running Cado instance. Open a browser and navigate to https:// where `` is the IPv4 of the Cado instance. You will now be able to log into the platform.","sidebar":"tutorialSidebar"},"cado-response/manage/monitoring":{"id":"cado-response/manage/monitoring","title":"Health Monitoring","description":"Within the Cado platform, you can see the platform health and statistics by navigating to the \\"Platform\\" tab. This list Free Disk Space, Available Memory, Total Memory, CPU Usage and pipeline processing details. In addition, roundtrip response latency for the API /api/v2/status endpoint should be less than or equal to 200ms.","sidebar":"tutorialSidebar"},"cado-response/manage/updating":{"id":"cado-response/manage/updating","title":"Updating","description":"You can view version information and trigger updates by clicking Updates from the Settings menu.","sidebar":"tutorialSidebar"},"cado-response/manage/users-authentication/sso/azure-ad":{"id":"cado-response/manage/users-authentication/sso/azure-ad","title":"Azure AD","description":"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.","sidebar":"tutorialSidebar"},"cado-response/manage/users-authentication/sso/okta":{"id":"cado-response/manage/users-authentication/sso/okta","title":"Okta OAuth","description":"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.","sidebar":"tutorialSidebar"},"cado-response/manage/users-authentication/sso/okta_saml":{"id":"cado-response/manage/users-authentication/sso/okta_saml","title":"Okta SAML","description":"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.","sidebar":"tutorialSidebar"},"cado-response/manage/users-authentication/sso/ping_saml":{"id":"cado-response/manage/users-authentication/sso/ping_saml","title":"Ping SAML","description":"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.","sidebar":"tutorialSidebar"},"cado-response/manage/users-authentication/users":{"id":"cado-response/manage/users-authentication/users","title":"Managing Users","description":"In the Cado platform you can grant access only to the data to which they need access - to both processed data within the platform, and resources or raw data residing in the cloud.","sidebar":"tutorialSidebar"},"cado-response/manage/workers":{"id":"cado-response/manage/workers","title":"Worker Management","description":"This section covers the options available for managing workers spun up during processing jobs. These settings can be accessed under Settings > General Settings","sidebar":"tutorialSidebar"},"eula/commercial-eula":{"id":"eula/commercial-eula","title":"Commercial EULA","description":"FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, DOCUMENT A - END USER LICENSE AGREEMENT SHALL APPLY.","sidebar":"tutorialSidebar"},"eula/community-eula":{"id":"eula/community-eula","title":"Community Edition EULA","description":"FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, DOCUMENT A - END USER LICENSE AGREEMENT SHALL APPLY.","sidebar":"tutorialSidebar"},"release-notes/release-notes":{"id":"release-notes/release-notes","title":"Release Notes","description":"Latest release notes","sidebar":"tutorialSidebar"},"support-bulletins/role-update":{"id":"support-bulletins/role-update","title":"Sep 23 2022 - AWS Role Update","description":"On Sep 21st, 2022 AWS announced a change with immediate effect to AWS roles that affects the operation of the Cado platform. These new changes mean that any Cado installation deployed after June 30th will no longer operate correctly, including not being able to initialize new workers for data acquisition or processing.","sidebar":"tutorialSidebar"},"troubleshooting/faq":{"id":"troubleshooting/faq","title":"FAQs","description":"Solutions to some common questions can be found here. If you can\'t find your answer, please reach out to support@cadosecurity.com and let us know.","sidebar":"tutorialSidebar"}}}')}}]); \ No newline at end of file diff --git a/assets/js/96218945.51d05f82.js b/assets/js/96218945.51d05f82.js deleted file mode 100644 index 5b52c911a..000000000 --- a/assets/js/96218945.51d05f82.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7715],{1717:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>p,frontMatter:()=>r,metadata:()=>i,toc:()=>d});var n=o(5893),s=o(1151);const r={title:"Exporting Data",hide_title:!0,sidebar_position:1},a=void 0,i={id:"cado-response/export/intro",title:"Exporting Data",description:"Exporting Data from Cado Response",source:"@site/docs/cado-response/export/intro.md",sourceDirName:"cado-response/export",slug:"/cado-response/export/intro",permalink:"/cado-response/export/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/export/intro.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Exporting Data",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Oracle Cloud Virtual Machines",permalink:"/cado-response/discovery-import/import/oracle/virtual-machine"},next:{title:"Investigate",permalink:"/cado-response/investigate/intro"}},c={},d=[{value:"Exporting Data from Cado Response",id:"exporting-data-from-cado-response",level:2},{value:"Exporting Collected Disk Images and Raw Data to Forensic Tools",id:"exporting-collected-disk-images-and-raw-data-to-forensic-tools",level:4},{value:"Exporting Processed Data to SIEM Platforms",id:"exporting-processed-data-to-siem-platforms",level:4}];function l(e){const t={a:"a",h2:"h2",h4:"h4",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h2,{id:"exporting-data-from-cado-response",children:"Exporting Data from Cado Response"}),"\n",(0,n.jsx)(t.p,{children:"Cado Response is designed to be an open platform to import and export data from."}),"\n",(0,n.jsx)(t.h4,{id:"exporting-collected-disk-images-and-raw-data-to-forensic-tools",children:"Exporting Collected Disk Images and Raw Data to Forensic Tools"}),"\n",(0,n.jsx)(t.p,{children:"We collect:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"AWS EC2 systems in DD format"}),"\n",(0,n.jsx)(t.li,{children:"Azure Virtual Machines in VHD format"}),"\n",(0,n.jsx)(t.li,{children:"GCP Instances in VMDK format"}),"\n",(0,n.jsx)(t.li,{children:"Cado Host Triage captures (and captures from Containers) in a Zip format\nIn to storage (S3 in AWS, Storage in Azure)."}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"These formats can be downloaded from the relevant cloud console and imported into desktop forensic tools such as:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.a,{href:"https://www.magnetforensics.com/products/magnet-axiom/",children:"https://www.magnetforensics.com/products/magnet-axiom/"})," (See also ",(0,n.jsx)(t.a,{href:"https://www.magnetforensics.com/docs/axiom/html/Content/en-us/acquire-cloud/acquire-amazon-s3.htm",children:"How to import from S3"}),")"]}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://www.x-ways.net/forensics/",children:"https://www.x-ways.net/forensics/"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://www.opentext.com/products/encase-forensic",children:"https://www.opentext.com/products/encase-forensic"})}),"\n"]}),"\n",(0,n.jsx)(t.h4,{id:"exporting-processed-data-to-siem-platforms",children:"Exporting Processed Data to SIEM Platforms"}),"\n",(0,n.jsxs)(t.p,{children:["Please see ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"/cado-response/manage/integrations/siem",children:"SIEM Integrations >"})})]})]})}function p(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},1151:(e,t,o)=>{o.d(t,{Z:()=>i,a:()=>a});var n=o(7294);const s={},r=n.createContext(s);function a(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/96218945.87b1cc45.js b/assets/js/96218945.87b1cc45.js new file mode 100644 index 000000000..c021dc008 --- /dev/null +++ b/assets/js/96218945.87b1cc45.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7715],{1717:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>l,frontMatter:()=>r,metadata:()=>i,toc:()=>d});var n=o(5893),s=o(1151);const r={title:"Exporting Data",hide_title:!0,sidebar_position:1},a=void 0,i={id:"cado-response/export/intro",title:"Exporting Data",description:"Exporting Data from Cado Response",source:"@site/docs/cado-response/export/intro.md",sourceDirName:"cado-response/export",slug:"/cado-response/export/intro",permalink:"/cado-response/export/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/export/intro.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Exporting Data",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"RedHat Openshift",permalink:"/cado-response/discovery-import/import/openshift/"},next:{title:"Investigate",permalink:"/cado-response/investigate/intro"}},c={},d=[{value:"Exporting Data from Cado Response",id:"exporting-data-from-cado-response",level:2},{value:"Exporting Collected Disk Images and Raw Data to Forensic Tools",id:"exporting-collected-disk-images-and-raw-data-to-forensic-tools",level:4},{value:"Exporting Processed Data to SIEM Platforms",id:"exporting-processed-data-to-siem-platforms",level:4}];function p(e){const t={a:"a",h2:"h2",h4:"h4",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h2,{id:"exporting-data-from-cado-response",children:"Exporting Data from Cado Response"}),"\n",(0,n.jsx)(t.p,{children:"Cado Response is designed to be an open platform to import and export data from."}),"\n",(0,n.jsx)(t.h4,{id:"exporting-collected-disk-images-and-raw-data-to-forensic-tools",children:"Exporting Collected Disk Images and Raw Data to Forensic Tools"}),"\n",(0,n.jsx)(t.p,{children:"We collect:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsx)(t.li,{children:"AWS EC2 systems in DD format"}),"\n",(0,n.jsx)(t.li,{children:"Azure Virtual Machines in VHD format"}),"\n",(0,n.jsx)(t.li,{children:"GCP Instances in VMDK format"}),"\n",(0,n.jsx)(t.li,{children:"Cado Host Triage captures (and captures from Containers) in a Zip format\nIn to storage (S3 in AWS, Storage in Azure)."}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"These formats can be downloaded from the relevant cloud console and imported into desktop forensic tools such as:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.a,{href:"https://www.magnetforensics.com/products/magnet-axiom/",children:"https://www.magnetforensics.com/products/magnet-axiom/"})," (See also ",(0,n.jsx)(t.a,{href:"https://www.magnetforensics.com/docs/axiom/html/Content/en-us/acquire-cloud/acquire-amazon-s3.htm",children:"How to import from S3"}),")"]}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://www.x-ways.net/forensics/",children:"https://www.x-ways.net/forensics/"})}),"\n",(0,n.jsx)(t.li,{children:(0,n.jsx)(t.a,{href:"https://www.opentext.com/products/encase-forensic",children:"https://www.opentext.com/products/encase-forensic"})}),"\n"]}),"\n",(0,n.jsx)(t.h4,{id:"exporting-processed-data-to-siem-platforms",children:"Exporting Processed Data to SIEM Platforms"}),"\n",(0,n.jsxs)(t.p,{children:["Please see ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"/cado-response/manage/integrations/siem",children:"SIEM Integrations >"})})]})]})}function l(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(p,{...e})}):p(e)}},1151:(e,t,o)=>{o.d(t,{Z:()=>i,a:()=>a});var n=o(7294);const s={},r=n.createContext(s);function a(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/97af6bc6.02ed1073.js b/assets/js/97af6bc6.02ed1073.js deleted file mode 100644 index 069d5703f..000000000 --- a/assets/js/97af6bc6.02ed1073.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8399],{5915:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>c,contentTitle:()=>i,default:()=>p,frontMatter:()=>o,metadata:()=>a,toc:()=>d});var t=n(5893),r=n(1151);const o={title:"Worker Management",hide_title:!0,sidebar_position:6},i="Worker Management",a={id:"cado-response/manage/workers",title:"Worker Management",description:"This section covers the options available for managing workers spun up during processing jobs. These settings can be accessed under Settings > General Settings",source:"@site/docs/cado-response/manage/workers.md",sourceDirName:"cado-response/manage",slug:"/cado-response/manage/workers",permalink:"/cado-response/manage/workers",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/workers.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:6,frontMatter:{title:"Worker Management",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"CrowdStrike",permalink:"/cado-response/manage/integrations/xdr/crowdstrike"},next:{title:"Data Management",permalink:"/cado-response/manage/data"}},c={},d=[{value:"Processing",id:"processing",level:2}];function l(e){const s={admonition:"admonition",code:"code",h1:"h1",h2:"h2",p:"p",strong:"strong",...(0,r.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"worker-management",children:"Worker Management"}),"\n",(0,t.jsxs)(s.p,{children:["This section covers the options available for managing workers spun up during processing jobs. These settings can be accessed under ",(0,t.jsx)(s.strong,{children:"Settings > General Settings"})]}),"\n",(0,t.jsx)(s.h2,{id:"processing",children:"Processing"}),"\n",(0,t.jsxs)(s.p,{children:["The ",(0,t.jsx)(s.strong,{children:"Maximum Workers"})," sets the maximum number of workers (AWS EC2 Instances) the system will start for processing. The platform will wait to launch new workers if this limit is exceeded. The default value is 20. The platform will also back off and wait if the AWS limits for the maximum number of VCPUs in a region have been exceeded."]}),"\n",(0,t.jsxs)(s.p,{children:["The ",(0,t.jsx)(s.strong,{children:"Worker Instance Size"})," limits the size of data that can be imported. The default setting in AWS (i3.4xlarge) has 1.9 TB of disk space, allowing the processing of disks up to approximately 1.5 TB in size. The default Azure setting allows the processing of disks up to approximately 800 GB in size. Please set a large instance size (see for AWS or Azure) to increase the working space."]}),"\n",(0,t.jsx)(s.admonition,{type:"tip",children:(0,t.jsxs)(s.p,{children:["In AWS, for most use cases, you should keep the Worker Instance Size set to a Storage Optimized instance, like an ",(0,t.jsx)(s.code,{children:"i3.4xlarge"})]})}),"\n",(0,t.jsxs)(s.p,{children:["The ",(0,t.jsx)(s.strong,{children:"Worker Shutdown Wait"})," is the number of seconds after a worker finishes processing a pipeline before it should shutdown. If nothing is set, the default is 5 minutes (300 seconds)."]})]})}function p(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},1151:(e,s,n)=>{n.d(s,{Z:()=>a,a:()=>i});var t=n(7294);const r={},o=t.createContext(r);function i(e){const s=t.useContext(o);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),t.createElement(o.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/97af6bc6.16af820d.js b/assets/js/97af6bc6.16af820d.js new file mode 100644 index 000000000..defd57381 --- /dev/null +++ b/assets/js/97af6bc6.16af820d.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8399],{5915:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>i,default:()=>p,frontMatter:()=>o,metadata:()=>a,toc:()=>d});var n=t(5893),r=t(1151);const o={title:"Worker Management",hide_title:!0,sidebar_position:6},i="Worker Management",a={id:"cado-response/manage/workers",title:"Worker Management",description:"This section covers the options available for managing workers spun up during processing jobs. These settings can be accessed under Settings > General Settings",source:"@site/docs/cado-response/manage/workers.md",sourceDirName:"cado-response/manage",slug:"/cado-response/manage/workers",permalink:"/cado-response/manage/workers",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/workers.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:6,frontMatter:{title:"Worker Management",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"CrowdStrike",permalink:"/cado-response/manage/integrations/xdr/crowdstrike"},next:{title:"Data Management",permalink:"/cado-response/manage/data"}},c={},d=[{value:"Processing",id:"processing",level:2}];function l(e){const s={admonition:"admonition",code:"code",h1:"h1",h2:"h2",p:"p",strong:"strong",...(0,r.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.h1,{id:"worker-management",children:"Worker Management"}),"\n",(0,n.jsxs)(s.p,{children:["This section covers the options available for managing workers spun up during processing jobs. These settings can be accessed under ",(0,n.jsx)(s.strong,{children:"Settings > General Settings"})]}),"\n",(0,n.jsx)(s.h2,{id:"processing",children:"Processing"}),"\n",(0,n.jsxs)(s.p,{children:["The ",(0,n.jsx)(s.strong,{children:"Maximum Workers"})," sets the maximum number of workers (AWS EC2 Instances) the system will start for processing. The platform will wait to launch new workers if this limit is exceeded. The default value is 20. The platform will also back off and wait if the AWS limits for the maximum number of VCPUs in a region have been exceeded."]}),"\n",(0,n.jsxs)(s.p,{children:["The ",(0,n.jsx)(s.strong,{children:"Worker Instance Size"})," limits the size of data that can be imported. The default setting in AWS (i3.4xlarge) has 1.9 TB of disk space, allowing the processing of disks up to approximately 1.5 TB in size. The default Azure setting allows the processing of disks up to approximately 800 GB in size. Please set a large instance size (see for AWS or Azure) to increase the working space."]}),"\n",(0,n.jsx)(s.admonition,{type:"tip",children:(0,n.jsxs)(s.p,{children:["In AWS, for most use cases, you should keep the Worker Instance Size set to a Storage Optimized instance, like an ",(0,n.jsx)(s.code,{children:"i3.4xlarge"})]})}),"\n",(0,n.jsxs)(s.p,{children:["The ",(0,n.jsx)(s.strong,{children:"Worker Shutdown Wait"})," is the number of seconds after a worker finishes processing a pipeline before it should shutdown. If nothing is set, the default is 5 minutes (300 seconds)."]})]})}function p(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},1151:(e,s,t)=>{t.d(s,{Z:()=>a,a:()=>i});var n=t(7294);const r={},o=n.createContext(r);function i(e){const s=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),n.createElement(o.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9bdcf68b.4ec82426.js b/assets/js/9bdcf68b.4ec82426.js deleted file mode 100644 index 618931582..000000000 --- a/assets/js/9bdcf68b.4ec82426.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7721],{5617:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>d});var n=i(5893),s=i(1151);const o={title:"Indicators",hide_title:!0,sidebar_position:5},a="Indicators",r={id:"cado-response/investigate/indicators",title:"Indicators",description:"The Indicators tab shows which Alarms and Suspicious Indicators were found in which piece of evidence",source:"@site/docs/cado-response/investigate/indicators.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/indicators",permalink:"/cado-response/investigate/indicators",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/indicators.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:5,frontMatter:{title:"Indicators",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Key Events, Alarms & Suspicious",permalink:"/cado-response/investigate/key-events"},next:{title:"Network",permalink:"/cado-response/investigate/network"}},c={},d=[];function p(e){const t={h1:"h1",img:"img",p:"p",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"indicators",children:"Indicators"}),"\n",(0,n.jsx)(t.p,{children:"The Indicators tab shows which Alarms and Suspicious Indicators were found in which piece of evidence"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Indicators Evidence Mapping",src:i(64).Z+"",width:"1510",height:"638"})}),"\n",(0,n.jsx)(t.p,{children:"The Matched Indicators table gives addition information about how Cado has decided that an indicator has been found"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Matched Indicators Table",src:i(7674).Z+"",width:"1498",height:"525"})})]})}function h(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(p,{...e})}):p(e)}},64:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/indicators-evidence-00be9c476d2b4de37be4d1b6dff2029d.png"},7674:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/matched-indicators-82f3c5b320f799456da578a53f9721c3.png"},1151:(e,t,i)=>{i.d(t,{Z:()=>r,a:()=>a});var n=i(7294);const s={},o=n.createContext(s);function a(e){const t=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),n.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9bdcf68b.f69e72b3.js b/assets/js/9bdcf68b.f69e72b3.js new file mode 100644 index 000000000..44d5e9112 --- /dev/null +++ b/assets/js/9bdcf68b.f69e72b3.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7721],{5617:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>d});var n=i(5893),s=i(1151);const o={title:"Indicators",hide_title:!0,sidebar_position:5},a="Indicators",r={id:"cado-response/investigate/indicators",title:"Indicators",description:"The Indicators tab shows which Alarms and Suspicious Indicators were found in which piece of evidence",source:"@site/docs/cado-response/investigate/indicators.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/indicators",permalink:"/cado-response/investigate/indicators",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/indicators.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:5,frontMatter:{title:"Indicators",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Key Events, Alarms & Suspicious",permalink:"/cado-response/investigate/key-events"},next:{title:"Network",permalink:"/cado-response/investigate/network"}},c={},d=[];function p(e){const t={h1:"h1",img:"img",p:"p",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"indicators",children:"Indicators"}),"\n",(0,n.jsx)(t.p,{children:"The Indicators tab shows which Alarms and Suspicious Indicators were found in which piece of evidence"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Indicators Evidence Mapping",src:i(64).Z+"",width:"1510",height:"638"})}),"\n",(0,n.jsx)(t.p,{children:"The Matched Indicators table gives addition information about how Cado has decided that an indicator has been found"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Matched Indicators Table",src:i(7674).Z+"",width:"1498",height:"525"})})]})}function h(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(p,{...e})}):p(e)}},64:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/indicators-evidence-00be9c476d2b4de37be4d1b6dff2029d.png"},7674:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/matched-indicators-82f3c5b320f799456da578a53f9721c3.png"},1151:(e,t,i)=>{i.d(t,{Z:()=>r,a:()=>a});var n=i(7294);const s={},o=n.createContext(s);function a(e){const t=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),n.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9e607239.5bd7dea7.js b/assets/js/9e607239.5bd7dea7.js new file mode 100644 index 000000000..014537f42 --- /dev/null +++ b/assets/js/9e607239.5bd7dea7.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4877],{3137:(e,t,i)=>{i.r(t),i.d(t,{Highlight:()=>c,assets:()=>l,contentTitle:()=>r,default:()=>p,frontMatter:()=>o,metadata:()=>a,toc:()=>d});var s=i(5893),n=i(1151);const o={title:"Overview",hide_title:!0,sidebar_position:1},r=void 0,a={id:"cado-response/deploy/aws/overview",title:"Overview",description:"AWS Deployment Overview",source:"@site/docs/cado-response/deploy/aws/overview.md",sourceDirName:"cado-response/deploy/aws",slug:"/cado-response/deploy/aws/overview",permalink:"/cado-response/deploy/aws/overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/overview.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Overview",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Deployment Options",permalink:"/cado-response/deploy/intro"},next:{title:"Overview",permalink:"/cado-response/deploy/aws/iam/deployment-iam-considerations"}},l={},d=[{value:"AWS Deployment Overview",id:"aws-deployment-overview",level:2},{value:"AWS CloudFormation Template",id:"aws-cloudformation-template",level:2},{value:"Parameters",id:"parameters",level:3},{value:"AWS CloudFormation High Availability",id:"aws-cloudformation-high-availability",level:2},{value:"Deployment Time",id:"deployment-time",level:3},{value:"AWS Terraform Deployment",id:"aws-terraform-deployment",level:3},{value:"Parameters",id:"parameters-1",level:3},{value:"Supported Regions",id:"supported-regions",level:3},{value:"AWS GovCloud",id:"aws-govcloud",level:2}],c=({children:e,color:t})=>{const i={span:"span",...(0,n.a)()};return(0,s.jsx)(i.span,{style:{backgroundColor:t,borderRadius:"2px",color:"#fff",padding:"0.2rem"},children:e})};function h(e){const t={a:"a",admonition:"admonition",br:"br",code:"code",em:"em",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h2,{id:"aws-deployment-overview",children:"AWS Deployment Overview"}),"\n",(0,s.jsx)(t.admonition,{type:"note",children:(0,s.jsxs)(t.p,{children:[(0,s.jsx)(t.strong,{children:"Intended Audience and Operating Environment Requirements:"}),"\n*This information is written for proficient AWS cloud administrators who are familiar with AWS technology and cloud operations. This manual assumes you already have an AWS account and are familiar with Amazon Web Services capabilites and terminology, including Cloudformation Templates, EC2s, Security Groups, VPCs, IAM roles and S3. For a list of supported AWS regions, please see our Markteplace listing: ",(0,s.jsx)(t.a,{href:"https://aws.amazon.com/marketplace/pp/prodview-2ol4yojhc5vpa?ref_=srh_res_product_title",children:"https://aws.amazon.com/marketplace/pp/prodview-2ol4yojhc5vpa?ref_=srh_res_product_title"})," *"]})}),"\n",(0,s.jsx)(t.p,{children:"Deployment of the Cado platform is performed within your AWS cloud environment either via a CloudFormation Template, a Terraform Script or via the AWS Marketplace. When the platform is deployed, it creates its own isolated VPC in which you can control who has access. From start to finish, you can be up and running in under 25 minutes."}),"\n",(0,s.jsxs)(t.p,{children:["By default AWS will limit the number of CPUs that can run in a region to 32. We recommend raising this limit to 128 CPU's to enable fast processing. You can do so by filling out ",(0,s.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-on-demand-instances.html#vcpu-limits-request-increase",children:"this form"}),' and requesting 128 vCPU for "Running On-Demand All Standard" instances.']}),"\n",(0,s.jsxs)(t.p,{children:["Cado consists of a few key components that interact with each other in order to provide the capabilities within the platform.",(0,s.jsx)(t.br,{}),"\n",(0,s.jsx)(t.img,{alt:"AWS architecture",src:i(6164).Z+"",width:"885",height:"476"})]}),"\n",(0,s.jsx)(t.h2,{id:"aws-cloudformation-template",children:"AWS CloudFormation Template"}),"\n",(0,s.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/aMQOitmPLeE",title:"Deploying with Cloudformation",frameborder:"0",allowfullscreen:!0}),"\n",(0,s.jsx)(t.p,{children:"To set up Cado in AWS you simply deploy our CloudFormation Template (CFT). The CFT steps you through the process of configuring the platform stack."}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["If you have signed up for a Free Trial or are working with the Cado Sales team already, you should receive a link to the Cado CloudFormation Template in order to get started. If you have not, reach out to ",(0,s.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})," for more details. Once you receive the link to the Cado CloudFormation Template, click the link to open the AWS CloudFormation Management Console."]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["On Step 1 (Specify template), do not change the default ",(0,s.jsx)(t.strong,{children:"Template is ready"})," and ",(0,s.jsx)(t.strong,{children:"Amazon S3 URL"})," settings. Click ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(c,{color:"#F78631",children:"Next"})})]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["On Step 2 (Specify stack details), give your stack an appropriate Stack Name, for example: ",(0,s.jsx)(t.code,{children:"CadoResponse"})," and enter the parameters as outlined below:"]}),"\n",(0,s.jsx)(t.h3,{id:"parameters",children:"Parameters"}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Parameter Name"}),(0,s.jsx)(t.th,{children:"Value"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"Instance type for Cado EC2 Server"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"t3a.xlarge"})}),(0,s.jsx)(t.td,{children:"For enterprise use we recommend at minimum a t3a.xlarge as the instance type."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"Key pair for Cado EC2 Server"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(choose your keypair)"})}),(0,s.jsx)(t.td,{children:"This key pair is used to enable SSH access to the Cado instance. This is not needed for normal operation, but is helpful should Cado Support ask for additional logs."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"Allowed source IP addresses for connection to SSH"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(enter ip range)"})}),(0,s.jsx)(t.td,{children:"Enter details of your IP address/ IP address ranges that will be used to connect to SSH services. The IPv4 address range is specified in the CIDR notation e.g. 192.168.0.1/24. It is strongly recommended following the principle of least privilege and restrict this to only those IPs needing SSH access"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"Allowed source IP addresses for connection to HTTPS"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(enter ip range)"})}),(0,s.jsx)(t.td,{children:"Enter details of your IP address/ IP address ranges that will be used to connect to HTTPS services. The IPv4 address range is specified in the CIDR notation e.g. 192.168.0.1/24. It is strongly recommended following the principle of least privilege and restrict this to only those IPs needing HTTPS access"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"VPC CIDR"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(enter ip range)"})}),(0,s.jsx)(t.td,{children:"The Subnet the Cado VPC will use. Specify the IPv4 address range as a Classless Inter-Domain Routing (CIDR) block."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"EFSArchive"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"AFTER_30_DAYS"})}),(0,s.jsx)(t.td,{children:"EFS - move data to infrequent storage after X days."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"InstanceVolumeSize"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"1000"})}),(0,s.jsx)(t.td,{children:"EC2 instance volume required in GBit."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"S3ArchiveTime"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"30"})}),(0,s.jsx)(t.td,{children:"Move S3 data to s3 glacier storage if not used after X days"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"S3GlacierDelete"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"365"})}),(0,s.jsx)(t.td,{children:"Delete S3 glacier storage data after X days."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"AvailabilityZoneA"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(choose your AZ)"})}),(0,s.jsx)(t.td,{children:"The Availability Zone used by the primary subnet."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"AvailabilityZoneB"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(choose your AZ)"})}),(0,s.jsx)(t.td,{children:"The Availability Zone used by the secondary subnet."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"FeatureFlagPlatformUpgrade"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"True"})}),(0,s.jsx)(t.td,{children:"Enables the platform to perform native upgrades."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"FeatureFlagDeployWithALB"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"False"})}),(0,s.jsx)(t.td,{children:"Deploys the platform with an Application Load Balancer. If set to True CertificateARN MUST be populated"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"CertificateARN"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(enter certificate arn)"})}),(0,s.jsx)(t.td,{children:"The ARN of the Certificate that will be assigned to the Application Load Balancer. Not used unless FeatureFlagDeployWithALB is True"})]})]})]}),"\n",(0,s.jsx)(t.admonition,{type:"tip",children:(0,s.jsx)(t.p,{children:"We recommend a minimum setting of 500GB for InstanceVolumeSize. The instance will roughly need to be sized to be 20% of the amount of data you intend to be on the platform at once. For example, to have 5TB of disk images imported you will need approximately 1000GB of disk space. Projects can always be deleted to recover space."})}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["Click ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(c,{color:"#F78631",children:"Next"})})]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["On Step 3 (Configure stack options), click ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(c,{color:"#F78631",children:"Next"})})," again (unless you require custom settings). If you require custom settings, please contact Cado Security"]}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Step 3",src:i(517).Z+"",width:"242",height:"315"})}),"\n",(0,s.jsx)(t.admonition,{type:"info",children:(0,s.jsxs)(t.p,{children:["For more information on available stack options, see ",(0,s.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-add-tags.html",children:"AWS Documentation"}),"."]})}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["Click ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(c,{color:"#F78631",children:"Next"})})]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["Review the details that have been applied and click ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(c,{color:"#F78631",children:"Create Stack"})})]}),"\n",(0,s.jsx)(t.admonition,{type:"info",children:(0,s.jsxs)(t.p,{children:["The Cado IAM policy defines which resources are accessible and which actions are allowed by the Cado software. If an IAM role has not been applied in ",(0,s.jsx)(t.em,{children:"Step 3 (Configure stack options)"})," tick the check box for ",(0,s.jsx)(t.code,{children:"I acknowledge that AWS CloudFormation might create IAM resources"}),". The default IAM policy created by the Cloudformation template follows the principles of least privilege and only allows those actions needed by the Cado platform and, when able, are restricted based on tagging. The exact IAM permissions used within Cado, can be found within the Cloudformation Template json file."]})}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"aws-cloudformation-high-availability",children:"AWS CloudFormation High Availability"}),"\n",(0,s.jsxs)(t.p,{children:["The Cado platform can be deployed in a High Availability (HA) configuration allowing a multi-AZ deployment using managed services and an auto-scaling group with a load balancer. To deploy with HA, please contact the Cado Sales team at ",(0,s.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"}),"."]}),"\n",(0,s.jsx)(t.h3,{id:"deployment-time",children:"Deployment Time"}),"\n",(0,s.jsx)(t.p,{children:"Deploying the CloudFormation stack will take approximately fifteen minutes, followed by another ten minutes for the completed stack to run an installation and update process."}),"\n",(0,s.jsxs)(t.p,{children:["When the CFT stack has a status of ",(0,s.jsx)(t.code,{children:"CREATE_COMPLETE"}),", CloudFormation has finished creating the infrastructure for Cado."]}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Creation Complete",src:i(754).Z+"",width:"449",height:"92"})}),"\n",(0,s.jsxs)(t.p,{children:["You can then ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(t.a,{href:"/cado-response/manage/logging-in",children:"Log into Cado"})})]}),"\n",(0,s.jsx)(t.admonition,{type:"tip",children:(0,s.jsxs)(t.p,{children:["After deployment, you can import Test Data from the ",(0,s.jsx)(t.code,{children:"Help"})," menu to confirm that the deployment was successful."]})}),"\n",(0,s.jsx)(t.h3,{id:"aws-terraform-deployment",children:"AWS Terraform Deployment"}),"\n",(0,s.jsxs)(t.p,{children:["If you have not already, please contact the Cado Sales team at ",(0,s.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})," for a copy of the AWS Terraform code and the AMI for the region which you will deploy into."]}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsxs)(t.li,{children:["Download and unzip ",(0,s.jsx)(t.strong,{children:"aws.zip"}),"."]}),"\n",(0,s.jsxs)(t.li,{children:["Navigate to the ",(0,s.jsx)(t.strong,{children:"aws_combined"})," folder."]}),"\n",(0,s.jsxs)(t.li,{children:["Run ",(0,s.jsx)(t.code,{children:"terraform init"})]}),"\n",(0,s.jsxs)(t.li,{children:["Run ",(0,s.jsx)(t.code,{children:"terraform apply"}),". Note that the Terraform script will ask you for a number of variables which you can also pass in via the command line if you choose. Example: ",(0,s.jsx)(t.code,{children:'terraform apply -var="region=us-west-2" -var="key_name=second_oregon.pem" -var="ami_id=ami-08f75cb3e680edc28" -var="ssh_location=[\\"8.8.8.8/32\\"]" -var="http_location=[\\"8.8.8.8/32\\"]" -var="certificate_arn=" -var="feature_flag_deploy_with_alb=false"'}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsx)(t.li,{children:"PowerShell on Windows cannot correctly pass literal quotes to external programs, so we do not recommend using Terraform with PowerShell when you are on Windows. Use Windows Command Prompt instead."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(t.h3,{id:"parameters-1",children:"Parameters"}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Parameter Name"}),(0,s.jsx)(t.th,{children:"Value"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"region"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(choose AWS region)"})}),(0,s.jsxs)(t.td,{children:["AWS Region to deploy the Cado platform in, e.g. ",(0,s.jsx)(t.code,{children:"us-east-1"})]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"key_name"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(choose your keypair)"})}),(0,s.jsx)(t.td,{children:"This key pair is used to enable SSH access to the Cado instance. This is not needed for normal operation, but is helpful should Cado Support ask for additional logs."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"ami_id"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(contact Cado Sales)"})}),(0,s.jsx)(t.td,{children:"Please contact your Cado Sales team for the appropriate AMI ID. When contacting Sales, please provide your AWS Account Number and your AWS region where you will be deploying Cado."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"ssh_location"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(enter ip range)"})}),(0,s.jsx)(t.td,{children:"Enter details of your IP address/ IP address ranges that will be used to connect to SSH services. The IPv4 address range is specified in the CIDR notation e.g. 192.168.0.1/24. It is strongly recommended following the principle of least privilege and restrict this to only those IPs needing SSH access"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"http_location"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(enter ip range)"})}),(0,s.jsx)(t.td,{children:"Enter details of your IP address/ IP address ranges that will be used to connect to HTTPS services. The IPv4 address range is specified in the CIDR notation e.g. 192.168.0.1/24. It is strongly recommended following the principle of least privilege and restrict this to only those IPs needing HTTPS access"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"feature_flag_deploy_with_alb"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"False"})}),(0,s.jsx)(t.td,{children:"Deploys the platform with an Application Load Balancer. If set to True CertificateARN MUST be populated"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"certificate_arn"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(enter certificate arn)"})}),(0,s.jsx)(t.td,{children:"The ARN of the Certificate that will be assigned to the Application Load Balancer. Not used unless FeatureFlagDeployWithALB is True"})]})]})]}),"\n",(0,s.jsxs)(t.ol,{start:"5",children:["\n",(0,s.jsx)(t.li,{children:"After the infrastructure is built out, there is a one-time initialization that is performed. In total, the deploy and initialization process should take about 10-15 minutes with Terraform."}),"\n",(0,s.jsxs)(t.li,{children:["You can then ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(t.a,{href:"/cado-response/manage/logging-in",children:"Log into Cado"})}),". Note that the initial username is admin and the password is the instance id for the Cado platform. You'll be asked to change your password after first login."]}),"\n",(0,s.jsx)(t.li,{children:"Lastly, you will need to import a license JSON file."}),"\n"]}),"\n",(0,s.jsx)(t.h3,{id:"supported-regions",children:"Supported Regions"}),"\n",(0,s.jsx)(t.p,{children:"Cado makes AWS AMI's available for the regions below. As a customer, if you require deployment to a region that isn't listed, we can deploy our release AMIs to additional regions. You can deploy to all 20+ default AWS regions via our AWS marketplace listing."}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"us-east-1"}),"\n",(0,s.jsx)(t.li,{children:"us-east-2"}),"\n",(0,s.jsx)(t.li,{children:"us-west-1"}),"\n",(0,s.jsx)(t.li,{children:"us-west-2"}),"\n",(0,s.jsx)(t.li,{children:"eu-west-1"}),"\n",(0,s.jsx)(t.li,{children:"eu-west-2"}),"\n",(0,s.jsx)(t.li,{children:"eu-west-3"}),"\n",(0,s.jsx)(t.li,{children:"ap-southeast-2"}),"\n",(0,s.jsx)(t.li,{children:"eu-central-1"}),"\n",(0,s.jsx)(t.li,{children:"ca-central-1"}),"\n",(0,s.jsx)(t.li,{children:"ap-south-1"}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"aws-govcloud",children:"AWS GovCloud"}),"\n",(0,s.jsxs)(t.p,{children:["The Cado platform can be deployed in to AWS GovCloud using CloudFormation.\nWe support both us-gov-west-1 and us-gov-east-1 regions.\nTo deploy into GovCloud, please contact the Cado Sales team at ",(0,s.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})]})]})}function p(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(h,{...e})}):h(e)}},6164:(e,t,i)=>{i.d(t,{Z:()=>s});const s=i.p+"assets/images/aws-architecture-0dbe90e455ee953f8e8753f2c5494359.png"},517:(e,t,i)=>{i.d(t,{Z:()=>s});const s=i.p+"assets/images/cft-step3-54b4069a1b5f8a55273902a48d5ebca5.png"},754:(e,t,i)=>{i.d(t,{Z:()=>s});const s="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAcEAAABcCAYAAAAWNA7BAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAByMSURBVHhe7d0LWBTl/gfwryJCKKwXQEhQcKlQLuIqQhwpMFM7djQ9WWlaVpqpdTypiZlWpnk5aWnl/XLIC6amZubxGlgUghc0lcu/WJWLYUDhLraxAvp/35lZGJbdETkuetzf53nGnZl33pl3Zn3myzszu9uk5Pffr5/LzUdYUGcQQggh9uBURhbCw0LRVJomhBBC7I7UE8xFz9NXpVmEEELI3e1oaHPWEwyTQjAvDz1/NEI3rKdUTAghhNydVJuP4mhXJ4R37SpdDr3eRHghhBBC7IKUe3RPkBBCiN2iECSEEGK3KAQJIYTYLQpBQgghdotCkBBCiN2iECSEEGK3KAQJIYTYLQpBQgghdotCkBBCiN2iECSEEGK3KAQJIYTYLQpBQgghdut/LwSNxchMyUCxUZomhBBCGqiRQlAP7f7VmDV+OEaO4EMc5m9LZ3MboDQFS4d9gtRSabpBMrBRaIc0THkfa+N34WSRVEwIIcQu2D4EjSxwXnwE/d8/AafY5zBh/KuY8FIUfMrLcfs6c0aUJafAtx9rC2/PkO5wyt6CCQMm4sAlaRFCCCF3PZuHYOaGmZhV+DS27l2BaUP7IzIqCpGxgzBiZBQ8pGVg1ENflIOTmfnQ/yHNk2PlBZkZKNBbj02jPh+Z1upb4RvE2sLbE9UfI+YvwOsP7MLSrzOkUpHV9Va3SW8xzI1sfzK1xTBWSjPkKo3QF2Qgs4DVtVQuYMsI67Cw/j+Koc3MQbGF49GQ40AIIfZK/GX53Hz0PF1ug1+Wz8Daxwbg8HPJ2DDMV5pXW/H+OAyacQLqBzyBqiJoU4yIWbUDc/uJEWlM/xSjxy5EgQ/rPToXoRiecEpxw+i0FfibF1vgjxxse+cFTD/qgcgOQEFyPnymrsSaCRo4CWuwJB3LOw4Bdl7AOI00i6159/hwzAvag5QJQWy9rAf7xitYluMLNWta8f/lQzNHbFdx0tuYMCoJiPZl2yhHgcfL2PpRf+CrVxC1Q4WhxhPIcWDtLPoZqeW9sTRhAfr6iFsxardg1gtxONKW7Q/ykVrgi0kr/83awVvL2zUWRVNfRtGuLdB7erLtpkDfbQG2rnqaLW9EZvwrGL00v/p4FfRagqQbtJcQQkgN4ZflQ50RHhZq456gUYfiTCDAUyXNqMsj5j2kHDuEDRsTsGEze53ji227UlgkcezE/tZCOP/jEJJ2iuX73u0PN6FMlLl5KqaXjMG+xB1sHTuQ9MMMeMSPxVIWpjdDn7IFG/ZoMDI6QJjO3DAVy3zfw74DbLusbbs+7I/DM7Ygk7Usddt6+Czbga28zXybLACroybJCX1XHhLLDnyD1Y8lYsLifdL9T7Y/U+JQPEban53JSJrpgQ1jP0FqdXOLWYB2x7wD4jHZ99lb8NifhJPCZdoMfPtOPkaurTleQgAy1ttLCCHEGtuGoE4P/qyJq5s8tsw4if01o14PfnXPTSVbNvcsDmf2x8BYMZgEKpUsBDNwZHs6+g6MhbqZNMunP54aUozlqeJlTWG9skEejR8O9sN9HcWh+7SziN24BONCeXvYendloF9oMEtHqZ5nALoVnYX2khs8/DyQun0LDmstPdrjiZpdcENMn6eBbawen8xMwVfptffHp9/TGFj0KVJOSzMYt3t9a/axjSfrAZp4wD02B0ls2ycvyfdEqb3SIoQQQuqwbQh6euI+9qLNzxenLSnYh+l9w9H/+Vcw4aXhGDl7n1TA/MZ6XfzVFHB1GHGVd3WaOYuTAic4ubCXnHzWp0rHupBQdK8eptZ68GXSzgv4OfcCUpYNgkeLAERqTJdsxfUeXjMRE8azdvFh9i7oo7tD7eWEyEk7MLfrz5j/TCii+k7E2mMKz7k68LbloIBvt9wo9szk++PkDN5P1haKfV9lvhj68R4MrdqHSREPIHbU+9it5WGo1F6xJiGEkLps/GBMADqPBA4cSpcub5orxoFFryB/5Gbx8iC/xDezv1TGtPVAJPQ8O6xgPaNo9lJZLk4KjDAa2EuALyvVYBwLOR504iDdRzTjMWAK3vT/FPPiM6SeorjemFdXiG2qHsagCy9u5ouYiUuw79j/YVecJ756ciEOW8lB4x869sdAsBhGwv4w8odhjOVgS0DtXc97d25BGDrn30jSnsbSR/Ix6dX1LFhv0F5CCCEW2TgE3RAz/C102zMHk1jPJLNIvBzJL1EWa/OF+2RGecBV6lHwiyxNOgYjRpOCbV+mQC8EhxHFGWdRIBRyvnhwUCwObNiFk6ZqBV9iwwoPjIsU75XVjy/+9upbwL9mYqPQVfNFUIwGGzdsQaY83H6X2l/95KUTPPxkly4FZ5FhqqTPwbbNq9FlRBTUfLpjFAbG7sOG7TWfkSz4aj3Wer6KqFBphiIW8Kbj1cwNah9PaUK5vYQQcqfR/qrDa5vT0HVeItq8dUgY+Difx8sai41DkOkyBhsSZyBIuxCDwkMR3NEPwSGhGDRuHwszDzw8YgyMM/ogdvAQxPaeigzWe6wRhJc+WYGAPRPRXe2H+8IHYN7PKja3hs/Q97CaBeWEEOn+3l8+BWbFY0KU9WdDLeryHN6dCsz/1xYhZLuMXoLV6iSMZusV2sbWHTtpLytjwTY6nLWlD0YO64Oo3qvhu2wMYmRJmLl+CKJ4W0L6YC3ew7zRpidVfYVenCZ1LLrzcr7OT4B3PnsNkfVprj4FHz3K6j00BCMHRyN4ag4mvf+c0Nuz3l5CCLmzLD54FuEfH8P602W4oL+GqmsQBj7O5/EyvkxjsPFHJMzwzwPyromDG9xaiLMEwnwnuLlZTwLee2QLWP/Yg7RuJxe2jNV7iA1grc1/sPlVtbdXzD8i8Vowtua+im68XqVZHRm+P0a2N0r7bI1Yl23b0vGw1l5CCLkD8HB7J7F+T+zN6u2Ffz4aLE3dOo33EQlzTuzEzE7cdU7OwnzlMLB4wpeT1n1LA5Cz1uYWN9ger6cQQnx/GhKAnFjXyvGw1l5CCLnN+GXO9w7X/5F1vqytL402bgje7Vr4IjL6BmFNCCF2anFitnDZU+7Fnvfi8PgewsDH5fiyvI4tUQjeQh6PvIUNG8V7dIQQQmr77kLt73Pkobf2qS54uFMrYeDj5kFoXudWoxAkhBDSKPKv1O4GPtejduBx5vPM69xqFIKEEELsFoUgIYSQRuHbsnbkrD/+izRWw3yeeZ1bjUKQEEJIo3jIr/Zj6+uO/oKXtmbi23OXhYGP83ly5nVuNQpBQgghjeKfvQPhYJY6PPRilh0XBvMA5MvyOrZEIUgIIaRRqNup8HZM/b/Vny/L69gShSAhhJBGw78Bhn8TjHmPUI6X2erbYsxRCBJCCGlUPNyO/SMcz4W6ws+tqRB6fODjfB4va4wA5Br3u0MJIYSQ20z+3aG2D8GqCpRcSIe2pAL3uAciVO0uFXCsTGulTLGeqKIoG1m/qdC5szccpXkWVelQ+NMZ5OkdofIJRGB782vMFdDlZSMXHRDa4QbXn3VaZGcXQuekQgd1CLxdpflcWR6yM/Msl9VhZZusrXmsrYVW28qwNpw+XyJNSNqwY8TXo1Rmrj7bggGFWWdQcW8E6q6C1T+VB5fAELjLftdYl5eGQmcNAp3y6rZF4IJ7q+tIx+F3/iOQLmjlH8i2o/huikqycVpbgj+d3KEOCYS7gzSfU3ofGlpGCLlryEPQYWpc3LulOj1W/1qJN0PaS4vcKlrsiXsbu0rZGeqPQpzatRHbdfejXxAPNAOyN8RhbpIOrk2u4PzhBGzK90Z0Vx5oSvVYzQsHsGn5Iqze8j1SLqkQ/dD97PRpRVUhEv/1JuJ/doBzZSHOfJmAxKYaRHfiZzgWtKe2YPXHq7B+9xGkNVVjENu+NYZjizBp+Rlca26ALuc7rF9/HB4P9YIPP5kX7cHcaRuRc48DKi79iF3xSXDo+TD86zzdq7DNsu+xdOoqZF4DynU/I/mzBPzY9mFE+sp/OZ/57UccOpaNouIiNlxAyq59SLtHg36d2yiXydVzW7qURZjxyTdA8ECEmn6+sFomvn5zBwwxsfCXvQEXvpqFHYYIRKu01W3JPLwbh/Iq0PxqKZs2otV9LLiq0rFp+iysTdbiSpMKXGHHLTH9GrqF+8Nsj2sxZCxH3NzvUOZ2DYZz3yP+82wERIfDnWen0vvQ0DJCyF1l/tmLGNOuGdp7tbN1CDrD58En8OhfNAgNDcdfvC9i6+cX8cDfNHAv/BKLP3PEiDmvo193DbpHuiN35Q7oevRBgKtCPZQg67tstOo7FoPan0FigQ8eVQjBilP/xsLTYZg+/XlEdQ1HZIgB+5emodWjEfBudgEnDl9B6LBXEX5tD9IQrhiC/FfdH3+8D8JCWbvCg+B4fAd+aB6FaH9HpCcswmnNZMx8ug9Cw3oh2GEflh1zZfvmA3knhUWE9W1eVyH4rwMRreH7HYXg5kewKRWIib4fzgbWS8nRwcVDBUc3f1bOl9Hg3qID+BYDMG2EBi78Dq9SmXwdStsSGsOwYPhw7UWoWurQqqulEGR/VOzKhmvf2iFYcno3slxjER0WUt2WVr/sRsEDr2LCEw+zaRaATjqkfToXB/3HYcG0kWxZthw7bjFmAZi9YQz2N5NvOw+JH2+B4/B5GNc/AqE9euHevDXYUhqG3ve5KLwP7fBjg8rM3z9CyP86eQja+MEYF7jILilVGCuADt4syNj5+LwWhZ1DEGg6eTpr0ENTghNZ/PKZ9Xpg/4YOHIqIDuxELkwry8vRwjE0BN6mM5m3Bg+2PoOs83xCjehnBiDQ0xHNhUJljq7y64EGVJYDHdvxVmmRc8YFoUHC78cLvNmJX3XsDCsxp7BNZxVcZGdcvt+OPt7gWzWc2YbFH21DNr9qKClhvbQPjmnwxvjY2pcDGUtltdahsC0B70GvTULHUcMRaYvLgmXpSD3tjn79WEBLs+qlTIvsi2p0rf6P44gQFraFp85Ap/g+NLSMEHI3s3EIyhjSsXWzFtED2UmZTxrYmdidnYjFUsYRLvzS0zUWeHJm9W5WhdEA7zby8HLBPfyk/l9+J2vJoQTsdh2AfsLnOA2oKFPx3anh5AJVhdm+3AzWC/v31y4YzEKCc4mYjBXLJ0NjOmAXEjB3dTZ0v6Zjx940lFRJ8zkrZXXWYWK2La7k0HJ8rR6NZ4NuKqLqj70vf6ADvNtK07XokL13DTZtWoP9WUDWIdO4TqqngkoWzI4u7M8hto8Viu9DQ8sIIXezxglB3qtYshwnuj2Pp0Jv4qR6s/XKzmA/O1nyE2b1SbOBClNq1rNpUxIKpfkcvyc1dyvw1MtP1OmB3RIs+DfN/5JtYBz6yS9Byrfl+wTmfLwQH84Yjs4FCZixLo2FgESpzLy9lral/Qxzk0Pwxt9t+00NPLYqLeaMCuqHh2Iw6/FH+gMdIsXx6AB5ShFCyH+vEULQgOyE+fjaZxzmjKy59KVSsX5dTh5qnh3UQccmWriYlrBcT5GjOzoGhSBEGjq2ZX/Nq1TQ5uZJC3A6lBS5wFHpyQvGxadmPSFBHWq2z3pNiz8tweNzZqJ3dUCp0MqzEHnyb/xhO1PoyrYjTdabEPxrkPvX9zC9j8L9SQd+yZj1pN3ViI4ORIX80p1SmZzFbZUgcev3MOjTsHj6FMTFLcJOdviSV0/B0u8tPelZgYpavWrWH6vPz3+1ZD0vfhlS/tbIOLqw9rN9ULH3qQVbVtgffjCFennILRKX4ww69sdOC7bPiu9DQ8sIIXczG4cgfwL0TazCcMwZXjvIHEMiEFGYhrSL0oyiJHyTpUZkEP9r33o9Rc7eCAyLQKg08Ptu3uER8E5LQ7p0L81wOgnJzTTo7idOW6PqULOe0DA1O00y/AnCd9LR/e1psgDk1NDEuCM1hYWHMG3A6cPpcOwVwUpuAg+lf81GqmZa3QDkD7Vk5YnrrzCgovryZwUK81g/tbMaHYRJhTL5Oqxuyx3RE1kv8v2ZeGcGH0ajPyvWDJuJFyLML0irEaApwf796dJ+M4V7sC/dHd2DFAKcc+6FRx4DErdvg1Yn6w6aXYJUqSMQ0Eqa4Jwj0COqBMmpUqyz/UhO1CI0gv8/UXofGlpGCLmb2fZzgiUsNN74sk4vpPeU1Xg2iJ1qMtZg1pJ0VLR2hKHUEZFjpmFUODvR3qCeScmhtxGXGoEFMwYo3i8sSZyNGZ8Xsl4h+wP/ijcGx01GP7/a0cqfQvwA47CW9TqtEZZJlCZM1E+I2+eh8tFsbM3j/RHWq+3QF9PHD0UHhQSvs82M5XhpYbo4Xs0bz37wHiK1izBpLfDy4slQp8/HjPV5cGzNeip/sm211ODlN8ZB05rt3/fWywxpNevQnLe+rd61Dibbrzlvo3Bw7WNfrfR7xH+QgNQrbL+dDNDpXBAyajImRNUOQb6vO7zNerdVJTi97WOsTiyEQco+x6ChWDClr/hHhzX8Eu47y5FcwXqHRh0cezyP6aN6QcUv9Sq9Dw0tI4TcVRr3w/I3UmWAgZ0B+eUvR1vcXzNhPSRDOb/MxsLBhtupMOhY/8sFLsK1u1uM9/BMba+qEB8u4pc+zbelWMYGG+y/sN9s3Q17HytQUcZ6sPyJ1XofNqmOI9tH57qVlN6HhpYRQu4O8hBsvKdDrZHuX9k0ADl+suT3eGy8HeFelq1OoPK2OziK98ksbUuxTHq9xUz38Bp2fB2Fj5/c3GGT6lgIQE7pfWhoGSHk7nP7Q5AQQgi5TSgECSGE2C0KQUIIIXaLQpAQQojdohAkhBBitygECSGE2K1GDcFTF4/gvf3j8fjKzghb4CQMfJzP42WEEEJIY2q0EORBN2J9L2xNX4kLv/+EymuVwsDH+TxexpchhBBCGkujhODYLY8JQce9GDkFW0al4eTUP4WBj/N5HF+GL0sIIYQ0Bpt/bRrv3fFw822txqInNqOLV3eppLbMSycw+cthyC/V4inNWLzdb5lUYl2Z9giySsvZmDPc/buhU1tnNi+JzRPL0dIPnX384dpSmi6/hOyzWdBLkyIvdO7RGaafpzNePIkff2uFrqH+cOIzSrNwVHtJKKutFToFd4PTRdn2JG7eDyKw/Q1+poKx1H7BtXKU/HQEmb+Xw7m5l7Add9nq6rSxGqt39ghKWovbF5YrvCwW8fV06gz3WseiFO1l+y66jHPHT8p+3YPj++oP/Vnz+SK+v/7IqtmWSetu6KmWf/s1IYTcfvKvTXOYGhf3bqlOj9W/VuLNkPbSIrcGv883e98EYXzNsP1WA5DzaHkvND5R2HZqNTIKTyCqU194uflKpWauHMGq5ZGYfvZnoOoeGH9Pxq5MR/QIuw+5BwIw75wPWhsvozg3Ae8nTkV21VOI9WNn/+LdmLNjJS41ZXUuX0KxMDjCJ+g+uAkrvozDnwdg3I9X0KXLQHTiX55cdBwHM84Iy57KHontv0rrvnwZLn7dUPqtbHvSOnUuIejSTiEEFdrvwstWPIoPCprBq7IcxYU7MP/QMpS1fArdvZoJ1S+nvYbB366GW9uXEeYhzBLlrseU7UNx0nEC+qtbisudKsB9fD1FB7Hx4Bh89+cQPKpuLR2LI+gYHc3+DJA7iW2fvY4fqtiK9aZjxPfVC8UnkvATn85PQFx2FtpdbwK9tL/eF96o2ZZ0HIrhh7AObFuEEHIHmX/2Isa0a4b2Xu1s2xM09QL55c5JsQukubWVlV/GgkOTENfnQ7g6t8KHSXFYl7pQoTd4Gd+tCcKqll9g7TMPmvWEWPB+7oD4thex+FHp1H5qLmK+ccaKyZMQWLgZ/4w/j1FvTkeYWFrbbzvxDisP7ZSAb5y3Ydlj/lKBqM66GUvzlCm133KZke3DS/sL8fLoT/BQW6Dk4JOIOX0BgfdMxorxw6Rf0CjH0fXBiNf5oXngRqE9wnK/TcZZti5B7jqMTziJZ8az9RisHQsWwvMWof2oLzDA2q8hsfYEp/jjcPW2pTbJt0UIIXeoRvsC7aMXkoTXfoFDhVceeHww4eMvJDyCL898xno7rwvzTMua6tahO4Lk4gcxLLpuAFqk8kKnq+UsIm7s4tG1yA8cjL+HjUd5ThJMP3V4Sym130qZU9gwDGuxDMmZssuN7d/CK82mIOGotGfnE1gATseo+xUuP7bzRycUokz80TxCCLF7Ng3BgsvnhNf7PUOrA48PpjDk49m/nsIDnl0xrc9H1ctyprp1GC6jGJ3RXuE3W/W/HcHR40ls2IvN+2fiasBjrIbJOixc0gcvSsPmTGk2ziM1pxwDurDen38sBlxbhoPZUtENnDo1onp9L8bvtXjfrJpS+4UyDdrXuSrtj/asy1VcLo9yL/R5aDKOpiXg4jXWg/xmLgIjhqOT+TtayY61jg+XkP3NWnzd8q8IUzh2oiNY+XnNMVqYbOmeqAW5b9QchyXLUM/DRwght02jfUSCu379uhB6pjA0BWD8s4nCpdD6K8fVq9KoBfrL6cg8n4g9yY8juf0hbBzaTdazGoaXR32BJdIwJECanb0Tmyv/CnUbHhitofZxxtcZJ6VCZWFdPqle35K/xyr+wK9Iqf2lYB1XM1aWDxyPf6jmYvP2ZVh1dTaG97RwH/Li+5gY/yQbRmBz2d+x7rkXceM7vw/i+QE1x2hseD0v9bLeafVxGPUiAqXZhBByp7JpCPq06iS8/lR0Wgg5HnY89Hj4WQtAvixnqltHay/4IAmZVjqKnI96AkYNnY3psbNRlLMT2bVC5R64qVrBVRqcmotzszMSUFL5H3wsBMaT+DjvMkpy9uLUNbFcUfPW1etzdb3BU6FK7W/nhy5NLZRdy0JmsRe6eJiHkTN6Rs9G2S/pGNC75v5cLR0/wLqJh4Rh1jOD0UnxJ9trOLvWHKMb7VK1ZrI6qvpWIoSQ28emIdjTL1Z43Z+9TXiVB6G1HqBpWVPdOpxj8XigM+K/W4ds+UcTal0qFDmFTcLUtksxZ+8NenTXTiL1ghdee0oMC2F4fTdec1mK747XXe9/Ran9TR/EQ/eLZeeuSPNZL/Dc3kWIbzoZD4lXimvzH4ZZE7/AMOp2EULITbNpCA4MHim88qc9+ecAOVMQWgpAvgxfljPVtSRw0NdY3DYRU1c5IHieOMSst3QvjvWUBqxB559mYvt5aRZmYoRURxzm4tjxHYhvPgSRHaVFBP6IDOiGHT8dgVGaY82h4+1l63PAPw8q30NTar9Y9h+M+yQAI5b0wYgFLTAuV4PFIyYh8Ja/W3WPxSlh/k7ExcvnP4k9hUKBsvO9ZHXY8Dl9FR4h5M72P/1hec6ou4yrTjdxya6RCO2Sxms417lMaLX9V8tR9ifrHTqwMtMH3AkhhPzX5B+RsHkIcvyr0H44d0AY558Z5B+DMD0Fyu8B8kugph7gXzr1xcqn9wrj/7tOYvOSN3BQmqoxBFMnjqcHRggh5DZq9BDkTD1CJTfTAySEEEIaotE+LC/Hw23jc98LQefX5n40a9pMGPg4n8fLKAAJIYQ0pkbrCRJCCCF3gtvSEySEEELuNBSChBBC7BaFICGEELtFIUgIIcRuUQgSQgixWxSChBBC7BaFICGEELtFIUgIIcRuUQgSQgixWxSChBBC7BaFICGEELtFIUgIIcRuUQgSQgixW7V+RYIQQgixB9U/qvtbaen1/IsXcfYnLYpKSlBVVSUtQgghhNxdHJo2hYe7O0IeCEDXoCA00en1169WVODP8nJcrajE9evXpUUJIYSQu0uTJk3Q3LEZ7nF2hnubNmiiLyuj1COEEGJ3XFu2xP8DaKcy/UdYKwQAAAAASUVORK5CYII="},1151:(e,t,i)=>{i.d(t,{Z:()=>a,a:()=>r});var s=i(7294);const n={},o=s.createContext(n);function r(e){const t=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:r(e.components),s.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9e607239.da28e4e4.js b/assets/js/9e607239.da28e4e4.js deleted file mode 100644 index 707b0467c..000000000 --- a/assets/js/9e607239.da28e4e4.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4877],{3137:(e,t,i)=>{i.r(t),i.d(t,{Highlight:()=>c,assets:()=>l,contentTitle:()=>r,default:()=>p,frontMatter:()=>o,metadata:()=>a,toc:()=>d});var s=i(5893),n=i(1151);const o={title:"Overview",hide_title:!0,sidebar_position:1},r=void 0,a={id:"cado-response/deploy/aws/overview",title:"Overview",description:"AWS Deployment Overview",source:"@site/docs/cado-response/deploy/aws/overview.md",sourceDirName:"cado-response/deploy/aws",slug:"/cado-response/deploy/aws/overview",permalink:"/cado-response/deploy/aws/overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/overview.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Overview",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Deployment Options",permalink:"/cado-response/deploy/intro"},next:{title:"Overview",permalink:"/cado-response/deploy/aws/iam/deployment-iam-considerations"}},l={},d=[{value:"AWS Deployment Overview",id:"aws-deployment-overview",level:2},{value:"AWS CloudFormation Template",id:"aws-cloudformation-template",level:2},{value:"Parameters",id:"parameters",level:3},{value:"AWS CloudFormation High Availability",id:"aws-cloudformation-high-availability",level:2},{value:"Deployment Time",id:"deployment-time",level:3},{value:"AWS Terraform Deployment",id:"aws-terraform-deployment",level:3},{value:"Parameters",id:"parameters-1",level:3},{value:"Supported Regions",id:"supported-regions",level:3},{value:"AWS GovCloud",id:"aws-govcloud",level:2}],c=({children:e,color:t})=>{const i={span:"span",...(0,n.a)()};return(0,s.jsx)(i.span,{style:{backgroundColor:t,borderRadius:"2px",color:"#fff",padding:"0.2rem"},children:e})};function h(e){const t={a:"a",admonition:"admonition",br:"br",code:"code",em:"em",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h2,{id:"aws-deployment-overview",children:"AWS Deployment Overview"}),"\n",(0,s.jsx)(t.admonition,{type:"note",children:(0,s.jsxs)(t.p,{children:[(0,s.jsx)(t.strong,{children:"Intended Audience and Operating Environment Requirements:"}),"\n*This information is written for proficient AWS cloud administrators who are familiar with AWS technology and cloud operations. This manual assumes you already have an AWS account and are familiar with Amazon Web Services capabilites and terminology, including Cloudformation Templates, EC2s, Security Groups, VPCs, IAM roles and S3. For a list of supported AWS regions, please see our Markteplace listing: ",(0,s.jsx)(t.a,{href:"https://aws.amazon.com/marketplace/pp/prodview-2ol4yojhc5vpa?ref_=srh_res_product_title",children:"https://aws.amazon.com/marketplace/pp/prodview-2ol4yojhc5vpa?ref_=srh_res_product_title"})," *"]})}),"\n",(0,s.jsx)(t.p,{children:"Deployment of the Cado platform is performed within your AWS cloud environment either via a CloudFormation Template, a Terraform Script or via the AWS Marketplace. When the platform is deployed, it creates its own isolated VPC in which you can control who has access. From start to finish, you can be up and running in under 25 minutes."}),"\n",(0,s.jsxs)(t.p,{children:["By default AWS will limit the number of CPUs that can run in a region to 32. We recommend raising this limit to 128 CPU's to enable fast processing. You can do so by filling out ",(0,s.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-on-demand-instances.html#vcpu-limits-request-increase",children:"this form"}),' and requesting 128 vCPU for "Running On-Demand All Standard" instances.']}),"\n",(0,s.jsxs)(t.p,{children:["Cado consists of a few key components that interact with each other in order to provide the capabilities within the platform.",(0,s.jsx)(t.br,{}),"\n",(0,s.jsx)(t.img,{alt:"AWS architecture",src:i(6164).Z+"",width:"885",height:"476"})]}),"\n",(0,s.jsx)(t.h2,{id:"aws-cloudformation-template",children:"AWS CloudFormation Template"}),"\n",(0,s.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/aMQOitmPLeE",title:"Deploying with Cloudformation",frameborder:"0",allowfullscreen:!0}),"\n",(0,s.jsx)(t.p,{children:"To set up Cado in AWS you simply deploy our CloudFormation Template (CFT). The CFT steps you through the process of configuring the platform stack."}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["If you have signed up for a Free Trial or are working with the Cado Sales team already, you should receive a link to the Cado CloudFormation Template in order to get started. If you have not, reach out to ",(0,s.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})," for more details. Once you receive the link to the Cado CloudFormation Template, click the link to open the AWS CloudFormation Management Console."]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["On Step 1 (Specify template), do not change the default ",(0,s.jsx)(t.strong,{children:"Template is ready"})," and ",(0,s.jsx)(t.strong,{children:"Amazon S3 URL"})," settings. Click ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(c,{color:"#F78631",children:"Next"})})]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["On Step 2 (Specify stack details), give your stack an appropriate Stack Name, for example: ",(0,s.jsx)(t.code,{children:"CadoResponse"})," and enter the parameters as outlined below:"]}),"\n",(0,s.jsx)(t.h3,{id:"parameters",children:"Parameters"}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Parameter Name"}),(0,s.jsx)(t.th,{children:"Value"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"Instance type for Cado EC2 Server"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"t3a.xlarge"})}),(0,s.jsx)(t.td,{children:"For enterprise use we recommend at minimum a t3a.xlarge as the instance type."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"Key pair for Cado EC2 Server"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(choose your keypair)"})}),(0,s.jsx)(t.td,{children:"This key pair is used to enable SSH access to the Cado instance. This is not needed for normal operation, but is helpful should Cado Support ask for additional logs."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"Allowed source IP addresses for connection to SSH"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(enter ip range)"})}),(0,s.jsx)(t.td,{children:"Enter details of your IP address/ IP address ranges that will be used to connect to SSH services. The IPv4 address range is specified in the CIDR notation e.g. 192.168.0.1/24. It is strongly recommended following the principle of least privilege and restrict this to only those IPs needing SSH access"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"Allowed source IP addresses for connection to HTTPS"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(enter ip range)"})}),(0,s.jsx)(t.td,{children:"Enter details of your IP address/ IP address ranges that will be used to connect to HTTPS services. The IPv4 address range is specified in the CIDR notation e.g. 192.168.0.1/24. It is strongly recommended following the principle of least privilege and restrict this to only those IPs needing HTTPS access"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"VPC CIDR"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(enter ip range)"})}),(0,s.jsx)(t.td,{children:"The Subnet the Cado VPC will use. Specify the IPv4 address range as a Classless Inter-Domain Routing (CIDR) block."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"EFSArchive"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"AFTER_30_DAYS"})}),(0,s.jsx)(t.td,{children:"EFS - move data to infrequent storage after X days."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"InstanceVolumeSize"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"1000"})}),(0,s.jsx)(t.td,{children:"EC2 instance volume required in GBit."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"S3ArchiveTime"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"30"})}),(0,s.jsx)(t.td,{children:"Move S3 data to s3 glacier storage if not used after X days"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"S3GlacierDelete"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"365"})}),(0,s.jsx)(t.td,{children:"Delete S3 glacier storage data after X days."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"AvailabilityZoneA"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(choose your AZ)"})}),(0,s.jsx)(t.td,{children:"The Availability Zone used by the primary subnet."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"AvailabilityZoneB"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(choose your AZ)"})}),(0,s.jsx)(t.td,{children:"The Availability Zone used by the secondary subnet."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"FeatureFlagPlatformUpgrade"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"True"})}),(0,s.jsx)(t.td,{children:"Enables the platform to perform native upgrades."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"FeatureFlagDeployWithALB"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"False"})}),(0,s.jsx)(t.td,{children:"Deploys the platform with an Application Load Balancer. If set to True CertificateARN MUST be populated"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"CertificateARN"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(enter certificate arn)"})}),(0,s.jsx)(t.td,{children:"The ARN of the Certificate that will be assigned to the Application Load Balancer. Not used unless FeatureFlagDeployWithALB is True"})]})]})]}),"\n",(0,s.jsx)(t.admonition,{type:"tip",children:(0,s.jsx)(t.p,{children:"We recommend a minimum setting of 500GB for InstanceVolumeSize. The instance will roughly need to be sized to be 20% of the amount of data you intend to be on the platform at once. For example, to have 5TB of disk images imported you will need approximately 1000GB of disk space. Projects can always be deleted to recover space."})}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["Click ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(c,{color:"#F78631",children:"Next"})})]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["On Step 3 (Configure stack options), click ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(c,{color:"#F78631",children:"Next"})})," again (unless you require custom settings). If you require custom settings, please contact Cado Security"]}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Step 3",src:i(517).Z+"",width:"242",height:"315"})}),"\n",(0,s.jsx)(t.admonition,{type:"info",children:(0,s.jsxs)(t.p,{children:["For more information on available stack options, see ",(0,s.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-add-tags.html",children:"AWS Documentation"}),"."]})}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["Click ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(c,{color:"#F78631",children:"Next"})})]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:["\n",(0,s.jsxs)(t.p,{children:["Review the details that have been applied and click ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(c,{color:"#F78631",children:"Create Stack"})})]}),"\n",(0,s.jsx)(t.admonition,{type:"info",children:(0,s.jsxs)(t.p,{children:["The Cado IAM policy defines which resources are accessible and which actions are allowed by the Cado software. If an IAM role has not been applied in ",(0,s.jsx)(t.em,{children:"Step 3 (Configure stack options)"})," tick the check box for ",(0,s.jsx)(t.code,{children:"I acknowledge that AWS CloudFormation might create IAM resources"}),". The default IAM policy created by the Cloudformation template follows the principles of least privilege and only allows those actions needed by the Cado platform and, when able, are restricted based on tagging. The exact IAM permissions used within Cado, can be found within the Cloudformation Template json file."]})}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"aws-cloudformation-high-availability",children:"AWS CloudFormation High Availability"}),"\n",(0,s.jsxs)(t.p,{children:["The Cado platform can be deployed in a High Availability (HA) configuration allowing a multi-AZ deployment using managed services and an auto-scaling group with a load balancer. To deploy with HA, please contact the Cado Sales team at ",(0,s.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"}),"."]}),"\n",(0,s.jsx)(t.h3,{id:"deployment-time",children:"Deployment Time"}),"\n",(0,s.jsx)(t.p,{children:"Deploying the CloudFormation stack will take approximately fifteen minutes, followed by another ten minutes for the completed stack to run an installation and update process."}),"\n",(0,s.jsxs)(t.p,{children:["When the CFT stack has a status of ",(0,s.jsx)(t.code,{children:"CREATE_COMPLETE"}),", CloudFormation has finished creating the infrastructure for Cado."]}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Creation Complete",src:i(754).Z+"",width:"449",height:"92"})}),"\n",(0,s.jsxs)(t.p,{children:["You can then ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(t.a,{href:"/cado-response/manage/logging-in",children:"Log into Cado"})})]}),"\n",(0,s.jsx)(t.admonition,{type:"tip",children:(0,s.jsxs)(t.p,{children:["After deployment, you can import Test Data from the ",(0,s.jsx)(t.code,{children:"Help"})," menu to confirm that the deployment was successful."]})}),"\n",(0,s.jsx)(t.h3,{id:"aws-terraform-deployment",children:"AWS Terraform Deployment"}),"\n",(0,s.jsxs)(t.p,{children:["If you have not already, please contact the Cado Sales team at ",(0,s.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})," for a copy of the AWS Terraform code and the AMI for the region which you will deploy into."]}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsxs)(t.li,{children:["Download and unzip ",(0,s.jsx)(t.strong,{children:"aws.zip"}),"."]}),"\n",(0,s.jsxs)(t.li,{children:["Navigate to the ",(0,s.jsx)(t.strong,{children:"aws_combined"})," folder."]}),"\n",(0,s.jsxs)(t.li,{children:["Run ",(0,s.jsx)(t.code,{children:"terraform init"})]}),"\n",(0,s.jsxs)(t.li,{children:["Run ",(0,s.jsx)(t.code,{children:"terraform apply"}),". Note that the Terraform script will ask you for a number of variables which you can also pass in via the command line if you choose. Example: ",(0,s.jsx)(t.code,{children:'terraform apply -var="region=us-west-2" -var="key_name=second_oregon.pem" -var="ami_id=ami-08f75cb3e680edc28" -var="ssh_location=[\\"8.8.8.8/32\\"]" -var="http_location=[\\"8.8.8.8/32\\"]" -var="certificate_arn=" -var="feature_flag_deploy_with_alb=false"'}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsx)(t.li,{children:"PowerShell on Windows cannot correctly pass literal quotes to external programs, so we do not recommend using Terraform with PowerShell when you are on Windows. Use Windows Command Prompt instead."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(t.h3,{id:"parameters-1",children:"Parameters"}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Parameter Name"}),(0,s.jsx)(t.th,{children:"Value"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"region"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(choose AWS region)"})}),(0,s.jsxs)(t.td,{children:["AWS Region to deploy the Cado platform in, e.g. ",(0,s.jsx)(t.code,{children:"us-east-1"})]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"key_name"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(choose your keypair)"})}),(0,s.jsx)(t.td,{children:"This key pair is used to enable SSH access to the Cado instance. This is not needed for normal operation, but is helpful should Cado Support ask for additional logs."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"ami_id"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(contact Cado Sales)"})}),(0,s.jsx)(t.td,{children:"Please contact your Cado Sales team for the appropriate AMI ID. When contacting Sales, please provide your AWS Account Number and your AWS region where you will be deploying Cado."})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"ssh_location"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(enter ip range)"})}),(0,s.jsx)(t.td,{children:"Enter details of your IP address/ IP address ranges that will be used to connect to SSH services. The IPv4 address range is specified in the CIDR notation e.g. 192.168.0.1/24. It is strongly recommended following the principle of least privilege and restrict this to only those IPs needing SSH access"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"http_location"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(enter ip range)"})}),(0,s.jsx)(t.td,{children:"Enter details of your IP address/ IP address ranges that will be used to connect to HTTPS services. The IPv4 address range is specified in the CIDR notation e.g. 192.168.0.1/24. It is strongly recommended following the principle of least privilege and restrict this to only those IPs needing HTTPS access"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"feature_flag_deploy_with_alb"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"False"})}),(0,s.jsx)(t.td,{children:"Deploys the platform with an Application Load Balancer. If set to True CertificateARN MUST be populated"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"certificate_arn"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.em,{children:"(enter certificate arn)"})}),(0,s.jsx)(t.td,{children:"The ARN of the Certificate that will be assigned to the Application Load Balancer. Not used unless FeatureFlagDeployWithALB is True"})]})]})]}),"\n",(0,s.jsxs)(t.ol,{start:"5",children:["\n",(0,s.jsx)(t.li,{children:"After the infrastructure is built out, there is a one-time initialization that is performed. In total, the deploy and initialization process should take about 10-15 minutes with Terraform."}),"\n",(0,s.jsxs)(t.li,{children:["You can then ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(t.a,{href:"/cado-response/manage/logging-in",children:"Log into Cado"})}),". Note that the initial username is admin and the password is the instance id for the Cado platform. You'll be asked to change your password after first login."]}),"\n",(0,s.jsx)(t.li,{children:"Lastly, you will need to import a license JSON file."}),"\n"]}),"\n",(0,s.jsx)(t.h3,{id:"supported-regions",children:"Supported Regions"}),"\n",(0,s.jsx)(t.p,{children:"Cado makes AWS AMI's available for the regions below. As a customer, if you require deployment to a region that isn't listed, we can deploy our release AMIs to additional regions. You can deploy to all 20+ default AWS regions via our AWS marketplace listing."}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"us-east-1"}),"\n",(0,s.jsx)(t.li,{children:"us-east-2"}),"\n",(0,s.jsx)(t.li,{children:"us-west-1"}),"\n",(0,s.jsx)(t.li,{children:"us-west-2"}),"\n",(0,s.jsx)(t.li,{children:"eu-west-1"}),"\n",(0,s.jsx)(t.li,{children:"eu-west-2"}),"\n",(0,s.jsx)(t.li,{children:"eu-west-3"}),"\n",(0,s.jsx)(t.li,{children:"ap-southeast-2"}),"\n",(0,s.jsx)(t.li,{children:"eu-central-1"}),"\n",(0,s.jsx)(t.li,{children:"ca-central-1"}),"\n",(0,s.jsx)(t.li,{children:"ap-south-1"}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"aws-govcloud",children:"AWS GovCloud"}),"\n",(0,s.jsxs)(t.p,{children:["The Cado platform can be deployed in to AWS GovCloud using CloudFormation.\nWe support both us-gov-west-1 and us-gov-east-1 regions.\nTo deploy into GovCloud, please contact the Cado Sales team at ",(0,s.jsx)(t.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})]})]})}function p(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(h,{...e})}):h(e)}},6164:(e,t,i)=>{i.d(t,{Z:()=>s});const s=i.p+"assets/images/aws-architecture-0dbe90e455ee953f8e8753f2c5494359.png"},517:(e,t,i)=>{i.d(t,{Z:()=>s});const s=i.p+"assets/images/cft-step3-54b4069a1b5f8a55273902a48d5ebca5.png"},754:(e,t,i)=>{i.d(t,{Z:()=>s});const s="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAcEAAABcCAYAAAAWNA7BAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAByMSURBVHhe7d0LWBTl/gfwryJCKKwXQEhQcKlQLuIqQhwpMFM7djQ9WWlaVpqpdTypiZlWpnk5aWnl/XLIC6amZubxGlgUghc0lcu/WJWLYUDhLraxAvp/35lZGJbdETkuetzf53nGnZl33pl3Zn3myzszu9uk5Pffr5/LzUdYUGcQQggh9uBURhbCw0LRVJomhBBC7I7UE8xFz9NXpVmEEELI3e1oaHPWEwyTQjAvDz1/NEI3rKdUTAghhNydVJuP4mhXJ4R37SpdDr3eRHghhBBC7IKUe3RPkBBCiN2iECSEEGK3KAQJIYTYLQpBQgghdotCkBBCiN2iECSEEGK3KAQJIYTYLQpBQgghdotCkBBCiN2iECSEEGK3KAQJIYTYLQpBQgghdut/LwSNxchMyUCxUZomhBBCGqiRQlAP7f7VmDV+OEaO4EMc5m9LZ3MboDQFS4d9gtRSabpBMrBRaIc0THkfa+N34WSRVEwIIcQu2D4EjSxwXnwE/d8/AafY5zBh/KuY8FIUfMrLcfs6c0aUJafAtx9rC2/PkO5wyt6CCQMm4sAlaRFCCCF3PZuHYOaGmZhV+DS27l2BaUP7IzIqCpGxgzBiZBQ8pGVg1ENflIOTmfnQ/yHNk2PlBZkZKNBbj02jPh+Z1upb4RvE2sLbE9UfI+YvwOsP7MLSrzOkUpHV9Va3SW8xzI1sfzK1xTBWSjPkKo3QF2Qgs4DVtVQuYMsI67Cw/j+Koc3MQbGF49GQ40AIIfZK/GX53Hz0PF1ug1+Wz8Daxwbg8HPJ2DDMV5pXW/H+OAyacQLqBzyBqiJoU4yIWbUDc/uJEWlM/xSjxy5EgQ/rPToXoRiecEpxw+i0FfibF1vgjxxse+cFTD/qgcgOQEFyPnymrsSaCRo4CWuwJB3LOw4Bdl7AOI00i6159/hwzAvag5QJQWy9rAf7xitYluMLNWta8f/lQzNHbFdx0tuYMCoJiPZl2yhHgcfL2PpRf+CrVxC1Q4WhxhPIcWDtLPoZqeW9sTRhAfr6iFsxardg1gtxONKW7Q/ykVrgi0kr/83awVvL2zUWRVNfRtGuLdB7erLtpkDfbQG2rnqaLW9EZvwrGL00v/p4FfRagqQbtJcQQkgN4ZflQ50RHhZq456gUYfiTCDAUyXNqMsj5j2kHDuEDRsTsGEze53ji227UlgkcezE/tZCOP/jEJJ2iuX73u0PN6FMlLl5KqaXjMG+xB1sHTuQ9MMMeMSPxVIWpjdDn7IFG/ZoMDI6QJjO3DAVy3zfw74DbLusbbs+7I/DM7Ygk7Usddt6+Czbga28zXybLACroybJCX1XHhLLDnyD1Y8lYsLifdL9T7Y/U+JQPEban53JSJrpgQ1jP0FqdXOLWYB2x7wD4jHZ99lb8NifhJPCZdoMfPtOPkaurTleQgAy1ttLCCHEGtuGoE4P/qyJq5s8tsw4if01o14PfnXPTSVbNvcsDmf2x8BYMZgEKpUsBDNwZHs6+g6MhbqZNMunP54aUozlqeJlTWG9skEejR8O9sN9HcWh+7SziN24BONCeXvYendloF9oMEtHqZ5nALoVnYX2khs8/DyQun0LDmstPdrjiZpdcENMn6eBbawen8xMwVfptffHp9/TGFj0KVJOSzMYt3t9a/axjSfrAZp4wD02B0ls2ycvyfdEqb3SIoQQQuqwbQh6euI+9qLNzxenLSnYh+l9w9H/+Vcw4aXhGDl7n1TA/MZ6XfzVFHB1GHGVd3WaOYuTAic4ubCXnHzWp0rHupBQdK8eptZ68GXSzgv4OfcCUpYNgkeLAERqTJdsxfUeXjMRE8azdvFh9i7oo7tD7eWEyEk7MLfrz5j/TCii+k7E2mMKz7k68LbloIBvt9wo9szk++PkDN5P1haKfV9lvhj68R4MrdqHSREPIHbU+9it5WGo1F6xJiGEkLps/GBMADqPBA4cSpcub5orxoFFryB/5Gbx8iC/xDezv1TGtPVAJPQ8O6xgPaNo9lJZLk4KjDAa2EuALyvVYBwLOR504iDdRzTjMWAK3vT/FPPiM6SeorjemFdXiG2qHsagCy9u5ouYiUuw79j/YVecJ756ciEOW8lB4x869sdAsBhGwv4w8odhjOVgS0DtXc97d25BGDrn30jSnsbSR/Ix6dX1LFhv0F5CCCEW2TgE3RAz/C102zMHk1jPJLNIvBzJL1EWa/OF+2RGecBV6lHwiyxNOgYjRpOCbV+mQC8EhxHFGWdRIBRyvnhwUCwObNiFk6ZqBV9iwwoPjIsU75XVjy/+9upbwL9mYqPQVfNFUIwGGzdsQaY83H6X2l/95KUTPPxkly4FZ5FhqqTPwbbNq9FlRBTUfLpjFAbG7sOG7TWfkSz4aj3Wer6KqFBphiIW8Kbj1cwNah9PaUK5vYQQcqfR/qrDa5vT0HVeItq8dUgY+Difx8sai41DkOkyBhsSZyBIuxCDwkMR3NEPwSGhGDRuHwszDzw8YgyMM/ogdvAQxPaeigzWe6wRhJc+WYGAPRPRXe2H+8IHYN7PKja3hs/Q97CaBeWEEOn+3l8+BWbFY0KU9WdDLeryHN6dCsz/1xYhZLuMXoLV6iSMZusV2sbWHTtpLytjwTY6nLWlD0YO64Oo3qvhu2wMYmRJmLl+CKJ4W0L6YC3ew7zRpidVfYVenCZ1LLrzcr7OT4B3PnsNkfVprj4FHz3K6j00BCMHRyN4ag4mvf+c0Nuz3l5CCLmzLD54FuEfH8P602W4oL+GqmsQBj7O5/EyvkxjsPFHJMzwzwPyromDG9xaiLMEwnwnuLlZTwLee2QLWP/Yg7RuJxe2jNV7iA1grc1/sPlVtbdXzD8i8Vowtua+im68XqVZHRm+P0a2N0r7bI1Yl23b0vGw1l5CCLkD8HB7J7F+T+zN6u2Ffz4aLE3dOo33EQlzTuzEzE7cdU7OwnzlMLB4wpeT1n1LA5Cz1uYWN9ger6cQQnx/GhKAnFjXyvGw1l5CCLnN+GXO9w7X/5F1vqytL402bgje7Vr4IjL6BmFNCCF2anFitnDZU+7Fnvfi8PgewsDH5fiyvI4tUQjeQh6PvIUNG8V7dIQQQmr77kLt73Pkobf2qS54uFMrYeDj5kFoXudWoxAkhBDSKPKv1O4GPtejduBx5vPM69xqFIKEEELsFoUgIYSQRuHbsnbkrD/+izRWw3yeeZ1bjUKQEEJIo3jIr/Zj6+uO/oKXtmbi23OXhYGP83ly5nVuNQpBQgghjeKfvQPhYJY6PPRilh0XBvMA5MvyOrZEIUgIIaRRqNup8HZM/b/Vny/L69gShSAhhJBGw78Bhn8TjHmPUI6X2erbYsxRCBJCCGlUPNyO/SMcz4W6ws+tqRB6fODjfB4va4wA5Br3u0MJIYSQ20z+3aG2D8GqCpRcSIe2pAL3uAciVO0uFXCsTGulTLGeqKIoG1m/qdC5szccpXkWVelQ+NMZ5OkdofIJRGB782vMFdDlZSMXHRDa4QbXn3VaZGcXQuekQgd1CLxdpflcWR6yM/Msl9VhZZusrXmsrYVW28qwNpw+XyJNSNqwY8TXo1Rmrj7bggGFWWdQcW8E6q6C1T+VB5fAELjLftdYl5eGQmcNAp3y6rZF4IJ7q+tIx+F3/iOQLmjlH8i2o/huikqycVpbgj+d3KEOCYS7gzSfU3ofGlpGCLlryEPQYWpc3LulOj1W/1qJN0PaS4vcKlrsiXsbu0rZGeqPQpzatRHbdfejXxAPNAOyN8RhbpIOrk2u4PzhBGzK90Z0Vx5oSvVYzQsHsGn5Iqze8j1SLqkQ/dD97PRpRVUhEv/1JuJ/doBzZSHOfJmAxKYaRHfiZzgWtKe2YPXHq7B+9xGkNVVjENu+NYZjizBp+Rlca26ALuc7rF9/HB4P9YIPP5kX7cHcaRuRc48DKi79iF3xSXDo+TD86zzdq7DNsu+xdOoqZF4DynU/I/mzBPzY9mFE+sp/OZ/57UccOpaNouIiNlxAyq59SLtHg36d2yiXydVzW7qURZjxyTdA8ECEmn6+sFomvn5zBwwxsfCXvQEXvpqFHYYIRKu01W3JPLwbh/Iq0PxqKZs2otV9LLiq0rFp+iysTdbiSpMKXGHHLTH9GrqF+8Nsj2sxZCxH3NzvUOZ2DYZz3yP+82wERIfDnWen0vvQ0DJCyF1l/tmLGNOuGdp7tbN1CDrD58En8OhfNAgNDcdfvC9i6+cX8cDfNHAv/BKLP3PEiDmvo193DbpHuiN35Q7oevRBgKtCPZQg67tstOo7FoPan0FigQ8eVQjBilP/xsLTYZg+/XlEdQ1HZIgB+5emodWjEfBudgEnDl9B6LBXEX5tD9IQrhiC/FfdH3+8D8JCWbvCg+B4fAd+aB6FaH9HpCcswmnNZMx8ug9Cw3oh2GEflh1zZfvmA3knhUWE9W1eVyH4rwMRreH7HYXg5kewKRWIib4fzgbWS8nRwcVDBUc3f1bOl9Hg3qID+BYDMG2EBi78Dq9SmXwdStsSGsOwYPhw7UWoWurQqqulEGR/VOzKhmvf2iFYcno3slxjER0WUt2WVr/sRsEDr2LCEw+zaRaATjqkfToXB/3HYcG0kWxZthw7bjFmAZi9YQz2N5NvOw+JH2+B4/B5GNc/AqE9euHevDXYUhqG3ve5KLwP7fBjg8rM3z9CyP86eQja+MEYF7jILilVGCuADt4syNj5+LwWhZ1DEGg6eTpr0ENTghNZ/PKZ9Xpg/4YOHIqIDuxELkwry8vRwjE0BN6mM5m3Bg+2PoOs83xCjehnBiDQ0xHNhUJljq7y64EGVJYDHdvxVmmRc8YFoUHC78cLvNmJX3XsDCsxp7BNZxVcZGdcvt+OPt7gWzWc2YbFH21DNr9qKClhvbQPjmnwxvjY2pcDGUtltdahsC0B70GvTULHUcMRaYvLgmXpSD3tjn79WEBLs+qlTIvsi2p0rf6P44gQFraFp85Ap/g+NLSMEHI3s3EIyhjSsXWzFtED2UmZTxrYmdidnYjFUsYRLvzS0zUWeHJm9W5WhdEA7zby8HLBPfyk/l9+J2vJoQTsdh2AfsLnOA2oKFPx3anh5AJVhdm+3AzWC/v31y4YzEKCc4mYjBXLJ0NjOmAXEjB3dTZ0v6Zjx940lFRJ8zkrZXXWYWK2La7k0HJ8rR6NZ4NuKqLqj70vf6ADvNtK07XokL13DTZtWoP9WUDWIdO4TqqngkoWzI4u7M8hto8Viu9DQ8sIIXezxglB3qtYshwnuj2Pp0Jv4qR6s/XKzmA/O1nyE2b1SbOBClNq1rNpUxIKpfkcvyc1dyvw1MtP1OmB3RIs+DfN/5JtYBz6yS9Byrfl+wTmfLwQH84Yjs4FCZixLo2FgESpzLy9lral/Qxzk0Pwxt9t+00NPLYqLeaMCuqHh2Iw6/FH+gMdIsXx6AB5ShFCyH+vEULQgOyE+fjaZxzmjKy59KVSsX5dTh5qnh3UQccmWriYlrBcT5GjOzoGhSBEGjq2ZX/Nq1TQ5uZJC3A6lBS5wFHpyQvGxadmPSFBHWq2z3pNiz8tweNzZqJ3dUCp0MqzEHnyb/xhO1PoyrYjTdabEPxrkPvX9zC9j8L9SQd+yZj1pN3ViI4ORIX80p1SmZzFbZUgcev3MOjTsHj6FMTFLcJOdviSV0/B0u8tPelZgYpavWrWH6vPz3+1ZD0vfhlS/tbIOLqw9rN9ULH3qQVbVtgffjCFennILRKX4ww69sdOC7bPiu9DQ8sIIXczG4cgfwL0TazCcMwZXjvIHEMiEFGYhrSL0oyiJHyTpUZkEP9r33o9Rc7eCAyLQKg08Ptu3uER8E5LQ7p0L81wOgnJzTTo7idOW6PqULOe0DA1O00y/AnCd9LR/e1psgDk1NDEuCM1hYWHMG3A6cPpcOwVwUpuAg+lf81GqmZa3QDkD7Vk5YnrrzCgovryZwUK81g/tbMaHYRJhTL5Oqxuyx3RE1kv8v2ZeGcGH0ajPyvWDJuJFyLML0irEaApwf796dJ+M4V7sC/dHd2DFAKcc+6FRx4DErdvg1Yn6w6aXYJUqSMQ0Eqa4Jwj0COqBMmpUqyz/UhO1CI0gv8/UXofGlpGCLmb2fZzgiUsNN74sk4vpPeU1Xg2iJ1qMtZg1pJ0VLR2hKHUEZFjpmFUODvR3qCeScmhtxGXGoEFMwYo3i8sSZyNGZ8Xsl4h+wP/ijcGx01GP7/a0cqfQvwA47CW9TqtEZZJlCZM1E+I2+eh8tFsbM3j/RHWq+3QF9PHD0UHhQSvs82M5XhpYbo4Xs0bz37wHiK1izBpLfDy4slQp8/HjPV5cGzNeip/sm211ODlN8ZB05rt3/fWywxpNevQnLe+rd61Dibbrzlvo3Bw7WNfrfR7xH+QgNQrbL+dDNDpXBAyajImRNUOQb6vO7zNerdVJTi97WOsTiyEQco+x6ChWDClr/hHhzX8Eu47y5FcwXqHRh0cezyP6aN6QcUv9Sq9Dw0tI4TcVRr3w/I3UmWAgZ0B+eUvR1vcXzNhPSRDOb/MxsLBhtupMOhY/8sFLsK1u1uM9/BMba+qEB8u4pc+zbelWMYGG+y/sN9s3Q17HytQUcZ6sPyJ1XofNqmOI9tH57qVlN6HhpYRQu4O8hBsvKdDrZHuX9k0ADl+suT3eGy8HeFelq1OoPK2OziK98ksbUuxTHq9xUz38Bp2fB2Fj5/c3GGT6lgIQE7pfWhoGSHk7nP7Q5AQQgi5TSgECSGE2C0KQUIIIXaLQpAQQojdohAkhBBitygECSGE2K1GDcFTF4/gvf3j8fjKzghb4CQMfJzP42WEEEJIY2q0EORBN2J9L2xNX4kLv/+EymuVwsDH+TxexpchhBBCGkujhODYLY8JQce9GDkFW0al4eTUP4WBj/N5HF+GL0sIIYQ0Bpt/bRrv3fFw822txqInNqOLV3eppLbMSycw+cthyC/V4inNWLzdb5lUYl2Z9giySsvZmDPc/buhU1tnNi+JzRPL0dIPnX384dpSmi6/hOyzWdBLkyIvdO7RGaafpzNePIkff2uFrqH+cOIzSrNwVHtJKKutFToFd4PTRdn2JG7eDyKw/Q1+poKx1H7BtXKU/HQEmb+Xw7m5l7Add9nq6rSxGqt39ghKWovbF5YrvCwW8fV06gz3WseiFO1l+y66jHPHT8p+3YPj++oP/Vnz+SK+v/7IqtmWSetu6KmWf/s1IYTcfvKvTXOYGhf3bqlOj9W/VuLNkPbSIrcGv883e98EYXzNsP1WA5DzaHkvND5R2HZqNTIKTyCqU194uflKpWauHMGq5ZGYfvZnoOoeGH9Pxq5MR/QIuw+5BwIw75wPWhsvozg3Ae8nTkV21VOI9WNn/+LdmLNjJS41ZXUuX0KxMDjCJ+g+uAkrvozDnwdg3I9X0KXLQHTiX55cdBwHM84Iy57KHontv0rrvnwZLn7dUPqtbHvSOnUuIejSTiEEFdrvwstWPIoPCprBq7IcxYU7MP/QMpS1fArdvZoJ1S+nvYbB366GW9uXEeYhzBLlrseU7UNx0nEC+qtbisudKsB9fD1FB7Hx4Bh89+cQPKpuLR2LI+gYHc3+DJA7iW2fvY4fqtiK9aZjxPfVC8UnkvATn85PQFx2FtpdbwK9tL/eF96o2ZZ0HIrhh7AObFuEEHIHmX/2Isa0a4b2Xu1s2xM09QL55c5JsQukubWVlV/GgkOTENfnQ7g6t8KHSXFYl7pQoTd4Gd+tCcKqll9g7TMPmvWEWPB+7oD4thex+FHp1H5qLmK+ccaKyZMQWLgZ/4w/j1FvTkeYWFrbbzvxDisP7ZSAb5y3Ydlj/lKBqM66GUvzlCm133KZke3DS/sL8fLoT/BQW6Dk4JOIOX0BgfdMxorxw6Rf0CjH0fXBiNf5oXngRqE9wnK/TcZZti5B7jqMTziJZ8az9RisHQsWwvMWof2oLzDA2q8hsfYEp/jjcPW2pTbJt0UIIXeoRvsC7aMXkoTXfoFDhVceeHww4eMvJDyCL898xno7rwvzTMua6tahO4Lk4gcxLLpuAFqk8kKnq+UsIm7s4tG1yA8cjL+HjUd5ThJMP3V4Sym130qZU9gwDGuxDMmZssuN7d/CK82mIOGotGfnE1gATseo+xUuP7bzRycUokz80TxCCLF7Ng3BgsvnhNf7PUOrA48PpjDk49m/nsIDnl0xrc9H1ctyprp1GC6jGJ3RXuE3W/W/HcHR40ls2IvN+2fiasBjrIbJOixc0gcvSsPmTGk2ziM1pxwDurDen38sBlxbhoPZUtENnDo1onp9L8bvtXjfrJpS+4UyDdrXuSrtj/asy1VcLo9yL/R5aDKOpiXg4jXWg/xmLgIjhqOT+TtayY61jg+XkP3NWnzd8q8IUzh2oiNY+XnNMVqYbOmeqAW5b9QchyXLUM/DRwght02jfUSCu379uhB6pjA0BWD8s4nCpdD6K8fVq9KoBfrL6cg8n4g9yY8juf0hbBzaTdazGoaXR32BJdIwJECanb0Tmyv/CnUbHhitofZxxtcZJ6VCZWFdPqle35K/xyr+wK9Iqf2lYB1XM1aWDxyPf6jmYvP2ZVh1dTaG97RwH/Li+5gY/yQbRmBz2d+x7rkXceM7vw/i+QE1x2hseD0v9bLeafVxGPUiAqXZhBByp7JpCPq06iS8/lR0Wgg5HnY89Hj4WQtAvixnqltHay/4IAmZVjqKnI96AkYNnY3psbNRlLMT2bVC5R64qVrBVRqcmotzszMSUFL5H3wsBMaT+DjvMkpy9uLUNbFcUfPW1etzdb3BU6FK7W/nhy5NLZRdy0JmsRe6eJiHkTN6Rs9G2S/pGNC75v5cLR0/wLqJh4Rh1jOD0UnxJ9trOLvWHKMb7VK1ZrI6qvpWIoSQ28emIdjTL1Z43Z+9TXiVB6G1HqBpWVPdOpxj8XigM+K/W4ds+UcTal0qFDmFTcLUtksxZ+8NenTXTiL1ghdee0oMC2F4fTdec1mK747XXe9/Ran9TR/EQ/eLZeeuSPNZL/Dc3kWIbzoZD4lXimvzH4ZZE7/AMOp2EULITbNpCA4MHim88qc9+ecAOVMQWgpAvgxfljPVtSRw0NdY3DYRU1c5IHieOMSst3QvjvWUBqxB559mYvt5aRZmYoRURxzm4tjxHYhvPgSRHaVFBP6IDOiGHT8dgVGaY82h4+1l63PAPw8q30NTar9Y9h+M+yQAI5b0wYgFLTAuV4PFIyYh8Ja/W3WPxSlh/k7ExcvnP4k9hUKBsvO9ZHXY8Dl9FR4h5M72P/1hec6ou4yrTjdxya6RCO2Sxms417lMaLX9V8tR9ifrHTqwMtMH3AkhhPzX5B+RsHkIcvyr0H44d0AY558Z5B+DMD0Fyu8B8kugph7gXzr1xcqn9wrj/7tOYvOSN3BQmqoxBFMnjqcHRggh5DZq9BDkTD1CJTfTAySEEEIaotE+LC/Hw23jc98LQefX5n40a9pMGPg4n8fLKAAJIYQ0pkbrCRJCCCF3gtvSEySEEELuNBSChBBC7BaFICGEELtFIUgIIcRuUQgSQgixWxSChBBC7BaFICGEELtFIUgIIcRuUQgSQgixWxSChBBC7BaFICGEELtFIUgIIcRuUQgSQgixW7V+RYIQQgixB9U/qvtbaen1/IsXcfYnLYpKSlBVVSUtQgghhNxdHJo2hYe7O0IeCEDXoCA00en1169WVODP8nJcrajE9evXpUUJIYSQu0uTJk3Q3LEZ7nF2hnubNmiiLyuj1COEEGJ3XFu2xP8DaKcy/UdYKwQAAAAASUVORK5CYII="},1151:(e,t,i)=>{i.d(t,{Z:()=>a,a:()=>r});var s=i(7294);const n={},o=s.createContext(n);function r(e){const t=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:r(e.components),s.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/a47ab00a.a4133254.js b/assets/js/a47ab00a.a4133254.js new file mode 100644 index 000000000..fed3ac9d9 --- /dev/null +++ b/assets/js/a47ab00a.a4133254.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[572],{2861:(e,a,s)=>{s.r(a),s.d(a,{assets:()=>i,contentTitle:()=>r,default:()=>p,frontMatter:()=>o,metadata:()=>c,toc:()=>d});var n=s(5893),t=s(1151);const o={title:"Backups and Recovery",hide_title:!0,sidebar_position:1},r="AWS Backups and Recovery",c={id:"cado-response/deploy/aws/performance-resiliency/aws-backups",title:"Backups and Recovery",description:"Backup and Recovery",source:"@site/docs/cado-response/deploy/aws/performance-resiliency/aws-backups.md",sourceDirName:"cado-response/deploy/aws/performance-resiliency",slug:"/cado-response/deploy/aws/performance-resiliency/aws-backups",permalink:"/cado-response/deploy/aws/performance-resiliency/aws-backups",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/performance-resiliency/aws-backups.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Backups and Recovery",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Private IP Addresses",permalink:"/cado-response/deploy/aws/networking/internet-routable-addresses"},next:{title:"Large EC2 Imports",permalink:"/cado-response/deploy/aws/performance-resiliency/large-aws-imports"}},i={},d=[{value:"Backup and Recovery",id:"backup-and-recovery",level:3},{value:"Scheduling Automated Backups of the Data Volume",id:"scheduling-automated-backups-of-the-data-volume",level:4},{value:"Restoring the Data Volume",id:"restoring-the-data-volume",level:4}];function l(e){const a={a:"a",code:"code",h1:"h1",h3:"h3",h4:"h4",img:"img",p:"p",strong:"strong",...(0,t.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(a.h1,{id:"aws-backups-and-recovery",children:"AWS Backups and Recovery"}),"\n",(0,n.jsx)(a.h3,{id:"backup-and-recovery",children:"Backup and Recovery"}),"\n",(0,n.jsx)(a.p,{children:"This section explains how to recover or migrate the Cado platform to a new instance."}),"\n",(0,n.jsx)(a.p,{children:"Cado also backs up any imports to S3 which can then be re-imported later to a fresh instance, but you will need to restore the data volume if you want to recover user settings such as user logins."}),"\n",(0,n.jsx)(a.p,{children:"If a Cado instance fails, you will need to recover and attach the data volume to a new instance. The data volume contains previously imported data as well as user settings."}),"\n",(0,n.jsx)(a.p,{children:"You can also use this approach to migrate Cado to a new availability zone or region."}),"\n",(0,n.jsx)(a.h4,{id:"scheduling-automated-backups-of-the-data-volume",children:"Scheduling Automated Backups of the Data Volume"}),"\n",(0,n.jsx)(a.p,{children:"Amazon EBS Snapshots are stored by AWS in Amazon S3, where it is stored redundantly in multiple Availability Zones."}),"\n",(0,n.jsxs)(a.p,{children:["You can create an ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://us-west-2.console.aws.amazon.com/events/home",children:"EventBridge"})})," rule that regularly (e.g. daily) backs up the CadoResponse EC2 instance:"]}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 1",src:s(6476).Z+"",width:"551",height:"560"})}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 2",src:s(1209).Z+"",width:"571",height:"408"})}),"\n",(0,n.jsxs)(a.p,{children:["For more, see ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-scheduled-snapshot.html",children:"this tutorial"})})," from AWS."]}),"\n",(0,n.jsx)(a.h4,{id:"restoring-the-data-volume",children:"Restoring the Data Volume"}),"\n",(0,n.jsx)(a.p,{children:"To perform a migration or restoration to a new instance, deploy a Cado installation and Stop the Cado EC2 Installation."}),"\n",(0,n.jsxs)(a.p,{children:["The operating system volume will be smaller (typically 10 GB). Detach the larger Data Volume (",(0,n.jsx)(a.code,{children:"/dev/sdh"})," seen below):"]}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 3",src:s(79).Z+"",width:"606",height:"104"})}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 4",src:s(7921).Z+"",width:"247",height:"270"})}),"\n",(0,n.jsxs)(a.p,{children:["Next, ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/restore.html",children:"restore"})})," the Snapshot backup of your old Cado installation to a Volume in the same availability zone as your new Cado EC2 Instance."]}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 5",src:s(8031).Z+"",width:"254",height:"64"})}),"\n",(0,n.jsxs)(a.p,{children:["Then, simply ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-attaching-volume.html",children:"attach"})})," the restored Data Volume to your new Cado EC2 Instance and start it."]})]})}function p(e={}){const{wrapper:a}={...(0,t.a)(),...e.components};return a?(0,n.jsx)(a,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},6476:(e,a,s)=>{s.d(a,{Z:()=>n});const n=s.p+"assets/images/aws-backup-1-b629b9478cc5046d96fdc7973d8fc07d.png"},1209:(e,a,s)=>{s.d(a,{Z:()=>n});const n=s.p+"assets/images/aws-backup-2-5704a0f85c843e2bac5efef40f42d14b.png"},79:(e,a,s)=>{s.d(a,{Z:()=>n});const n=s.p+"assets/images/aws-backup-3-aa9c09491fe25218da52c4c56e163e32.png"},7921:(e,a,s)=>{s.d(a,{Z:()=>n});const n=s.p+"assets/images/aws-backup-4-5504cf261e4c5a3680ed3e026c7928a8.png"},8031:(e,a,s)=>{s.d(a,{Z:()=>n});const n="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAP4AAABACAYAAAA6VspUAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAABgZSURBVHhe7Z3pU1xXmqef3MiFJJMEMiHZNwFCSEKbte+StdmtcnS7eiq6oiPmL5jpLz2faqK+zIeJmJmIiZilumuiqruqXba7u1y22tZqW2hBktkkJLGIRawCkoRcyYTc52SSkhFGEiCpCon7oAxJ5977nuWe3znve7h5jywYDMaQkJBYVbwy4Y/ZxrnX1oFtfIJIJJJMlVjpqFQqykuLWVu5hrQ0fTJV4m3nlQn/7IVvmJh0kJWZkehMEm8G/ukZRsds7N+zIyF+idXBKxP+L/7fb6gSHWf/np2kpEjCf1Pw+af5+1/9li2bNrDznS3JVIm3HXny75cmHA6j0agl0b9hpOq0yGUyotFoMkViNfDKhC8hIfHmIAlfQmIVIglfQmIVIglfQmIVsmqFH/I5sU868c2EkikSEquHN0P4ETvdDVf46g+f803rIBO+l1yBDo3Sdu0bfv/xV9x4MIpb0r7EKuONEH5o/AE3r3/L52cv8Ydrd+mf9LFo6c8M03L5HL+71ELvhG82TSYj4p/E4XDhC0WJyWaTVxqhcJiGptt8/uV5hh+NJFMlJF6eN0D4QWzdD+kf8xNRxXA97KR/1I5vgaeCo+EZPC4nbt80oUhyaHD10/zddb5s6GDQ7iYQChORmyjfspuT7x9ka0kWesXsqXGiQS+O8WFGxicTYUD0yeNNUaKhAMFgiEhU/Dtx3hjjLh+B8JxhKBrG57ExNjKC3eMn+Lgcy6D3YT8Xv7nCma8ucP1mAw6nK3lEQuLlUPzsZz/7efLfL0V8ZsrNzaGoID+Z8ooIDtNU10CzI531ZRpibiF6QwmlBTmYNMlxK+xl6N4tLl+9yfWGVlrbOhkMaNH6+2i5dYtrbcKd904z7RBCDeswZYCzvYu2Ngcqq5msDD2qqB9bewN1V65x5btW7tzvov2hjbDGSLpRj1oxSdfVeuqaHtDX10lrSzM3Gu+KvHpxKdPJNBnQhR9x58Z1vqm7xXd32rnf2Y1LYSLDlI5uic81uVxuLlyq487d+0z5fAnvJDvbTLbFjFI5Z6R6BXzX2EJOtoXC/LxkisTbzoqf8YPjvXSPTUBuGZs3raPQpGCgd5DRSS/hxBlRnL1NXL50gYvNPbhkQthpGmSxMOFQkGm/j1AoHsQLF0GkxeI/MS8j7Xepr2ulx+YhII76Ht3hyuWLwjMYwJ+SgVnlobvlGp9dbOTBqIsQyWsu1dPycIKgLg1dZILe1puca+hkyDmDs6+Z61eu0uFUkJFfRIk5VQwYooRLfCg64eI33+a2EL3P70+k2cbtXKu/xcjoWOL/EhIvwwoXvp+R7n5GJ2IUFlrJq1xLWZYJxVAPA7ZJphLKd9Lf2sb97gDW9Ts5+d4J/uzUcY7UFlNQWsOmqgKs6WK6NZewdd8h3t1USrZembD+PTOMPRAzdO8EqeVbOHTsBKdP7+OdXC2ue/doH7LjnR1lIKAiu6KWfUePcXx7CTnpcibcHhEWiDDA68Y1Pc0UKWQWVbJr/yF2VFpJVyevXSRxF/9mQzMTk5PJlFnahQfxXVOL5PJLvDQrW/j+Idq7x7A5gzge3ubylWYe2LyEfCN0DYxh9wbFSV5cE35mfAaKi4spzs3EYEgnI02PLtVIml6HWiUDtR5DhoUsg/i/cv5qXoAp9zSBaRX5hfnkZmdiyhXhhDUdY8SFd2qGmcfCR0t6uhFjmgGDXktKinzWixA/xuJattUUoZns5OqFs3x6tp77Q04CSwjz4y5+/Y0GEU4MEpm3PjAzM8N1cay9s4tAIF53CYnlsaKF7xvppXdsErdwtG19HTTcaKHT7hHz8wz93YOMTIhBACHihI6DBMNR5q6zLR45SoUMhTxERBiIxhcOo2HxJyrCAnFMLkO+iJbSWKrYeeg9fnL6CNvzIgy01vPFjXYGHbPu+mJout36lIs/H8nll3gVrGDhe3nUNYTNHqRg0y5Onv6AD390mh//xSF2FptRCne/f3QCTzCD7DwDeqOH9tY7QjTtYrZ8QPewHfd0WMzIaiFo4dpPjjI80EvPqIOpmfm/EtCQZTWhT4P+zg7aH3TQdf82d4WL79JnYzbpSV3Eepp3bBhHUIa1cgPbN4qQQhdm2ObA5Vv87Dxun0gs5j2PwaFHCc9AQmK5rNxVfW8316+0cGdITe3Ro7y7dwvrSoooKbKisgtPoL+fSUMx5YVFFGWnEPHa6O7qo69/iN7uHh5FjFhzLJjTYjgGhhgaGGXMNsqEPFO48io8bZ10Dkcp2LaONQVmjKkaZNMOcW0fD/sH6OnoosutZs2OvezfXE623sdAY9ucazKR2dppah9gJKWQ7evKSBv/jsvXbnKztY+ungEGHEpKN25iR3UhJu38dYWF0Wo0FIo23FCzlk0baxb81K5fR1lZMampuuRVL4e0qr/6eGUv4vhfv/gVW7fUsnfX9mTKS+Ifob1jgCGXmtKaMiFuIymJA1Fcg0KA/eP408uoKc3DkhrFOdjDg74R7FNhYjIVpuJKqkusZGqDjPcIEQ9O4BITb2p+hbgmjUDvQ3pHo+RsWEOxiOXVRPCN9dLRM8Soa4ZITIEqzULl2nIKzQZS5B6G73Y/dQ0T3dzrHmFcZaV2TSFG/0Nx/TCjbhEyxK/XZbKmeo0ou7C/gn2r//m/f8nGDevYvWNbMkXibWflCn85xCKE40G+XCHce3n8Ab3viYnYPSYTafFPMm0hEjYixEQUpFAoRGz/vJMX4GWv/xMgCX/1sbJX9ZeKTIFSpUKpmCf6ODJ5QoTPFX2chI0UVCrl8kT7stdLSPwReLuELyEhsSgk4UtIrEIk4UtIrEIk4UtIrEJemfDjm2j4/dPMBOJfeZF4U/B4pxKv1o7/FkRi9fDKfp33bd11evsHEgOA1IneHOLfBIyEIxzct4vyspJkqsTbjsxmn4g9HBzA7fUmk5aHw+nmYd8ATpdL2pzhDUKhUJIXf+KyMB+dVpNMlXhbqSorI8dsRiZm6dj1xkbS9HosmZnJwxISEm8bnb29VJSWsL6q6nvhr6uoSCRKSEi8nVy8dg29LpXa6mppVV9CYjURjcbfQBV/oFxCQmLVIQlfQmIVIglfQmIVIglfQmIVIglfQmIVIglfQmIVIgn/FRGZdmEbseOcCsS37lgRRHx2BjtbaWnt5pHDT0h6oFI0ygwu2yjjjqk5r0xffbx+4c/Y6b9znTO//xd++9Hv+OTzczR02/C+Zd/lCYzc5vPfXeVGxyTTybQ/KVMD3PzXz/jsiyvcaumg3+5hWhI+TI/Q9Pmn1N3sZHJF3Kg/Da9V+DNjd/n6nz7i0z/U0z44icc3jWv8IY/GXSzhjdOLx9HFZ3W3aRqMb3n1xyXsHuJO40N6x/yshK0ugvYuvq4bwaEpoWZzFYVZqaRIbwKL3yiGWpvo6bPhW+6M/yfsZ6+K1yf8gI17Fz+nrtOLad1OTpw6yen3TnHq3SNsLreQNm9bqUgoRDgSebL9dSQ0u1GkZyqISP6eSIig34V9wolr3rHgRDd1zZ08sPt+4G4/094SiYRmcDucuD3CdX6JnXDnkrDpcuP1i7LFTUYjBH1OJl0+poPz8nhyzMNUQLTXM75bGfRMMj5jJKt0LTUbKyjITEMzd2+AsGjHUGQ2P8Fi6rWkcj7F92X2TH+f5xOeYyfeL6YcdiadbvyivD/MZU57BOcfX36+z2vn5/WzN4XX9qx+cOgK/+O/nCWw7QQ//XA3ZYb528U66PzDFcbUBqanHtHVE6Ts8FF2bzDiaL3G9fsjwhWTIRc327JxD/u2VZE1dZ+LV1p55PQTjoWYdsnJ3XqAAztLiHVe4PzZc3zSGiInP59yy1YOfbCHbVUqRpsWtpc/t0yBEZrPNOPNrRYzZBlZWpEWsnHni0bc1rWs21xItO8W395sZ8wbJhbxIcvexP4D21mXb2Cm5Tf8p/9qY+1PP+Cn75ejG2rgTGeE0sq1bCxMR8UMQw1f0R4uYW31eize25y5bycy5SI4M43H4cEdzKJibTZKnwu3cwK73Yu2ci/HD26mzKwl5uqjoa6euyMOpuVyImELG/fsZtu6PIxPqjKbz9kzX/DJZT8ZlWVUlaxlz/HDVGpaaHFoMPq9DHf1ECg7wrHd60gdbXpmvaLxeiyxnE/NJtOiDesv0Ng9wRQGUiJGavbupFZ0tY7zbThVUXwBD17XrB1Z6Q5OHd5KVU6Y3osXuNnrwCM0GQmI2TWtit0H91JbmoW/6wsu900RHA8TnZli0uclqF/DzoP72FxqRhd8Rr55dj77z/+djrQNFJUXJTY+fTpfPTHvALcvf0vzgBM/SvxhPRXb97O/NpfA/bML97MakWeyyiuV+LP6Oo2OTete47P60+ODDEQzMeXnYdIvtEe0l6FrX3PhXAMPvQpMORZMwg3w9tZztuUBE8oMytaUUpLmofmbFm53TxJQasm0WCkoKqNizRpylMNcbrzDvZEpFGlZZJlS0ejTyMjJpbAoi/RUFZ6eZ9t7KsQTQvKIwaqu5TYDjtkjwdE2zjd38cA5IzrYPS581UinI4XssnLKi01Md1zkmxu3GXT+0LkP2ju53NQ2Z1YIYe+4SmNbFzafmE3ix8/c4u5wFH12AWUl6QTuXOHqjU7cSiPW4nKKUh00nG+i4YEQOi56rp6nuWsSZWapGKSLSPO28E1LKz0Tc2siRy3awmI2oRODanqWlfyibDJE2/qH6rlw/gK3hGAUplyyTXoU9vvPrdfSy/k0MyN3RPsPMabMobS0mFJRFpNejTJkp6PuS6429RNUZ5Ir7JQavLRcukNTl1PYUZJiMJOTV0BJ+RoqSox4b12ipbErEZt7B0VdrjbS61eTWVhORVkOssErfF3fSJ844Zn5JsOdYERBavpC+Yp2vi4GlTuDRIxFwm4pucpRbpyt51bnBCH9wv3s9S+WvVpen/CnxgkZZegMalTPzCVEICWDil3H+PCvTrK9Ss1Ey3UmQhY27zrEkQN7OHJ4G7mTdsb67cwY14gR/ygn3j3EgQPHOHGgUtzIaRxCSBlr93N47xYKq2vZcfxH/NVf72WjmFVGG55tzzM3QFNlUb29ghmng/6xeAcIMdrZhCs7g4LyLIK931LvVlC29yinTx7j/R/9JR9sNTDQ20PbiGd5cb2Yfc3F29h/+BgnTx1kl0WGWmGiatte3j1+jA9O7sEUkgs3d5qAa4Dvrk0QMdey9/AhDu07zLvbrDgmxhhI7CH4mBQsj9vCLLyNve/xl399QrSthfgmwaGgioyKHZz8i3/He9tLkYnB7oX1Wko5E2X4ntiMH4dTiNhUzqYd4vz39rGhzJzcksyJypRD7e4DHBN2fnRiF5aoCpc7IOzoyd8m7tmpExw9eIB3Tx3lnbQAkUkxCycbOxRLp3DzbvaLa0+8/2NO78rH9ugRD8a8BJ6bLxhySnln/wL5xtu5bpigeQeHTr7PqZPv8ZMPD1DhbKX33gDywoX6WTpv2psMXpvwlSoNcneEsF+4Ysm0hdAYjaQb9GjVSpTyKZxiJva03ePmxTN88vEnfHLxNuOhMBpxx+QBG80Xfs+vfvUP/Pqjj/n4XCMDtqmkpYXw4nievacWu5RkrdtBtVzEk4OPRGw3xoPGEPkZhZTlqHGPDeNKU2EUo70u3nkUBuHq5REa9DI6NiUc7OWQglKpjO//IezJxSAmZmuVSItvxBE/qklFoUwuhngcdE96abv7HefP/DMfffzPnLttJxDWiPLIZ/cNXQzaNNJNaeh1KaiUQRy2xdRrCeWcR0reZk7UWqDtIr/8v3/Hr/9NeHh2/5PYWKMRdlSz24spU0SfUTz2DiO4em/yxT/9I7/+9W/57UdnuNQ/ylMbh4syKZXy2fso12HOziH2aJpxYT+63Hzj7WwX4UpqFvrU2b2bNOZcilPceEZtuHxv6nLe07w24RvMRWTPuHEMT+DxP0/6c1GhEoLUmoxYhBuVL2Ko/LKNHPrJUXZszGLqnnAN2x4S1JkpyM3BmmVAm/K8PemeZy8Pw7xLFemlbK6IMTo5TM/9O9xVFGItKcMq3GSlcFvmv1Es/vVGUkS68B9f+4K5EJpWoRGiNWPNFfUQdSmtPcBP3n2HjXlpYthaDvHNP15vvRTpRew+eoSTh7ezPl8jPLozXGm4x6j3Bctizm4ufd7EfZsMY24uVquFDI3wHpOHFyIWEaLUykVTic9y8020s2I2nycLerHE5CUXg578hTuyvBm8NuGnWGvYuTHGUOu3fH2rixF3MPFut2BwCs/UNMHQQsvR6VgqcwmZMsmq2MS+Q0c4Jm7esX0bKDWn4HzYxoTawqa9Rzh1dD97asvJFKHEE2RiShK2p2dChBPmn2dPv0An0lO0cT3qsRFuXrqMrzCTghKLcA9TyClai9nlZWzYkdiDDxGjPnzQiypHT0G2GIAS18c7VXKQi5dl0oPHPUNAJMcf8HG4RNmWFRMI0rOozA1jysyiQri3R+L1EJ+D60uwiBhzeSy2Xi+BuOcaYx7r9xzlzz88zub0cWwjwzhfNBl4HnG7M4C2dBsHTxzjyP6trDcbxR2aw5QbV3xFPv5k0oyNns4e1FYjBTlGNMvNN93K+mIfPscAY65ZD8E32Mvd6Qy0ebmY4vHSD/rZm8fyJorFoM9nx+lTuM5dpeX8P9DxrXAlhVsWjSmwbhVx+h5j8sS5aMjbdoSN4/U0ffp3dOWY0QSFs6ktE/HUVjKLKtG2tnLu4yma0jPIlk3gDWcnrxVXW4qp0XbQ8vtf0le/leN/tkfEoc+yt4v1pZk/6NhphVvYbGjkdw0+andZKciaXaVOrzjM8bIvqb/4G/7bVQ0pshl8UyrWHVzPujw9ekd8hbeZu1+JvEpMvGMpoFLWQNO//ILB6/kUFeUicwsX9PviLg1tHtuPrcd+rZlP/083V8wa4lXRlb7D8b01lGYtJ8pUvLBeyu7kqcvE23eDr+vaGI6oUURtDNkslB8sISvtBYoxWakpucbNW1/wj2PXMGel4lRMI0tLHo8TneTBrTP8/e0YAbcHr09F9dFq1lpTmV5uvtpcth3dzNDlVv71F218KcKBoBhgfEXv8P6mcuLNrFign22tMr/8IPlHRPEf/uPf/HxwZCTxvr1MkymZ/CqQo83Ioygvmwy9FnWKGo0ulfTMbArLyii2ZmA0ZpJTWUVJQSZ64Z7FURvMIq4WM408hkKrQ6vRYzQLOyV55OXlYRJ2UnRCaEYzxeVrKK+ooKbYQpaIx1RaAxaTOKbVkmrIobjUSl5BAcUL2ssR5RKdIpHrHFQ6Ee+mYCraxMaaSgoyNInRUa4RsW+2mHGEaywT8aDGaKViyz72bKsiL10IRsTOWVlpok7ZFIh8c6xmckw6UjUaNPoMcgrKqKouZ82aaoqzM0nTajBk57O2Oh+rKZ6HcE91pqfbQ65Cl2mhskqENSYDGaLcGQYdsqgIX1K14mPAnF9ISa4JvfrpmsiEl/K0/bg5LRk5lVQV5yfaK97iL6qX8gd2XlTO2bweEwl4cU8FiaaI8or7k7d2J9s3VZEr2kZrsFBQVSVmaBOJXcTn2snJJC9Lh06rRqeLr6CXUFFTQUV1NbmZJgIDl6gbVlNYspbSzFTUqdlUbBVe4NZKctPVxJabr+g/6Zm5wpNMRR6TifhfR1bROvYd3M6mUhH3q2SiH/2wn5mNT9d7JdI7OIhKqcJqmfOyzdf9zr1I/DXO0ajoXIrZXWST6c8kEiYszo/E49D4NY8vSKSLji0CU8WTxEXwLHtLJRoR3quwI5OjTOzKm0xfkPjOufE8F3Pu4nnSlnGb8bZ8FWHnkuq1RB7bjrfDEts+UVeE2OaVqf/i3/LzqwaOfvDv+fPabJTxnZDnl/sl8o0z285idhQXLqmvrVD+KL/Hn49CqSQlRczK8Y6aTHsuCiXxXWfVqnk3LJGuXPqNeJa9pSI6V3xHXrVyMXbEuWKEXdy5i+dJWwq7r0T0cZZUryXy2PYy2j5R1wXKJFdlYUlNJ1UcS9zbhcr9EvnGmW3nZfS1N4C3r0YSqwJT5Ul+fOIQm/INK97FXolIwpd4I0nLrWFrbTVFmTpJ+MtAEr6ExCpEEr6ExCpEEr6ExCpEEr6ExCpEEr6ExCrkyQM8CqWCdIMhmSwhIfG2MTQyQlFeQeIBnoTwXR4P0dgLvrwgISHxxqOQK2cf2XW5PTG1OgWNeuHvU0tISLw9eKemkMsVyGKJL19LSEisHuD/A51YNghCpMniAAAAAElFTkSuQmCC"},1151:(e,a,s)=>{s.d(a,{Z:()=>c,a:()=>r});var n=s(7294);const t={},o=n.createContext(t);function r(e){const a=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(a):{...a,...e}}),[a,e])}function c(e){let a;return a=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:r(e.components),n.createElement(o.Provider,{value:a},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/a47ab00a.c5c34c16.js b/assets/js/a47ab00a.c5c34c16.js deleted file mode 100644 index 990c1afb0..000000000 --- a/assets/js/a47ab00a.c5c34c16.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[572],{2861:(e,a,s)=>{s.r(a),s.d(a,{assets:()=>i,contentTitle:()=>r,default:()=>p,frontMatter:()=>o,metadata:()=>c,toc:()=>d});var n=s(5893),t=s(1151);const o={title:"Backups and Recovery",hide_title:!0,sidebar_position:1},r="AWS Backups and Recovery",c={id:"cado-response/deploy/aws/performance-resiliency/aws-backups",title:"Backups and Recovery",description:"Backup and Recovery",source:"@site/docs/cado-response/deploy/aws/performance-resiliency/aws-backups.md",sourceDirName:"cado-response/deploy/aws/performance-resiliency",slug:"/cado-response/deploy/aws/performance-resiliency/aws-backups",permalink:"/cado-response/deploy/aws/performance-resiliency/aws-backups",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/performance-resiliency/aws-backups.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Backups and Recovery",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Private IP Addresses",permalink:"/cado-response/deploy/aws/networking/internet-routable-addresses"},next:{title:"Large EC2 Imports",permalink:"/cado-response/deploy/aws/performance-resiliency/large-aws-imports"}},i={},d=[{value:"Backup and Recovery",id:"backup-and-recovery",level:3},{value:"Scheduling Automated Backups of the Data Volume",id:"scheduling-automated-backups-of-the-data-volume",level:4},{value:"Restoring the Data Volume",id:"restoring-the-data-volume",level:4}];function l(e){const a={a:"a",code:"code",h1:"h1",h3:"h3",h4:"h4",img:"img",p:"p",strong:"strong",...(0,t.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(a.h1,{id:"aws-backups-and-recovery",children:"AWS Backups and Recovery"}),"\n",(0,n.jsx)(a.h3,{id:"backup-and-recovery",children:"Backup and Recovery"}),"\n",(0,n.jsx)(a.p,{children:"This section explains how to recover or migrate the Cado platform to a new instance."}),"\n",(0,n.jsx)(a.p,{children:"Cado also backs up any imports to S3 which can then be re-imported later to a fresh instance, but you will need to restore the data volume if you want to recover user settings such as user logins."}),"\n",(0,n.jsx)(a.p,{children:"If a Cado instance fails, you will need to recover and attach the data volume to a new instance. The data volume contains previously imported data as well as user settings."}),"\n",(0,n.jsx)(a.p,{children:"You can also use this approach to migrate Cado to a new availability zone or region."}),"\n",(0,n.jsx)(a.h4,{id:"scheduling-automated-backups-of-the-data-volume",children:"Scheduling Automated Backups of the Data Volume"}),"\n",(0,n.jsx)(a.p,{children:"Amazon EBS Snapshots are stored by AWS in Amazon S3, where it is stored redundantly in multiple Availability Zones."}),"\n",(0,n.jsxs)(a.p,{children:["You can create an ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://us-west-2.console.aws.amazon.com/events/home",children:"EventBridge"})})," rule that regularly (e.g. daily) backs up the CadoResponse EC2 instance:"]}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 1",src:s(6476).Z+"",width:"551",height:"560"})}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 2",src:s(1209).Z+"",width:"571",height:"408"})}),"\n",(0,n.jsxs)(a.p,{children:["For more, see ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-scheduled-snapshot.html",children:"this tutorial"})})," from AWS."]}),"\n",(0,n.jsx)(a.h4,{id:"restoring-the-data-volume",children:"Restoring the Data Volume"}),"\n",(0,n.jsx)(a.p,{children:"To perform a migration or restoration to a new instance, deploy a Cado installation and Stop the Cado EC2 Installation."}),"\n",(0,n.jsxs)(a.p,{children:["The operating system volume will be smaller (typically 10 GB). Detach the larger Data Volume (",(0,n.jsx)(a.code,{children:"/dev/sdh"})," seen below):"]}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 3",src:s(79).Z+"",width:"606",height:"104"})}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 4",src:s(7921).Z+"",width:"247",height:"270"})}),"\n",(0,n.jsxs)(a.p,{children:["Next, ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/restore.html",children:"restore"})})," the Snapshot backup of your old Cado installation to a Volume in the same availability zone as your new Cado EC2 Instance."]}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Backup 5",src:s(8031).Z+"",width:"254",height:"64"})}),"\n",(0,n.jsxs)(a.p,{children:["Then, simply ",(0,n.jsx)(a.strong,{children:(0,n.jsx)(a.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-attaching-volume.html",children:"attach"})})," the restored Data Volume to your new Cado EC2 Instance and start it."]})]})}function p(e={}){const{wrapper:a}={...(0,t.a)(),...e.components};return a?(0,n.jsx)(a,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},6476:(e,a,s)=>{s.d(a,{Z:()=>n});const n=s.p+"assets/images/aws-backup-1-b629b9478cc5046d96fdc7973d8fc07d.png"},1209:(e,a,s)=>{s.d(a,{Z:()=>n});const n=s.p+"assets/images/aws-backup-2-5704a0f85c843e2bac5efef40f42d14b.png"},79:(e,a,s)=>{s.d(a,{Z:()=>n});const n=s.p+"assets/images/aws-backup-3-aa9c09491fe25218da52c4c56e163e32.png"},7921:(e,a,s)=>{s.d(a,{Z:()=>n});const n=s.p+"assets/images/aws-backup-4-5504cf261e4c5a3680ed3e026c7928a8.png"},8031:(e,a,s)=>{s.d(a,{Z:()=>n});const n="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAP4AAABACAYAAAA6VspUAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAABgZSURBVHhe7Z3pU1xXmqef3MiFJJMEMiHZNwFCSEKbte+StdmtcnS7eiq6oiPmL5jpLz2faqK+zIeJmJmIiZilumuiqruqXba7u1y22tZqW2hBktkkJLGIRawCkoRcyYTc52SSkhFGEiCpCon7oAxJ5977nuWe3znve7h5jywYDMaQkJBYVbwy4Y/ZxrnX1oFtfIJIJJJMlVjpqFQqykuLWVu5hrQ0fTJV4m3nlQn/7IVvmJh0kJWZkehMEm8G/ukZRsds7N+zIyF+idXBKxP+L/7fb6gSHWf/np2kpEjCf1Pw+af5+1/9li2bNrDznS3JVIm3HXny75cmHA6j0agl0b9hpOq0yGUyotFoMkViNfDKhC8hIfHmIAlfQmIVIglfQmIVIglfQmIVsmqFH/I5sU868c2EkikSEquHN0P4ETvdDVf46g+f803rIBO+l1yBDo3Sdu0bfv/xV9x4MIpb0r7EKuONEH5o/AE3r3/L52cv8Ydrd+mf9LFo6c8M03L5HL+71ELvhG82TSYj4p/E4XDhC0WJyWaTVxqhcJiGptt8/uV5hh+NJFMlJF6eN0D4QWzdD+kf8xNRxXA97KR/1I5vgaeCo+EZPC4nbt80oUhyaHD10/zddb5s6GDQ7iYQChORmyjfspuT7x9ka0kWesXsqXGiQS+O8WFGxicTYUD0yeNNUaKhAMFgiEhU/Dtx3hjjLh+B8JxhKBrG57ExNjKC3eMn+Lgcy6D3YT8Xv7nCma8ucP1mAw6nK3lEQuLlUPzsZz/7efLfL0V8ZsrNzaGoID+Z8ooIDtNU10CzI531ZRpibiF6QwmlBTmYNMlxK+xl6N4tLl+9yfWGVlrbOhkMaNH6+2i5dYtrbcKd904z7RBCDeswZYCzvYu2Ngcqq5msDD2qqB9bewN1V65x5btW7tzvov2hjbDGSLpRj1oxSdfVeuqaHtDX10lrSzM3Gu+KvHpxKdPJNBnQhR9x58Z1vqm7xXd32rnf2Y1LYSLDlI5uic81uVxuLlyq487d+0z5fAnvJDvbTLbFjFI5Z6R6BXzX2EJOtoXC/LxkisTbzoqf8YPjvXSPTUBuGZs3raPQpGCgd5DRSS/hxBlRnL1NXL50gYvNPbhkQthpGmSxMOFQkGm/j1AoHsQLF0GkxeI/MS8j7Xepr2ulx+YhII76Ht3hyuWLwjMYwJ+SgVnlobvlGp9dbOTBqIsQyWsu1dPycIKgLg1dZILe1puca+hkyDmDs6+Z61eu0uFUkJFfRIk5VQwYooRLfCg64eI33+a2EL3P70+k2cbtXKu/xcjoWOL/EhIvwwoXvp+R7n5GJ2IUFlrJq1xLWZYJxVAPA7ZJphLKd9Lf2sb97gDW9Ts5+d4J/uzUcY7UFlNQWsOmqgKs6WK6NZewdd8h3t1USrZembD+PTOMPRAzdO8EqeVbOHTsBKdP7+OdXC2ue/doH7LjnR1lIKAiu6KWfUePcXx7CTnpcibcHhEWiDDA68Y1Pc0UKWQWVbJr/yF2VFpJVyevXSRxF/9mQzMTk5PJlFnahQfxXVOL5PJLvDQrW/j+Idq7x7A5gzge3ubylWYe2LyEfCN0DYxh9wbFSV5cE35mfAaKi4spzs3EYEgnI02PLtVIml6HWiUDtR5DhoUsg/i/cv5qXoAp9zSBaRX5hfnkZmdiyhXhhDUdY8SFd2qGmcfCR0t6uhFjmgGDXktKinzWixA/xuJattUUoZns5OqFs3x6tp77Q04CSwjz4y5+/Y0GEU4MEpm3PjAzM8N1cay9s4tAIF53CYnlsaKF7xvppXdsErdwtG19HTTcaKHT7hHz8wz93YOMTIhBACHihI6DBMNR5q6zLR45SoUMhTxERBiIxhcOo2HxJyrCAnFMLkO+iJbSWKrYeeg9fnL6CNvzIgy01vPFjXYGHbPu+mJout36lIs/H8nll3gVrGDhe3nUNYTNHqRg0y5Onv6AD390mh//xSF2FptRCne/f3QCTzCD7DwDeqOH9tY7QjTtYrZ8QPewHfd0WMzIaiFo4dpPjjI80EvPqIOpmfm/EtCQZTWhT4P+zg7aH3TQdf82d4WL79JnYzbpSV3Eepp3bBhHUIa1cgPbN4qQQhdm2ObA5Vv87Dxun0gs5j2PwaFHCc9AQmK5rNxVfW8316+0cGdITe3Ro7y7dwvrSoooKbKisgtPoL+fSUMx5YVFFGWnEPHa6O7qo69/iN7uHh5FjFhzLJjTYjgGhhgaGGXMNsqEPFO48io8bZ10Dkcp2LaONQVmjKkaZNMOcW0fD/sH6OnoosutZs2OvezfXE623sdAY9ucazKR2dppah9gJKWQ7evKSBv/jsvXbnKztY+ungEGHEpKN25iR3UhJu38dYWF0Wo0FIo23FCzlk0baxb81K5fR1lZMampuuRVL4e0qr/6eGUv4vhfv/gVW7fUsnfX9mTKS+Ifob1jgCGXmtKaMiFuIymJA1Fcg0KA/eP408uoKc3DkhrFOdjDg74R7FNhYjIVpuJKqkusZGqDjPcIEQ9O4BITb2p+hbgmjUDvQ3pHo+RsWEOxiOXVRPCN9dLRM8Soa4ZITIEqzULl2nIKzQZS5B6G73Y/dQ0T3dzrHmFcZaV2TSFG/0Nx/TCjbhEyxK/XZbKmeo0ou7C/gn2r//m/f8nGDevYvWNbMkXibWflCn85xCKE40G+XCHce3n8Ab3viYnYPSYTafFPMm0hEjYixEQUpFAoRGz/vJMX4GWv/xMgCX/1sbJX9ZeKTIFSpUKpmCf6ODJ5QoTPFX2chI0UVCrl8kT7stdLSPwReLuELyEhsSgk4UtIrEIk4UtIrEIk4UtIrEJemfDjm2j4/dPMBOJfeZF4U/B4pxKv1o7/FkRi9fDKfp33bd11evsHEgOA1IneHOLfBIyEIxzct4vyspJkqsTbjsxmn4g9HBzA7fUmk5aHw+nmYd8ATpdL2pzhDUKhUJIXf+KyMB+dVpNMlXhbqSorI8dsRiZm6dj1xkbS9HosmZnJwxISEm8bnb29VJSWsL6q6nvhr6uoSCRKSEi8nVy8dg29LpXa6mppVV9CYjURjcbfQBV/oFxCQmLVIQlfQmIVIglfQmIVIglfQmIVIglfQmIVIglfQmIVIgn/FRGZdmEbseOcCsS37lgRRHx2BjtbaWnt5pHDT0h6oFI0ygwu2yjjjqk5r0xffbx+4c/Y6b9znTO//xd++9Hv+OTzczR02/C+Zd/lCYzc5vPfXeVGxyTTybQ/KVMD3PzXz/jsiyvcaumg3+5hWhI+TI/Q9Pmn1N3sZHJF3Kg/Da9V+DNjd/n6nz7i0z/U0z44icc3jWv8IY/GXSzhjdOLx9HFZ3W3aRqMb3n1xyXsHuJO40N6x/yshK0ugvYuvq4bwaEpoWZzFYVZqaRIbwKL3yiGWpvo6bPhW+6M/yfsZ6+K1yf8gI17Fz+nrtOLad1OTpw6yen3TnHq3SNsLreQNm9bqUgoRDgSebL9dSQ0u1GkZyqISP6eSIig34V9wolr3rHgRDd1zZ08sPt+4G4/094SiYRmcDucuD3CdX6JnXDnkrDpcuP1i7LFTUYjBH1OJl0+poPz8nhyzMNUQLTXM75bGfRMMj5jJKt0LTUbKyjITEMzd2+AsGjHUGQ2P8Fi6rWkcj7F92X2TH+f5xOeYyfeL6YcdiadbvyivD/MZU57BOcfX36+z2vn5/WzN4XX9qx+cOgK/+O/nCWw7QQ//XA3ZYb528U66PzDFcbUBqanHtHVE6Ts8FF2bzDiaL3G9fsjwhWTIRc327JxD/u2VZE1dZ+LV1p55PQTjoWYdsnJ3XqAAztLiHVe4PzZc3zSGiInP59yy1YOfbCHbVUqRpsWtpc/t0yBEZrPNOPNrRYzZBlZWpEWsnHni0bc1rWs21xItO8W395sZ8wbJhbxIcvexP4D21mXb2Cm5Tf8p/9qY+1PP+Cn75ejG2rgTGeE0sq1bCxMR8UMQw1f0R4uYW31eize25y5bycy5SI4M43H4cEdzKJibTZKnwu3cwK73Yu2ci/HD26mzKwl5uqjoa6euyMOpuVyImELG/fsZtu6PIxPqjKbz9kzX/DJZT8ZlWVUlaxlz/HDVGpaaHFoMPq9DHf1ECg7wrHd60gdbXpmvaLxeiyxnE/NJtOiDesv0Ng9wRQGUiJGavbupFZ0tY7zbThVUXwBD17XrB1Z6Q5OHd5KVU6Y3osXuNnrwCM0GQmI2TWtit0H91JbmoW/6wsu900RHA8TnZli0uclqF/DzoP72FxqRhd8Rr55dj77z/+djrQNFJUXJTY+fTpfPTHvALcvf0vzgBM/SvxhPRXb97O/NpfA/bML97MakWeyyiuV+LP6Oo2OTete47P60+ODDEQzMeXnYdIvtEe0l6FrX3PhXAMPvQpMORZMwg3w9tZztuUBE8oMytaUUpLmofmbFm53TxJQasm0WCkoKqNizRpylMNcbrzDvZEpFGlZZJlS0ejTyMjJpbAoi/RUFZ6eZ9t7KsQTQvKIwaqu5TYDjtkjwdE2zjd38cA5IzrYPS581UinI4XssnLKi01Md1zkmxu3GXT+0LkP2ju53NQ2Z1YIYe+4SmNbFzafmE3ix8/c4u5wFH12AWUl6QTuXOHqjU7cSiPW4nKKUh00nG+i4YEQOi56rp6nuWsSZWapGKSLSPO28E1LKz0Tc2siRy3awmI2oRODanqWlfyibDJE2/qH6rlw/gK3hGAUplyyTXoU9vvPrdfSy/k0MyN3RPsPMabMobS0mFJRFpNejTJkp6PuS6429RNUZ5Ir7JQavLRcukNTl1PYUZJiMJOTV0BJ+RoqSox4b12ipbErEZt7B0VdrjbS61eTWVhORVkOssErfF3fSJ844Zn5JsOdYERBavpC+Yp2vi4GlTuDRIxFwm4pucpRbpyt51bnBCH9wv3s9S+WvVpen/CnxgkZZegMalTPzCVEICWDil3H+PCvTrK9Ss1Ey3UmQhY27zrEkQN7OHJ4G7mTdsb67cwY14gR/ygn3j3EgQPHOHGgUtzIaRxCSBlr93N47xYKq2vZcfxH/NVf72WjmFVGG55tzzM3QFNlUb29ghmng/6xeAcIMdrZhCs7g4LyLIK931LvVlC29yinTx7j/R/9JR9sNTDQ20PbiGd5cb2Yfc3F29h/+BgnTx1kl0WGWmGiatte3j1+jA9O7sEUkgs3d5qAa4Dvrk0QMdey9/AhDu07zLvbrDgmxhhI7CH4mBQsj9vCLLyNve/xl399QrSthfgmwaGgioyKHZz8i3/He9tLkYnB7oX1Wko5E2X4ntiMH4dTiNhUzqYd4vz39rGhzJzcksyJypRD7e4DHBN2fnRiF5aoCpc7IOzoyd8m7tmpExw9eIB3Tx3lnbQAkUkxCycbOxRLp3DzbvaLa0+8/2NO78rH9ugRD8a8BJ6bLxhySnln/wL5xtu5bpigeQeHTr7PqZPv8ZMPD1DhbKX33gDywoX6WTpv2psMXpvwlSoNcneEsF+4Ysm0hdAYjaQb9GjVSpTyKZxiJva03ePmxTN88vEnfHLxNuOhMBpxx+QBG80Xfs+vfvUP/Pqjj/n4XCMDtqmkpYXw4nievacWu5RkrdtBtVzEk4OPRGw3xoPGEPkZhZTlqHGPDeNKU2EUo70u3nkUBuHq5REa9DI6NiUc7OWQglKpjO//IezJxSAmZmuVSItvxBE/qklFoUwuhngcdE96abv7HefP/DMfffzPnLttJxDWiPLIZ/cNXQzaNNJNaeh1KaiUQRy2xdRrCeWcR0reZk7UWqDtIr/8v3/Hr/9NeHh2/5PYWKMRdlSz24spU0SfUTz2DiO4em/yxT/9I7/+9W/57UdnuNQ/ylMbh4syKZXy2fso12HOziH2aJpxYT+63Hzj7WwX4UpqFvrU2b2bNOZcilPceEZtuHxv6nLe07w24RvMRWTPuHEMT+DxP0/6c1GhEoLUmoxYhBuVL2Ko/LKNHPrJUXZszGLqnnAN2x4S1JkpyM3BmmVAm/K8PemeZy8Pw7xLFemlbK6IMTo5TM/9O9xVFGItKcMq3GSlcFvmv1Es/vVGUkS68B9f+4K5EJpWoRGiNWPNFfUQdSmtPcBP3n2HjXlpYthaDvHNP15vvRTpRew+eoSTh7ezPl8jPLozXGm4x6j3Bctizm4ufd7EfZsMY24uVquFDI3wHpOHFyIWEaLUykVTic9y8020s2I2nycLerHE5CUXg578hTuyvBm8NuGnWGvYuTHGUOu3fH2rixF3MPFut2BwCs/UNMHQQsvR6VgqcwmZMsmq2MS+Q0c4Jm7esX0bKDWn4HzYxoTawqa9Rzh1dD97asvJFKHEE2RiShK2p2dChBPmn2dPv0An0lO0cT3qsRFuXrqMrzCTghKLcA9TyClai9nlZWzYkdiDDxGjPnzQiypHT0G2GIAS18c7VXKQi5dl0oPHPUNAJMcf8HG4RNmWFRMI0rOozA1jysyiQri3R+L1EJ+D60uwiBhzeSy2Xi+BuOcaYx7r9xzlzz88zub0cWwjwzhfNBl4HnG7M4C2dBsHTxzjyP6trDcbxR2aw5QbV3xFPv5k0oyNns4e1FYjBTlGNMvNN93K+mIfPscAY65ZD8E32Mvd6Qy0ebmY4vHSD/rZm8fyJorFoM9nx+lTuM5dpeX8P9DxrXAlhVsWjSmwbhVx+h5j8sS5aMjbdoSN4/U0ffp3dOWY0QSFs6ktE/HUVjKLKtG2tnLu4yma0jPIlk3gDWcnrxVXW4qp0XbQ8vtf0le/leN/tkfEoc+yt4v1pZk/6NhphVvYbGjkdw0+andZKciaXaVOrzjM8bIvqb/4G/7bVQ0pshl8UyrWHVzPujw9ekd8hbeZu1+JvEpMvGMpoFLWQNO//ILB6/kUFeUicwsX9PviLg1tHtuPrcd+rZlP/083V8wa4lXRlb7D8b01lGYtJ8pUvLBeyu7kqcvE23eDr+vaGI6oUURtDNkslB8sISvtBYoxWakpucbNW1/wj2PXMGel4lRMI0tLHo8TneTBrTP8/e0YAbcHr09F9dFq1lpTmV5uvtpcth3dzNDlVv71F218KcKBoBhgfEXv8P6mcuLNrFign22tMr/8IPlHRPEf/uPf/HxwZCTxvr1MkymZ/CqQo83Ioygvmwy9FnWKGo0ulfTMbArLyii2ZmA0ZpJTWUVJQSZ64Z7FURvMIq4WM408hkKrQ6vRYzQLOyV55OXlYRJ2UnRCaEYzxeVrKK+ooKbYQpaIx1RaAxaTOKbVkmrIobjUSl5BAcUL2ssR5RKdIpHrHFQ6Ee+mYCraxMaaSgoyNInRUa4RsW+2mHGEaywT8aDGaKViyz72bKsiL10IRsTOWVlpok7ZFIh8c6xmckw6UjUaNPoMcgrKqKouZ82aaoqzM0nTajBk57O2Oh+rKZ6HcE91pqfbQ65Cl2mhskqENSYDGaLcGQYdsqgIX1K14mPAnF9ISa4JvfrpmsiEl/K0/bg5LRk5lVQV5yfaK97iL6qX8gd2XlTO2bweEwl4cU8FiaaI8or7k7d2J9s3VZEr2kZrsFBQVSVmaBOJXcTn2snJJC9Lh06rRqeLr6CXUFFTQUV1NbmZJgIDl6gbVlNYspbSzFTUqdlUbBVe4NZKctPVxJabr+g/6Zm5wpNMRR6TifhfR1bROvYd3M6mUhH3q2SiH/2wn5mNT9d7JdI7OIhKqcJqmfOyzdf9zr1I/DXO0ajoXIrZXWST6c8kEiYszo/E49D4NY8vSKSLji0CU8WTxEXwLHtLJRoR3quwI5OjTOzKm0xfkPjOufE8F3Pu4nnSlnGb8bZ8FWHnkuq1RB7bjrfDEts+UVeE2OaVqf/i3/LzqwaOfvDv+fPabJTxnZDnl/sl8o0z285idhQXLqmvrVD+KL/Hn49CqSQlRczK8Y6aTHsuCiXxXWfVqnk3LJGuXPqNeJa9pSI6V3xHXrVyMXbEuWKEXdy5i+dJWwq7r0T0cZZUryXy2PYy2j5R1wXKJFdlYUlNJ1UcS9zbhcr9EvnGmW3nZfS1N4C3r0YSqwJT5Ul+fOIQm/INK97FXolIwpd4I0nLrWFrbTVFmTpJ+MtAEr6ExCpEEr6ExCpEEr6ExCpEEr6ExCpEEr6ExCrkyQM8CqWCdIMhmSwhIfG2MTQyQlFeQeIBnoTwXR4P0dgLvrwgISHxxqOQK2cf2XW5PTG1OgWNeuHvU0tISLw9eKemkMsVyGKJL19LSEisHuD/A51YNghCpMniAAAAAElFTkSuQmCC"},1151:(e,a,s)=>{s.d(a,{Z:()=>c,a:()=>r});var n=s(7294);const t={},o=n.createContext(t);function r(e){const a=n.useContext(o);return n.useMemo((function(){return"function"==typeof e?e(a):{...a,...e}}),[a,e])}function c(e){let a;return a=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:r(e.components),n.createElement(o.Provider,{value:a},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/a739b8a8.13daca6b.js b/assets/js/a739b8a8.13daca6b.js new file mode 100644 index 000000000..52a850f1a --- /dev/null +++ b/assets/js/a739b8a8.13daca6b.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3698],{8147:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>p,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var n=i(5893),s=i(1151);const r={title:"Cross Subscription and Tenancy",hide_title:!0,sidebar_position:2},o="Azure Cross Subscription Creation",a={id:"cado-response/deploy/azure/azure-cross-tenancy-subscriptions",title:"Cross Subscription and Tenancy",description:"Setting up an app registration for cross tenancy/subcription acquisitions",source:"@site/docs/cado-response/deploy/azure/azure-cross-tenancy-subscriptions.md",sourceDirName:"cado-response/deploy/azure",slug:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions",permalink:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/azure/azure-cross-tenancy-subscriptions.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"Cross Subscription and Tenancy",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Overview",permalink:"/cado-response/deploy/azure/azure-deploy"},next:{title:"GCP Deployment (Beta)",permalink:"/cado-response/deploy/gcp/gcp-deploy"}},c={},d=[{value:"Setting up an app registration for cross tenancy/subcription acquisitions",id:"setting-up-an-app-registration-for-cross-tenancysubcription-acquisitions",level:3},{value:"Required role-asignments",id:"required-role-asignments",level:4},{value:"Registering credentials within Cado",id:"registering-credentials-within-cado",level:3}];function l(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"azure-cross-subscription-creation",children:"Azure Cross Subscription Creation"}),"\n",(0,n.jsx)(t.h3,{id:"setting-up-an-app-registration-for-cross-tenancysubcription-acquisitions",children:"Setting up an app registration for cross tenancy/subcription acquisitions"}),"\n",(0,n.jsxs)(t.p,{children:["To leverage cross Azure acquisitions, you need to create an ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app",children:"Azure app registration"})})," in the Azure tenancy you want to acquire resources from. Follow the contents of this guide, and select the option for ",(0,n.jsx)(t.code,{children:"Accounts in any organizational directory (Any Azure AD directory - Multitenant)"}),". ",(0,n.jsx)(t.img,{alt:"Azure App Registration",src:i(6160).Z+"",width:"1048",height:"516"})]}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsxs)(t.p,{children:["If you are only importing from a seperate subscription within the same tenancy as your Cado deployment, you can use ",(0,n.jsx)(t.code,{children:"Accounts in this organizational directory only"})," as your app registration account type."]})}),"\n",(0,n.jsxs)(t.p,{children:["You can then generate a client secret associated with this app registration using ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#add-credentials",children:"this guide"})}),", be sure to keep a note of it as you will need it to register the app with the Cado platform. ",(0,n.jsx)(t.img,{alt:"Creating a client secret",src:i(8142).Z+"",width:"1606",height:"595"}),"\nBy default, when you create an app registration, Azure will also create an enterprise application alongside it with the same name. You have to navigate to this, and under the ",(0,n.jsx)(t.strong,{children:"properties"})," sidebar, allow the option for ",(0,n.jsx)(t.code,{children:"Enabled for users to sign-in"}),". Without enabling this option, cross tenancy/subscrition acquisitions will not work.\n",(0,n.jsx)(t.img,{alt:"Azure Enterprise App Registration Permission",src:i(9614).Z+"",width:"1273",height:"443"})]}),"\n",(0,n.jsx)(t.h4,{id:"required-role-asignments",children:"Required role-asignments"}),"\n",(0,n.jsx)(t.p,{children:"Once you have created your app registration, you will need to give it the required Azure role-assignments to allow it to access your Azure resources."}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsx)(t.li,{children:"Go to the Azure management group you want to acquire from, this could be within the same, or a different Azure tenancy."}),"\n",(0,n.jsxs)(t.li,{children:["Select your management group and go to the Access control (IAM) permissions for it. ",(0,n.jsx)(t.img,{alt:"Adding IAM permissions",src:i(6395).Z+"",width:"1357",height:"687"})]}),"\n",(0,n.jsxs)(t.li,{children:["Select ",(0,n.jsx)(t.code,{children:"Add role assignment"})," and add the following role-assignments for your app registration: ",(0,n.jsx)(t.img,{alt:"Adding IAM permissions to app registration",src:i(5342).Z+"",width:"1900",height:"802"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.code,{children:"Storage Account Contributor"}),"."]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.code,{children:"Disk Snapshot Contributor"}),"."]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.code,{children:"Virtual Machine Contributor"}),"."]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.code,{children:"Monitoring Contributor"}),"."]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.code,{children:"Azure Kubernetes Service Cluster Admin Role"}),"."]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsxs)(t.p,{children:["Search for your app registration name under the ",(0,n.jsx)(t.code,{children:"Select members"})," prompt."]})}),"\n",(0,n.jsx)(t.p,{children:"With these credentials in place, you are able to register the app with Cado."}),"\n",(0,n.jsx)(t.h3,{id:"registering-credentials-within-cado",children:"Registering credentials within Cado"}),"\n",(0,n.jsx)(t.p,{children:"Once you have created the app registration, you will be able to register the credentials within Cado using the following steps:"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:["Navigate to the to the settings page and choose the ",(0,n.jsx)(t.code,{children:"Cloud"})," option."]}),"\n",(0,n.jsxs)(t.li,{children:["Select the ",(0,n.jsx)(t.strong,{children:"Azure"})," tab and click ",(0,n.jsx)(t.code,{children:"Add Azure Credentials"}),". ",(0,n.jsx)(t.img,{alt:"Azure Credentials Page",src:i(5755).Z+"",width:"1908",height:"872"})]}),"\n",(0,n.jsxs)(t.li,{children:["Using the information generated during the the app registration setup, fill-in the required fields with the appropriate information and click ",(0,n.jsx)(t.code,{children:"Submit"}),". ",(0,n.jsx)(t.strong,{children:"Use the subscription ID you assigned app-registration permissions for"}),". ",(0,n.jsx)(t.img,{alt:"Azure Credentials Insertion Page",src:i(7542).Z+"",width:"826",height:"737"})]}),"\n"]}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.code,{children:"Cloud ID"})," is only used to assign a name to the added credentials, it can be any memorable name of your choosing."]})}),"\n",(0,n.jsxs)(t.p,{children:["Some of the information you will need is on the Azure app registration page, shown below: ",(0,n.jsx)(t.img,{alt:"Azure App Registration Page",src:i(6417).Z+"",width:"1008",height:"552"})]}),"\n",(0,n.jsx)(t.p,{children:'Set the Cloud ID as a name you will recognize, e.g. "AzureCrossAccount".\nYou can find the Tenant ID under Azure Active Directory.\nThe Subscription ID is on the Overview Tab of your Subscription.\nThe Client ID is the Client ID of the application, found on the Properties tab of the Enterprise Application you created earlier.\nThe Client Secret is from the the first step above.'}),"\n",(0,n.jsxs)(t.p,{children:["The credentials are now ready to use within Cado. Go to an Azure import and select the credential you wish to use from the dropdown in the top left of the import page. ",(0,n.jsx)(t.img,{alt:"Using Custom Azure Credentials",src:i(7194).Z+"",width:"1890",height:"467"})," You are now able to import resources managed by other tenants and or subscriptions as normal."]}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsx)(t.p,{children:"If you encounter an error when attempting to acquire a resource across Azure accounts or subscriptions, verify that a typo has not been made during addition, or if the wrong information has been entered in the wrong field."})})]})}function p(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},5342:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-adding-permissions-to-app-registration-91d7323c8ba189612ae5ea3fbabbd66d.png"},6395:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-adding-subscription-permissions-e2146bdc5ec4876758142af7a70bbe9f.png"},6417:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-app-registration-info-14372ffdbbc2f89883de3e5abc64801b.png"},8142:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-creating-client-secret-03828e236f7cf994e5a59b1679a09140.png"},5755:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-creds-page-bdefcb9f68f08bf069307313b5a22e3b.png"},9614:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-enterprise-app-permission-6a7d1aeb3be81574d65c00d1a9ff6e49.png"},7542:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-insert-custom-creds-ac198c8ff6e0477c840d19eb85e21380.png"},6160:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-registering-app-2dd0987baae6d76b0eb998ec283da27e.png"},7194:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-using-custom-credentials-4b431d8630ae3b3a3945aab6f0fa028c.png"},1151:(e,t,i)=>{i.d(t,{Z:()=>a,a:()=>o});var n=i(7294);const s={},r=n.createContext(s);function o(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/a739b8a8.7e11c17a.js b/assets/js/a739b8a8.7e11c17a.js deleted file mode 100644 index ced9a5aa2..000000000 --- a/assets/js/a739b8a8.7e11c17a.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3698],{8147:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>p,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var n=i(5893),s=i(1151);const r={title:"Cross Subscription and Tenancy",hide_title:!0,sidebar_position:2},o="Azure Cross Subscription Creation",a={id:"cado-response/deploy/azure/azure-cross-tenancy-subscriptions",title:"Cross Subscription and Tenancy",description:"Setting up an app registration for cross tenancy/subcription acquisitions",source:"@site/docs/cado-response/deploy/azure/azure-cross-tenancy-subscriptions.md",sourceDirName:"cado-response/deploy/azure",slug:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions",permalink:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/azure/azure-cross-tenancy-subscriptions.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"Cross Subscription and Tenancy",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Overview",permalink:"/cado-response/deploy/azure/azure-deploy"},next:{title:"GCP Deployment (Beta)",permalink:"/cado-response/deploy/gcp/gcp-deploy"}},c={},d=[{value:"Setting up an app registration for cross tenancy/subcription acquisitions",id:"setting-up-an-app-registration-for-cross-tenancysubcription-acquisitions",level:3},{value:"Required role-asignments",id:"required-role-asignments",level:4},{value:"Registering credentials within Cado",id:"registering-credentials-within-cado",level:3}];function l(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"azure-cross-subscription-creation",children:"Azure Cross Subscription Creation"}),"\n",(0,n.jsx)(t.h3,{id:"setting-up-an-app-registration-for-cross-tenancysubcription-acquisitions",children:"Setting up an app registration for cross tenancy/subcription acquisitions"}),"\n",(0,n.jsxs)(t.p,{children:["To leverage cross Azure acquisitions, you need to create an ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app",children:"Azure app registration"})})," in the Azure tenancy you want to acquire resources from. Follow the contents of this guide, and select the option for ",(0,n.jsx)(t.code,{children:"Accounts in any organizational directory (Any Azure AD directory - Multitenant)"}),". ",(0,n.jsx)(t.img,{alt:"Azure App Registration",src:i(6160).Z+"",width:"1048",height:"516"})]}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsxs)(t.p,{children:["If you are only importing from a seperate subscription within the same tenancy as your Cado deployment, you can use ",(0,n.jsx)(t.code,{children:"Accounts in this organizational directory only"})," as your app registration account type."]})}),"\n",(0,n.jsxs)(t.p,{children:["You can then generate a client secret associated with this app registration using ",(0,n.jsx)(t.strong,{children:(0,n.jsx)(t.a,{href:"https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#add-credentials",children:"this guide"})}),", be sure to keep a note of it as you will need it to register the app with the Cado platform. ",(0,n.jsx)(t.img,{alt:"Creating a client secret",src:i(8142).Z+"",width:"1606",height:"595"}),"\nBy default, when you create an app registration, Azure will also create an enterprise application alongside it with the same name. You have to navigate to this, and under the ",(0,n.jsx)(t.strong,{children:"properties"})," sidebar, allow the option for ",(0,n.jsx)(t.code,{children:"Enabled for users to sign-in"}),". Without enabling this option, cross tenancy/subscrition acquisitions will not work.\n",(0,n.jsx)(t.img,{alt:"Azure Enterprise App Registration Permission",src:i(9614).Z+"",width:"1273",height:"443"})]}),"\n",(0,n.jsx)(t.h4,{id:"required-role-asignments",children:"Required role-asignments"}),"\n",(0,n.jsx)(t.p,{children:"Once you have created your app registration, you will need to give it the required Azure role-assignments to allow it to access your Azure resources."}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsx)(t.li,{children:"Go to the Azure management group you want to acquire from, this could be within the same, or a different Azure tenancy."}),"\n",(0,n.jsxs)(t.li,{children:["Select your management group and go to the Access control (IAM) permissions for it. ",(0,n.jsx)(t.img,{alt:"Adding IAM permissions",src:i(6395).Z+"",width:"1357",height:"687"})]}),"\n",(0,n.jsxs)(t.li,{children:["Select ",(0,n.jsx)(t.code,{children:"Add role assignment"})," and add the following role-assignments for your app registration: ",(0,n.jsx)(t.img,{alt:"Adding IAM permissions to app registration",src:i(5342).Z+"",width:"1900",height:"802"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.code,{children:"Storage Account Contributor"}),"."]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.code,{children:"Disk Snapshot Contributor"}),"."]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.code,{children:"Virtual Machine Contributor"}),"."]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.code,{children:"Monitoring Contributor"}),"."]}),"\n",(0,n.jsxs)(t.li,{children:[(0,n.jsx)(t.code,{children:"Azure Kubernetes Service Cluster Admin Role"}),"."]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsxs)(t.p,{children:["Search for your app registration name under the ",(0,n.jsx)(t.code,{children:"Select members"})," prompt."]})}),"\n",(0,n.jsx)(t.p,{children:"With these credentials in place, you are able to register the app with Cado."}),"\n",(0,n.jsx)(t.h3,{id:"registering-credentials-within-cado",children:"Registering credentials within Cado"}),"\n",(0,n.jsx)(t.p,{children:"Once you have created the app registration, you will be able to register the credentials within Cado using the following steps:"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:["Navigate to the to the settings page and choose the ",(0,n.jsx)(t.code,{children:"Cloud"})," option."]}),"\n",(0,n.jsxs)(t.li,{children:["Select the ",(0,n.jsx)(t.strong,{children:"Azure"})," tab and click ",(0,n.jsx)(t.code,{children:"Add Azure Credentials"}),". ",(0,n.jsx)(t.img,{alt:"Azure Credentials Page",src:i(5755).Z+"",width:"1908",height:"872"})]}),"\n",(0,n.jsxs)(t.li,{children:["Using the information generated during the the app registration setup, fill-in the required fields with the appropriate information and click ",(0,n.jsx)(t.code,{children:"Submit"}),". ",(0,n.jsx)(t.strong,{children:"Use the subscription ID you assigned app-registration permissions for"}),". ",(0,n.jsx)(t.img,{alt:"Azure Credentials Insertion Page",src:i(7542).Z+"",width:"826",height:"737"})]}),"\n"]}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsxs)(t.p,{children:[(0,n.jsx)(t.code,{children:"Cloud ID"})," is only used to assign a name to the added credentials, it can be any memorable name of your choosing."]})}),"\n",(0,n.jsxs)(t.p,{children:["Some of the information you will need is on the Azure app registration page, shown below: ",(0,n.jsx)(t.img,{alt:"Azure App Registration Page",src:i(6417).Z+"",width:"1008",height:"552"})]}),"\n",(0,n.jsx)(t.p,{children:'Set the Cloud ID as a name you will recognize, e.g. "AzureCrossAccount".\nYou can find the Tenant ID under Azure Active Directory.\nThe Subscription ID is on the Overview Tab of your Subscription.\nThe Client ID is the Client ID of the application, found on the Properties tab of the Enterprise Application you created earlier.\nThe Client Secret is from the the first step above.'}),"\n",(0,n.jsxs)(t.p,{children:["The credentials are now ready to use within Cado. Go to an Azure import and select the credential you wish to use from the dropdown in the top left of the import page. ",(0,n.jsx)(t.img,{alt:"Using Custom Azure Credentials",src:i(7194).Z+"",width:"1890",height:"467"})," You are now able to import resources managed by other tenants and or subscriptions as normal."]}),"\n",(0,n.jsx)(t.admonition,{type:"tip",children:(0,n.jsx)(t.p,{children:"If you encounter an error when attempting to acquire a resource across Azure accounts or subscriptions, verify that a typo has not been made during addition, or if the wrong information has been entered in the wrong field."})})]})}function p(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},5342:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-adding-permissions-to-app-registration-91d7323c8ba189612ae5ea3fbabbd66d.png"},6395:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-adding-subscription-permissions-e2146bdc5ec4876758142af7a70bbe9f.png"},6417:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-app-registration-info-14372ffdbbc2f89883de3e5abc64801b.png"},8142:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-creating-client-secret-03828e236f7cf994e5a59b1679a09140.png"},5755:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-creds-page-bdefcb9f68f08bf069307313b5a22e3b.png"},9614:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-enterprise-app-permission-6a7d1aeb3be81574d65c00d1a9ff6e49.png"},7542:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-insert-custom-creds-ac198c8ff6e0477c840d19eb85e21380.png"},6160:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-registering-app-2dd0987baae6d76b0eb998ec283da27e.png"},7194:(e,t,i)=>{i.d(t,{Z:()=>n});const n=i.p+"assets/images/azure-using-custom-credentials-4b431d8630ae3b3a3945aab6f0fa028c.png"},1151:(e,t,i)=>{i.d(t,{Z:()=>a,a:()=>o});var n=i(7294);const s={},r=n.createContext(s);function o(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/a86077fa.54760627.js b/assets/js/a86077fa.54760627.js deleted file mode 100644 index afbe41f6e..000000000 --- a/assets/js/a86077fa.54760627.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4858],{4913:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>c});var s=t(5893),i=t(1151);const r={title:"Azure AD",hide_title:!0,sidebar_position:1},o="Azure AD OAuth Integration",a={id:"cado-response/manage/users-authentication/sso/azure-ad",title:"Azure AD",description:"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.",source:"@site/docs/cado-response/manage/users-authentication/sso/azure-ad.md",sourceDirName:"cado-response/manage/users-authentication/sso",slug:"/cado-response/manage/users-authentication/sso/azure-ad",permalink:"/cado-response/manage/users-authentication/sso/azure-ad",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/users-authentication/sso/azure-ad.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Azure AD",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Managing Users",permalink:"/cado-response/manage/users-authentication/users"},next:{title:"Okta OAuth",permalink:"/cado-response/manage/users-authentication/sso/okta"}},l={},c=[{value:"Setting up Azure AD SSO",id:"setting-up-azure-ad-sso",level:3}];function d(e){const n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"azure-ad-oauth-integration",children:"Azure AD OAuth Integration"}),"\n",(0,s.jsx)(n.admonition,{type:"warning",children:(0,s.jsxs)(n.p,{children:["If you encounter issues, please contact ",(0,s.jsx)(n.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," describing your issue and providing as much detail about your configuration as possible."]})}),"\n",(0,s.jsx)(n.p,{children:'You can now enable the beta of Azure AD OAuth Integration in the Cado platform by going to "Settings > SSO > Microsoft OAuth".'}),"\n",(0,s.jsx)(n.h3,{id:"setting-up-azure-ad-sso",children:"Setting up Azure AD SSO"}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["Open Azure portal and navigate to ",(0,s.jsx)(n.strong,{children:"Enterprise Applications"})]}),"\n",(0,s.jsxs)(n.li,{children:["Click ",(0,s.jsx)(n.strong,{children:"New Application"})]}),"\n",(0,s.jsxs)(n.li,{children:["Click ",(0,s.jsx)(n.strong,{children:"Create your own application"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Enter a name (e.g. Cado)"}),"\n",(0,s.jsxs)(n.li,{children:["Select ",(0,s.jsx)(n.code,{children:"Integrate any other application you don't find in the gallery (Non-gallery)"})]}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(n.li,{children:"Make a note of the Application ID"}),"\n"]}),"\n",(0,s.jsxs)(n.admonition,{type:"tip",children:[(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.em,{children:"Optional:"})," Create a role to allow Azure AD users to be assigned admin privileges"]}),(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["From the home page, open ",(0,s.jsx)(n.strong,{children:"Azure Active Directory"})," and select the ",(0,s.jsx)(n.strong,{children:"App Registrations"})," blade"]}),"\n",(0,s.jsxs)(n.li,{children:["Select your application (you may need to switch to the ",(0,s.jsx)(n.strong,{children:"All Applications"})," tab if you are not an owner)"]}),"\n",(0,s.jsxs)(n.li,{children:["Select ",(0,s.jsx)(n.strong,{children:"App roles"})," then ",(0,s.jsx)(n.strong,{children:"Create app role"}),"."]}),"\n",(0,s.jsxs)(n.li,{children:["Set the role value, in this example it will be called, ",(0,s.jsx)(n.code,{children:"admin"}),", but you can name this as you like. Just make note of what you call this; you'll need it later\n",(0,s.jsx)(n.img,{alt:"Azure AD Role",src:t(981).Z+"",width:"567",height:"501"})]}),"\n"]})]}),"\n",(0,s.jsxs)(n.ol,{start:"5",children:["\n",(0,s.jsxs)(n.li,{children:["Configure Access Control","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Navigate to ",(0,s.jsx)(n.strong,{children:"Enterprise Applications"})," and select the ",(0,s.jsx)(n.strong,{children:"Properties"})," blade and make sure ",(0,s.jsx)(n.strong,{children:"User assignment required?"})," is set to ",(0,s.jsx)(n.code,{children:"Yes"}),". This means only assigned users will be allowed to log into Cado\n",(0,s.jsx)(n.img,{alt:"Azure Properties",src:t(4073).Z+"",width:"604",height:"497"})]}),"\n",(0,s.jsxs)(n.li,{children:["Navigate to ",(0,s.jsx)(n.strong,{children:"Users and Groups"})]}),"\n",(0,s.jsxs)(n.li,{children:["Click ",(0,s.jsx)(n.strong,{children:"Add User/Group"})," and add any users you want to give access to the app. If you created an admin role, you can assign the new users the admin role to give them admin access within Cado."]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["Create a secret to allow authentication with Cado","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["From the home page, open ",(0,s.jsx)(n.strong,{children:"Azure Active Directory"})," and select the ",(0,s.jsx)(n.strong,{children:"App Registrations"})," blade"]}),"\n",(0,s.jsxs)(n.li,{children:["Select your application (you may need to switch to the ",(0,s.jsx)(n.strong,{children:"All Applications"})," tab if you are not an owner)"]}),"\n",(0,s.jsxs)(n.li,{children:["Select the ",(0,s.jsx)(n.strong,{children:"Clients & Secrets"})," blade and click ",(0,s.jsx)(n.strong,{children:"New Client Secret"})]}),"\n",(0,s.jsxs)(n.li,{children:["Make a note of the ",(0,s.jsx)(n.strong,{children:"Value"}),", you will need this in Cado."]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["Collect other required information","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Select the ",(0,s.jsx)(n.strong,{children:"Overview"})," blade and make a note of the following values:","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"Application Client ID"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"Directory (Tenant) ID"})}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"Client Secret"})," (which you should already have from previous step)"]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["Whitelist the redirect URL","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Select the ",(0,s.jsx)(n.strong,{children:"Authentication"})," blade\n",(0,s.jsx)(n.img,{alt:"Azure Authentication",src:t(9357).Z+"",width:"240",height:"274"})]}),"\n",(0,s.jsxs)(n.li,{children:["Click ",(0,s.jsx)(n.strong,{children:"Add a Platform"})]}),"\n",(0,s.jsxs)(n.li,{children:["Select ",(0,s.jsx)(n.strong,{children:"Web"})," and input your redirect url. This should be the url you use to access Cado in the web browser, including the ",(0,s.jsx)(n.code,{children:"/login"})," path. Example: ",(0,s.jsx)(n.code,{children:"https://my.cado.instance/login"})]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["Configure SSO in the Cado platform","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Open your Cado instance and log in as an admin user"}),"\n",(0,s.jsxs)(n.li,{children:["Go to ",(0,s.jsx)(n.strong,{children:"Settings > SSO > Microsoft OAuth"})]}),"\n",(0,s.jsx)(n.li,{children:"Enter the Microsoft OAuth details you noted earlier"}),"\n",(0,s.jsxs)(n.li,{children:["In the ",(0,s.jsx)(n.code,{children:"Admin Group Name"})," enter in the value you configured in step 4"]}),"\n",(0,s.jsxs)(n.li,{children:["Click ",(0,s.jsx)(n.strong,{children:"Update"})]}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},9357:(e,n,t)=>{t.d(n,{Z:()=>s});const s=t.p+"assets/images/azure-authentication-f45196cbc1394bf9eda1aadd1e4e95d8.png"},981:(e,n,t)=>{t.d(n,{Z:()=>s});const s=t.p+"assets/images/azure-create-role-a52699b7efa0b967fc0650cb134610f8.png"},4073:(e,n,t)=>{t.d(n,{Z:()=>s});const s=t.p+"assets/images/azure-properties-57e0d66a92abcab515c9f71b4974011b.png"},1151:(e,n,t)=>{t.d(n,{Z:()=>a,a:()=>o});var s=t(7294);const i={},r=s.createContext(i);function o(e){const n=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),s.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/a86077fa.b35f90de.js b/assets/js/a86077fa.b35f90de.js new file mode 100644 index 000000000..bcefa37db --- /dev/null +++ b/assets/js/a86077fa.b35f90de.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4858],{4913:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>c});var s=t(5893),i=t(1151);const r={title:"Azure AD",hide_title:!0,sidebar_position:1},o="Azure AD OAuth Integration",a={id:"cado-response/manage/users-authentication/sso/azure-ad",title:"Azure AD",description:"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.",source:"@site/docs/cado-response/manage/users-authentication/sso/azure-ad.md",sourceDirName:"cado-response/manage/users-authentication/sso",slug:"/cado-response/manage/users-authentication/sso/azure-ad",permalink:"/cado-response/manage/users-authentication/sso/azure-ad",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/users-authentication/sso/azure-ad.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Azure AD",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Managing Users",permalink:"/cado-response/manage/users-authentication/users"},next:{title:"Okta OAuth",permalink:"/cado-response/manage/users-authentication/sso/okta"}},l={},c=[{value:"Setting up Azure AD SSO",id:"setting-up-azure-ad-sso",level:3}];function d(e){const n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"azure-ad-oauth-integration",children:"Azure AD OAuth Integration"}),"\n",(0,s.jsx)(n.admonition,{type:"warning",children:(0,s.jsxs)(n.p,{children:["If you encounter issues, please contact ",(0,s.jsx)(n.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," describing your issue and providing as much detail about your configuration as possible."]})}),"\n",(0,s.jsx)(n.p,{children:'You can now enable the beta of Azure AD OAuth Integration in the Cado platform by going to "Settings > SSO > Microsoft OAuth".'}),"\n",(0,s.jsx)(n.h3,{id:"setting-up-azure-ad-sso",children:"Setting up Azure AD SSO"}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["Open Azure portal and navigate to ",(0,s.jsx)(n.strong,{children:"Enterprise Applications"})]}),"\n",(0,s.jsxs)(n.li,{children:["Click ",(0,s.jsx)(n.strong,{children:"New Application"})]}),"\n",(0,s.jsxs)(n.li,{children:["Click ",(0,s.jsx)(n.strong,{children:"Create your own application"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Enter a name (e.g. Cado)"}),"\n",(0,s.jsxs)(n.li,{children:["Select ",(0,s.jsx)(n.code,{children:"Integrate any other application you don't find in the gallery (Non-gallery)"})]}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(n.li,{children:"Make a note of the Application ID"}),"\n"]}),"\n",(0,s.jsxs)(n.admonition,{type:"tip",children:[(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.em,{children:"Optional:"})," Create a role to allow Azure AD users to be assigned admin privileges"]}),(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["From the home page, open ",(0,s.jsx)(n.strong,{children:"Azure Active Directory"})," and select the ",(0,s.jsx)(n.strong,{children:"App Registrations"})," blade"]}),"\n",(0,s.jsxs)(n.li,{children:["Select your application (you may need to switch to the ",(0,s.jsx)(n.strong,{children:"All Applications"})," tab if you are not an owner)"]}),"\n",(0,s.jsxs)(n.li,{children:["Select ",(0,s.jsx)(n.strong,{children:"App roles"})," then ",(0,s.jsx)(n.strong,{children:"Create app role"}),"."]}),"\n",(0,s.jsxs)(n.li,{children:["Set the role value, in this example it will be called, ",(0,s.jsx)(n.code,{children:"admin"}),", but you can name this as you like. Just make note of what you call this; you'll need it later\n",(0,s.jsx)(n.img,{alt:"Azure AD Role",src:t(981).Z+"",width:"567",height:"501"})]}),"\n"]})]}),"\n",(0,s.jsxs)(n.ol,{start:"5",children:["\n",(0,s.jsxs)(n.li,{children:["Configure Access Control","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Navigate to ",(0,s.jsx)(n.strong,{children:"Enterprise Applications"})," and select the ",(0,s.jsx)(n.strong,{children:"Properties"})," blade and make sure ",(0,s.jsx)(n.strong,{children:"User assignment required?"})," is set to ",(0,s.jsx)(n.code,{children:"Yes"}),". This means only assigned users will be allowed to log into Cado\n",(0,s.jsx)(n.img,{alt:"Azure Properties",src:t(4073).Z+"",width:"604",height:"497"})]}),"\n",(0,s.jsxs)(n.li,{children:["Navigate to ",(0,s.jsx)(n.strong,{children:"Users and Groups"})]}),"\n",(0,s.jsxs)(n.li,{children:["Click ",(0,s.jsx)(n.strong,{children:"Add User/Group"})," and add any users you want to give access to the app. If you created an admin role, you can assign the new users the admin role to give them admin access within Cado."]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["Create a secret to allow authentication with Cado","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["From the home page, open ",(0,s.jsx)(n.strong,{children:"Azure Active Directory"})," and select the ",(0,s.jsx)(n.strong,{children:"App Registrations"})," blade"]}),"\n",(0,s.jsxs)(n.li,{children:["Select your application (you may need to switch to the ",(0,s.jsx)(n.strong,{children:"All Applications"})," tab if you are not an owner)"]}),"\n",(0,s.jsxs)(n.li,{children:["Select the ",(0,s.jsx)(n.strong,{children:"Clients & Secrets"})," blade and click ",(0,s.jsx)(n.strong,{children:"New Client Secret"})]}),"\n",(0,s.jsxs)(n.li,{children:["Make a note of the ",(0,s.jsx)(n.strong,{children:"Value"}),", you will need this in Cado."]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["Collect other required information","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Select the ",(0,s.jsx)(n.strong,{children:"Overview"})," blade and make a note of the following values:","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"Application Client ID"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"Directory (Tenant) ID"})}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"Client Secret"})," (which you should already have from previous step)"]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["Whitelist the redirect URL","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Select the ",(0,s.jsx)(n.strong,{children:"Authentication"})," blade\n",(0,s.jsx)(n.img,{alt:"Azure Authentication",src:t(9357).Z+"",width:"240",height:"274"})]}),"\n",(0,s.jsxs)(n.li,{children:["Click ",(0,s.jsx)(n.strong,{children:"Add a Platform"})]}),"\n",(0,s.jsxs)(n.li,{children:["Select ",(0,s.jsx)(n.strong,{children:"Web"})," and input your redirect url. This should be the url you use to access Cado in the web browser, including the ",(0,s.jsx)(n.code,{children:"/login"})," path. Example: ",(0,s.jsx)(n.code,{children:"https://my.cado.instance/login"})]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["Configure SSO in the Cado platform","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Open your Cado instance and log in as an admin user"}),"\n",(0,s.jsxs)(n.li,{children:["Go to ",(0,s.jsx)(n.strong,{children:"Settings > SSO > Microsoft OAuth"})]}),"\n",(0,s.jsx)(n.li,{children:"Enter the Microsoft OAuth details you noted earlier"}),"\n",(0,s.jsxs)(n.li,{children:["In the ",(0,s.jsx)(n.code,{children:"Admin Group Name"})," enter in the value you configured in step 4"]}),"\n",(0,s.jsxs)(n.li,{children:["Click ",(0,s.jsx)(n.strong,{children:"Update"})]}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},9357:(e,n,t)=>{t.d(n,{Z:()=>s});const s=t.p+"assets/images/azure-authentication-f45196cbc1394bf9eda1aadd1e4e95d8.png"},981:(e,n,t)=>{t.d(n,{Z:()=>s});const s=t.p+"assets/images/azure-create-role-a52699b7efa0b967fc0650cb134610f8.png"},4073:(e,n,t)=>{t.d(n,{Z:()=>s});const s=t.p+"assets/images/azure-properties-57e0d66a92abcab515c9f71b4974011b.png"},1151:(e,n,t)=>{t.d(n,{Z:()=>a,a:()=>o});var s=t(7294);const i={},r=s.createContext(i);function o(e){const n=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),s.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/aa26b973.2f6b40fd.js b/assets/js/aa26b973.2f6b40fd.js deleted file mode 100644 index 81db5ad11..000000000 --- a/assets/js/aa26b973.2f6b40fd.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7214],{2092:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>d,contentTitle:()=>a,default:()=>h,frontMatter:()=>i,metadata:()=>r,toc:()=>l});var t=n(5893),s=n(1151);const i={title:"Deploying",hide_title:!0,sidebar_position:2},a="Deploying Cado Host",r={id:"cado-host/deploy",title:"Deploying",description:"You can execute Cado Host individually on a device or you can deploy it to a number of machines that may be compromised, for example through Group Policy or other systems management software.",source:"@site/docs/cado-host/deploy.md",sourceDirName:"cado-host",slug:"/cado-host/deploy",permalink:"/cado-host/deploy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-host/deploy.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"Deploying",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Summary",permalink:"/cado-host/intro"},next:{title:"Collected Artifacts",permalink:"/cado-host/artifacts"}},d={},l=[{value:"Deploy through Cado Response Platform",id:"deploy-through-cado-response-platform",level:2},{value:"Using Script Builder",id:"using-script-builder",level:3},{value:"Using Direct Download",id:"using-direct-download",level:3},{value:"Considerations",id:"considerations",level:2},{value:"Creating Secure Cloud Storage Credentials",id:"creating-secure-cloud-storage-credentials",level:2},{value:"Using Local Storage",id:"using-local-storage",level:2},{value:"Command Line Parameters",id:"command-line-parameters",level:3},{value:"Example Command Line",id:"example-command-line",level:3}];function c(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,s.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"deploying-cado-host",children:"Deploying Cado Host"}),"\n",(0,t.jsxs)(o.p,{children:["You can execute Cado Host individually on a device or you can deploy it to a number of machines that may be compromised, for example through ",(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"https://support.microsoft.com/en-gb/help/816102/how-to-use-group-policy-to-remotely-install-software-in-windows-server",children:"Group Policy"})})," or other systems management software."]}),"\n",(0,t.jsx)(o.h2,{id:"deploy-through-cado-response-platform",children:"Deploy through Cado Response Platform"}),"\n",(0,t.jsx)(o.p,{children:"In order to deploy Cado Host, you can choose from one of the following deployment methods:"}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["Use the ",(0,t.jsx)(o.strong,{children:"Script Builder"})," from within the Cado Response Platform. This allows you to build a script which can be run on any supported device, upload the triage artifacts to cloud storage and automatically process the data into Cado Response."]}),"\n",(0,t.jsxs)(o.li,{children:["Use the ",(0,t.jsx)(o.strong,{children:"Direct Download"})," method. This allows customers to download and run Cado Host independent of running Cado Response."]}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"using-script-builder",children:"Using Script Builder"}),"\n",(0,t.jsx)(o.p,{children:"In order to deploy Cado Host via the Script Builder in the Cado Response platform, follow the instructions below. Note that when using the Script Builder, the pre-signed URLs and API keys expire 2 hours after being generated and AWS enforces a limit of 5GB total upload size."}),"\n",(0,t.jsx)(o.admonition,{type:"caution",children:(0,t.jsxs)(o.p,{children:["Ensure that the devices on which the scripts will be run have HTTPS access to the AWS S3 endpoint. For example: ",(0,t.jsx)(o.code,{children:"https://.s3.amazonaws.com/"})]})}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["Find the Cado Host deployment options on the platform under ",(0,t.jsx)(o.code,{children:"Project > Import > Forensic Artifacts > Cado Host"}),"."]}),"\n"]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Import Evidence",src:n(263).Z+"",width:"842",height:"242"})}),"\n",(0,t.jsxs)(o.ol,{start:"2",children:["\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:["Select either ",(0,t.jsx)(o.strong,{children:"Direct Download"})," or ",(0,t.jsx)(o.strong,{children:"Script Builder"}),". ",(0,t.jsx)(o.strong,{children:"Direct Download"})," can be used if you are downloading the Cado Host binary to your endpoints directly, via Group Policy or via a MDM tool. ",(0,t.jsx)(o.strong,{children:"Script Builder"})," will generate a script that can be run directly on a device via a terminal window, cmd window or remote script execution tool."]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Select OS, storage, etc",src:n(3653).Z+"",width:"1162",height:"836"})}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:["If you choose the ",(0,t.jsx)(o.strong,{children:"Script Builder"})," tab, select your OS, cloud storage (where the Cado Host ZIP will be uploaded to) and then the Cado Host binary deployment method."]}),"\n",(0,t.jsx)(o.admonition,{type:"tip",children:(0,t.jsxs)(o.p,{children:["If you select ",(0,t.jsx)(o.strong,{children:"Manual"})," under ",(0,t.jsx)(o.code,{children:"Select Cado Host Binary deployment"}),", download the Cado Host binary to your devices, then copy and paste the command generated for you, into your terminal."]})}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsx)(o.p,{children:'Copy the pre-generated command to the device and run it, or click the "Download Script" button and run that script on the device.'}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Download Script",src:n(288).Z+"",width:"1088",height:"514"})}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"using-direct-download",children:"Using Direct Download"}),"\n",(0,t.jsxs)(o.p,{children:["If you choose the ",(0,t.jsx)(o.strong,{children:"Direct Download"})," tab, select your OS, click ",(0,t.jsx)(o.strong,{children:"Download"})," and then follow the instructions to run Cado Host locally."]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Direct Download",src:n(5782).Z+"",width:"460",height:"272"})}),"\n",(0,t.jsx)(o.h2,{id:"considerations",children:"Considerations"}),"\n",(0,t.jsx)(o.p,{children:"\u200bCado Host is designed to be executed through the commandline. If you do not execute the application with administrative privileges there are some files you will not be able to acquire."}),"\n",(0,t.jsxs)(o.p,{children:["Cado Host can take parameters from a file (named ",(0,t.jsx)(o.code,{children:"config.cfg"}),") or on the command line. On Microsoft Windows, if you execute it without the use of the command line, you may be prompted by the Windows SmartScreen. If you wish to run cado-host.exe by manually clicking it, you will have to select Properties and Untick this box:"]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Properties",src:n(142).Z+"",width:"388",height:"175"})}),"\n",(0,t.jsxs)(o.admonition,{type:"tip",children:[(0,t.jsx)(o.p,{children:"When running on Linux or OSX, you may need to set the binary as executable:"}),(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{className:"language-console",children:"chmod +x ./cado-host\n./cado-host\n"})})]}),"\n",(0,t.jsx)(o.admonition,{type:"warning",children:(0,t.jsxs)(o.p,{children:["Version 1.4.0 and later of Cado Host (deployed by 2.5.0 and later of Cado Response) default to a ARM (M1/M2) build of Cado Host when deployed to a MacOS system.\nTo execute on an older x86 system, append -x86 to the end of the Cado Host URL in the deployment.\nI.e. ",(0,t.jsx)(o.a,{href:"https://cado-public.s3.amazonaws.com/cado-host/v1.4.1/osx/cado-host",children:"https://cado-public.s3.amazonaws.com/cado-host/v1.4.1/osx/cado-host"})," becomes ",(0,t.jsx)(o.a,{href:"https://cado-public.s3.amazonaws.com/cado-host/v1.4.1/osx/cado-host-x86",children:"https://cado-public.s3.amazonaws.com/cado-host/v1.4.1/osx/cado-host-x86"}),"\nWe will be automating the selection of x86 vs ARM in a future release so this will no longer be required."]})}),"\n",(0,t.jsx)(o.h2,{id:"creating-secure-cloud-storage-credentials",children:"Creating Secure Cloud Storage Credentials"}),"\n",(0,t.jsx)(o.admonition,{type:"warning",children:(0,t.jsx)(o.p,{children:"We now recommend using the automatically created temporary credentials generated by Cado Response."})}),"\n",(0,t.jsx)(o.p,{children:"If you are not using Cado Response, yet still want to automatically store the Cado Host collected data to the cloud, you'll need to create credentials with limited write access to your cloud storage."}),"\n",(0,t.jsx)(o.admonition,{type:"caution",children:(0,t.jsx)(o.p,{children:"It is very important to generate write-only cloud credentials if you will be entering credentials (access and secret keys) on the command line. Ensure that the devices on which the scripts will be run have HTTPS access to the cloud storage URLs as defined below."})}),"\n",(0,t.jsx)(o.p,{children:"To create secure credentials to upload the Cado Host collected data to the cloud, follow the instructions below based on your cloud provider of choice:"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"azure-credentials",children:"Creating Secure Credentials for Azure"})})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"aws-credentials",children:"Creating Secure Credentials for AWS"})})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"google-credentials",children:"Creating Secure Credentials for Google Cloud Storage"})})}),"\n"]}),"\n",(0,t.jsx)(o.h2,{id:"using-local-storage",children:"Using Local Storage"}),"\n",(0,t.jsx)(o.p,{children:"\u200bIf you do not set a cloud storage option, files will be saved to the same folder that Cado Host is run from. You can not set a different storage location at this time."}),"\n",(0,t.jsx)(o.h3,{id:"command-line-parameters",children:"Command Line Parameters"}),"\n",(0,t.jsx)(o.p,{children:"Below are the commandline parameters suppoted by Cado Host."}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{children:"usage: cado-host.exe [-h] [--presigned_data PRESIGNED_DATA] [--presigned_url PRESIGNED_URL]\n [--storage {aws,local,gcp,azure}] [--bucket BUCKET] [--access_key ACCESS_KEY]\n [--secret_key SECRET_KEY] [--region REGION] [--sas SAS] [-l]\n [-a ADDITIONAL_FILES [ADDITIONAL_FILES ...]] [-ap ADDITIONAL_FILES_PATH]\n [--only_additional_files] [--single_file_unzipped SINGLE_FILE_UNZIPPED]\n [--include_large_varc] [--skip_linux_memory] [--get_windows_memory] [-v]\n [--verbose] [--verbose_network] [-dd DEFAULT_DRIVE] [-o OUTPUT_PATH]\n [--no_cleanup] [--dev]\n\noptions:\n -h, --help show this help message and exit\n --presigned_data PRESIGNED_DATA\n Encoded upload credentials generated by Cado Response.\n --presigned_url PRESIGNED_URL\n Specify the presigned url you wish to upload files to.\n --storage {aws,local,gcp,azure}\n --bucket BUCKET Bucket to upload files to.\n --access_key ACCESS_KEY\n Access key of your AWS credentials.\n --secret_key SECRET_KEY\n Secret Key of your AWS credentials.\n --region REGION AWS Region.\n --sas SAS Shared Access Signature that can be used to upload triage/full disk to\n an Azure container.\n -l, --light_mode Enable light_mode where we only retrieve files 10 MB in size or less.\n -a ADDITIONAL_FILES [ADDITIONAL_FILES ...], --additional_files ADDITIONAL_FILES [ADDITIONAL_FILES ...]\n List multiple files/folders to collect with the space character between\n them.\n -ap ADDITIONAL_FILES_PATH, --additional_files_path ADDITIONAL_FILES_PATH\n Path to a local file containing a list of files/folders to collect. One\n on each line.\n --only_additional_files\n Only collect files and folders specified in --additional-files.\n --single_file_unzipped SINGLE_FILE_UNZIPPED\n Directly upload a single file to storage and import. Useful as a\n command line option for uploading files to Cado Response.\n --include_large_varc Include open files and memory even if it exceeds 1MB in size (this can\n be slow).\n --skip_linux_memory Dont collect memory on Linux. Faster.\n --get_windows_memory Acquire Process Memory on Windows systems. Unlike Linux, this is\n disabled by default as its slower on Windows. Implicitly applies\n --include_large_varc.\n -v, --version\n --verbose\n --verbose_network\n -dd DEFAULT_DRIVE, --default_drive DEFAULT_DRIVE\n Specify the default drive for your system.\n -o OUTPUT_PATH, --output_path OUTPUT_PATH\n Output path if running for local storage.\n --no_cleanup Disable cleanup after triage.\n --dev Runs cado host in development mode.\n \n"})}),"\n",(0,t.jsx)(o.h3,{id:"example-command-line",children:"Example Command Line"}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{className:"language-console",children:'cado-host.exe --additional_files "C:\\tools\\secretfile.txt" "C:\\SuperSecretFolder"\n'})}),"\n",(0,t.jsx)(o.admonition,{type:"tip",children:(0,t.jsx)(o.p,{children:"Note that folders should NOT have trailing slashes. Files and folder paths should be delimted by a space and be enclosed in double quotes."})})]})}function h(e={}){const{wrapper:o}={...(0,s.a)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},5782:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/cado-direct-download-d110334f50f7736d0958945a66201f71.png"},288:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/cado-host-script-621624bc3f1dd77f5fd7f22a830a9dff.png"},142:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/import-security-856f56febba6db2d8b739dc366096cd4.png"},3653:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/import-step2-f6daa84fd01353ebb44f20dc61f0e1a0.png"},263:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},1151:(e,o,n)=>{n.d(o,{Z:()=>r,a:()=>a});var t=n(7294);const s={},i=t.createContext(s);function a(e){const o=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),t.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/aa26b973.32bf86cb.js b/assets/js/aa26b973.32bf86cb.js new file mode 100644 index 000000000..c3e624f18 --- /dev/null +++ b/assets/js/aa26b973.32bf86cb.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[7214],{2092:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>d,contentTitle:()=>a,default:()=>h,frontMatter:()=>i,metadata:()=>r,toc:()=>l});var t=n(5893),s=n(1151);const i={title:"Deploying",hide_title:!0,sidebar_position:2},a="Deploying Cado Host",r={id:"cado-host/deploy",title:"Deploying",description:"You can execute Cado Host individually on a device or you can deploy it to a number of machines that may be compromised, for example through Group Policy or other systems management software.",source:"@site/docs/cado-host/deploy.md",sourceDirName:"cado-host",slug:"/cado-host/deploy",permalink:"/cado-host/deploy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-host/deploy.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"Deploying",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Summary",permalink:"/cado-host/intro"},next:{title:"Collected Artifacts",permalink:"/cado-host/artifacts"}},d={},l=[{value:"Deploy through Cado Response Platform",id:"deploy-through-cado-response-platform",level:2},{value:"Using Script Builder",id:"using-script-builder",level:3},{value:"Using Direct Download",id:"using-direct-download",level:3},{value:"Considerations",id:"considerations",level:2},{value:"Creating Secure Cloud Storage Credentials",id:"creating-secure-cloud-storage-credentials",level:2},{value:"Using Local Storage",id:"using-local-storage",level:2},{value:"Command Line Parameters",id:"command-line-parameters",level:3},{value:"Example Command Line",id:"example-command-line",level:3}];function c(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,s.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{id:"deploying-cado-host",children:"Deploying Cado Host"}),"\n",(0,t.jsxs)(o.p,{children:["You can execute Cado Host individually on a device or you can deploy it to a number of machines that may be compromised, for example through ",(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"https://support.microsoft.com/en-gb/help/816102/how-to-use-group-policy-to-remotely-install-software-in-windows-server",children:"Group Policy"})})," or other systems management software."]}),"\n",(0,t.jsx)(o.h2,{id:"deploy-through-cado-response-platform",children:"Deploy through Cado Response Platform"}),"\n",(0,t.jsx)(o.p,{children:"In order to deploy Cado Host, you can choose from one of the following deployment methods:"}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["Use the ",(0,t.jsx)(o.strong,{children:"Script Builder"})," from within the Cado Response Platform. This allows you to build a script which can be run on any supported device, upload the triage artifacts to cloud storage and automatically process the data into Cado Response."]}),"\n",(0,t.jsxs)(o.li,{children:["Use the ",(0,t.jsx)(o.strong,{children:"Direct Download"})," method. This allows customers to download and run Cado Host independent of running Cado Response."]}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"using-script-builder",children:"Using Script Builder"}),"\n",(0,t.jsx)(o.p,{children:"In order to deploy Cado Host via the Script Builder in the Cado Response platform, follow the instructions below. Note that when using the Script Builder, the pre-signed URLs and API keys expire 2 hours after being generated and AWS enforces a limit of 5GB total upload size."}),"\n",(0,t.jsx)(o.admonition,{type:"caution",children:(0,t.jsxs)(o.p,{children:["Ensure that the devices on which the scripts will be run have HTTPS access to the AWS S3 endpoint. For example: ",(0,t.jsx)(o.code,{children:"https://.s3.amazonaws.com/"})]})}),"\n",(0,t.jsxs)(o.ol,{children:["\n",(0,t.jsxs)(o.li,{children:["Find the Cado Host deployment options on the platform under ",(0,t.jsx)(o.code,{children:"Project > Import > Forensic Artifacts > Cado Host"}),"."]}),"\n"]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Import Evidence",src:n(263).Z+"",width:"842",height:"242"})}),"\n",(0,t.jsxs)(o.ol,{start:"2",children:["\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:["Select either ",(0,t.jsx)(o.strong,{children:"Direct Download"})," or ",(0,t.jsx)(o.strong,{children:"Script Builder"}),". ",(0,t.jsx)(o.strong,{children:"Direct Download"})," can be used if you are downloading the Cado Host binary to your endpoints directly, via Group Policy or via a MDM tool. ",(0,t.jsx)(o.strong,{children:"Script Builder"})," will generate a script that can be run directly on a device via a terminal window, cmd window or remote script execution tool."]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Select OS, storage, etc",src:n(3653).Z+"",width:"1162",height:"836"})}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsxs)(o.p,{children:["If you choose the ",(0,t.jsx)(o.strong,{children:"Script Builder"})," tab, select your OS, cloud storage (where the Cado Host ZIP will be uploaded to) and then the Cado Host binary deployment method."]}),"\n",(0,t.jsx)(o.admonition,{type:"tip",children:(0,t.jsxs)(o.p,{children:["If you select ",(0,t.jsx)(o.strong,{children:"Manual"})," under ",(0,t.jsx)(o.code,{children:"Select Cado Host Binary deployment"}),", download the Cado Host binary to your devices, then copy and paste the command generated for you, into your terminal."]})}),"\n"]}),"\n",(0,t.jsxs)(o.li,{children:["\n",(0,t.jsx)(o.p,{children:'Copy the pre-generated command to the device and run it, or click the "Download Script" button and run that script on the device.'}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Download Script",src:n(288).Z+"",width:"1088",height:"514"})}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(o.h3,{id:"using-direct-download",children:"Using Direct Download"}),"\n",(0,t.jsxs)(o.p,{children:["If you choose the ",(0,t.jsx)(o.strong,{children:"Direct Download"})," tab, select your OS, click ",(0,t.jsx)(o.strong,{children:"Download"})," and then follow the instructions to run Cado Host locally."]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Direct Download",src:n(5782).Z+"",width:"460",height:"272"})}),"\n",(0,t.jsx)(o.h2,{id:"considerations",children:"Considerations"}),"\n",(0,t.jsx)(o.p,{children:"\u200bCado Host is designed to be executed through the commandline. If you do not execute the application with administrative privileges there are some files you will not be able to acquire."}),"\n",(0,t.jsxs)(o.p,{children:["Cado Host can take parameters from a file (named ",(0,t.jsx)(o.code,{children:"config.cfg"}),") or on the command line. On Microsoft Windows, if you execute it without the use of the command line, you may be prompted by the Windows SmartScreen. If you wish to run cado-host.exe by manually clicking it, you will have to select Properties and Untick this box:"]}),"\n",(0,t.jsx)(o.p,{children:(0,t.jsx)(o.img,{alt:"Properties",src:n(142).Z+"",width:"388",height:"175"})}),"\n",(0,t.jsxs)(o.admonition,{type:"tip",children:[(0,t.jsx)(o.p,{children:"When running on Linux or OSX, you may need to set the binary as executable:"}),(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{className:"language-console",children:"chmod +x ./cado-host\n./cado-host\n"})})]}),"\n",(0,t.jsx)(o.admonition,{type:"warning",children:(0,t.jsxs)(o.p,{children:["Version 1.4.0 and later of Cado Host (deployed by 2.5.0 and later of Cado Response) default to a ARM (M1/M2) build of Cado Host when deployed to a MacOS system.\nTo execute on an older x86 system, append -x86 to the end of the Cado Host URL in the deployment.\nI.e. ",(0,t.jsx)(o.a,{href:"https://cado-public.s3.amazonaws.com/cado-host/v1.4.1/osx/cado-host",children:"https://cado-public.s3.amazonaws.com/cado-host/v1.4.1/osx/cado-host"})," becomes ",(0,t.jsx)(o.a,{href:"https://cado-public.s3.amazonaws.com/cado-host/v1.4.1/osx/cado-host-x86",children:"https://cado-public.s3.amazonaws.com/cado-host/v1.4.1/osx/cado-host-x86"}),"\nWe will be automating the selection of x86 vs ARM in a future release so this will no longer be required."]})}),"\n",(0,t.jsx)(o.h2,{id:"creating-secure-cloud-storage-credentials",children:"Creating Secure Cloud Storage Credentials"}),"\n",(0,t.jsx)(o.admonition,{type:"warning",children:(0,t.jsx)(o.p,{children:"We now recommend using the automatically created temporary credentials generated by Cado Response."})}),"\n",(0,t.jsx)(o.p,{children:"If you are not using Cado Response, yet still want to automatically store the Cado Host collected data to the cloud, you'll need to create credentials with limited write access to your cloud storage."}),"\n",(0,t.jsx)(o.admonition,{type:"caution",children:(0,t.jsx)(o.p,{children:"It is very important to generate write-only cloud credentials if you will be entering credentials (access and secret keys) on the command line. Ensure that the devices on which the scripts will be run have HTTPS access to the cloud storage URLs as defined below."})}),"\n",(0,t.jsx)(o.p,{children:"To create secure credentials to upload the Cado Host collected data to the cloud, follow the instructions below based on your cloud provider of choice:"}),"\n",(0,t.jsxs)(o.ul,{children:["\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"azure-credentials",children:"Creating Secure Credentials for Azure"})})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"aws-credentials",children:"Creating Secure Credentials for AWS"})})}),"\n",(0,t.jsx)(o.li,{children:(0,t.jsx)(o.strong,{children:(0,t.jsx)(o.a,{href:"google-credentials",children:"Creating Secure Credentials for Google Cloud Storage"})})}),"\n"]}),"\n",(0,t.jsx)(o.h2,{id:"using-local-storage",children:"Using Local Storage"}),"\n",(0,t.jsx)(o.p,{children:"\u200bIf you do not set a cloud storage option, files will be saved to the same folder that Cado Host is run from. You can not set a different storage location at this time."}),"\n",(0,t.jsx)(o.h3,{id:"command-line-parameters",children:"Command Line Parameters"}),"\n",(0,t.jsx)(o.p,{children:"Below are the commandline parameters suppoted by Cado Host."}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{children:"usage: cado-host.exe [-h] [--presigned_data PRESIGNED_DATA] [--presigned_url PRESIGNED_URL]\n [--storage {aws,local,gcp,azure}] [--bucket BUCKET] [--access_key ACCESS_KEY]\n [--secret_key SECRET_KEY] [--region REGION] [--sas SAS] [-l]\n [-a ADDITIONAL_FILES [ADDITIONAL_FILES ...]] [-ap ADDITIONAL_FILES_PATH]\n [--only_additional_files] [--single_file_unzipped SINGLE_FILE_UNZIPPED]\n [--include_large_varc] [--skip_linux_memory] [--get_windows_memory] [-v]\n [--verbose] [--verbose_network] [-dd DEFAULT_DRIVE] [-o OUTPUT_PATH]\n [--no_cleanup] [--dev]\n\noptions:\n -h, --help show this help message and exit\n --presigned_data PRESIGNED_DATA\n Encoded upload credentials generated by Cado Response.\n --presigned_url PRESIGNED_URL\n Specify the presigned url you wish to upload files to.\n --storage {aws,local,gcp,azure}\n --bucket BUCKET Bucket to upload files to.\n --access_key ACCESS_KEY\n Access key of your AWS credentials.\n --secret_key SECRET_KEY\n Secret Key of your AWS credentials.\n --region REGION AWS Region.\n --sas SAS Shared Access Signature that can be used to upload triage/full disk to\n an Azure container.\n -l, --light_mode Enable light_mode where we only retrieve files 10 MB in size or less.\n -a ADDITIONAL_FILES [ADDITIONAL_FILES ...], --additional_files ADDITIONAL_FILES [ADDITIONAL_FILES ...]\n List multiple files/folders to collect with the space character between\n them.\n -ap ADDITIONAL_FILES_PATH, --additional_files_path ADDITIONAL_FILES_PATH\n Path to a local file containing a list of files/folders to collect. One\n on each line.\n --only_additional_files\n Only collect files and folders specified in --additional-files.\n --single_file_unzipped SINGLE_FILE_UNZIPPED\n Directly upload a single file to storage and import. Useful as a\n command line option for uploading files to Cado Response.\n --include_large_varc Include open files and memory even if it exceeds 1MB in size (this can\n be slow).\n --skip_linux_memory Dont collect memory on Linux. Faster.\n --get_windows_memory Acquire Process Memory on Windows systems. Unlike Linux, this is\n disabled by default as its slower on Windows. Implicitly applies\n --include_large_varc.\n -v, --version\n --verbose\n --verbose_network\n -dd DEFAULT_DRIVE, --default_drive DEFAULT_DRIVE\n Specify the default drive for your system.\n -o OUTPUT_PATH, --output_path OUTPUT_PATH\n Output path if running for local storage.\n --no_cleanup Disable cleanup after triage.\n --dev Runs cado host in development mode.\n \n"})}),"\n",(0,t.jsx)(o.h3,{id:"example-command-line",children:"Example Command Line"}),"\n",(0,t.jsx)(o.pre,{children:(0,t.jsx)(o.code,{className:"language-console",children:'cado-host.exe --additional_files "C:\\tools\\secretfile.txt" "C:\\SuperSecretFolder"\n'})}),"\n",(0,t.jsx)(o.admonition,{type:"tip",children:(0,t.jsx)(o.p,{children:"Note that folders should NOT have trailing slashes. Files and folder paths should be delimted by a space and be enclosed in double quotes."})})]})}function h(e={}){const{wrapper:o}={...(0,s.a)(),...e.components};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},5782:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/cado-direct-download-d110334f50f7736d0958945a66201f71.png"},288:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/cado-host-script-621624bc3f1dd77f5fd7f22a830a9dff.png"},142:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/import-security-856f56febba6db2d8b739dc366096cd4.png"},3653:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/import-step2-f6daa84fd01353ebb44f20dc61f0e1a0.png"},263:(e,o,n)=>{n.d(o,{Z:()=>t});const t=n.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},1151:(e,o,n)=>{n.d(o,{Z:()=>r,a:()=>a});var t=n(7294);const s={},i=t.createContext(s);function a(e){const o=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function r(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),t.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/aa6d861f.8adf9577.js b/assets/js/aa6d861f.8adf9577.js new file mode 100644 index 000000000..0d1728975 --- /dev/null +++ b/assets/js/aa6d861f.8adf9577.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5185],{9257:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>d,default:()=>o,frontMatter:()=>r,metadata:()=>c,toc:()=>a});var i=n(5893),s=n(1151);const r={title:"Splunk SOAR",hide_title:!0,sidebar_position:5},d="Splunk SOAR Integration",c={id:"cado-response/manage/integrations/soar/splunk-soar",title:"Splunk SOAR",description:"Splunk SOAR is a Security Orchestration, Automation, and Response (SOAR) system. The Splunk SOAR platform combines security infrastructure orchestration, playbook automation, and case management capabilities to integrate your team, processes, and tools together including integrating with Cado.",source:"@site/docs/cado-response/manage/integrations/soar/splunk-soar.md",sourceDirName:"cado-response/manage/integrations/soar",slug:"/cado-response/manage/integrations/soar/splunk-soar",permalink:"/cado-response/manage/integrations/soar/splunk-soar",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/soar/splunk-soar.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:5,frontMatter:{title:"Splunk SOAR",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Tines",permalink:"/cado-response/manage/integrations/soar/tines"},next:{title:"Cortex XSOAR",permalink:"/cado-response/manage/integrations/soar/cortex-xsoar"}},l={},a=[{value:"Getting Started",id:"getting-started",level:2},{value:"Create an API Access Key",id:"create-an-api-access-key",level:3},{value:"Install and Configure the Cado Response App",id:"install-and-configure-the-cado-response-app",level:3},{value:"Configuration Variables",id:"configuration-variables",level:4},{value:"Test your connection",id:"test-your-connection",level:3},{value:"Atomic Actions",id:"atomic-actions",level:2},{value:"List Projects",id:"list-projects",level:3},{value:"List EC2 instances",id:"list-ec2-instances",level:3},{value:"List S3 buckets",id:"list-s3-buckets",level:3},{value:"List Pipelines",id:"list-pipelines",level:3},{value:"Get a pipeline",id:"get-a-pipeline",level:3},{value:"Loop Until Terminated",id:"loop-until-terminated",level:3},{value:"Create Project",id:"create-project",level:3},{value:"Capture EC2 instance",id:"capture-ec2-instance",level:3},{value:"Capture S3 bucket",id:"capture-s3-bucket",level:3},{value:"Playbooks",id:"playbooks",level:2},{value:"Capture EC2 Instance",id:"capture-ec2-instance-1",level:3},{value:"Prompt: Set Project Name",id:"prompt-set-project-name",level:4},{value:"Action: Creating the Project",id:"action-creating-the-project",level:4},{value:"Action: List S3 Buckets",id:"action-list-s3-buckets",level:4},{value:"Prompt: Set S3 Bucket",id:"prompt-set-s3-bucket",level:4},{value:"Action: List EC2 Instances",id:"action-list-ec2-instances",level:4},{value:"Prompt: Set EC2 Instance",id:"prompt-set-ec2-instance",level:4},{value:"Action: Capture EC2 Instance",id:"action-capture-ec2-instance",level:4},{value:"Action: Loop Pipeline until Terminated",id:"action-loop-pipeline-until-terminated",level:4}];function h(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"splunk-soar-integration",children:"Splunk SOAR Integration"}),"\n",(0,i.jsx)(t.p,{children:"Splunk SOAR is a Security Orchestration, Automation, and Response (SOAR) system. The Splunk SOAR platform combines security infrastructure orchestration, playbook automation, and case management capabilities to integrate your team, processes, and tools together including integrating with Cado."}),"\n",(0,i.jsx)(t.h2,{id:"getting-started",children:"Getting Started"}),"\n",(0,i.jsxs)(t.p,{children:["Before getting started, please see the ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado-response/manage/integrations/api-overview",children:"Integrations Overview >"})})," page for general instructions on setting up the Cado platform for integration with third-party tools."]}),"\n",(0,i.jsx)(t.p,{children:"Below are the instructions for setting up the Cado and Splunk SOAR integration:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#create-an-api-access-key",children:"Create an API Access Key"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#install-and-configure-the-cado-response-app",children:"Install and configure the Cado Response app in Splunk SOAR"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#configuration-variables",children:"Set your configuration variables"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#test-your-connection",children:"Test your connection"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#playbooks",children:"Setup your Playbooks"})})}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"create-an-api-access-key",children:"Create an API Access Key"}),"\n",(0,i.jsxs)(t.p,{children:["In order to allow third-party services to authenticate and interact with a Cado instance, you will need to ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado-response/manage/integrations/api-overview#creating-and-storing-an-api-access-key",children:"Create an API Access Key"})})," for use within Splunk SOAR."]}),"\n",(0,i.jsx)(t.admonition,{type:"tip",children:(0,i.jsx)(t.p,{children:"In addition to the API Access Key, please ensure that the Splunk SOAR platform has access (network, firewall, etc) to make API calls to the Cado platform."})}),"\n",(0,i.jsx)(t.h3,{id:"install-and-configure-the-cado-response-app",children:"Install and Configure the Cado Response App"}),"\n",(0,i.jsx)(t.p,{children:"In order to install and configure the Cado Response Splunk SOAR App, you will need the below information:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["The latest version of the Cado Response Splunk SOAR App Add-on from the ",(0,i.jsx)(t.a,{href:"https://splunkbase.splunk.com/app/6181/",children:(0,i.jsx)(t.strong,{children:"Splunkbase Marketplace"})})]}),"\n",(0,i.jsxs)(t.li,{children:["The URL to Cado, followed by ",(0,i.jsx)(t.code,{children:"/api/v2"})]}),"\n",(0,i.jsx)(t.li,{children:"The API Access Key"}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["To install the Cado Response App, from within Splunk SOAR, navigate to ",(0,i.jsx)(t.strong,{children:"Apps"})," and click the ",(0,i.jsx)(t.strong,{children:"INSTALL APP"})," button in the top right of the page, then upload the Cado Response tarball and click ",(0,i.jsx)(t.strong,{children:"INSTALL"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["If you have successfully installed the Cado Response App you will see it appear under your ",(0,i.jsx)(t.strong,{children:"Unconfigured Apps"}),". Next, do the following:"]}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"CONFIGURE NEW ASSET"})," on the Cado Response App."]}),"\n",(0,i.jsx)(t.li,{children:"Fill in the Asset Info fields with a name and description."}),"\n",(0,i.jsx)(t.li,{children:"Navigate to Asset Settings"}),"\n",(0,i.jsx)(t.li,{children:"input your URL for the Cado platform"}),"\n",(0,i.jsxs)(t.li,{children:["input your ",(0,i.jsx)(t.strong,{children:"Access token"})," you generated earlier."]}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"SAVE"})," and ",(0,i.jsx)(t.strong,{children:"TEST CONNECTIVITY"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["If all is successful, you should see a ",(0,i.jsx)(t.code,{children:"Test Connectivity Passed"})," message."]}),"\n",(0,i.jsx)(t.h4,{id:"configuration-variables",children:"Configuration Variables"}),"\n",(0,i.jsx)(t.p,{children:"The below configuration variables are required to operate Cado via the Splunk SOAR App. These are specified when configuring an asset in Splunk SOAR."}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"VARIABLE"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"base_url"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsxs)(t.td,{children:["URL for the Cado Platform e.g. ",(0,i.jsx)(t.code,{children:"https://cadoresponseurl/api/v2"})]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"access_token"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:"password"}),(0,i.jsx)(t.td,{children:"Access token"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"default_project"}),(0,i.jsx)(t.td,{children:"optional"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"A project ID in Cado that can be used if a project ID is not specified in an action."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"default_bucket"}),(0,i.jsx)(t.td,{children:"optional"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"A default bucket in Cado"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"default_region"}),(0,i.jsx)(t.td,{children:"optional"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"AWS region, e.g. us-east-1, that can be used if a region is not specified in an action."})]})]})]}),"\n",(0,i.jsx)(t.p,{children:"When running Actions, if the above inputs are required, they would be entered automatically into the response fields, but you are still able to replace them if you wish to use different values."}),"\n",(0,i.jsx)(t.h3,{id:"test-your-connection",children:"Test your connection"}),"\n",(0,i.jsx)(t.p,{children:"When Cado is configured, you can validate your connection to make sure everything is set up correctly."}),"\n",(0,i.jsxs)(t.p,{children:["Navigate to ",(0,i.jsx)(t.strong,{children:"Home -> Apps -> Cado Response Asset -> Asset Settings"}),". If you haven't already, Edit and enter the Cado URL and Secret Key. Save and Test Connectivity to ensure everything is connected as expected."]}),"\n",(0,i.jsx)(t.p,{children:"If the following was successful, then you have correctly setup Splunk SOAR to interact with the Cado Response API."}),"\n",(0,i.jsx)(t.h2,{id:"atomic-actions",children:"Atomic Actions"}),"\n",(0,i.jsxs)(t.p,{children:["Atomic Actions are the basic actions that can be chained together in ",(0,i.jsx)(t.em,{children:"Playbooks"})," that can be run to perform a specific task or workflow."]}),"\n",(0,i.jsx)(t.h3,{id:"list-projects",children:"List Projects"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list projects"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_projects"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List projects that are currently active in the Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsx)(t.p,{children:"No Parameters required for this action."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.case_name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"My First Project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"list-ec2-instances",children:"List EC2 instances"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list instances"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_instances"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List EC2 instances that are currently visible in the Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.region"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"us-east-1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.instance_name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"CadoResponse-Test"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.instance_type"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"t3a.2xlarge"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"list-s3-buckets",children:"List S3 buckets"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list buckets"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_buckets"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List S3 buckets that are currently visible to the Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsxs)(t.td,{children:["action_result.data.",(0,i.jsx)(t.em,{children:"."}),".bucket_name"]}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"list-pipelines",children:"List Pipelines"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list pipelines"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_pipelines"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List pipelines for specified project in Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Pipeline identifier as listed in the output of "list pipelines" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquiring i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.pipeline_type"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquisition"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.evidence_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"4"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.total"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"18"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.failure"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.pending"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.running"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.success"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"18"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.cancelled"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.terminated"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"true"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"get-a-pipeline",children:"Get a pipeline"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"get pipeline"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: get_pipeline"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: Get pipeline details for specified pipeline ID in Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Pipeline identifier as listed in the output of "get pipelines" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquisition: Create a processing pipeline for each copied EC2 volume"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.start_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633025565.147805"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.finish_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633031638.334756"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.execution_duration"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6073"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.state"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"SUCCESS"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"loop-until-terminated",children:"Loop Until Terminated"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"loop pipeline"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: loop_pipeline"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: Get pipeline details every 60 seconds for specified pipeline ID in Cado Response platform until it is terminated."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Pipeline identifier as listed in the output of "get pipelines" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquisition: Create a processing pipeline for each copied EC2 volume"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.start_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633025565.147805"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.finish_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633031638.334756"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.execution_duration"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6073"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.state"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"SUCCESS"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"create-project",children:"Create Project"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"create project"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: create_project"}),"\n",(0,i.jsx)(t.li,{children:"Type: n/a"}),"\n",(0,i.jsx)(t.li,{children:"Description: Create a project in Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_name"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:"User provided Project name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"My First Project"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"My First Project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.msg"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Created"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"capture-ec2-instance",children:"Capture EC2 instance"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"capture instance"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: capture_instance"}),"\n",(0,i.jsx)(t.li,{children:"Type: n/a"}),"\n",(0,i.jsx)(t.li,{children:"Description: Capture a specific EC2 instance for processing and analysis on the Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'S3 bucket name as listed in the output of "list bucket" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"region"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'AWS instance region as listed in the output of "list instances" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"us-east-1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"instance_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'AWS instance ID as listed in the output of "list instances" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"i-1234567890abcdef0"})]})]})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquiring i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.region"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"us-east-1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.instance_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.bucket"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"capture-s3-bucket",children:"Capture S3 bucket"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"capture bucket"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: capture_bucket"}),"\n",(0,i.jsx)(t.li,{children:"Type: n/a"}),"\n",(0,i.jsx)(t.li,{children:"Description: Capture contents of a specific S3 bucket processing and analysis on the Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'S3 bucket name as listed in the output of "list bucket" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"example-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})]})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.pipeline_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.project_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.evidence_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"4"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.pipeline_type"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"acquisition"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.bucket"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})]})]}),"\n",(0,i.jsx)(t.h2,{id:"playbooks",children:"Playbooks"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.em,{children:"If you have a good grasp of the basics of Splunk SOAR, feel free to skip this section."})}),"\n",(0,i.jsxs)(t.p,{children:["To create a new playbook, navigate to Playbooks from the Splunk SOAR dashboard. Click the ",(0,i.jsx)(t.strong,{children:"+ PLAYBOOK"})," button in the top right."]}),"\n",(0,i.jsx)(t.p,{children:"Using the graphic playbook editor, you can drag and drop the required elements into place from the blue nodes, and configure them one by one as you place them, until you have a playbook ready."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Splunk SOAR Playbook",src:n(6533).Z+"",width:"1713",height:"474"})}),"\n",(0,i.jsx)(t.p,{children:"Playbooks are made up of multiple blocks that carry out a workflow. There are 3 main types of blocks:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Execute actions (these include the atomic actions detailed above)"}),"\n",(0,i.jsx)(t.li,{children:"Process filters"}),"\n",(0,i.jsx)(t.li,{children:"Human input"}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"The example below makes use of both execute actions and human input. Prompts pop up and asks the user for an input. This input can then be passed to the actions as action parameters and act accordingly."}),"\n",(0,i.jsx)(t.h3,{id:"capture-ec2-instance-1",children:"Capture EC2 Instance"}),"\n",(0,i.jsx)(t.p,{children:"This section covers a quick tutorial in creating a basic workflow (or playbook in Splunk SOAR terms) that:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Creates a new Project"}),"\n",(0,i.jsx)(t.li,{children:"Triggers an EC2 Disk Acquisition"}),"\n",(0,i.jsx)(t.li,{children:"Loops over a pipeline until it has been terminated"}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"prompt-set-project-name",children:"Prompt: Set Project Name"}),"\n",(0,i.jsxs)(t.p,{children:["From the START block you can drag the blue node to add a new block. Select the Prompt option. Under the ",(0,i.jsx)(t.strong,{children:"Advance Settings"})," -> ",(0,i.jsx)(t.strong,{children:"General Settings"})," you can set a custom name, i.e. ",(0,i.jsx)(t.code,{children:"Set Project Name"}),". You can include a Message, so the user knows what to include."]}),"\n",(0,i.jsx)(t.h4,{id:"action-creating-the-project",children:"Action: Creating the Project"}),"\n",(0,i.jsxs)(t.p,{children:["Drag the blue node from the prompt you just added to add an action. Select your configured Cado Response App to view the available actions you can carry out. You will want the ",(0,i.jsx)(t.strong,{children:"create project"})," action. Again here you can change the action name under ",(0,i.jsx)(t.strong,{children:"Advanced Settings"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["You can configure the action by clicking the Cado Response Asset and entering the output from the previous prompt into the ",(0,i.jsx)(t.strong,{children:"project_name"})," field. Do this by clicking on the field where a sidebar will pop up with a list of blocks currently used in the playbook. Select the prompt you just created, e.g. ",(0,i.jsx)(t.code,{children:"Set_Project_Name"}),". This will open another sidebar with the data path outputs generated from the prompt. Select ",(0,i.jsx)(t.code,{children:"summary.responses.0"}),". SAVE and the action will be created."]}),"\n",(0,i.jsx)(t.h4,{id:"action-list-s3-buckets",children:"Action: List S3 Buckets"}),"\n",(0,i.jsxs)(t.p,{children:["From the last action add the ",(0,i.jsx)(t.strong,{children:"list bucket"})," action. Configure the project_id to be the ID output from the ",(0,i.jsx)(t.strong,{children:"create project"})," action, i.e. ",(0,i.jsx)(t.code,{children:"create_project_1:action_result.data.*.id"})]}),"\n",(0,i.jsx)(t.h4,{id:"prompt-set-s3-bucket",children:"Prompt: Set S3 Bucket"}),"\n",(0,i.jsxs)(t.p,{children:["Add a new prompt block from the previous action called ",(0,i.jsx)(t.code,{children:"Set S3"}),". Click the ",(0,i.jsx)(t.strong,{children:"ADD MESSAGE PARAMETERS"})," button. This will add ",(0,i.jsx)(t.strong,{children:0})," to the message which acts as a placeholder for a message parameter. In the message parameter field select the list bucket action you just created followed by the bucket_name action results i.e. ",(0,i.jsx)(t.code,{children:"list_bucket_1:action_result.data.*.*.bucket_name"}),"."]}),"\n",(0,i.jsx)(t.h4,{id:"action-list-ec2-instances",children:"Action: List EC2 Instances"}),"\n",(0,i.jsxs)(t.p,{children:["Add the list instances action next with the project_id field containing the ID output from the ",(0,i.jsx)(t.strong,{children:"create project"})," action, i.e. ",(0,i.jsx)(t.code,{children:"create_project_1:action_result.data.*.id"}),"."]}),"\n",(0,i.jsx)(t.h4,{id:"prompt-set-ec2-instance",children:"Prompt: Set EC2 Instance"}),"\n",(0,i.jsxs)(t.p,{children:["Similar to the ",(0,i.jsx)(t.strong,{children:"Set S3"})," prompt, add a new prompt block with 2 message parameters. The first being the list instances region (",(0,i.jsx)(t.code,{children:"list_instances_1:action_result.data.*.*.region"}),") and the second being the list instances instance ID (",(0,i.jsx)(t.code,{children:"list_instances_1:action_result.data.*.*.id"}),")."]}),"\n",(0,i.jsxs)(t.p,{children:["In the responses part of the configuration for the action add the first to be ",(0,i.jsx)(t.code,{children:"Region"})," and the second to be ",(0,i.jsx)(t.code,{children:"Instance ID"}),"."]}),"\n",(0,i.jsx)(t.h4,{id:"action-capture-ec2-instance",children:"Action: Capture EC2 Instance"}),"\n",(0,i.jsxs)(t.p,{children:["Next add the ",(0,i.jsx)(t.strong,{children:"capture instance"})," action, this will need 4 parameters configured. ",(0,i.jsx)(t.strong,{children:"project_id"})," will take the ID result from the create project action. Instance ID and region will take their respective responses from the previous prompt and bucket will take the response from the set S3 prompt."]}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["project_id: ",(0,i.jsx)(t.code,{children:"create_project_1:action_result.data.*.id"})]}),"\n",(0,i.jsxs)(t.li,{children:["instance_id: ",(0,i.jsx)(t.code,{children:"Set_EC2:action_result.summary.responses.1"})]}),"\n",(0,i.jsxs)(t.li,{children:["region: ",(0,i.jsx)(t.code,{children:"Set_EC2:action_result.summary.responses.0"})]}),"\n",(0,i.jsxs)(t.li,{children:["bucket: ",(0,i.jsx)(t.code,{children:"Set_S3:action_result.summary.responses.0"})]}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"action-loop-pipeline-until-terminated",children:"Action: Loop Pipeline until Terminated"}),"\n",(0,i.jsxs)(t.p,{children:["Add the final action which will be the ",(0,i.jsx)(t.strong,{children:"loop pipeline"})," action. Fill in the ",(0,i.jsx)(t.strong,{children:"pipeline_id"})," field with the name result from the capture instance action: ",(0,i.jsx)(t.code,{children:"capture_instance_1:action_result.data.*.name"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["Connect this final action block to the ",(0,i.jsx)(t.strong,{children:"END"})," block and the playbook is complete. Be sure to ",(0,i.jsx)(t.strong,{children:"SAVE"})," using the top right button, and then you can run your playbook."]})]})}function o(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(h,{...e})}):h(e)}},6533:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/phantom-playbook-75c99069a3e66ac4d5d564309f5f7045.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>c,a:()=>d});var i=n(7294);const s={},r=i.createContext(s);function d(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:d(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/aa6d861f.9c4839fc.js b/assets/js/aa6d861f.9c4839fc.js deleted file mode 100644 index 8bdf245e5..000000000 --- a/assets/js/aa6d861f.9c4839fc.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5185],{9257:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>d,default:()=>o,frontMatter:()=>r,metadata:()=>c,toc:()=>a});var i=n(5893),s=n(1151);const r={title:"Splunk SOAR",hide_title:!0,sidebar_position:5},d="Splunk SOAR Integration",c={id:"cado-response/manage/integrations/soar/splunk-soar",title:"Splunk SOAR",description:"Splunk SOAR is a Security Orchestration, Automation, and Response (SOAR) system. The Splunk SOAR platform combines security infrastructure orchestration, playbook automation, and case management capabilities to integrate your team, processes, and tools together including integrating with Cado.",source:"@site/docs/cado-response/manage/integrations/soar/splunk-soar.md",sourceDirName:"cado-response/manage/integrations/soar",slug:"/cado-response/manage/integrations/soar/splunk-soar",permalink:"/cado-response/manage/integrations/soar/splunk-soar",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/soar/splunk-soar.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:5,frontMatter:{title:"Splunk SOAR",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Tines",permalink:"/cado-response/manage/integrations/soar/tines"},next:{title:"Cortex XSOAR",permalink:"/cado-response/manage/integrations/soar/cortex-xsoar"}},l={},a=[{value:"Getting Started",id:"getting-started",level:2},{value:"Create an API Access Key",id:"create-an-api-access-key",level:3},{value:"Install and Configure the Cado Response App",id:"install-and-configure-the-cado-response-app",level:3},{value:"Configuration Variables",id:"configuration-variables",level:4},{value:"Test your connection",id:"test-your-connection",level:3},{value:"Atomic Actions",id:"atomic-actions",level:2},{value:"List Projects",id:"list-projects",level:3},{value:"List EC2 instances",id:"list-ec2-instances",level:3},{value:"List S3 buckets",id:"list-s3-buckets",level:3},{value:"List Pipelines",id:"list-pipelines",level:3},{value:"Get a pipeline",id:"get-a-pipeline",level:3},{value:"Loop Until Terminated",id:"loop-until-terminated",level:3},{value:"Create Project",id:"create-project",level:3},{value:"Capture EC2 instance",id:"capture-ec2-instance",level:3},{value:"Capture S3 bucket",id:"capture-s3-bucket",level:3},{value:"Playbooks",id:"playbooks",level:2},{value:"Capture EC2 Instance",id:"capture-ec2-instance-1",level:3},{value:"Prompt: Set Project Name",id:"prompt-set-project-name",level:4},{value:"Action: Creating the Project",id:"action-creating-the-project",level:4},{value:"Action: List S3 Buckets",id:"action-list-s3-buckets",level:4},{value:"Prompt: Set S3 Bucket",id:"prompt-set-s3-bucket",level:4},{value:"Action: List EC2 Instances",id:"action-list-ec2-instances",level:4},{value:"Prompt: Set EC2 Instance",id:"prompt-set-ec2-instance",level:4},{value:"Action: Capture EC2 Instance",id:"action-capture-ec2-instance",level:4},{value:"Action: Loop Pipeline until Terminated",id:"action-loop-pipeline-until-terminated",level:4}];function h(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"splunk-soar-integration",children:"Splunk SOAR Integration"}),"\n",(0,i.jsx)(t.p,{children:"Splunk SOAR is a Security Orchestration, Automation, and Response (SOAR) system. The Splunk SOAR platform combines security infrastructure orchestration, playbook automation, and case management capabilities to integrate your team, processes, and tools together including integrating with Cado."}),"\n",(0,i.jsx)(t.h2,{id:"getting-started",children:"Getting Started"}),"\n",(0,i.jsxs)(t.p,{children:["Before getting started, please see the ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado-response/manage/integrations/api-overview",children:"Integrations Overview >"})})," page for general instructions on setting up the Cado platform for integration with third-party tools."]}),"\n",(0,i.jsx)(t.p,{children:"Below are the instructions for setting up the Cado and Splunk SOAR integration:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#create-an-api-access-key",children:"Create an API Access Key"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#install-and-configure-the-cado-response-app",children:"Install and configure the Cado Response app in Splunk SOAR"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#configuration-variables",children:"Set your configuration variables"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#test-your-connection",children:"Test your connection"})})}),"\n",(0,i.jsx)(t.li,{children:(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"#playbooks",children:"Setup your Playbooks"})})}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"create-an-api-access-key",children:"Create an API Access Key"}),"\n",(0,i.jsxs)(t.p,{children:["In order to allow third-party services to authenticate and interact with a Cado instance, you will need to ",(0,i.jsx)(t.strong,{children:(0,i.jsx)(t.a,{href:"/cado-response/manage/integrations/api-overview#creating-and-storing-an-api-access-key",children:"Create an API Access Key"})})," for use within Splunk SOAR."]}),"\n",(0,i.jsx)(t.admonition,{type:"tip",children:(0,i.jsx)(t.p,{children:"In addition to the API Access Key, please ensure that the Splunk SOAR platform has access (network, firewall, etc) to make API calls to the Cado platform."})}),"\n",(0,i.jsx)(t.h3,{id:"install-and-configure-the-cado-response-app",children:"Install and Configure the Cado Response App"}),"\n",(0,i.jsx)(t.p,{children:"In order to install and configure the Cado Response Splunk SOAR App, you will need the below information:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["The latest version of the Cado Response Splunk SOAR App Add-on from the ",(0,i.jsx)(t.a,{href:"https://splunkbase.splunk.com/app/6181/",children:(0,i.jsx)(t.strong,{children:"Splunkbase Marketplace"})})]}),"\n",(0,i.jsxs)(t.li,{children:["The URL to Cado, followed by ",(0,i.jsx)(t.code,{children:"/api/v2"})]}),"\n",(0,i.jsx)(t.li,{children:"The API Access Key"}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["To install the Cado Response App, from within Splunk SOAR, navigate to ",(0,i.jsx)(t.strong,{children:"Apps"})," and click the ",(0,i.jsx)(t.strong,{children:"INSTALL APP"})," button in the top right of the page, then upload the Cado Response tarball and click ",(0,i.jsx)(t.strong,{children:"INSTALL"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["If you have successfully installed the Cado Response App you will see it appear under your ",(0,i.jsx)(t.strong,{children:"Unconfigured Apps"}),". Next, do the following:"]}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"CONFIGURE NEW ASSET"})," on the Cado Response App."]}),"\n",(0,i.jsx)(t.li,{children:"Fill in the Asset Info fields with a name and description."}),"\n",(0,i.jsx)(t.li,{children:"Navigate to Asset Settings"}),"\n",(0,i.jsx)(t.li,{children:"input your URL for the Cado platform"}),"\n",(0,i.jsxs)(t.li,{children:["input your ",(0,i.jsx)(t.strong,{children:"Access token"})," you generated earlier."]}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"SAVE"})," and ",(0,i.jsx)(t.strong,{children:"TEST CONNECTIVITY"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(t.p,{children:["If all is successful, you should see a ",(0,i.jsx)(t.code,{children:"Test Connectivity Passed"})," message."]}),"\n",(0,i.jsx)(t.h4,{id:"configuration-variables",children:"Configuration Variables"}),"\n",(0,i.jsx)(t.p,{children:"The below configuration variables are required to operate Cado via the Splunk SOAR App. These are specified when configuring an asset in Splunk SOAR."}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"VARIABLE"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"base_url"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsxs)(t.td,{children:["URL for the Cado Platform e.g. ",(0,i.jsx)(t.code,{children:"https://cadoresponseurl/api/v2"})]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"access_token"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:"password"}),(0,i.jsx)(t.td,{children:"Access token"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"default_project"}),(0,i.jsx)(t.td,{children:"optional"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"A project ID in Cado that can be used if a project ID is not specified in an action."})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"default_bucket"}),(0,i.jsx)(t.td,{children:"optional"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"A default bucket in Cado"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"default_region"}),(0,i.jsx)(t.td,{children:"optional"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"AWS region, e.g. us-east-1, that can be used if a region is not specified in an action."})]})]})]}),"\n",(0,i.jsx)(t.p,{children:"When running Actions, if the above inputs are required, they would be entered automatically into the response fields, but you are still able to replace them if you wish to use different values."}),"\n",(0,i.jsx)(t.h3,{id:"test-your-connection",children:"Test your connection"}),"\n",(0,i.jsx)(t.p,{children:"When Cado is configured, you can validate your connection to make sure everything is set up correctly."}),"\n",(0,i.jsxs)(t.p,{children:["Navigate to ",(0,i.jsx)(t.strong,{children:"Home -> Apps -> Cado Response Asset -> Asset Settings"}),". If you haven't already, Edit and enter the Cado URL and Secret Key. Save and Test Connectivity to ensure everything is connected as expected."]}),"\n",(0,i.jsx)(t.p,{children:"If the following was successful, then you have correctly setup Splunk SOAR to interact with the Cado Response API."}),"\n",(0,i.jsx)(t.h2,{id:"atomic-actions",children:"Atomic Actions"}),"\n",(0,i.jsxs)(t.p,{children:["Atomic Actions are the basic actions that can be chained together in ",(0,i.jsx)(t.em,{children:"Playbooks"})," that can be run to perform a specific task or workflow."]}),"\n",(0,i.jsx)(t.h3,{id:"list-projects",children:"List Projects"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list projects"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_projects"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List projects that are currently active in the Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsx)(t.p,{children:"No Parameters required for this action."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.case_name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"My First Project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"list-ec2-instances",children:"List EC2 instances"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list instances"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_instances"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List EC2 instances that are currently visible in the Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.region"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"us-east-1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.instance_name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"CadoResponse-Test"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.instance_type"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"t3a.2xlarge"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"list-s3-buckets",children:"List S3 buckets"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list buckets"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_buckets"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List S3 buckets that are currently visible to the Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsxs)(t.td,{children:["action_result.data.",(0,i.jsx)(t.em,{children:"."}),".bucket_name"]}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"list-pipelines",children:"List Pipelines"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"list pipelines"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: list_pipelines"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: List pipelines for specified project in Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Pipeline identifier as listed in the output of "list pipelines" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquiring i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.pipeline_type"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquisition"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.evidence_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"4"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.total"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"18"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.failure"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.pending"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.running"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.success"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"18"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.summary.cancelled"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.*.terminated"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"true"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"get-a-pipeline",children:"Get a pipeline"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"get pipeline"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: get_pipeline"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: Get pipeline details for specified pipeline ID in Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Pipeline identifier as listed in the output of "get pipelines" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquisition: Create a processing pipeline for each copied EC2 volume"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.start_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633025565.147805"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.finish_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633031638.334756"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.execution_duration"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6073"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.state"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"SUCCESS"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"loop-until-terminated",children:"Loop Until Terminated"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"loop pipeline"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: loop_pipeline"}),"\n",(0,i.jsx)(t.li,{children:"Type: Investigate"}),"\n",(0,i.jsx)(t.li,{children:"Description: Get pipeline details every 60 seconds for specified pipeline ID in Cado Response platform until it is terminated."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"pipeline_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Pipeline identifier as listed in the output of "get pipelines" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquisition: Create a processing pipeline for each copied EC2 volume"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.start_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633025565.147805"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.finish_time"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1633031638.334756"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.execution_duration"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6073"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.subtasks.*.state"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"SUCCESS"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"create-project",children:"Create Project"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"create project"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: create_project"}),"\n",(0,i.jsx)(t.li,{children:"Type: n/a"}),"\n",(0,i.jsx)(t.li,{children:"Description: Create a project in Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsx)(t.tbody,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_name"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:"User provided Project name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"My First Project"})]})})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"My First Project"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.msg"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Created"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"capture-ec2-instance",children:"Capture EC2 instance"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"capture instance"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: capture_instance"}),"\n",(0,i.jsx)(t.li,{children:"Type: n/a"}),"\n",(0,i.jsx)(t.li,{children:"Description: Capture a specific EC2 instance for processing and analysis on the Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'S3 bucket name as listed in the output of "list bucket" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"region"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'AWS instance region as listed in the output of "list instances" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"us-east-1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"instance_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'AWS instance ID as listed in the output of "list instances" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"i-1234567890abcdef0"})]})]})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.pipelines.pipeline_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.name"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"Acquiring i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.region"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"us-east-1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.instance_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"i-1234567890abcdef0"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.bucket"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]})]})]}),"\n",(0,i.jsx)(t.h3,{id:"capture-s3-bucket",children:"Capture S3 bucket"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Name: ",(0,i.jsx)(t.code,{children:"capture bucket"})]}),"\n",(0,i.jsx)(t.li,{children:"Identifier: capture_bucket"}),"\n",(0,i.jsx)(t.li,{children:"Type: n/a"}),"\n",(0,i.jsx)(t.li,{children:"Description: Capture contents of a specific S3 bucket processing and analysis on the Cado Response platform."}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Parameters"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"PARAMETER"}),(0,i.jsx)(t.th,{children:"REQUIRED"}),(0,i.jsx)(t.th,{children:"DESCRIPTION"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"bucket"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'S3 bucket name as listed in the output of "list bucket" action'}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"example-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"project_id"}),(0,i.jsx)(t.td,{children:"required"}),(0,i.jsx)(t.td,{children:'Project identifier as listed in the output of "list projects" action'}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})]})]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"Action Output"})}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"DATA PATH"}),(0,i.jsx)(t.th,{children:"TYPE"}),(0,i.jsx)(t.th,{children:"EXAMPLE VALUE"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.pipeline_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"6"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.project_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"1"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.evidence_id"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"4"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.data.*.*.pipelines.pipeline_type"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"acquisition"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.status"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"success"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.bucket"}),(0,i.jsx)(t.td,{children:"string"}),(0,i.jsx)(t.td,{children:"test-bucket"})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"action_result.parameter.project_id"}),(0,i.jsx)(t.td,{children:"numeric"}),(0,i.jsx)(t.td,{children:"1"})]})]})]}),"\n",(0,i.jsx)(t.h2,{id:"playbooks",children:"Playbooks"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.em,{children:"If you have a good grasp of the basics of Splunk SOAR, feel free to skip this section."})}),"\n",(0,i.jsxs)(t.p,{children:["To create a new playbook, navigate to Playbooks from the Splunk SOAR dashboard. Click the ",(0,i.jsx)(t.strong,{children:"+ PLAYBOOK"})," button in the top right."]}),"\n",(0,i.jsx)(t.p,{children:"Using the graphic playbook editor, you can drag and drop the required elements into place from the blue nodes, and configure them one by one as you place them, until you have a playbook ready."}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Splunk SOAR Playbook",src:n(6533).Z+"",width:"1713",height:"474"})}),"\n",(0,i.jsx)(t.p,{children:"Playbooks are made up of multiple blocks that carry out a workflow. There are 3 main types of blocks:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Execute actions (these include the atomic actions detailed above)"}),"\n",(0,i.jsx)(t.li,{children:"Process filters"}),"\n",(0,i.jsx)(t.li,{children:"Human input"}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"The example below makes use of both execute actions and human input. Prompts pop up and asks the user for an input. This input can then be passed to the actions as action parameters and act accordingly."}),"\n",(0,i.jsx)(t.h3,{id:"capture-ec2-instance-1",children:"Capture EC2 Instance"}),"\n",(0,i.jsx)(t.p,{children:"This section covers a quick tutorial in creating a basic workflow (or playbook in Splunk SOAR terms) that:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"Creates a new Project"}),"\n",(0,i.jsx)(t.li,{children:"Triggers an EC2 Disk Acquisition"}),"\n",(0,i.jsx)(t.li,{children:"Loops over a pipeline until it has been terminated"}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"prompt-set-project-name",children:"Prompt: Set Project Name"}),"\n",(0,i.jsxs)(t.p,{children:["From the START block you can drag the blue node to add a new block. Select the Prompt option. Under the ",(0,i.jsx)(t.strong,{children:"Advance Settings"})," -> ",(0,i.jsx)(t.strong,{children:"General Settings"})," you can set a custom name, i.e. ",(0,i.jsx)(t.code,{children:"Set Project Name"}),". You can include a Message, so the user knows what to include."]}),"\n",(0,i.jsx)(t.h4,{id:"action-creating-the-project",children:"Action: Creating the Project"}),"\n",(0,i.jsxs)(t.p,{children:["Drag the blue node from the prompt you just added to add an action. Select your configured Cado Response App to view the available actions you can carry out. You will want the ",(0,i.jsx)(t.strong,{children:"create project"})," action. Again here you can change the action name under ",(0,i.jsx)(t.strong,{children:"Advanced Settings"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["You can configure the action by clicking the Cado Response Asset and entering the output from the previous prompt into the ",(0,i.jsx)(t.strong,{children:"project_name"})," field. Do this by clicking on the field where a sidebar will pop up with a list of blocks currently used in the playbook. Select the prompt you just created, e.g. ",(0,i.jsx)(t.code,{children:"Set_Project_Name"}),". This will open another sidebar with the data path outputs generated from the prompt. Select ",(0,i.jsx)(t.code,{children:"summary.responses.0"}),". SAVE and the action will be created."]}),"\n",(0,i.jsx)(t.h4,{id:"action-list-s3-buckets",children:"Action: List S3 Buckets"}),"\n",(0,i.jsxs)(t.p,{children:["From the last action add the ",(0,i.jsx)(t.strong,{children:"list bucket"})," action. Configure the project_id to be the ID output from the ",(0,i.jsx)(t.strong,{children:"create project"})," action, i.e. ",(0,i.jsx)(t.code,{children:"create_project_1:action_result.data.*.id"})]}),"\n",(0,i.jsx)(t.h4,{id:"prompt-set-s3-bucket",children:"Prompt: Set S3 Bucket"}),"\n",(0,i.jsxs)(t.p,{children:["Add a new prompt block from the previous action called ",(0,i.jsx)(t.code,{children:"Set S3"}),". Click the ",(0,i.jsx)(t.strong,{children:"ADD MESSAGE PARAMETERS"})," button. This will add ",(0,i.jsx)(t.strong,{children:0})," to the message which acts as a placeholder for a message parameter. In the message parameter field select the list bucket action you just created followed by the bucket_name action results i.e. ",(0,i.jsx)(t.code,{children:"list_bucket_1:action_result.data.*.*.bucket_name"}),"."]}),"\n",(0,i.jsx)(t.h4,{id:"action-list-ec2-instances",children:"Action: List EC2 Instances"}),"\n",(0,i.jsxs)(t.p,{children:["Add the list instances action next with the project_id field containing the ID output from the ",(0,i.jsx)(t.strong,{children:"create project"})," action, i.e. ",(0,i.jsx)(t.code,{children:"create_project_1:action_result.data.*.id"}),"."]}),"\n",(0,i.jsx)(t.h4,{id:"prompt-set-ec2-instance",children:"Prompt: Set EC2 Instance"}),"\n",(0,i.jsxs)(t.p,{children:["Similar to the ",(0,i.jsx)(t.strong,{children:"Set S3"})," prompt, add a new prompt block with 2 message parameters. The first being the list instances region (",(0,i.jsx)(t.code,{children:"list_instances_1:action_result.data.*.*.region"}),") and the second being the list instances instance ID (",(0,i.jsx)(t.code,{children:"list_instances_1:action_result.data.*.*.id"}),")."]}),"\n",(0,i.jsxs)(t.p,{children:["In the responses part of the configuration for the action add the first to be ",(0,i.jsx)(t.code,{children:"Region"})," and the second to be ",(0,i.jsx)(t.code,{children:"Instance ID"}),"."]}),"\n",(0,i.jsx)(t.h4,{id:"action-capture-ec2-instance",children:"Action: Capture EC2 Instance"}),"\n",(0,i.jsxs)(t.p,{children:["Next add the ",(0,i.jsx)(t.strong,{children:"capture instance"})," action, this will need 4 parameters configured. ",(0,i.jsx)(t.strong,{children:"project_id"})," will take the ID result from the create project action. Instance ID and region will take their respective responses from the previous prompt and bucket will take the response from the set S3 prompt."]}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["project_id: ",(0,i.jsx)(t.code,{children:"create_project_1:action_result.data.*.id"})]}),"\n",(0,i.jsxs)(t.li,{children:["instance_id: ",(0,i.jsx)(t.code,{children:"Set_EC2:action_result.summary.responses.1"})]}),"\n",(0,i.jsxs)(t.li,{children:["region: ",(0,i.jsx)(t.code,{children:"Set_EC2:action_result.summary.responses.0"})]}),"\n",(0,i.jsxs)(t.li,{children:["bucket: ",(0,i.jsx)(t.code,{children:"Set_S3:action_result.summary.responses.0"})]}),"\n"]}),"\n",(0,i.jsx)(t.h4,{id:"action-loop-pipeline-until-terminated",children:"Action: Loop Pipeline until Terminated"}),"\n",(0,i.jsxs)(t.p,{children:["Add the final action which will be the ",(0,i.jsx)(t.strong,{children:"loop pipeline"})," action. Fill in the ",(0,i.jsx)(t.strong,{children:"pipeline_id"})," field with the name result from the capture instance action: ",(0,i.jsx)(t.code,{children:"capture_instance_1:action_result.data.*.name"}),"."]}),"\n",(0,i.jsxs)(t.p,{children:["Connect this final action block to the ",(0,i.jsx)(t.strong,{children:"END"})," block and the playbook is complete. Be sure to ",(0,i.jsx)(t.strong,{children:"SAVE"})," using the top right button, and then you can run your playbook."]})]})}function o(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(h,{...e})}):h(e)}},6533:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/phantom-playbook-75c99069a3e66ac4d5d564309f5f7045.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>c,a:()=>d});var i=n(7294);const s={},r=i.createContext(s);function d(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:d(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b038dc2c.2180e801.js b/assets/js/b038dc2c.2180e801.js deleted file mode 100644 index c5845100b..000000000 --- a/assets/js/b038dc2c.2180e801.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2616],{489:(e,s,d)=>{d.r(s),d.d(s,{assets:()=>h,contentTitle:()=>n,default:()=>a,frontMatter:()=>r,metadata:()=>c,toc:()=>l});var i=d(5893),t=d(1151);const r={title:"Timeline Search",hide_title:!0,sidebar_position:3},n="Timeline Search",c={id:"cado-response/investigate/timeline-search",title:"Timeline Search",description:"The Cado platform includes an advanced search interface which supports complex queries.",source:"@site/docs/cado-response/investigate/timeline-search.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/timeline-search",permalink:"/cado-response/investigate/timeline-search",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/timeline-search.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:3,frontMatter:{title:"Timeline Search",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Evidence",permalink:"/cado-response/investigate/evidence"},next:{title:"Automated Investigation",permalink:"/cado-response/investigate/automated-investigation"}},h={},l=[{value:"Faceted Search",id:"faceted-search",level:3},{value:"Basic Searches",id:"basic-searches",level:3},{value:"Plain search terms",id:"plain-search-terms",level:4},{value:"Fields",id:"fields",level:4},{value:"Ranges",id:"ranges",level:4},{value:"Building complex queries",id:"building-complex-queries",level:3},{value:"Fields",id:"fields-1",level:2}];function o(e){const s={admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"timeline-search",children:"Timeline Search"}),"\n",(0,i.jsx)(s.p,{children:"The Cado platform includes an advanced search interface which supports complex queries."}),"\n",(0,i.jsx)(s.h3,{id:"faceted-search",children:"Faceted Search"}),"\n",(0,i.jsx)(s.p,{children:"Cado allows you to filter your search based upon 'facets', like event severity, or associated user name, file, source/destination IP address"}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Faceted Search",src:d(29).Z+"",width:"1851",height:"852"})}),"\n",(0,i.jsx)(s.p,{children:"For long lists of facets, you can search and sort the list of facets"}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Faceted List",src:d(4472).Z+"",width:"1503",height:"752"})}),"\n",(0,i.jsx)(s.h3,{id:"basic-searches",children:"Basic Searches"}),"\n",(0,i.jsx)(s.p,{children:"You can also use the search bar to craft specific searches using search strings"}),"\n",(0,i.jsx)(s.h4,{id:"plain-search-terms",children:"Plain search terms"}),"\n",(0,i.jsxs)(s.p,{children:["Providing plain search terms will search across all fields, for example: ",(0,i.jsx)(s.code,{children:"foo"})]}),"\n",(0,i.jsxs)(s.p,{children:["You can quote terms containing spaces: ",(0,i.jsx)(s.code,{children:'"foo bar"'})]}),"\n",(0,i.jsx)(s.h4,{id:"fields",children:"Fields"}),"\n",(0,i.jsxs)(s.p,{children:["You can search a specific field by prepending it to the search term: ",(0,i.jsx)(s.code,{children:"user: Chris"})," OR ",(0,i.jsx)(s.code,{children:'extra: "foo bar"'})]}),"\n",(0,i.jsx)(s.h4,{id:"ranges",children:"Ranges"}),"\n",(0,i.jsxs)(s.p,{children:["You can restrict a field to a range of values: ",(0,i.jsx)(s.code,{children:"file_size: [1024 TO 8196]"})]}),"\n",(0,i.jsx)(s.h3,{id:"building-complex-queries",children:"Building complex queries"}),"\n",(0,i.jsxs)(s.p,{children:["You can build complex queries using ",(0,i.jsx)(s.code,{children:"AND"}),", ",(0,i.jsx)(s.code,{children:"OR"})," and ",(0,i.jsx)(s.code,{children:"NOT"})," to combine terms, and brackets to group ",(0,i.jsx)(s.code,{children:"()"}),":"]}),"\n",(0,i.jsxs)(s.p,{children:["For example: ",(0,i.jsx)(s.code,{children:'alarm_severity: [0 TO 5] AND (user: "Chris" OR user: "James") AND NOT filename: "/foo/bar.txt"'})]}),"\n",(0,i.jsx)(s.admonition,{type:"info",children:(0,i.jsxs)(s.p,{children:["Note that without brackets, ANDs will bind before ORs. This means that ",(0,i.jsx)(s.code,{children:'user: "Chris" AND user: "James" OR filename: "/foo/bar.txt"'})," is searched as ",(0,i.jsx)(s.code,{children:'(user: "Chris" AND user: "James") OR filename: "/foo/bar.txt"'}),"."]})}),"\n",(0,i.jsx)(s.h2,{id:"fields-1",children:"Fields"}),"\n",(0,i.jsx)(s.p,{children:"Searchable fields"}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:"Field"}),(0,i.jsx)(s.th,{children:"Type"}),(0,i.jsx)(s.th,{children:"Description"})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"macb"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsxs)(s.td,{children:["4 character string which encoding MACB information for this event. An ",(0,i.jsx)(s.code,{children:"M"})," in position 0 indicates this is a Modified event and a ",(0,i.jsx)(s.code,{children:"."})," represents a non-modified event. e.g. ",(0,i.jsx)(s.code,{children:"M..B"})," indicates modified and birth."]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"source"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsxs)(s.td,{children:["The type of the file or data that produced this event e.g. ",(0,i.jsx)(s.code,{children:"EVT"}),", ",(0,i.jsx)(s.code,{children:"CLOUDTRAIL"}),", ",(0,i.jsx)(s.code,{children:"FILE"}),", ",(0,i.jsx)(s.code,{children:"JAVA_IDX"}),", ",(0,i.jsx)(s.code,{children:"LOG"}),"."]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"sourcetype"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsxs)(s.td,{children:["More specific subtype of ",(0,i.jsx)(s.code,{children:"source"})]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"type"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsxs)(s.td,{children:[(0,i.jsx)(s.code,{children:";"})," separated list of event types, e.g. ",(0,i.jsx)(s.code,{children:"Last Executed Time"}),", ",(0,i.jsx)(s.code,{children:"Updated Time"}),", ",(0,i.jsx)(s.code,{children:"Content Modification Time"}),", ",(0,i.jsx)(s.code,{children:"Creation Time"}),"."]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"user"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"User associated with the event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"host"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"Host name associated with the event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"filename"})}),(0,i.jsx)(s.td,{children:"special"}),(0,i.jsx)(s.td,{children:"The path of the file associated with this event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"full_filename"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"The full path of the file associated with this event, supports regex and must match entire path"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"inode"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"The inode number of the file associated with this event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"source_hostname"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"For network connections, the hostname that it originated from"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"destination_hostname"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"For network connections, the destination hostname"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"tag"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsxs)(s.td,{children:["Tag representing type of event e.g. ",(0,i.jsx)(s.code,{children:"Network Logon"}),", ",(0,i.jsx)(s.code,{children:"File Access"}),", ",(0,i.jsx)(s.code,{children:"Execution"})]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"executed_process"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"Where we detect a process execution, the path of the executed file"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"short"})}),(0,i.jsx)(s.td,{children:"text"}),(0,i.jsx)(s.td,{children:"Short text providing additional data from raw event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"extra"})}),(0,i.jsx)(s.td,{children:"text"}),(0,i.jsxs)(s.td,{children:["Longer text, providing more raw data than ",(0,i.jsx)(s.code,{children:"short"})]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"alarm_severity"})}),(0,i.jsx)(s.td,{children:"int"}),(0,i.jsxs)(s.td,{children:["Severity of event based on detections. Malicious ",(0,i.jsx)(s.code,{children:"1"}),", Suspcious ",(0,i.jsx)(s.code,{children:"3"}),", Other ",(0,i.jsx)(s.code,{children:"10"})]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"isFolder"})}),(0,i.jsx)(s.td,{children:"boolean"}),(0,i.jsx)(s.td,{children:"Whether an event is a folder."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"evidence_id"})}),(0,i.jsx)(s.td,{children:"int"}),(0,i.jsx)(s.td,{children:"ID of evidence item"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"timestamp"})}),(0,i.jsx)(s.td,{children:"int"}),(0,i.jsx)(s.td,{children:"Unix timestamp of event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"evidence_id"})}),(0,i.jsx)(s.td,{children:"int"}),(0,i.jsx)(s.td,{children:"the id of a specific evidence to search within"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"file_size"})}),(0,i.jsx)(s.td,{children:"int"}),(0,i.jsx)(s.td,{children:"size of file associated with this event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"sha256"})}),(0,i.jsx)(s.td,{children:"text"}),(0,i.jsx)(s.td,{children:"sha256 of the file associated with this event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"strings"})}),(0,i.jsx)(s.td,{children:"text"}),(0,i.jsx)(s.td,{children:"Strings extracted from file associated with this event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"is_starred"})}),(0,i.jsx)(s.td,{children:"bool"}),(0,i.jsx)(s.td,{children:"Whether an event is starred"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"for_report"})}),(0,i.jsx)(s.td,{children:"bool"}),(0,i.jsx)(s.td,{children:"Whether an event is included in the report"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"alarm_description"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"Short description explaining the reason for an alarm"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"alarm_attack"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"Mitre attack code"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"attribute_name"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"$STANDARD_INFORMATION / $FILENAME / null"})]})]})]}),"\n",(0,i.jsxs)(s.p,{children:["Fields of type ",(0,i.jsx)(s.code,{children:"int"})," or ",(0,i.jsx)(s.code,{children:"keyword"})," require the search term to match exactly in order to return a result. For example, for an event with ",(0,i.jsx)(s.code,{children:"user"})," equal to ",(0,i.jsx)(s.code,{children:"chris"}),", the search term:"]}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.code,{children:"user: chris"})," matches"]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.code,{children:"user: ch*"})," matches"]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.code,{children:"user: ch"})," does not match"]}),"\n"]}),"\n",(0,i.jsxs)(s.p,{children:["Fields of type ",(0,i.jsx)(s.code,{children:"keyword"})," support wildcard characters. Use ",(0,i.jsx)(s.code,{children:"?"})," as a single-character wildcard and ",(0,i.jsx)(s.code,{children:"*"})," for any number of characters."]}),"\n",(0,i.jsxs)(s.p,{children:["Fields of type ",(0,i.jsx)(s.code,{children:"text"})," do not require a full match. E.g. searching for ",(0,i.jsx)(s.code,{children:"strings: content"})," will return the event with the following strings data: ",(0,i.jsx)(s.code,{children:"This is some example content"}),"."]})]})}function a(e={}){const{wrapper:s}={...(0,t.a)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(o,{...e})}):o(e)}},4472:(e,s,d)=>{d.d(s,{Z:()=>i});const i=d.p+"assets/images/facet-list-822105b27725dcc1e12938821d0f5fc8.png"},29:(e,s,d)=>{d.d(s,{Z:()=>i});const i=d.p+"assets/images/faceted-search-c8f6a6e06623cdfd84694866e8ed731b.png"},1151:(e,s,d)=>{d.d(s,{Z:()=>c,a:()=>n});var i=d(7294);const t={},r=i.createContext(t);function n(e){const s=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:n(e.components),i.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b038dc2c.d6ac9b63.js b/assets/js/b038dc2c.d6ac9b63.js new file mode 100644 index 000000000..6f02a4c0d --- /dev/null +++ b/assets/js/b038dc2c.d6ac9b63.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2616],{489:(e,s,d)=>{d.r(s),d.d(s,{assets:()=>h,contentTitle:()=>n,default:()=>a,frontMatter:()=>r,metadata:()=>c,toc:()=>l});var i=d(5893),t=d(1151);const r={title:"Timeline Search",hide_title:!0,sidebar_position:3},n="Timeline Search",c={id:"cado-response/investigate/timeline-search",title:"Timeline Search",description:"The Cado platform includes an advanced search interface which supports complex queries.",source:"@site/docs/cado-response/investigate/timeline-search.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/timeline-search",permalink:"/cado-response/investigate/timeline-search",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/timeline-search.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:3,frontMatter:{title:"Timeline Search",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Evidence",permalink:"/cado-response/investigate/evidence"},next:{title:"Automated Investigation",permalink:"/cado-response/investigate/automated-investigation"}},h={},l=[{value:"Faceted Search",id:"faceted-search",level:3},{value:"Basic Searches",id:"basic-searches",level:3},{value:"Plain search terms",id:"plain-search-terms",level:4},{value:"Fields",id:"fields",level:4},{value:"Ranges",id:"ranges",level:4},{value:"Building complex queries",id:"building-complex-queries",level:3},{value:"Fields",id:"fields-1",level:2}];function o(e){const s={admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.h1,{id:"timeline-search",children:"Timeline Search"}),"\n",(0,i.jsx)(s.p,{children:"The Cado platform includes an advanced search interface which supports complex queries."}),"\n",(0,i.jsx)(s.h3,{id:"faceted-search",children:"Faceted Search"}),"\n",(0,i.jsx)(s.p,{children:"Cado allows you to filter your search based upon 'facets', like event severity, or associated user name, file, source/destination IP address"}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Faceted Search",src:d(29).Z+"",width:"1851",height:"852"})}),"\n",(0,i.jsx)(s.p,{children:"For long lists of facets, you can search and sort the list of facets"}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.img,{alt:"Faceted List",src:d(4472).Z+"",width:"1503",height:"752"})}),"\n",(0,i.jsx)(s.h3,{id:"basic-searches",children:"Basic Searches"}),"\n",(0,i.jsx)(s.p,{children:"You can also use the search bar to craft specific searches using search strings"}),"\n",(0,i.jsx)(s.h4,{id:"plain-search-terms",children:"Plain search terms"}),"\n",(0,i.jsxs)(s.p,{children:["Providing plain search terms will search across all fields, for example: ",(0,i.jsx)(s.code,{children:"foo"})]}),"\n",(0,i.jsxs)(s.p,{children:["You can quote terms containing spaces: ",(0,i.jsx)(s.code,{children:'"foo bar"'})]}),"\n",(0,i.jsx)(s.h4,{id:"fields",children:"Fields"}),"\n",(0,i.jsxs)(s.p,{children:["You can search a specific field by prepending it to the search term: ",(0,i.jsx)(s.code,{children:"user: Chris"})," OR ",(0,i.jsx)(s.code,{children:'extra: "foo bar"'})]}),"\n",(0,i.jsx)(s.h4,{id:"ranges",children:"Ranges"}),"\n",(0,i.jsxs)(s.p,{children:["You can restrict a field to a range of values: ",(0,i.jsx)(s.code,{children:"file_size: [1024 TO 8196]"})]}),"\n",(0,i.jsx)(s.h3,{id:"building-complex-queries",children:"Building complex queries"}),"\n",(0,i.jsxs)(s.p,{children:["You can build complex queries using ",(0,i.jsx)(s.code,{children:"AND"}),", ",(0,i.jsx)(s.code,{children:"OR"})," and ",(0,i.jsx)(s.code,{children:"NOT"})," to combine terms, and brackets to group ",(0,i.jsx)(s.code,{children:"()"}),":"]}),"\n",(0,i.jsxs)(s.p,{children:["For example: ",(0,i.jsx)(s.code,{children:'alarm_severity: [0 TO 5] AND (user: "Chris" OR user: "James") AND NOT filename: "/foo/bar.txt"'})]}),"\n",(0,i.jsx)(s.admonition,{type:"info",children:(0,i.jsxs)(s.p,{children:["Note that without brackets, ANDs will bind before ORs. This means that ",(0,i.jsx)(s.code,{children:'user: "Chris" AND user: "James" OR filename: "/foo/bar.txt"'})," is searched as ",(0,i.jsx)(s.code,{children:'(user: "Chris" AND user: "James") OR filename: "/foo/bar.txt"'}),"."]})}),"\n",(0,i.jsx)(s.h2,{id:"fields-1",children:"Fields"}),"\n",(0,i.jsx)(s.p,{children:"Searchable fields"}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:"Field"}),(0,i.jsx)(s.th,{children:"Type"}),(0,i.jsx)(s.th,{children:"Description"})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"macb"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsxs)(s.td,{children:["4 character string which encoding MACB information for this event. An ",(0,i.jsx)(s.code,{children:"M"})," in position 0 indicates this is a Modified event and a ",(0,i.jsx)(s.code,{children:"."})," represents a non-modified event. e.g. ",(0,i.jsx)(s.code,{children:"M..B"})," indicates modified and birth."]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"source"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsxs)(s.td,{children:["The type of the file or data that produced this event e.g. ",(0,i.jsx)(s.code,{children:"EVT"}),", ",(0,i.jsx)(s.code,{children:"CLOUDTRAIL"}),", ",(0,i.jsx)(s.code,{children:"FILE"}),", ",(0,i.jsx)(s.code,{children:"JAVA_IDX"}),", ",(0,i.jsx)(s.code,{children:"LOG"}),"."]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"sourcetype"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsxs)(s.td,{children:["More specific subtype of ",(0,i.jsx)(s.code,{children:"source"})]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"type"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsxs)(s.td,{children:[(0,i.jsx)(s.code,{children:";"})," separated list of event types, e.g. ",(0,i.jsx)(s.code,{children:"Last Executed Time"}),", ",(0,i.jsx)(s.code,{children:"Updated Time"}),", ",(0,i.jsx)(s.code,{children:"Content Modification Time"}),", ",(0,i.jsx)(s.code,{children:"Creation Time"}),"."]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"user"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"User associated with the event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"host"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"Host name associated with the event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"filename"})}),(0,i.jsx)(s.td,{children:"special"}),(0,i.jsx)(s.td,{children:"The path of the file associated with this event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"full_filename"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"The full path of the file associated with this event, supports regex and must match entire path"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"inode"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"The inode number of the file associated with this event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"source_hostname"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"For network connections, the hostname that it originated from"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"destination_hostname"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"For network connections, the destination hostname"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"tag"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsxs)(s.td,{children:["Tag representing type of event e.g. ",(0,i.jsx)(s.code,{children:"Network Logon"}),", ",(0,i.jsx)(s.code,{children:"File Access"}),", ",(0,i.jsx)(s.code,{children:"Execution"})]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"executed_process"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"Where we detect a process execution, the path of the executed file"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"short"})}),(0,i.jsx)(s.td,{children:"text"}),(0,i.jsx)(s.td,{children:"Short text providing additional data from raw event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"extra"})}),(0,i.jsx)(s.td,{children:"text"}),(0,i.jsxs)(s.td,{children:["Longer text, providing more raw data than ",(0,i.jsx)(s.code,{children:"short"})]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"alarm_severity"})}),(0,i.jsx)(s.td,{children:"int"}),(0,i.jsxs)(s.td,{children:["Severity of event based on detections. Malicious ",(0,i.jsx)(s.code,{children:"1"}),", Suspcious ",(0,i.jsx)(s.code,{children:"3"}),", Other ",(0,i.jsx)(s.code,{children:"10"})]})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"isFolder"})}),(0,i.jsx)(s.td,{children:"boolean"}),(0,i.jsx)(s.td,{children:"Whether an event is a folder."})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"evidence_id"})}),(0,i.jsx)(s.td,{children:"int"}),(0,i.jsx)(s.td,{children:"ID of evidence item"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"timestamp"})}),(0,i.jsx)(s.td,{children:"int"}),(0,i.jsx)(s.td,{children:"Unix timestamp of event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"evidence_id"})}),(0,i.jsx)(s.td,{children:"int"}),(0,i.jsx)(s.td,{children:"the id of a specific evidence to search within"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"file_size"})}),(0,i.jsx)(s.td,{children:"int"}),(0,i.jsx)(s.td,{children:"size of file associated with this event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"sha256"})}),(0,i.jsx)(s.td,{children:"text"}),(0,i.jsx)(s.td,{children:"sha256 of the file associated with this event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"strings"})}),(0,i.jsx)(s.td,{children:"text"}),(0,i.jsx)(s.td,{children:"Strings extracted from file associated with this event"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"is_starred"})}),(0,i.jsx)(s.td,{children:"bool"}),(0,i.jsx)(s.td,{children:"Whether an event is starred"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"for_report"})}),(0,i.jsx)(s.td,{children:"bool"}),(0,i.jsx)(s.td,{children:"Whether an event is included in the report"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"alarm_description"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"Short description explaining the reason for an alarm"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"alarm_attack"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"Mitre attack code"})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.code,{children:"attribute_name"})}),(0,i.jsx)(s.td,{children:"keyword"}),(0,i.jsx)(s.td,{children:"$STANDARD_INFORMATION / $FILENAME / null"})]})]})]}),"\n",(0,i.jsxs)(s.p,{children:["Fields of type ",(0,i.jsx)(s.code,{children:"int"})," or ",(0,i.jsx)(s.code,{children:"keyword"})," require the search term to match exactly in order to return a result. For example, for an event with ",(0,i.jsx)(s.code,{children:"user"})," equal to ",(0,i.jsx)(s.code,{children:"chris"}),", the search term:"]}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.code,{children:"user: chris"})," matches"]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.code,{children:"user: ch*"})," matches"]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.code,{children:"user: ch"})," does not match"]}),"\n"]}),"\n",(0,i.jsxs)(s.p,{children:["Fields of type ",(0,i.jsx)(s.code,{children:"keyword"})," support wildcard characters. Use ",(0,i.jsx)(s.code,{children:"?"})," as a single-character wildcard and ",(0,i.jsx)(s.code,{children:"*"})," for any number of characters."]}),"\n",(0,i.jsxs)(s.p,{children:["Fields of type ",(0,i.jsx)(s.code,{children:"text"})," do not require a full match. E.g. searching for ",(0,i.jsx)(s.code,{children:"strings: content"})," will return the event with the following strings data: ",(0,i.jsx)(s.code,{children:"This is some example content"}),"."]})]})}function a(e={}){const{wrapper:s}={...(0,t.a)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(o,{...e})}):o(e)}},4472:(e,s,d)=>{d.d(s,{Z:()=>i});const i=d.p+"assets/images/facet-list-822105b27725dcc1e12938821d0f5fc8.png"},29:(e,s,d)=>{d.d(s,{Z:()=>i});const i=d.p+"assets/images/faceted-search-c8f6a6e06623cdfd84694866e8ed731b.png"},1151:(e,s,d)=>{d.d(s,{Z:()=>c,a:()=>n});var i=d(7294);const t={},r=i.createContext(t);function n(e){const s=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function c(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:n(e.components),i.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b309980d.4149ef1b.js b/assets/js/b309980d.4149ef1b.js deleted file mode 100644 index b73cc0c79..000000000 --- a/assets/js/b309980d.4149ef1b.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3622],{1130:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>p,frontMatter:()=>i,metadata:()=>c,toc:()=>l});var n=o(5893),s=o(1151);const i={title:"Google Cloud Kubernetes Engine",hide_title:!0,sidebar_position:5},r="Google Cloud Kubernetes Engine",c={id:"cado-response/discovery-import/import/gcp/kubernetes-engine",title:"Google Cloud Kubernetes Engine",description:"The Cado platform will collect key logs and forensic artifacts from Google Cloud Kubernetes Engine containers.",source:"@site/docs/cado-response/discovery-import/import/gcp/kubernetes-engine.md",sourceDirName:"cado-response/discovery-import/import/gcp",slug:"/cado-response/discovery-import/import/gcp/kubernetes-engine",permalink:"/cado-response/discovery-import/import/gcp/kubernetes-engine",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/gcp/kubernetes-engine.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:5,frontMatter:{title:"Google Cloud Kubernetes Engine",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Google Cloud Storage",permalink:"/cado-response/discovery-import/import/gcp/storage"},next:{title:"Oracle Cloud Virtual Machines",permalink:"/cado-response/discovery-import/import/oracle/virtual-machine"}},a={},l=[{value:"Import Steps",id:"import-steps",level:2}];function d(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"google-cloud-kubernetes-engine",children:"Google Cloud Kubernetes Engine"}),"\n",(0,n.jsx)(t.p,{children:"The Cado platform will collect key logs and forensic artifacts from Google Cloud Kubernetes Engine containers."}),"\n",(0,n.jsx)(t.admonition,{type:"info",children:(0,n.jsxs)(t.p,{children:["Due to the way the Cado platform interacts with Kubernetes, it is not possible to import containers built from a ",(0,n.jsx)(t.a,{href:"https://github.com/GoogleContainerTools/distroless#why-should-i-use-distroless-images",children:"distroless"})," image."]})}),"\n",(0,n.jsx)(t.h2,{id:"import-steps",children:"Import Steps"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:["Go to ",(0,n.jsx)(t.strong,{children:"Import > Cloud"})]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Cado Import Screen showing the Kubernetes Engine options",src:o(263).Z+"",width:"842",height:"242"})}),"\n",(0,n.jsxs)(t.ol,{start:"2",children:["\n",(0,n.jsxs)(t.li,{children:["Go through the steps to choose your ",(0,n.jsx)(t.strong,{children:"Cluster"}),", ",(0,n.jsx)(t.strong,{children:"Pod"})," and ",(0,n.jsx)(t.strong,{children:"Container"}),":"]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Cado Import Screen showing the available Kubernetes Engine Clusters",src:o(3633).Z+"",width:"1837",height:"477"})}),"\n",(0,n.jsxs)(t.ol,{start:"3",children:["\n",(0,n.jsxs)(t.li,{children:["Confirm the details and click ",(0,n.jsx)(t.strong,{children:"Start Import"})]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"Cado will now automatically collect all the key logs and forensic artifacts from the container to enable an investigation.\nFor a typical acquisition, import and processing will take a few minutes to complete."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Cado showing the confirmation screen of a successful Kubernetes Engine container capture",src:o(1574).Z+"",width:"1795",height:"698"})}),"\n",(0,n.jsxs)(t.admonition,{type:"info",children:[(0,n.jsxs)(t.p,{children:["To import GKE containers with Cado Response, the ",(0,n.jsx)(t.code,{children:"iam.serviceAccounts.implicitDelegation"})," IAM permission added to the Service Account."]}),(0,n.jsxs)(t.p,{children:["Currently, for GKE import Cado only suports GCP accounts configured using Workload Identity Federation. See more in the ",(0,n.jsx)(t.a,{href:"/cado-response/deploy/gcp/gcp-settings#workload-identity-federation",children:"GCP Import Settings"})," page."]})]})]})}function p(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},1574:(e,t,o)=>{o.d(t,{Z:()=>n});const n=o.p+"assets/images/eks3-fc961c2189e29adc6a2571cacf950e28.png"},3633:(e,t,o)=>{o.d(t,{Z:()=>n});const n=o.p+"assets/images/gke-8354716bca9bc18f39cbf9caa850c641.png"},263:(e,t,o)=>{o.d(t,{Z:()=>n});const n=o.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>c,a:()=>r});var n=o(7294);const s={},i=n.createContext(s);function r(e){const t=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),n.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b309980d.49596163.js b/assets/js/b309980d.49596163.js new file mode 100644 index 000000000..4d6360e10 --- /dev/null +++ b/assets/js/b309980d.49596163.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3622],{1130:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>a,contentTitle:()=>r,default:()=>p,frontMatter:()=>i,metadata:()=>c,toc:()=>l});var n=o(5893),s=o(1151);const i={title:"Google Cloud Kubernetes Engine",hide_title:!0,sidebar_position:5},r="Google Cloud Kubernetes Engine",c={id:"cado-response/discovery-import/import/gcp/kubernetes-engine",title:"Google Cloud Kubernetes Engine",description:"The Cado platform will collect key logs and forensic artifacts from Google Cloud Kubernetes Engine containers.",source:"@site/docs/cado-response/discovery-import/import/gcp/kubernetes-engine.md",sourceDirName:"cado-response/discovery-import/import/gcp",slug:"/cado-response/discovery-import/import/gcp/kubernetes-engine",permalink:"/cado-response/discovery-import/import/gcp/kubernetes-engine",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/gcp/kubernetes-engine.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:5,frontMatter:{title:"Google Cloud Kubernetes Engine",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Google Cloud Storage",permalink:"/cado-response/discovery-import/import/gcp/storage"},next:{title:"Oracle Cloud Virtual Machines",permalink:"/cado-response/discovery-import/import/oracle/virtual-machine"}},a={},l=[{value:"Import Steps",id:"import-steps",level:2}];function d(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,s.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"google-cloud-kubernetes-engine",children:"Google Cloud Kubernetes Engine"}),"\n",(0,n.jsx)(t.p,{children:"The Cado platform will collect key logs and forensic artifacts from Google Cloud Kubernetes Engine containers."}),"\n",(0,n.jsx)(t.admonition,{type:"info",children:(0,n.jsxs)(t.p,{children:["Due to the way the Cado platform interacts with Kubernetes, it is not possible to import containers built from a ",(0,n.jsx)(t.a,{href:"https://github.com/GoogleContainerTools/distroless#why-should-i-use-distroless-images",children:"distroless"})," image."]})}),"\n",(0,n.jsx)(t.h2,{id:"import-steps",children:"Import Steps"}),"\n",(0,n.jsxs)(t.ol,{children:["\n",(0,n.jsxs)(t.li,{children:["Go to ",(0,n.jsx)(t.strong,{children:"Import > Cloud"})]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Cado Import Screen showing the Kubernetes Engine options",src:o(263).Z+"",width:"842",height:"242"})}),"\n",(0,n.jsxs)(t.ol,{start:"2",children:["\n",(0,n.jsxs)(t.li,{children:["Go through the steps to choose your ",(0,n.jsx)(t.strong,{children:"Cluster"}),", ",(0,n.jsx)(t.strong,{children:"Pod"})," and ",(0,n.jsx)(t.strong,{children:"Container"}),":"]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Cado Import Screen showing the available Kubernetes Engine Clusters",src:o(3633).Z+"",width:"1837",height:"477"})}),"\n",(0,n.jsxs)(t.ol,{start:"3",children:["\n",(0,n.jsxs)(t.li,{children:["Confirm the details and click ",(0,n.jsx)(t.strong,{children:"Start Import"})]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:"Cado will now automatically collect all the key logs and forensic artifacts from the container to enable an investigation.\nFor a typical acquisition, import and processing will take a few minutes to complete."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Cado showing the confirmation screen of a successful Kubernetes Engine container capture",src:o(1574).Z+"",width:"1795",height:"698"})}),"\n",(0,n.jsxs)(t.admonition,{type:"info",children:[(0,n.jsxs)(t.p,{children:["To import GKE containers with Cado Response, the ",(0,n.jsx)(t.code,{children:"iam.serviceAccounts.implicitDelegation"})," IAM permission added to the Service Account."]}),(0,n.jsxs)(t.p,{children:["Currently, for GKE import Cado only suports GCP accounts configured using Workload Identity Federation. See more in the ",(0,n.jsx)(t.a,{href:"/cado-response/deploy/gcp/gcp-settings#workload-identity-federation",children:"GCP Import Settings"})," page."]})]})]})}function p(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},1574:(e,t,o)=>{o.d(t,{Z:()=>n});const n=o.p+"assets/images/eks3-fc961c2189e29adc6a2571cacf950e28.png"},3633:(e,t,o)=>{o.d(t,{Z:()=>n});const n=o.p+"assets/images/gke-8354716bca9bc18f39cbf9caa850c641.png"},263:(e,t,o)=>{o.d(t,{Z:()=>n});const n=o.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>c,a:()=>r});var n=o(7294);const s={},i=n.createContext(s);function r(e){const t=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:r(e.components),n.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b4399082.3385b082.js b/assets/js/b4399082.3385b082.js deleted file mode 100644 index a618fe960..000000000 --- a/assets/js/b4399082.3385b082.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6272],{8488:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>d,frontMatter:()=>s,metadata:()=>n,toc:()=>u});var r=o(5893),a=o(1151);const s={title:"Azure Storage",hide_title:!0,sidebar_position:2},i="Azure Storage Support",n={id:"cado-response/discovery-import/import/azure/azure-storage",title:"Azure Storage",description:"The Cado platform supports acquistion of data from Azure Blob Storage. The two main use cases for this are:",source:"@site/docs/cado-response/discovery-import/import/azure/azure-storage.md",sourceDirName:"cado-response/discovery-import/import/azure",slug:"/cado-response/discovery-import/import/azure/azure-storage",permalink:"/cado-response/discovery-import/import/azure/azure-storage",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/azure/azure-storage.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"Azure Storage",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Azure Compute",permalink:"/cado-response/discovery-import/import/azure/azure-compute"},next:{title:"Azure Kubernetes Service",permalink:"/cado-response/discovery-import/import/azure/azure-aks"}},c={},u=[{value:"Uploading On-Premise evidence to Azure Storage for Import",id:"uploading-on-premise-evidence-to-azure-storage-for-import",level:2}];function p(e){const t={a:"a",h1:"h1",h2:"h2",img:"img",li:"li",p:"p",ul:"ul",...(0,a.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"azure-storage-support",children:"Azure Storage Support"}),"\n",(0,r.jsx)(t.p,{children:"The Cado platform supports acquistion of data from Azure Blob Storage. The two main use cases for this are:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"Analyzing disk images or zip files that have been uploaded to an Azure Blob Storage continer as part of an investigation"}),"\n",(0,r.jsx)(t.li,{children:"Analyzing the contents of an Azure Blob Storage container for any uploaded content that could be part of an incident"}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Select an Azure subscription, and select the storage account, select the container and the click the download icon for the appropriate blob."}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Import Azure Storage",src:o(1848).Z+"",width:"1777",height:"721"})}),"\n",(0,r.jsx)(t.h2,{id:"uploading-on-premise-evidence-to-azure-storage-for-import",children:"Uploading On-Premise evidence to Azure Storage for Import"}),"\n",(0,r.jsxs)(t.p,{children:["You can use the ",(0,r.jsx)(t.a,{href:"https://portal.azure.com/",children:"Azure Console"})," to upload data from your web browser if you have access to it."]}),"\n",(0,r.jsxs)(t.p,{children:["Alternatively, you can use a ",(0,r.jsx)(t.a,{href:"https://cyberduck.io/azure/",children:"Sas Token or Access Key"})," with a Desktop GUI tool such as ",(0,r.jsx)(t.a,{href:"https://cyberduck.io/",children:"Cyberduck"})," to easily upload files from your desktop, with support for functionality such as resuming failed uploads."]}),"\n",(0,r.jsxs)(t.p,{children:["We reccomend scoping access by giving ",(0,r.jsx)(t.a,{href:"https://stackoverflow.com/questions/50864068/write-only-access-no-read-no-list-no-delete-to-azure-storage",children:"write-only"})," access to Azure storage."]}),"\n",(0,r.jsx)(t.p,{children:"You can also use Cado Host with the --single_file_unzipped parameter - this may be a good option if you do not have direct access to Azure as Cado Response will generate the credentials at Import > Forensic Artifacts."})]})}function d(e={}){const{wrapper:t}={...(0,a.a)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(p,{...e})}):p(e)}},1848:(e,t,o)=>{o.d(t,{Z:()=>r});const r=o.p+"assets/images/azure-storage-0814ca3c04c4e6ae93c1d365601b1b3d.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>n,a:()=>i});var r=o(7294);const a={},s=r.createContext(a);function i(e){const t=r.useContext(s);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function n(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:i(e.components),r.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b4399082.6923d028.js b/assets/js/b4399082.6923d028.js new file mode 100644 index 000000000..74fd69bbf --- /dev/null +++ b/assets/js/b4399082.6923d028.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6272],{8488:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>i,default:()=>d,frontMatter:()=>s,metadata:()=>n,toc:()=>u});var r=o(5893),a=o(1151);const s={title:"Azure Storage",hide_title:!0,sidebar_position:2},i="Azure Storage Support",n={id:"cado-response/discovery-import/import/azure/azure-storage",title:"Azure Storage",description:"The Cado platform supports acquistion of data from Azure Blob Storage. The two main use cases for this are:",source:"@site/docs/cado-response/discovery-import/import/azure/azure-storage.md",sourceDirName:"cado-response/discovery-import/import/azure",slug:"/cado-response/discovery-import/import/azure/azure-storage",permalink:"/cado-response/discovery-import/import/azure/azure-storage",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/azure/azure-storage.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"Azure Storage",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Azure Compute",permalink:"/cado-response/discovery-import/import/azure/azure-compute"},next:{title:"Azure Kubernetes Service",permalink:"/cado-response/discovery-import/import/azure/azure-aks"}},c={},u=[{value:"Uploading On-Premise evidence to Azure Storage for Import",id:"uploading-on-premise-evidence-to-azure-storage-for-import",level:2}];function p(e){const t={a:"a",h1:"h1",h2:"h2",img:"img",li:"li",p:"p",ul:"ul",...(0,a.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"azure-storage-support",children:"Azure Storage Support"}),"\n",(0,r.jsx)(t.p,{children:"The Cado platform supports acquistion of data from Azure Blob Storage. The two main use cases for this are:"}),"\n",(0,r.jsxs)(t.ul,{children:["\n",(0,r.jsx)(t.li,{children:"Analyzing disk images or zip files that have been uploaded to an Azure Blob Storage continer as part of an investigation"}),"\n",(0,r.jsx)(t.li,{children:"Analyzing the contents of an Azure Blob Storage container for any uploaded content that could be part of an incident"}),"\n"]}),"\n",(0,r.jsx)(t.p,{children:"Select an Azure subscription, and select the storage account, select the container and the click the download icon for the appropriate blob."}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Import Azure Storage",src:o(1848).Z+"",width:"1777",height:"721"})}),"\n",(0,r.jsx)(t.h2,{id:"uploading-on-premise-evidence-to-azure-storage-for-import",children:"Uploading On-Premise evidence to Azure Storage for Import"}),"\n",(0,r.jsxs)(t.p,{children:["You can use the ",(0,r.jsx)(t.a,{href:"https://portal.azure.com/",children:"Azure Console"})," to upload data from your web browser if you have access to it."]}),"\n",(0,r.jsxs)(t.p,{children:["Alternatively, you can use a ",(0,r.jsx)(t.a,{href:"https://cyberduck.io/azure/",children:"Sas Token or Access Key"})," with a Desktop GUI tool such as ",(0,r.jsx)(t.a,{href:"https://cyberduck.io/",children:"Cyberduck"})," to easily upload files from your desktop, with support for functionality such as resuming failed uploads."]}),"\n",(0,r.jsxs)(t.p,{children:["We reccomend scoping access by giving ",(0,r.jsx)(t.a,{href:"https://stackoverflow.com/questions/50864068/write-only-access-no-read-no-list-no-delete-to-azure-storage",children:"write-only"})," access to Azure storage."]}),"\n",(0,r.jsx)(t.p,{children:"You can also use Cado Host with the --single_file_unzipped parameter - this may be a good option if you do not have direct access to Azure as Cado Response will generate the credentials at Import > Forensic Artifacts."})]})}function d(e={}){const{wrapper:t}={...(0,a.a)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(p,{...e})}):p(e)}},1848:(e,t,o)=>{o.d(t,{Z:()=>r});const r=o.p+"assets/images/azure-storage-0814ca3c04c4e6ae93c1d365601b1b3d.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>n,a:()=>i});var r=o(7294);const a={},s=r.createContext(a);function i(e){const t=r.useContext(s);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function n(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:i(e.components),r.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b4ca64e0.42c62682.js b/assets/js/b4ca64e0.42c62682.js new file mode 100644 index 000000000..348ccced4 --- /dev/null +++ b/assets/js/b4ca64e0.42c62682.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5e3],{9495:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>c,contentTitle:()=>a,default:()=>l,frontMatter:()=>t,metadata:()=>r,toc:()=>d});var i=s(5893),o=s(1151);const t={title:"Removing and Tightening IAM Permissions",hide_title:!0,sidebar_position:2},a=void 0,r={id:"cado-response/deploy/aws/iam/tightening-iam",title:"Removing and Tightening IAM Permissions",description:"Removing and Tightening IAM Permissions",source:"@site/docs/cado-response/deploy/aws/iam/tightening-iam.md",sourceDirName:"cado-response/deploy/aws/iam",slug:"/cado-response/deploy/aws/iam/tightening-iam",permalink:"/cado-response/deploy/aws/iam/tightening-iam",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/iam/tightening-iam.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"Removing and Tightening IAM Permissions",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Overview",permalink:"/cado-response/deploy/aws/iam/deployment-iam-considerations"},next:{title:"Cross Account Creation",permalink:"/cado-response/deploy/aws/iam/cross-account-creation"}},c={},d=[{value:"Removing and Tightening IAM Permissions",id:"removing-and-tightening-iam-permissions",level:2},{value:"How to tighten IAM Permissions for SSM",id:"how-to-tighten-iam-permissions-for-ssm",level:2}];function m(e){const n={a:"a",code:"code",h2:"h2",img:"img",p:"p",pre:"pre",...(0,o.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h2,{id:"removing-and-tightening-iam-permissions",children:"Removing and Tightening IAM Permissions"}),"\n",(0,i.jsxs)(n.p,{children:["You can further tune the IAM permissions that Cado deploys if you do not require all functionality. We describe the functionality used by the permissions in the \u201cSid\u201d section of the ",(0,i.jsx)(n.a,{href:"https://cado-public.s3.amazonaws.com/policy-in-cross-account.json",children:"cross-account role"}),". Please contact ",(0,i.jsx)(n.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," for advice on what permissions are required for."]}),"\n",(0,i.jsx)(n.h2,{id:"how-to-tighten-iam-permissions-for-ssm",children:"How to tighten IAM Permissions for SSM"}),"\n",(0,i.jsx)(n.p,{children:"The Cado platform uses AWS SSM to perform live captures of AWS EC2 systems - this provides for a faster mechanism than a full disk acquisition and can also collect process memory."}),"\n",(0,i.jsx)(n.p,{children:"However, the default IAM permissions will be too wide for many environments, as this provides the Cado platform with permission to execute any command on SSM enabled systems:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'{\n "Sid": "RequiredForTriageAndRunCommand",\n "Effect": "Allow",\n "Action": [\n "ssm:SendCommand",\n "ssm:DescribeInstanceInformation"\n ],\n "Resource": [\n "arn:aws:ec2:*:*:instance/*",\n "arn:aws:ssm:*::document/AWS-RunShellScript",\n "arn:aws:ssm:*::document/AWS-RunPowerShellScript"\n ]\n}\n'})}),"\n",(0,i.jsx)(n.p,{children:"You may wish to scope these permissions down, so SSM commands can only be run against specific Instances. The easiest way to do this, is by adding a Tag Condition to the targeted EC2 resources:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'{\n "Sid": "RequiredForTriageAndRunCommandTagged",\n "Effect": "Allow",\n "Action": [\n "ssm:SendCommand",\n "ssm:DescribeInstanceInformation"\n ],\n "Resource": [\n "arn:aws:ec2:*:*:instance/*"\n ],\n "Condition": {\n "StringLike": {\n "ssm:resourceTag/CadoResponseSSMEnabled": [\n "True"\n ]\n }\n }\n },\n {\n "Sid": "RequiredForTriageAndRunCommandRun",\n "Effect": "Allow",\n "Action": [\n "ssm:SendCommand",\n "ssm:DescribeInstanceInformation"\n ],\n "Resource": [\n "arn:aws:ssm:*::document/AWS-RunShellScript",\n "arn:aws:ssm:*::document/AWS-RunPowerShellScript"\n ]\n}\n'})}),"\n",(0,i.jsxs)(n.p,{children:["Then adding the tag to the specific EC2 you wish to access with SSM:\n",(0,i.jsx)(n.img,{alt:"IAM",src:s(8248).Z+"",width:"1662",height:"822"})]}),"\n",(0,i.jsxs)(n.p,{children:["If an EC2 you are acquiring with SSM does not have the required Tag, you will receive an error such as:\nAn error occurred (AccessDeniedException) when calling the SendCommand operation: User: xxx is not authorized to perform: ssm",":SendCommand"," on resource: i-xxx because no identity-based policy allows the ssm",":SendCommand"," action"]})]})}function l(e={}){const{wrapper:n}={...(0,o.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(m,{...e})}):m(e)}},8248:(e,n,s)=>{s.d(n,{Z:()=>i});const i=s.p+"assets/images/ssm_tag-2de7a9a0e47b507498f19f3d125fdf16.png"},1151:(e,n,s)=>{s.d(n,{Z:()=>r,a:()=>a});var i=s(7294);const o={},t=i.createContext(o);function a(e){const n=i.useContext(t);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:a(e.components),i.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b4ca64e0.5aba69ff.js b/assets/js/b4ca64e0.5aba69ff.js deleted file mode 100644 index c10853ed5..000000000 --- a/assets/js/b4ca64e0.5aba69ff.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5e3],{9495:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>c,contentTitle:()=>a,default:()=>l,frontMatter:()=>t,metadata:()=>r,toc:()=>d});var i=s(5893),o=s(1151);const t={title:"Removing and Tightening IAM Permissions",hide_title:!0,sidebar_position:2},a=void 0,r={id:"cado-response/deploy/aws/iam/tightening-iam",title:"Removing and Tightening IAM Permissions",description:"Removing and Tightening IAM Permissions",source:"@site/docs/cado-response/deploy/aws/iam/tightening-iam.md",sourceDirName:"cado-response/deploy/aws/iam",slug:"/cado-response/deploy/aws/iam/tightening-iam",permalink:"/cado-response/deploy/aws/iam/tightening-iam",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/iam/tightening-iam.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"Removing and Tightening IAM Permissions",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Overview",permalink:"/cado-response/deploy/aws/iam/deployment-iam-considerations"},next:{title:"Cross Account Creation",permalink:"/cado-response/deploy/aws/iam/cross-account-creation"}},c={},d=[{value:"Removing and Tightening IAM Permissions",id:"removing-and-tightening-iam-permissions",level:2},{value:"How to tighten IAM Permissions for SSM",id:"how-to-tighten-iam-permissions-for-ssm",level:2}];function m(e){const n={a:"a",code:"code",h2:"h2",img:"img",p:"p",pre:"pre",...(0,o.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h2,{id:"removing-and-tightening-iam-permissions",children:"Removing and Tightening IAM Permissions"}),"\n",(0,i.jsxs)(n.p,{children:["You can further tune the IAM permissions that Cado deploys if you do not require all functionality. We describe the functionality used by the permissions in the \u201cSid\u201d section of the ",(0,i.jsx)(n.a,{href:"https://cado-public.s3.amazonaws.com/policy-in-cross-account.json",children:"cross-account role"}),". Please contact ",(0,i.jsx)(n.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," for advice on what permissions are required for."]}),"\n",(0,i.jsx)(n.h2,{id:"how-to-tighten-iam-permissions-for-ssm",children:"How to tighten IAM Permissions for SSM"}),"\n",(0,i.jsx)(n.p,{children:"The Cado platform uses AWS SSM to perform live captures of AWS EC2 systems - this provides for a faster mechanism than a full disk acquisition and can also collect process memory."}),"\n",(0,i.jsx)(n.p,{children:"However, the default IAM permissions will be too wide for many environments, as this provides the Cado platform with permission to execute any command on SSM enabled systems:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'{\n "Sid": "RequiredForTriageAndRunCommand",\n "Effect": "Allow",\n "Action": [\n "ssm:SendCommand",\n "ssm:DescribeInstanceInformation"\n ],\n "Resource": [\n "arn:aws:ec2:*:*:instance/*",\n "arn:aws:ssm:*::document/AWS-RunShellScript",\n "arn:aws:ssm:*::document/AWS-RunPowerShellScript"\n ]\n}\n'})}),"\n",(0,i.jsx)(n.p,{children:"You may wish to scope these permissions down, so SSM commands can only be run against specific Instances. The easiest way to do this, is by adding a Tag Condition to the targeted EC2 resources:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'{\n "Sid": "RequiredForTriageAndRunCommandTagged",\n "Effect": "Allow",\n "Action": [\n "ssm:SendCommand",\n "ssm:DescribeInstanceInformation"\n ],\n "Resource": [\n "arn:aws:ec2:*:*:instance/*"\n ],\n "Condition": {\n "StringLike": {\n "ssm:resourceTag/CadoResponseSSMEnabled": [\n "True"\n ]\n }\n }\n },\n {\n "Sid": "RequiredForTriageAndRunCommandRun",\n "Effect": "Allow",\n "Action": [\n "ssm:SendCommand",\n "ssm:DescribeInstanceInformation"\n ],\n "Resource": [\n "arn:aws:ssm:*::document/AWS-RunShellScript",\n "arn:aws:ssm:*::document/AWS-RunPowerShellScript"\n ]\n}\n'})}),"\n",(0,i.jsxs)(n.p,{children:["Then adding the tag to the specific EC2 you wish to access with SSM:\n",(0,i.jsx)(n.img,{alt:"IAM",src:s(8248).Z+"",width:"1662",height:"822"})]}),"\n",(0,i.jsxs)(n.p,{children:["If an EC2 you are acquiring with SSM does not have the required Tag, you will receive an error such as:\nAn error occurred (AccessDeniedException) when calling the SendCommand operation: User: xxx is not authorized to perform: ssm",":SendCommand"," on resource: i-xxx because no identity-based policy allows the ssm",":SendCommand"," action"]})]})}function l(e={}){const{wrapper:n}={...(0,o.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(m,{...e})}):m(e)}},8248:(e,n,s)=>{s.d(n,{Z:()=>i});const i=s.p+"assets/images/ssm_tag-2de7a9a0e47b507498f19f3d125fdf16.png"},1151:(e,n,s)=>{s.d(n,{Z:()=>r,a:()=>a});var i=s(7294);const o={},t=i.createContext(o);function a(e){const n=i.useContext(t);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:a(e.components),i.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b6cd3a1b.5074ea57.js b/assets/js/b6cd3a1b.5074ea57.js deleted file mode 100644 index 003c1eb1b..000000000 --- a/assets/js/b6cd3a1b.5074ea57.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1886],{2629:(t,e,i)=>{i.r(e),i.d(e,{assets:()=>d,contentTitle:()=>a,default:()=>p,frontMatter:()=>n,metadata:()=>s,toc:()=>c});var o=i(5893),r=i(1151);const n={title:"Overview",hide_title:!0,sidebar_position:2},a=void 0,s={id:"cado-response/discovery-import/intro",title:"Overview",description:"Getting Started with CTF Data",source:"@site/docs/cado-response/discovery-import/intro.md",sourceDirName:"cado-response/discovery-import",slug:"/cado-response/discovery-import/intro",permalink:"/cado-response/discovery-import/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/intro.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"Overview",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Cross-Project Setup",permalink:"/cado-response/deploy/gcp/gcp-cross-project"},next:{title:"Managing Projects",permalink:"/cado-response/discovery-import/projects"}},d={},c=[{value:"Getting Started with CTF Data",id:"getting-started-with-ctf-data",level:2},{value:"How to get started",id:"how-to-get-started",level:4},{value:"Scenario",id:"scenario",level:4}];function l(t){const e={a:"a",h2:"h2",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",...(0,r.a)(),...t.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(e.h2,{id:"getting-started-with-ctf-data",children:"Getting Started with CTF Data"}),"\n",(0,o.jsxs)(e.p,{children:["Cado provides a short Capture the Flag data set to help you get familiar with the Cado platform. A walkthrough of the data is available ",(0,o.jsx)(e.a,{href:"https://www.youtube.com/watch?v=fM1G10W-PQs",children:"here"})]}),"\n",(0,o.jsx)(e.h4,{id:"how-to-get-started",children:"How to get started"}),"\n",(0,o.jsxs)(e.ol,{children:["\n",(0,o.jsx)(e.li,{children:"Create a new project"}),"\n",(0,o.jsx)(e.li,{children:"Navigate to the help page and click \u201cImport CTF data\u201d. Import will take a few minutes."}),"\n",(0,o.jsx)(e.li,{children:"Open the project and start investigating"}),"\n"]}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Import CTF",src:i(351).Z+"",width:"513",height:"247"})}),"\n",(0,o.jsx)(e.h4,{id:"scenario",children:"Scenario"}),"\n",(0,o.jsx)(e.p,{children:"AWS GuardDuty raised a notification that an instance in our AWS account was accessing a known BitCoin mining address."}),"\n",(0,o.jsx)(e.p,{children:"We imported the AWS GuardDuty logs, plus a disk image of the instance in question. The original image file was over 8GB in size. For the purposes of this capture the flag though, we reduced it down to around 30MB"})]})}function p(t={}){const{wrapper:e}={...(0,r.a)(),...t.components};return e?(0,o.jsx)(e,{...t,children:(0,o.jsx)(l,{...t})}):l(t)}},351:(t,e,i)=>{i.d(e,{Z:()=>o});const o=i.p+"assets/images/ctf-9b6075235546bb5ca80013b54065efaf.png"},1151:(t,e,i)=>{i.d(e,{Z:()=>s,a:()=>a});var o=i(7294);const r={},n=o.createContext(r);function a(t){const e=o.useContext(n);return o.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function s(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(r):t.components||r:a(t.components),o.createElement(n.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/b6cd3a1b.8d29f50a.js b/assets/js/b6cd3a1b.8d29f50a.js new file mode 100644 index 000000000..49b2e06b7 --- /dev/null +++ b/assets/js/b6cd3a1b.8d29f50a.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1886],{2629:(t,e,i)=>{i.r(e),i.d(e,{assets:()=>d,contentTitle:()=>a,default:()=>p,frontMatter:()=>n,metadata:()=>s,toc:()=>c});var o=i(5893),r=i(1151);const n={title:"Overview",hide_title:!0,sidebar_position:2},a=void 0,s={id:"cado-response/discovery-import/intro",title:"Overview",description:"Getting Started with CTF Data",source:"@site/docs/cado-response/discovery-import/intro.md",sourceDirName:"cado-response/discovery-import",slug:"/cado-response/discovery-import/intro",permalink:"/cado-response/discovery-import/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/intro.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"Overview",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Cross-Project Setup",permalink:"/cado-response/deploy/gcp/gcp-cross-project"},next:{title:"Managing Projects",permalink:"/cado-response/discovery-import/projects"}},d={},c=[{value:"Getting Started with CTF Data",id:"getting-started-with-ctf-data",level:2},{value:"How to get started",id:"how-to-get-started",level:4},{value:"Scenario",id:"scenario",level:4}];function l(t){const e={a:"a",h2:"h2",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",...(0,r.a)(),...t.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(e.h2,{id:"getting-started-with-ctf-data",children:"Getting Started with CTF Data"}),"\n",(0,o.jsxs)(e.p,{children:["Cado provides a short Capture the Flag data set to help you get familiar with the Cado platform. A walkthrough of the data is available ",(0,o.jsx)(e.a,{href:"https://www.youtube.com/watch?v=fM1G10W-PQs",children:"here"})]}),"\n",(0,o.jsx)(e.h4,{id:"how-to-get-started",children:"How to get started"}),"\n",(0,o.jsxs)(e.ol,{children:["\n",(0,o.jsx)(e.li,{children:"Create a new project"}),"\n",(0,o.jsx)(e.li,{children:"Navigate to the help page and click \u201cImport CTF data\u201d. Import will take a few minutes."}),"\n",(0,o.jsx)(e.li,{children:"Open the project and start investigating"}),"\n"]}),"\n",(0,o.jsx)(e.p,{children:(0,o.jsx)(e.img,{alt:"Import CTF",src:i(351).Z+"",width:"513",height:"247"})}),"\n",(0,o.jsx)(e.h4,{id:"scenario",children:"Scenario"}),"\n",(0,o.jsx)(e.p,{children:"AWS GuardDuty raised a notification that an instance in our AWS account was accessing a known BitCoin mining address."}),"\n",(0,o.jsx)(e.p,{children:"We imported the AWS GuardDuty logs, plus a disk image of the instance in question. The original image file was over 8GB in size. For the purposes of this capture the flag though, we reduced it down to around 30MB"})]})}function p(t={}){const{wrapper:e}={...(0,r.a)(),...t.components};return e?(0,o.jsx)(e,{...t,children:(0,o.jsx)(l,{...t})}):l(t)}},351:(t,e,i)=>{i.d(e,{Z:()=>o});const o=i.p+"assets/images/ctf-9b6075235546bb5ca80013b54065efaf.png"},1151:(t,e,i)=>{i.d(e,{Z:()=>s,a:()=>a});var o=i(7294);const r={},n=o.createContext(r);function a(t){const e=o.useContext(n);return o.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function s(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(r):t.components||r:a(t.components),o.createElement(n.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/ba4c554d.0043ba55.js b/assets/js/ba4c554d.0043ba55.js new file mode 100644 index 000000000..75f612637 --- /dev/null +++ b/assets/js/ba4c554d.0043ba55.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8701],{7101:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>p,contentTitle:()=>a,default:()=>d,frontMatter:()=>s,metadata:()=>n,toc:()=>c});var r=o(5893),i=o(1151);const s={title:"Azure Compute",hide_title:!0,sidebar_position:1},a="Azure Compute",n={id:"cado-response/discovery-import/import/azure/azure-compute",title:"Azure Compute",description:"The Cado platform supports acquisition of Azure Compute instances. Select an Azure subscription, and this will populate a list of available instances. Select the instance to import, review the details and click on 'Start Import'",source:"@site/docs/cado-response/discovery-import/import/azure/azure-compute.md",sourceDirName:"cado-response/discovery-import/import/azure",slug:"/cado-response/discovery-import/import/azure/azure-compute",permalink:"/cado-response/discovery-import/import/azure/azure-compute",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/azure/azure-compute.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Azure Compute",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Monitoring for Snapshots and Volumes",permalink:"/cado-response/discovery-import/import/aws/monitoring"},next:{title:"Azure Storage",permalink:"/cado-response/discovery-import/import/azure/azure-storage"}},p={},c=[];function u(e){const t={h1:"h1",img:"img",p:"p",...(0,i.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"azure-compute",children:"Azure Compute"}),"\n",(0,r.jsx)(t.p,{children:"The Cado platform supports acquisition of Azure Compute instances. Select an Azure subscription, and this will populate a list of available instances. Select the instance to import, review the details and click on 'Start Import'"}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Azure Compute Import",src:o(1972).Z+"",width:"1806",height:"736"})})]})}function d(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(u,{...e})}):u(e)}},1972:(e,t,o)=>{o.d(t,{Z:()=>r});const r=o.p+"assets/images/azure-compute-dbab6f7874ca8382faabce3b07327841.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>n,a:()=>a});var r=o(7294);const i={},s=r.createContext(i);function a(e){const t=r.useContext(s);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function n(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),r.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ba4c554d.7ccf5333.js b/assets/js/ba4c554d.7ccf5333.js deleted file mode 100644 index 7ce7ee08d..000000000 --- a/assets/js/ba4c554d.7ccf5333.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8701],{7101:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>p,contentTitle:()=>a,default:()=>d,frontMatter:()=>s,metadata:()=>n,toc:()=>c});var r=o(5893),i=o(1151);const s={title:"Azure Compute",hide_title:!0,sidebar_position:1},a="Azure Compute",n={id:"cado-response/discovery-import/import/azure/azure-compute",title:"Azure Compute",description:"The Cado platform supports acquisition of Azure Compute instances. Select an Azure subscription, and this will populate a list of available instances. Select the instance to import, review the details and click on 'Start Import'",source:"@site/docs/cado-response/discovery-import/import/azure/azure-compute.md",sourceDirName:"cado-response/discovery-import/import/azure",slug:"/cado-response/discovery-import/import/azure/azure-compute",permalink:"/cado-response/discovery-import/import/azure/azure-compute",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/azure/azure-compute.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Azure Compute",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Monitoring for Snapshots and Volumes",permalink:"/cado-response/discovery-import/import/aws/monitoring"},next:{title:"Azure Storage",permalink:"/cado-response/discovery-import/import/azure/azure-storage"}},p={},c=[];function u(e){const t={h1:"h1",img:"img",p:"p",...(0,i.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"azure-compute",children:"Azure Compute"}),"\n",(0,r.jsx)(t.p,{children:"The Cado platform supports acquisition of Azure Compute instances. Select an Azure subscription, and this will populate a list of available instances. Select the instance to import, review the details and click on 'Start Import'"}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"Azure Compute Import",src:o(1972).Z+"",width:"1806",height:"736"})})]})}function d(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(u,{...e})}):u(e)}},1972:(e,t,o)=>{o.d(t,{Z:()=>r});const r=o.p+"assets/images/azure-compute-dbab6f7874ca8382faabce3b07327841.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>n,a:()=>a});var r=o(7294);const i={},s=r.createContext(i);function a(e){const t=r.useContext(s);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function n(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),r.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ba6e6a6f.aa7ef162.js b/assets/js/ba6e6a6f.aa7ef162.js new file mode 100644 index 000000000..2a27ae479 --- /dev/null +++ b/assets/js/ba6e6a6f.aa7ef162.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2090],{5009:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>u,frontMatter:()=>s,metadata:()=>r,toc:()=>c});var o=n(5893),i=n(1151);const s={title:"Sep 23 2022 - AWS Role Update",hide_title:!0,sidebar_position:1},a="AWS Role Update",r={id:"support-bulletins/role-update",title:"Sep 23 2022 - AWS Role Update",description:"On Sep 21st, 2022 AWS announced a change with immediate effect to AWS roles that affects the operation of the Cado platform. These new changes mean that any Cado installation deployed after June 30th will no longer operate correctly, including not being able to initialize new workers for data acquisition or processing.",source:"@site/docs/support-bulletins/092322-role-update.md",sourceDirName:"support-bulletins",slug:"/support-bulletins/role-update",permalink:"/support-bulletins/role-update",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/support-bulletins/092322-role-update.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Sep 23 2022 - AWS Role Update",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Community Edition EULA",permalink:"/eula/community-eula"},next:{title:"Release Notes",permalink:"/release-notes/"}},l={},c=[{value:"Instructions for manually updating your system",id:"instructions-for-manually-updating-your-system",level:2}];function d(e){const t={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,i.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"aws-role-update",children:"AWS Role Update"}),"\n",(0,o.jsxs)(t.p,{children:["On Sep 21st, 2022 ",(0,o.jsx)(t.a,{href:"https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/",children:"AWS announced a change with immediate effect to AWS roles"})," that affects the operation of the Cado platform. These new changes mean that ",(0,o.jsx)(t.strong,{children:"any Cado installation deployed after June 30th will no longer operate correctly"}),", including not being able to initialize new workers for data acquisition or processing."]}),"\n",(0,o.jsx)(t.p,{children:"Installations deployed prior to June 30th will continue to function, and Cado plans to issue an update during the week commencing Sep 26th, 2022 that will fix the issue. In the meantime - if needed - there are manual steps you can take in order to ensure that your Cado platform continues to function properly. These are detailed below."}),"\n",(0,o.jsx)(t.p,{children:"We are working with AWS to prevent the recurrence of unexpected changes."}),"\n",(0,o.jsx)(t.h2,{id:"instructions-for-manually-updating-your-system",children:"Instructions for manually updating your system"}),"\n",(0,o.jsxs)(t.ol,{children:["\n",(0,o.jsxs)(t.li,{children:["Cado Response instance, navigate to ",(0,o.jsx)(t.em,{children:"Settings > Cloud"}),' and copy the value in the "AWS Role" box:']}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:(0,o.jsx)(t.img,{alt:"AWS Role",src:n(6531).Z+"",width:"937",height:"160"})}),"\n",(0,o.jsxs)(t.ol,{start:"2",children:["\n",(0,o.jsx)(t.li,{children:"In the AWS IAM console, navigate to your Cado Response role"}),"\n",(0,o.jsx)(t.li,{children:'Select the "Trust relationships" tab'}),"\n",(0,o.jsx)(t.li,{children:'Select "Edit trust policy". Yours should currently look like this:'}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:(0,o.jsx)(t.img,{alt:"AWS Role",src:n(6600).Z+"",width:"1590",height:"499"})}),"\n",(0,o.jsxs)(t.ol,{start:"5",children:["\n",(0,o.jsxs)(t.li,{children:['Add a new line inside the "Principal" block with the text ',(0,o.jsx)(t.code,{children:'\u201cAWS\u201d:"\u201d'})," ( you can paste in your Cado Response role here )."]}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Your new Trust Policy will look like this, with your ARN in the designated place"}),"\n",(0,o.jsx)(t.p,{children:(0,o.jsx)(t.img,{alt:"AWS Role",src:n(3992).Z+"",width:"1651",height:"540"})}),"\n",(0,o.jsxs)(t.ol,{start:"6",children:["\n",(0,o.jsx)(t.li,{children:'Select "Update Policy"'}),"\n"]})]})}function u(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},6531:(e,t,n)=>{n.d(t,{Z:()=>o});const o=n.p+"assets/images/aws-role-cd08b26ec325b76b21b6474cebd655ce.png"},3992:(e,t,n)=>{n.d(t,{Z:()=>o});const o=n.p+"assets/images/trust-policy-after-fc5070acc2b0cc2517b173411012c544.png"},6600:(e,t,n)=>{n.d(t,{Z:()=>o});const o=n.p+"assets/images/trust-policy-before-40a6bce9fb9a90bb0aa8630168ef6b91.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>r,a:()=>a});var o=n(7294);const i={},s=o.createContext(i);function a(e){const t=o.useContext(s);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),o.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ba6e6a6f.e61631f5.js b/assets/js/ba6e6a6f.e61631f5.js deleted file mode 100644 index d98995529..000000000 --- a/assets/js/ba6e6a6f.e61631f5.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2090],{5009:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>u,frontMatter:()=>s,metadata:()=>r,toc:()=>c});var o=n(5893),i=n(1151);const s={title:"Sep 23 2022 - AWS Role Update",hide_title:!0,sidebar_position:1},a="AWS Role Update",r={id:"support-bulletins/role-update",title:"Sep 23 2022 - AWS Role Update",description:"On Sep 21st, 2022 AWS announced a change with immediate effect to AWS roles that affects the operation of the Cado platform. These new changes mean that any Cado installation deployed after June 30th will no longer operate correctly, including not being able to initialize new workers for data acquisition or processing.",source:"@site/docs/support-bulletins/092322-role-update.md",sourceDirName:"support-bulletins",slug:"/support-bulletins/role-update",permalink:"/support-bulletins/role-update",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/support-bulletins/092322-role-update.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Sep 23 2022 - AWS Role Update",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Community Edition EULA",permalink:"/eula/community-eula"},next:{title:"Release Notes",permalink:"/release-notes/"}},l={},c=[{value:"Instructions for manually updating your system",id:"instructions-for-manually-updating-your-system",level:2}];function d(e){const t={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",...(0,i.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"aws-role-update",children:"AWS Role Update"}),"\n",(0,o.jsxs)(t.p,{children:["On Sep 21st, 2022 ",(0,o.jsx)(t.a,{href:"https://aws.amazon.com/blogs/security/announcing-an-update-to-iam-role-trust-policy-behavior/",children:"AWS announced a change with immediate effect to AWS roles"})," that affects the operation of the Cado platform. These new changes mean that ",(0,o.jsx)(t.strong,{children:"any Cado installation deployed after June 30th will no longer operate correctly"}),", including not being able to initialize new workers for data acquisition or processing."]}),"\n",(0,o.jsx)(t.p,{children:"Installations deployed prior to June 30th will continue to function, and Cado plans to issue an update during the week commencing Sep 26th, 2022 that will fix the issue. In the meantime - if needed - there are manual steps you can take in order to ensure that your Cado platform continues to function properly. These are detailed below."}),"\n",(0,o.jsx)(t.p,{children:"We are working with AWS to prevent the recurrence of unexpected changes."}),"\n",(0,o.jsx)(t.h2,{id:"instructions-for-manually-updating-your-system",children:"Instructions for manually updating your system"}),"\n",(0,o.jsxs)(t.ol,{children:["\n",(0,o.jsxs)(t.li,{children:["Cado Response instance, navigate to ",(0,o.jsx)(t.em,{children:"Settings > Cloud"}),' and copy the value in the "AWS Role" box:']}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:(0,o.jsx)(t.img,{alt:"AWS Role",src:n(6531).Z+"",width:"937",height:"160"})}),"\n",(0,o.jsxs)(t.ol,{start:"2",children:["\n",(0,o.jsx)(t.li,{children:"In the AWS IAM console, navigate to your Cado Response role"}),"\n",(0,o.jsx)(t.li,{children:'Select the "Trust relationships" tab'}),"\n",(0,o.jsx)(t.li,{children:'Select "Edit trust policy". Yours should currently look like this:'}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:(0,o.jsx)(t.img,{alt:"AWS Role",src:n(6600).Z+"",width:"1590",height:"499"})}),"\n",(0,o.jsxs)(t.ol,{start:"5",children:["\n",(0,o.jsxs)(t.li,{children:['Add a new line inside the "Principal" block with the text ',(0,o.jsx)(t.code,{children:'\u201cAWS\u201d:"\u201d'})," ( you can paste in your Cado Response role here )."]}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Your new Trust Policy will look like this, with your ARN in the designated place"}),"\n",(0,o.jsx)(t.p,{children:(0,o.jsx)(t.img,{alt:"AWS Role",src:n(3992).Z+"",width:"1651",height:"540"})}),"\n",(0,o.jsxs)(t.ol,{start:"6",children:["\n",(0,o.jsx)(t.li,{children:'Select "Update Policy"'}),"\n"]})]})}function u(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},6531:(e,t,n)=>{n.d(t,{Z:()=>o});const o=n.p+"assets/images/aws-role-cd08b26ec325b76b21b6474cebd655ce.png"},3992:(e,t,n)=>{n.d(t,{Z:()=>o});const o=n.p+"assets/images/trust-policy-after-fc5070acc2b0cc2517b173411012c544.png"},6600:(e,t,n)=>{n.d(t,{Z:()=>o});const o=n.p+"assets/images/trust-policy-before-40a6bce9fb9a90bb0aa8630168ef6b91.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>r,a:()=>a});var o=n(7294);const i={},s=o.createContext(i);function a(e){const t=o.useContext(s);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),o.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c1224519.8d93948f.js b/assets/js/c1224519.8d93948f.js deleted file mode 100644 index 0d1738ff0..000000000 --- a/assets/js/c1224519.8d93948f.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5357],{8826:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>d,frontMatter:()=>a,metadata:()=>i,toc:()=>p});var n=s(5893),r=s(1151);const a={title:"Large EC2 Imports",hide_title:!0,sidebar_position:5},o="Importing Large AWS EC2 Instances",i={id:"cado-response/deploy/aws/performance-resiliency/large-aws-imports",title:"Large EC2 Imports",description:"Importing AWS EC2 instances with disks over 500GB can start to reach limitations in AWS.",source:"@site/docs/cado-response/deploy/aws/performance-resiliency/large-aws-imports.md",sourceDirName:"cado-response/deploy/aws/performance-resiliency",slug:"/cado-response/deploy/aws/performance-resiliency/large-aws-imports",permalink:"/cado-response/deploy/aws/performance-resiliency/large-aws-imports",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/performance-resiliency/large-aws-imports.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:5,frontMatter:{title:"Large EC2 Imports",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Backups and Recovery",permalink:"/cado-response/deploy/aws/performance-resiliency/aws-backups"},next:{title:"High Availability",permalink:"/cado-response/deploy/aws/performance-resiliency/high-availability"}},c={},p=[];function l(e){const t={a:"a",h1:"h1",li:"li",p:"p",ul:"ul",...(0,r.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"importing-large-aws-ec2-instances",children:"Importing Large AWS EC2 Instances"}),"\n",(0,n.jsx)(t.p,{children:"Importing AWS EC2 instances with disks over 500GB can start to reach limitations in AWS.\nTo speed up the importing of very large instances, we recommend:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["Creating a Snapshot of the disk, then enabling ",(0,n.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-fast-snapshot-restore.html",children:"Fast Snapshot Restore"})," on it. You will need to wait for up to an hour for the Fast Snapshot Restore to be enabled, then you can import the Snapshot (snap-xxx)."]}),"\n",(0,n.jsx)(t.li,{children:"Another option is to change the instance type of the target system to a larger system. When acquiring, we match the instance type of the target system for compatability. Larger instances can have higher disk, network and CPU limits."}),"\n"]})]})}function d(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},1151:(e,t,s)=>{s.d(t,{Z:()=>i,a:()=>o});var n=s(7294);const r={},a=n.createContext(r);function o(e){const t=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),n.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c1224519.e02bd95e.js b/assets/js/c1224519.e02bd95e.js new file mode 100644 index 000000000..56cc143c1 --- /dev/null +++ b/assets/js/c1224519.e02bd95e.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5357],{8826:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>d,frontMatter:()=>a,metadata:()=>i,toc:()=>p});var n=s(5893),r=s(1151);const a={title:"Large EC2 Imports",hide_title:!0,sidebar_position:5},o="Importing Large AWS EC2 Instances",i={id:"cado-response/deploy/aws/performance-resiliency/large-aws-imports",title:"Large EC2 Imports",description:"Importing AWS EC2 instances with disks over 500GB can start to reach limitations in AWS.",source:"@site/docs/cado-response/deploy/aws/performance-resiliency/large-aws-imports.md",sourceDirName:"cado-response/deploy/aws/performance-resiliency",slug:"/cado-response/deploy/aws/performance-resiliency/large-aws-imports",permalink:"/cado-response/deploy/aws/performance-resiliency/large-aws-imports",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/performance-resiliency/large-aws-imports.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:5,frontMatter:{title:"Large EC2 Imports",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"Backups and Recovery",permalink:"/cado-response/deploy/aws/performance-resiliency/aws-backups"},next:{title:"High Availability",permalink:"/cado-response/deploy/aws/performance-resiliency/high-availability"}},c={},p=[];function l(e){const t={a:"a",h1:"h1",li:"li",p:"p",ul:"ul",...(0,r.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"importing-large-aws-ec2-instances",children:"Importing Large AWS EC2 Instances"}),"\n",(0,n.jsx)(t.p,{children:"Importing AWS EC2 instances with disks over 500GB can start to reach limitations in AWS.\nTo speed up the importing of very large instances, we recommend:"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["Creating a Snapshot of the disk, then enabling ",(0,n.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-fast-snapshot-restore.html",children:"Fast Snapshot Restore"})," on it. You will need to wait for up to an hour for the Fast Snapshot Restore to be enabled, then you can import the Snapshot (snap-xxx)."]}),"\n",(0,n.jsx)(t.li,{children:"Another option is to change the instance type of the target system to a larger system. When acquiring, we match the instance type of the target system for compatability. Larger instances can have higher disk, network and CPU limits."}),"\n"]})]})}function d(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}},1151:(e,t,s)=>{s.d(t,{Z:()=>i,a:()=>o});var n=s(7294);const r={},a=n.createContext(r);function o(e){const t=n.useContext(a);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),n.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c30a38de.15614ad8.js b/assets/js/c30a38de.15614ad8.js new file mode 100644 index 000000000..9c9ab9ca5 --- /dev/null +++ b/assets/js/c30a38de.15614ad8.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6909],{2009:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>l,contentTitle:()=>i,default:()=>h,frontMatter:()=>t,metadata:()=>a,toc:()=>c});var o=s(5893),r=s(1151);const t={title:"EKS",hide_title:!0,sidebar_position:5},i="AWS EKS",a={id:"cado-response/discovery-import/import/aws/aws-eks",title:"EKS",description:"The Cado platform will collect key logs and forensic artifacts containers running in an AWS EKS cluster.",source:"@site/docs/cado-response/discovery-import/import/aws/aws-eks.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/aws-eks",permalink:"/cado-response/discovery-import/import/aws/aws-eks",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/aws-eks.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:5,frontMatter:{title:"EKS",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"ECS",permalink:"/cado-response/discovery-import/import/aws/aws-ecs"},next:{title:"Lambda",permalink:"/cado-response/discovery-import/import/aws/aws-lambda"}},l={},c=[{value:"Known Limitations",id:"known-limitations",level:2},{value:"Configuring the Cluster RBAC for use with Cado",id:"configuring-the-cluster-rbac-for-use-with-cado",level:2},{value:"RBAC ClusterRole and ClusterRoleBinding",id:"rbac-clusterrole-and-clusterrolebinding",level:3},{value:"Linking AWS IAM to your Cluster RBAC",id:"linking-aws-iam-to-your-cluster-rbac",level:3},{value:"Import Steps",id:"import-steps",level:2}];function d(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(n.h1,{id:"aws-eks",children:"AWS EKS"}),"\n",(0,o.jsx)(n.p,{children:"The Cado platform will collect key logs and forensic artifacts containers running in an AWS EKS cluster."}),"\n",(0,o.jsx)(n.h2,{id:"known-limitations",children:"Known Limitations"}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:["The Cado platform cannot acquire artifacts from a container built with a ",(0,o.jsx)(n.a,{href:"https://github.com/GoogleContainerTools/distroless#why-should-i-use-distroless-images",children:"distroless"})," image. This is due to the way the platform interacts with a container, which requires a shell environment, you can learn more about the command we run ",(0,o.jsx)(n.a,{href:"../../../../cado-host/deploy#using-script-builder",children:"here"}),". Additionally, the platform will hide containers with the ",(0,o.jsx)(n.code,{children:"gcr.io/distroless"})," image tag."]}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:["The Cado platform will hide pods running under the following namespaces: ",(0,o.jsx)(n.code,{children:"kube-system"}),", ",(0,o.jsx)(n.code,{children:"kube-public"}),", ",(0,o.jsx)(n.code,{children:"kube-node-lease"}),", ",(0,o.jsx)(n.code,{children:"gke-gmp-system"}),", ",(0,o.jsx)(n.code,{children:"aks-command"}),", ",(0,o.jsx)(n.code,{children:"gmp-system"}),", ",(0,o.jsx)(n.code,{children:"calico-system"}),", and ",(0,o.jsx)(n.code,{children:"tigera-operator"}),". These are system level namespaces, which are often running a distroless environment, which the platform does not support."]}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(n.h2,{id:"configuring-the-cluster-rbac-for-use-with-cado",children:"Configuring the Cluster RBAC for use with Cado"}),"\n",(0,o.jsx)(n.p,{children:"In order for the Cado platform to acquire artifacts from a container, the following Kubernetes permissions are required:"}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.code,{children:"pods"})," - ",(0,o.jsx)(n.code,{children:"get, list"})]}),"\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.code,{children:"pods/exec"})," - ",(0,o.jsx)(n.code,{children:"create, get"})]}),"\n"]}),"\n",(0,o.jsx)(n.p,{children:"These permissions are required for every cluster you intend to acquire through the platform."}),"\n",(0,o.jsx)(n.h3,{id:"rbac-clusterrole-and-clusterrolebinding",children:"RBAC ClusterRole and ClusterRoleBinding"}),"\n",(0,o.jsx)(n.p,{children:"We recommend adding the following ClusterRole and ClusterRoleBinding to your Cluster RBAC with the permissions mentioned above."}),"\n",(0,o.jsxs)(n.p,{children:["See ",(0,o.jsx)(n.a,{href:"https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html",children:"the following AWS guide"})," for instructions of manipulating the role maps."]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-yaml",children:'apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cado-eks-cluster-role\nrules:\n- apiGroups: [""]\n resources: ["pods"]\n verbs: ["get", "list"]\n- apiGroups: [""]\n resources: ["pods/exec"]\n verbs: ["create", "get"]\n'})}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-yaml",children:"apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cado-eks-cluster-role-binding\nsubjects:\n- kind: Group\n name: cado\n apiGroup: rbac.authorization.k8s.io\nroleRef:\n kind: ClusterRole\n name: cado-eks-cluster-role\n apiGroup: rbac.authorization.k8s.io\n"})}),"\n",(0,o.jsx)(n.h3,{id:"linking-aws-iam-to-your-cluster-rbac",children:"Linking AWS IAM to your Cluster RBAC"}),"\n",(0,o.jsx)(n.admonition,{type:"info",children:(0,o.jsxs)(n.p,{children:["You should use the role ARN added in the ",(0,o.jsx)(n.a,{href:"/cado-response/deploy/aws/iam/cross-account-creation#step-2-add-target-aws-role-arn-to-the-cado-platform",children:"Cross Account Creation"})," that relates to the AWS Account ID where the cluster resides."]})}),"\n",(0,o.jsxs)(n.p,{children:["You'll need to add the appropriately configued Cado IAM role to your EKS RBAC configuration. Without\nthis you will see an error message saying that ",(0,o.jsx)(n.code,{children:"This role is not configured to authorize with this EKS cluster"}),"."]}),"\n",(0,o.jsxs)(n.p,{children:["See ",(0,o.jsx)(n.a,{href:"https://aws.amazon.com/premiumsupport/knowledge-center/eks-api-server-unauthorized-error/",children:"the following AWS guide"}),"\non how to add your role to the EKS RBAC, or if you have eksctl configured, you can use the following command:"]}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.code,{children:"eksctl create iamidentitymapping --cluster= --region= --arn= --group="})}),"\n",(0,o.jsxs)(n.p,{children:["If you added the ClusterRole and ClusterRoleBindings above, the group would be ",(0,o.jsx)(n.code,{children:"cado"}),":"]}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.code,{children:"eksctl create iamidentitymapping --cluster= --region= --arn= --group=cado"})}),"\n",(0,o.jsx)(n.p,{children:"You must also make sure the following IAM permissions are attached to your IAM role:"}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:'\t"eks:ListClusters",\n\t"eks:DescribeCluster",\n'})}),"\n",(0,o.jsx)(n.h2,{id:"import-steps",children:"Import Steps"}),"\n",(0,o.jsxs)(n.ol,{children:["\n",(0,o.jsxs)(n.li,{children:["Go to ",(0,o.jsx)(n.strong,{children:"Import > Cloud"})]}),"\n"]}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.img,{alt:"Cado Import Screen showing the AWS EKS options",src:s(263).Z+"",width:"842",height:"242"})}),"\n",(0,o.jsxs)(n.ol,{start:"2",children:["\n",(0,o.jsxs)(n.li,{children:["Go through the steps to choose your ",(0,o.jsx)(n.strong,{children:"Cluster"}),", ",(0,o.jsx)(n.strong,{children:"Pod"})," and ",(0,o.jsx)(n.strong,{children:"Container"}),":"]}),"\n"]}),"\n",(0,o.jsx)(n.admonition,{type:"tip",children:(0,o.jsx)(n.p,{children:"When selecting the role in the UI, select the role configured for the account where your EKS cluster resides"})}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.img,{alt:"Cado Import Screen showing the available AWS EKS Clusters",src:s(6599).Z+"",width:"1842",height:"563"})}),"\n",(0,o.jsxs)(n.ol,{start:"3",children:["\n",(0,o.jsx)(n.li,{children:"Cado will now automatically collect all the key logs and forensic artifacts from the container to enable an investigation.\nFor a typical acquisition, import and processing will take a few minutes to complete."}),"\n"]}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.img,{alt:"Cado showing the confirmation screen of a successful AWS EKS container capture",src:s(1574).Z+"",width:"1795",height:"698"})})]})}function h(e={}){const{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,o.jsx)(n,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},6599:(e,n,s)=>{s.d(n,{Z:()=>o});const o=s.p+"assets/images/eks2-61bad122854ee7bda7589ab4d9c32e68.png"},1574:(e,n,s)=>{s.d(n,{Z:()=>o});const o=s.p+"assets/images/eks3-fc961c2189e29adc6a2571cacf950e28.png"},263:(e,n,s)=>{s.d(n,{Z:()=>o});const o=s.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},1151:(e,n,s)=>{s.d(n,{Z:()=>a,a:()=>i});var o=s(7294);const r={},t=o.createContext(r);function i(e){const n=o.useContext(t);return o.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),o.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c30a38de.dd93fed3.js b/assets/js/c30a38de.dd93fed3.js deleted file mode 100644 index e8f7ceac6..000000000 --- a/assets/js/c30a38de.dd93fed3.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6909],{2009:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>l,contentTitle:()=>i,default:()=>h,frontMatter:()=>t,metadata:()=>a,toc:()=>c});var o=s(5893),r=s(1151);const t={title:"EKS",hide_title:!0,sidebar_position:5},i="AWS EKS",a={id:"cado-response/discovery-import/import/aws/aws-eks",title:"EKS",description:"The Cado platform will collect key logs and forensic artifacts containers running in an AWS EKS cluster.",source:"@site/docs/cado-response/discovery-import/import/aws/aws-eks.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/aws-eks",permalink:"/cado-response/discovery-import/import/aws/aws-eks",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/aws-eks.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:5,frontMatter:{title:"EKS",hide_title:!0,sidebar_position:5},sidebar:"tutorialSidebar",previous:{title:"ECS",permalink:"/cado-response/discovery-import/import/aws/aws-ecs"},next:{title:"Lambda",permalink:"/cado-response/discovery-import/import/aws/aws-lambda"}},l={},c=[{value:"Known Limitations",id:"known-limitations",level:2},{value:"Configuring the Cluster RBAC for use with Cado",id:"configuring-the-cluster-rbac-for-use-with-cado",level:2},{value:"RBAC ClusterRole and ClusterRoleBinding",id:"rbac-clusterrole-and-clusterrolebinding",level:3},{value:"Linking AWS IAM to your Cluster RBAC",id:"linking-aws-iam-to-your-cluster-rbac",level:3},{value:"Import Steps",id:"import-steps",level:2}];function d(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(n.h1,{id:"aws-eks",children:"AWS EKS"}),"\n",(0,o.jsx)(n.p,{children:"The Cado platform will collect key logs and forensic artifacts containers running in an AWS EKS cluster."}),"\n",(0,o.jsx)(n.h2,{id:"known-limitations",children:"Known Limitations"}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:["The Cado platform cannot acquire artifacts from a container built with a ",(0,o.jsx)(n.a,{href:"https://github.com/GoogleContainerTools/distroless#why-should-i-use-distroless-images",children:"distroless"})," image. This is due to the way the platform interacts with a container, which requires a shell environment, you can learn more about the command we run ",(0,o.jsx)(n.a,{href:"../../../../cado-host/deploy#using-script-builder",children:"here"}),". Additionally, the platform will hide containers with the ",(0,o.jsx)(n.code,{children:"gcr.io/distroless"})," image tag."]}),"\n"]}),"\n",(0,o.jsxs)(n.li,{children:["\n",(0,o.jsxs)(n.p,{children:["The Cado platform will hide pods running under the following namespaces: ",(0,o.jsx)(n.code,{children:"kube-system"}),", ",(0,o.jsx)(n.code,{children:"kube-public"}),", ",(0,o.jsx)(n.code,{children:"kube-node-lease"}),", ",(0,o.jsx)(n.code,{children:"gke-gmp-system"}),", ",(0,o.jsx)(n.code,{children:"aks-command"}),", ",(0,o.jsx)(n.code,{children:"gmp-system"}),", ",(0,o.jsx)(n.code,{children:"calico-system"}),", and ",(0,o.jsx)(n.code,{children:"tigera-operator"}),". These are system level namespaces, which are often running a distroless environment, which the platform does not support."]}),"\n"]}),"\n"]}),"\n",(0,o.jsx)(n.h2,{id:"configuring-the-cluster-rbac-for-use-with-cado",children:"Configuring the Cluster RBAC for use with Cado"}),"\n",(0,o.jsx)(n.p,{children:"In order for the Cado platform to acquire artifacts from a container, the following Kubernetes permissions are required:"}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.code,{children:"pods"})," - ",(0,o.jsx)(n.code,{children:"get, list"})]}),"\n",(0,o.jsxs)(n.li,{children:[(0,o.jsx)(n.code,{children:"pods/exec"})," - ",(0,o.jsx)(n.code,{children:"create, get"})]}),"\n"]}),"\n",(0,o.jsx)(n.p,{children:"These permissions are required for every cluster you intend to acquire through the platform."}),"\n",(0,o.jsx)(n.h3,{id:"rbac-clusterrole-and-clusterrolebinding",children:"RBAC ClusterRole and ClusterRoleBinding"}),"\n",(0,o.jsx)(n.p,{children:"We recommend adding the following ClusterRole and ClusterRoleBinding to your Cluster RBAC with the permissions mentioned above."}),"\n",(0,o.jsxs)(n.p,{children:["See ",(0,o.jsx)(n.a,{href:"https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html",children:"the following AWS guide"})," for instructions of manipulating the role maps."]}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-yaml",children:'apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: cado-eks-cluster-role\nrules:\n- apiGroups: [""]\n resources: ["pods"]\n verbs: ["get", "list"]\n- apiGroups: [""]\n resources: ["pods/exec"]\n verbs: ["create", "get"]\n'})}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{className:"language-yaml",children:"apiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: cado-eks-cluster-role-binding\nsubjects:\n- kind: Group\n name: cado\n apiGroup: rbac.authorization.k8s.io\nroleRef:\n kind: ClusterRole\n name: cado-eks-cluster-role\n apiGroup: rbac.authorization.k8s.io\n"})}),"\n",(0,o.jsx)(n.h3,{id:"linking-aws-iam-to-your-cluster-rbac",children:"Linking AWS IAM to your Cluster RBAC"}),"\n",(0,o.jsx)(n.admonition,{type:"info",children:(0,o.jsxs)(n.p,{children:["You should use the role ARN added in the ",(0,o.jsx)(n.a,{href:"/cado-response/deploy/aws/iam/cross-account-creation#step-2-add-target-aws-role-arn-to-the-cado-platform",children:"Cross Account Creation"})," that relates to the AWS Account ID where the cluster resides."]})}),"\n",(0,o.jsxs)(n.p,{children:["You'll need to add the appropriately configued Cado IAM role to your EKS RBAC configuration. Without\nthis you will see an error message saying that ",(0,o.jsx)(n.code,{children:"This role is not configured to authorize with this EKS cluster"}),"."]}),"\n",(0,o.jsxs)(n.p,{children:["See ",(0,o.jsx)(n.a,{href:"https://aws.amazon.com/premiumsupport/knowledge-center/eks-api-server-unauthorized-error/",children:"the following AWS guide"}),"\non how to add your role to the EKS RBAC, or if you have eksctl configured, you can use the following command:"]}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.code,{children:"eksctl create iamidentitymapping --cluster= --region= --arn= --group="})}),"\n",(0,o.jsxs)(n.p,{children:["If you added the ClusterRole and ClusterRoleBindings above, the group would be ",(0,o.jsx)(n.code,{children:"cado"}),":"]}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.code,{children:"eksctl create iamidentitymapping --cluster= --region= --arn= --group=cado"})}),"\n",(0,o.jsx)(n.p,{children:"You must also make sure the following IAM permissions are attached to your IAM role:"}),"\n",(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:'\t"eks:ListClusters",\n\t"eks:DescribeCluster",\n'})}),"\n",(0,o.jsx)(n.h2,{id:"import-steps",children:"Import Steps"}),"\n",(0,o.jsxs)(n.ol,{children:["\n",(0,o.jsxs)(n.li,{children:["Go to ",(0,o.jsx)(n.strong,{children:"Import > Cloud"})]}),"\n"]}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.img,{alt:"Cado Import Screen showing the AWS EKS options",src:s(263).Z+"",width:"842",height:"242"})}),"\n",(0,o.jsxs)(n.ol,{start:"2",children:["\n",(0,o.jsxs)(n.li,{children:["Go through the steps to choose your ",(0,o.jsx)(n.strong,{children:"Cluster"}),", ",(0,o.jsx)(n.strong,{children:"Pod"})," and ",(0,o.jsx)(n.strong,{children:"Container"}),":"]}),"\n"]}),"\n",(0,o.jsx)(n.admonition,{type:"tip",children:(0,o.jsx)(n.p,{children:"When selecting the role in the UI, select the role configured for the account where your EKS cluster resides"})}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.img,{alt:"Cado Import Screen showing the available AWS EKS Clusters",src:s(6599).Z+"",width:"1842",height:"563"})}),"\n",(0,o.jsxs)(n.ol,{start:"3",children:["\n",(0,o.jsx)(n.li,{children:"Cado will now automatically collect all the key logs and forensic artifacts from the container to enable an investigation.\nFor a typical acquisition, import and processing will take a few minutes to complete."}),"\n"]}),"\n",(0,o.jsx)(n.p,{children:(0,o.jsx)(n.img,{alt:"Cado showing the confirmation screen of a successful AWS EKS container capture",src:s(1574).Z+"",width:"1795",height:"698"})})]})}function h(e={}){const{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,o.jsx)(n,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},6599:(e,n,s)=>{s.d(n,{Z:()=>o});const o=s.p+"assets/images/eks2-61bad122854ee7bda7589ab4d9c32e68.png"},1574:(e,n,s)=>{s.d(n,{Z:()=>o});const o=s.p+"assets/images/eks3-fc961c2189e29adc6a2571cacf950e28.png"},263:(e,n,s)=>{s.d(n,{Z:()=>o});const o=s.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},1151:(e,n,s)=>{s.d(n,{Z:()=>a,a:()=>i});var o=s(7294);const r={},t=o.createContext(r);function i(e){const n=o.useContext(t);return o.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),o.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c46214b8.3624f9ff.js b/assets/js/c46214b8.3624f9ff.js new file mode 100644 index 000000000..8e173f4eb --- /dev/null +++ b/assets/js/c46214b8.3624f9ff.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2480],{8578:(o,t,e)=>{e.r(t),e.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>m,frontMatter:()=>s,metadata:()=>a,toc:()=>d});var n=e(5893),i=e(1151);const s={title:"Monitoring for Snapshots and Volumes",hide_title:!0,sidebar_position:9},r="Monitoring for Snapshots and Volumes",a={id:"cado-response/discovery-import/import/aws/monitoring",title:"Monitoring for Snapshots and Volumes",description:"You can monitor for Snapshots and Volumes created within an account.",source:"@site/docs/cado-response/discovery-import/import/aws/monitoring.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/monitoring",permalink:"/cado-response/discovery-import/import/aws/monitoring",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/monitoring.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:9,frontMatter:{title:"Monitoring for Snapshots and Volumes",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Lightsail",permalink:"/cado-response/discovery-import/import/aws/aws-lightsail"},next:{title:"Azure Compute",permalink:"/cado-response/discovery-import/import/azure/azure-compute"}},c={},d=[];function p(o){const t={h1:"h1",img:"img",p:"p",...(0,i.a)(),...o.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"monitoring-for-snapshots-and-volumes",children:"Monitoring for Snapshots and Volumes"}),"\n",(0,n.jsx)(t.p,{children:"You can monitor for Snapshots and Volumes created within an account."}),"\n",(0,n.jsx)(t.p,{children:"By enabling the Tag Key and Tag Value setting at Settings > Advanced, any snapshots or volumes created with the specified tag in any region in the AWS account that the Cado platform is deployed into will be automatically imported:"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Monitoring",src:e(8277).Z+"",width:"1950",height:"316"})}),"\n",(0,n.jsx)(t.p,{children:"Cado will check for new resources every 5 minutes."}),"\n",(0,n.jsx)(t.p,{children:"This is useful for importing AWS resources into a dedicated forensics account from other accounts in the same organization, following detections or suspicious activity."})]})}function m(o={}){const{wrapper:t}={...(0,i.a)(),...o.components};return t?(0,n.jsx)(t,{...o,children:(0,n.jsx)(p,{...o})}):p(o)}},8277:(o,t,e)=>{e.d(t,{Z:()=>n});const n=e.p+"assets/images/tag_monitor-fb97c3b6317c7d5180b1e35079d3d918.png"},1151:(o,t,e)=>{e.d(t,{Z:()=>a,a:()=>r});var n=e(7294);const i={},s=n.createContext(i);function r(o){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof o?o(t):{...t,...o}}),[t,o])}function a(o){let t;return t=o.disableParentContext?"function"==typeof o.components?o.components(i):o.components||i:r(o.components),n.createElement(s.Provider,{value:t},o.children)}}}]); \ No newline at end of file diff --git a/assets/js/c46214b8.7e1179b3.js b/assets/js/c46214b8.7e1179b3.js deleted file mode 100644 index c894b7fb5..000000000 --- a/assets/js/c46214b8.7e1179b3.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2480],{8578:(o,t,e)=>{e.r(t),e.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>m,frontMatter:()=>s,metadata:()=>a,toc:()=>d});var n=e(5893),i=e(1151);const s={title:"Monitoring for Snapshots and Volumes",hide_title:!0,sidebar_position:9},r="Monitoring for Snapshots and Volumes",a={id:"cado-response/discovery-import/import/aws/monitoring",title:"Monitoring for Snapshots and Volumes",description:"You can monitor for Snapshots and Volumes created within an account.",source:"@site/docs/cado-response/discovery-import/import/aws/monitoring.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/monitoring",permalink:"/cado-response/discovery-import/import/aws/monitoring",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/monitoring.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:9,frontMatter:{title:"Monitoring for Snapshots and Volumes",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Lightsail",permalink:"/cado-response/discovery-import/import/aws/aws-lightsail"},next:{title:"Azure Compute",permalink:"/cado-response/discovery-import/import/azure/azure-compute"}},c={},d=[];function p(o){const t={h1:"h1",img:"img",p:"p",...(0,i.a)(),...o.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"monitoring-for-snapshots-and-volumes",children:"Monitoring for Snapshots and Volumes"}),"\n",(0,n.jsx)(t.p,{children:"You can monitor for Snapshots and Volumes created within an account."}),"\n",(0,n.jsx)(t.p,{children:"By enabling the Tag Key and Tag Value setting at Settings > Advanced, any snapshots or volumes created with the specified tag in any region in the AWS account that the Cado platform is deployed into will be automatically imported:"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"Monitoring",src:e(8277).Z+"",width:"1950",height:"316"})}),"\n",(0,n.jsx)(t.p,{children:"Cado will check for new resources every 5 minutes."}),"\n",(0,n.jsx)(t.p,{children:"This is useful for importing AWS resources into a dedicated forensics account from other accounts in the same organization, following detections or suspicious activity."})]})}function m(o={}){const{wrapper:t}={...(0,i.a)(),...o.components};return t?(0,n.jsx)(t,{...o,children:(0,n.jsx)(p,{...o})}):p(o)}},8277:(o,t,e)=>{e.d(t,{Z:()=>n});const n=e.p+"assets/images/tag_monitor-fb97c3b6317c7d5180b1e35079d3d918.png"},1151:(o,t,e)=>{e.d(t,{Z:()=>a,a:()=>r});var n=e(7294);const i={},s=n.createContext(i);function r(o){const t=n.useContext(s);return n.useMemo((function(){return"function"==typeof o?o(t):{...t,...o}}),[t,o])}function a(o){let t;return t=o.disableParentContext?"function"==typeof o.components?o.components(i):o.components||i:r(o.components),n.createElement(s.Provider,{value:t},o.children)}}}]); \ No newline at end of file diff --git a/assets/js/c4c8013b.1c4cb2fb.js b/assets/js/c4c8013b.1c4cb2fb.js deleted file mode 100644 index 875225c76..000000000 --- a/assets/js/c4c8013b.1c4cb2fb.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9297],{4594:(e,i,t)=>{t.r(i),t.d(i,{assets:()=>l,contentTitle:()=>n,default:()=>d,frontMatter:()=>r,metadata:()=>s,toc:()=>p});var a=t(5893),o=t(1151);const r={title:"High Availability",hide_title:!0,sidebar_position:6},n="Platform High Availability Support",s={id:"cado-response/deploy/aws/performance-resiliency/high-availability",title:"High Availability",description:"The Cado platform can be deployed in AWS in full high availability mode.",source:"@site/docs/cado-response/deploy/aws/performance-resiliency/high-availability.md",sourceDirName:"cado-response/deploy/aws/performance-resiliency",slug:"/cado-response/deploy/aws/performance-resiliency/high-availability",permalink:"/cado-response/deploy/aws/performance-resiliency/high-availability",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/performance-resiliency/high-availability.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:6,frontMatter:{title:"High Availability",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Large EC2 Imports",permalink:"/cado-response/deploy/aws/performance-resiliency/large-aws-imports"},next:{title:"Overview",permalink:"/cado-response/deploy/azure/azure-deploy"}},l={},p=[];function c(e){const i={h1:"h1",p:"p",...(0,o.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(i.h1,{id:"platform-high-availability-support",children:"Platform High Availability Support"}),"\n",(0,a.jsx)(i.p,{children:"The Cado platform can be deployed in AWS in full high availability mode.\nThis makes use of native AWS services to provide a highly available deployment of the Cado platform.\nFor more information speak to your Cado Customer Service representative."})]})}function d(e={}){const{wrapper:i}={...(0,o.a)(),...e.components};return i?(0,a.jsx)(i,{...e,children:(0,a.jsx)(c,{...e})}):c(e)}},1151:(e,i,t)=>{t.d(i,{Z:()=>s,a:()=>n});var a=t(7294);const o={},r=a.createContext(o);function n(e){const i=a.useContext(r);return a.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function s(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:n(e.components),a.createElement(r.Provider,{value:i},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c4c8013b.f3461f7a.js b/assets/js/c4c8013b.f3461f7a.js new file mode 100644 index 000000000..13bbf9f75 --- /dev/null +++ b/assets/js/c4c8013b.f3461f7a.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9297],{4594:(e,i,t)=>{t.r(i),t.d(i,{assets:()=>l,contentTitle:()=>n,default:()=>d,frontMatter:()=>r,metadata:()=>s,toc:()=>p});var a=t(5893),o=t(1151);const r={title:"High Availability",hide_title:!0,sidebar_position:6},n="Platform High Availability Support",s={id:"cado-response/deploy/aws/performance-resiliency/high-availability",title:"High Availability",description:"The Cado platform can be deployed in AWS in full high availability mode.",source:"@site/docs/cado-response/deploy/aws/performance-resiliency/high-availability.md",sourceDirName:"cado-response/deploy/aws/performance-resiliency",slug:"/cado-response/deploy/aws/performance-resiliency/high-availability",permalink:"/cado-response/deploy/aws/performance-resiliency/high-availability",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/performance-resiliency/high-availability.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:6,frontMatter:{title:"High Availability",hide_title:!0,sidebar_position:6},sidebar:"tutorialSidebar",previous:{title:"Large EC2 Imports",permalink:"/cado-response/deploy/aws/performance-resiliency/large-aws-imports"},next:{title:"Overview",permalink:"/cado-response/deploy/azure/azure-deploy"}},l={},p=[];function c(e){const i={h1:"h1",p:"p",...(0,o.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(i.h1,{id:"platform-high-availability-support",children:"Platform High Availability Support"}),"\n",(0,a.jsx)(i.p,{children:"The Cado platform can be deployed in AWS in full high availability mode.\nThis makes use of native AWS services to provide a highly available deployment of the Cado platform.\nFor more information speak to your Cado Customer Service representative."})]})}function d(e={}){const{wrapper:i}={...(0,o.a)(),...e.components};return i?(0,a.jsx)(i,{...e,children:(0,a.jsx)(c,{...e})}):c(e)}},1151:(e,i,t)=>{t.d(i,{Z:()=>s,a:()=>n});var a=t(7294);const o={},r=a.createContext(o);function n(e){const i=a.useContext(r);return a.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function s(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:n(e.components),a.createElement(r.Provider,{value:i},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c4f709c5.58782ad2.js b/assets/js/c4f709c5.58782ad2.js deleted file mode 100644 index 968055571..000000000 --- a/assets/js/c4f709c5.58782ad2.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2159],{5029:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>c,contentTitle:()=>r,default:()=>p,frontMatter:()=>i,metadata:()=>a,toc:()=>l});var t=s(5893),o=s(1151);const i={title:"KMS Support",hide_title:!0,sidebar_position:2},r="AWS KMS Support",a={id:"cado-response/deploy/aws/data-encryption/aws-kms",title:"KMS Support",description:"The Cado platform will import EC2 instances with encrypted volumes, provided that the appropriate permissions are given to the CadoResponseRole.",source:"@site/docs/cado-response/deploy/aws/data-encryption/aws-kms.md",sourceDirName:"cado-response/deploy/aws/data-encryption",slug:"/cado-response/deploy/aws/data-encryption/aws-kms",permalink:"/cado-response/deploy/aws/data-encryption/aws-kms",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/data-encryption/aws-kms.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"KMS Support",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Overview",permalink:"/cado-response/deploy/aws/data-encryption/data-encryption-overview"},next:{title:"Logging",permalink:"/cado-response/deploy/aws/logging"}},c={},l=[{value:"Custom Keys",id:"custom-keys",level:3},{value:"Cross Region",id:"cross-region",level:3},{value:"Cross Account using Customer Managed Keys",id:"cross-account-using-customer-managed-keys",level:3},{value:"Cross Account using AWS default keys",id:"cross-account-using-aws-default-keys",level:3},{value:"Resolving Issues with KMS Support",id:"resolving-issues-with-kms-support",level:3},{value:"Using Cado Host to bypass KMS",id:"using-cado-host-to-bypass-kms",level:4},{value:"Bypassing KMS by creating an Unencrypted Volume",id:"bypassing-kms-by-creating-an-unencrypted-volume",level:4},{value:"Debugging IAM Permissions for KMS",id:"debugging-iam-permissions-for-kms",level:4}];function d(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",h4:"h4",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,o.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"aws-kms-support",children:"AWS KMS Support"}),"\n",(0,t.jsx)(n.p,{children:"The Cado platform will import EC2 instances with encrypted volumes, provided that the appropriate permissions are given to the CadoResponseRole."}),"\n",(0,t.jsxs)(n.p,{children:["AWS provides default keys in your account. These provide default access with the statement below, and this default is supported by the platform out of the box. For more information on KMS, you can visit the ",(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"https://aws.amazon.com/kms/",children:"AWS Key Management Service (KMS)"})})," page."]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "Sid": "Allow access through EBS for all principals in the account that are authorized to use EBS",\n "Effect": "Allow",\n "Principal": {\n "AWS": "*"\n },\n "Action": [\n "kms:Encrypt",\n "kms:Decrypt",\n "kms:ReEncrypt*",\n "kms:GenerateDataKey*",\n "kms:CreateGrant",\n "kms:DescribeKey"\n ],\n "Resource": "*",\n "Condition": {\n "StringEquals": {\n "kms:ViaService": "ec2.eu-west-3.amazonaws.com",\n "kms:CallerAccount": "012345678910"\n }\n }\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["As the Sid suggests: all ",(0,t.jsx)(n.code,{children:"Principals"})," (users/roles etc) in the account and region specified in ",(0,t.jsx)(n.code,{children:"Condition"})," have permission to perform the given actions."]}),"\n",(0,t.jsx)(n.h3,{id:"custom-keys",children:"Custom Keys"}),"\n",(0,t.jsx)(n.p,{children:"When using custom keys the required actions to CadoResponseRole are:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'"kms:Encrypt",\n"kms:Decrypt",\n"kms:ReEncrypt*",\n"kms:GenerateDataKey*",\n"kms:CreateGrant"\n'})}),"\n",(0,t.jsxs)(n.p,{children:["There are a number of options available - but the recommended approach is adding required permisisons to ",(0,t.jsx)(n.code,{children:"myCadoResponseRole"})," directly and witholding ",(0,t.jsx)(n.code,{children:'"CreateGrant"'})," for resources only:"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["You may not wish to give kms",":CreateGrant"," permission to CadoResponseRole itself"]}),"\n",(0,t.jsx)(n.li,{children:"Your policy must feature a statement which provides access to CadoResponseRole with the above permissions (except CreateGrant)"}),"\n",(0,t.jsx)(n.li,{children:"You may then tighten the policy to only allow CreateGrant permission to AWS resources"}),"\n"]}),"\n",(0,t.jsxs)(n.p,{children:["An sample policy is shown below (be sure to adjust ",(0,t.jsx)(n.code,{children:"Principal"})," and add ",(0,t.jsx)(n.code,{children:"Condition"})," according to your needs):"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'[\n {\n "Sid": "Allow required KMS permissions",\n "Effect": "Allow",\n "Principal": {\n "AWS": "arn:aws:iam::012345678910:role/myCadoResponseRole"\n },\n "Action": [\n "kms:Encrypt",\n "kms:Decrypt",\n "kms:ReEncrypt*",\n "kms:GenerateDataKey*"\n ],\n "Resource": "*"\n },\n {\n "Sid": "Allow attachment of persistent resources",\n "Effect": "Allow",\n "Principal": {\n "AWS": "arn:aws:iam::012345678910:role/myCadoResponseRole"\n },\n "Action": [\n "kms:CreateGrant"\n ],\n "Resource": "*",\n "Condition": {\n "Bool": {\n "kms:GrantIsForAWSResource": true\n }\n }\n }\n]\n'})}),"\n",(0,t.jsx)(n.h3,{id:"cross-region",children:"Cross Region"}),"\n",(0,t.jsxs)(n.p,{children:["It is important to ensure that if you are acquiring cross region that your relevant policy statements still apply to the region of your Cado platform (e.g. that policy ",(0,t.jsx)(n.code,{children:"Conditions"})," don't preclude the platform's access)."]}),"\n",(0,t.jsx)(n.h3,{id:"cross-account-using-customer-managed-keys",children:"Cross Account using Customer Managed Keys"}),"\n",(0,t.jsx)(n.admonition,{type:"info",children:(0,t.jsx)(n.p,{children:"During both of the following, be sure to reference the specific KMS key your EC2 is encrypted with to ensure minimal scoping."})}),"\n",(0,t.jsxs)(n.p,{children:["The simplest approach is to give ",(0,t.jsx)(n.code,{children:"kms:CreateGrant"})," permissions to the role being assumed ",(0,t.jsx)(n.strong,{children:"in the target account EC2s are being acquired from"}),". See the ",(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"/cado-response/deploy/aws/iam/cross-account-creation",children:"Cross Account Acquisition"})})," instructions for more details on cross account permissions."]}),"\n",(0,t.jsxs)(n.p,{children:["Alternatively the permissions in Custom Keys section are still valid, however both the primary and secondary account roles need to be accessible principals to ",(0,t.jsx)(n.code,{children:'"kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", kms:GenerateDataKey*"'}),"."]}),"\n",(0,t.jsx)(n.h3,{id:"cross-account-using-aws-default-keys",children:"Cross Account using AWS default keys"}),"\n",(0,t.jsxs)(n.admonition,{type:"warning",children:[(0,t.jsxs)(n.p,{children:["When importing a Default KMS encrypted EC2 for the first time, it is recommended that you include the following permission for ",(0,t.jsx)(n.code,{children:'"iam:CreateServiceLinkedRole"'})," in the myCadoResponseRole in the ",(0,t.jsx)(n.strong,{children:"account where the Cado platform has been deployed"}),". Failure to do so may result in IAM errors until the permission has been added. Once added, and a default encrypted EC2 import has suceeded, the permission can be removed. While this permission is present in the supplied Terraform and CloudFormation templates, it is reproduced here for your convenience."]}),(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n\t"Sid": "RequiredForFirstTimeKMSDefaultencryptedImportCanBeDeletedAfter",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"iam:CreateServiceLinkedRole"\n\t],\n\t"Resource": "arn:aws:iam::*:role/aws-service-role/kms.amazonaws.com/*CadoResponse*",\n\t"Condition": {\n\t\t"StringLike": {\n\t\t\t"iam:AWSServiceName": "kms.amazonaws.com"\n\t\t}\n\t}\n}\n'})})]}),"\n",(0,t.jsxs)(n.p,{children:["To import EC2s across accounts that are encrypted with AWS default keys, you will require the following permissions in the ",(0,t.jsx)(n.code,{children:"myCadoResponseRole"})," in the ",(0,t.jsx)(n.strong,{children:"account where the Cado Response platform has been deployed"}),". You will not need to alter your cross-account role. These permissions are also located in the supplied terraform and cloudformation configurations."]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n\t"Sid": "RequiredForKmsEncryptedEc2Import",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"kms:Encrypt",\n\t\t"kms:Decrypt",\n\t\t"kms:ReEncrypt*",\n\t\t"kms:GenerateDataKey*",\n\t\t"kms:CreateGrant"\n\t],\n\t"Resource": "*"\n},\n{\n\t"Sid": "RequiredForCrossAccountDefaultKmsEncryptedEc2Import",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"kms:CreateKey",\n\t\t"kms:CreateAlias",\n\t\t"kms:DescribeKey",\n\t\t"kms:ListAliases"\n\t],\n\t"Resource": "*"\n},\n{\n\t"Sid": "RequiredForOperationsOnTemporaryKMSResourcesduringDefaultEncryptedEc2Import",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"kms:DeleteAlias",\n\t\t"kms:ReplicateKey",\n\t\t"kms:ScheduleKeyDeletion"\n\t],\n\t"Resource": "*",\n\t"Condition": {\n\t\t "ForAllValues:StringLike": {\n\t\t "kms:ResourceAliases": [\n\t\t "alias/CadoResponse-KMS-Alias*"\n\t\t ]\n\t\t },\n\t\t "ForAnyValue:StringLike": {\n\t\t "kms:ResourceAliases": [\n\t\t "alias/CadoResponse-KMS-Alias*"\n\t\t ]\n\t\t }\n\t}\n}\n'})}),"\n",(0,t.jsx)(n.h3,{id:"resolving-issues-with-kms-support",children:"Resolving Issues with KMS Support"}),"\n",(0,t.jsx)(n.p,{children:"Getting the right KMS policies can prove difficult, particularly for cross-account Default KMS acquisitions and custom configurations."}),"\n",(0,t.jsx)(n.h4,{id:"using-cado-host-to-bypass-kms",children:"Using Cado Host to bypass KMS"}),"\n",(0,t.jsx)(n.p,{children:"If you are unable to obtain a full disk capture, you can bypass KMS by acquiring a system using Cado Host:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:'If the system has SSM enabled, select "Use Alternate Triage Acquisition" when acquiring the system'}),"\n",(0,t.jsx)(n.li,{children:"Conect to the system via SSH or RDP, and perform a collection of Forensic Artifacts by going to Import > Forensic Artifacts"}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"bypassing-kms-by-creating-an-unencrypted-volume",children:"Bypassing KMS by creating an Unencrypted Volume"}),"\n",(0,t.jsxs)(n.p,{children:["You can remove KMS from a volume by following the steps at ",(0,t.jsx)(n.a,{href:"https://aws.amazon.com/premiumsupport/knowledge-center/create-unencrypted-volume-kms-key/",children:"https://aws.amazon.com/premiumsupport/knowledge-center/create-unencrypted-volume-kms-key/"})]}),"\n",(0,t.jsx)(n.h4,{id:"debugging-iam-permissions-for-kms",children:"Debugging IAM Permissions for KMS"}),"\n",(0,t.jsxs)(n.p,{children:["Simple issues can be identified by the automated healthchecks present in Cado Response. Alternatively (Or when more granular output is required), you can debug any IAM permissions using the AWS Policy Simulator at ",(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html",children:"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"}),"."]})]})}function p(e={}){const{wrapper:n}={...(0,o.a)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},1151:(e,n,s)=>{s.d(n,{Z:()=>a,a:()=>r});var t=s(7294);const o={},i=t.createContext(o);function r(e){const n=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),t.createElement(i.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c4f709c5.5cc66311.js b/assets/js/c4f709c5.5cc66311.js new file mode 100644 index 000000000..7157741fa --- /dev/null +++ b/assets/js/c4f709c5.5cc66311.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[2159],{5029:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>c,contentTitle:()=>r,default:()=>p,frontMatter:()=>i,metadata:()=>a,toc:()=>l});var t=s(5893),o=s(1151);const i={title:"KMS Support",hide_title:!0,sidebar_position:2},r="AWS KMS Support",a={id:"cado-response/deploy/aws/data-encryption/aws-kms",title:"KMS Support",description:"The Cado platform will import EC2 instances with encrypted volumes, provided that the appropriate permissions are given to the CadoResponseRole.",source:"@site/docs/cado-response/deploy/aws/data-encryption/aws-kms.md",sourceDirName:"cado-response/deploy/aws/data-encryption",slug:"/cado-response/deploy/aws/data-encryption/aws-kms",permalink:"/cado-response/deploy/aws/data-encryption/aws-kms",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/data-encryption/aws-kms.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"KMS Support",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Overview",permalink:"/cado-response/deploy/aws/data-encryption/data-encryption-overview"},next:{title:"Logging",permalink:"/cado-response/deploy/aws/logging"}},c={},l=[{value:"Custom Keys",id:"custom-keys",level:3},{value:"Cross Region",id:"cross-region",level:3},{value:"Cross Account using Customer Managed Keys",id:"cross-account-using-customer-managed-keys",level:3},{value:"Cross Account using AWS default keys",id:"cross-account-using-aws-default-keys",level:3},{value:"Resolving Issues with KMS Support",id:"resolving-issues-with-kms-support",level:3},{value:"Using Cado Host to bypass KMS",id:"using-cado-host-to-bypass-kms",level:4},{value:"Bypassing KMS by creating an Unencrypted Volume",id:"bypassing-kms-by-creating-an-unencrypted-volume",level:4},{value:"Debugging IAM Permissions for KMS",id:"debugging-iam-permissions-for-kms",level:4}];function d(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",h4:"h4",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,o.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"aws-kms-support",children:"AWS KMS Support"}),"\n",(0,t.jsx)(n.p,{children:"The Cado platform will import EC2 instances with encrypted volumes, provided that the appropriate permissions are given to the CadoResponseRole."}),"\n",(0,t.jsxs)(n.p,{children:["AWS provides default keys in your account. These provide default access with the statement below, and this default is supported by the platform out of the box. For more information on KMS, you can visit the ",(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"https://aws.amazon.com/kms/",children:"AWS Key Management Service (KMS)"})})," page."]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "Sid": "Allow access through EBS for all principals in the account that are authorized to use EBS",\n "Effect": "Allow",\n "Principal": {\n "AWS": "*"\n },\n "Action": [\n "kms:Encrypt",\n "kms:Decrypt",\n "kms:ReEncrypt*",\n "kms:GenerateDataKey*",\n "kms:CreateGrant",\n "kms:DescribeKey"\n ],\n "Resource": "*",\n "Condition": {\n "StringEquals": {\n "kms:ViaService": "ec2.eu-west-3.amazonaws.com",\n "kms:CallerAccount": "012345678910"\n }\n }\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["As the Sid suggests: all ",(0,t.jsx)(n.code,{children:"Principals"})," (users/roles etc) in the account and region specified in ",(0,t.jsx)(n.code,{children:"Condition"})," have permission to perform the given actions."]}),"\n",(0,t.jsx)(n.h3,{id:"custom-keys",children:"Custom Keys"}),"\n",(0,t.jsx)(n.p,{children:"When using custom keys the required actions to CadoResponseRole are:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'"kms:Encrypt",\n"kms:Decrypt",\n"kms:ReEncrypt*",\n"kms:GenerateDataKey*",\n"kms:CreateGrant"\n'})}),"\n",(0,t.jsxs)(n.p,{children:["There are a number of options available - but the recommended approach is adding required permisisons to ",(0,t.jsx)(n.code,{children:"myCadoResponseRole"})," directly and witholding ",(0,t.jsx)(n.code,{children:'"CreateGrant"'})," for resources only:"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["You may not wish to give kms",":CreateGrant"," permission to CadoResponseRole itself"]}),"\n",(0,t.jsx)(n.li,{children:"Your policy must feature a statement which provides access to CadoResponseRole with the above permissions (except CreateGrant)"}),"\n",(0,t.jsx)(n.li,{children:"You may then tighten the policy to only allow CreateGrant permission to AWS resources"}),"\n"]}),"\n",(0,t.jsxs)(n.p,{children:["An sample policy is shown below (be sure to adjust ",(0,t.jsx)(n.code,{children:"Principal"})," and add ",(0,t.jsx)(n.code,{children:"Condition"})," according to your needs):"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'[\n {\n "Sid": "Allow required KMS permissions",\n "Effect": "Allow",\n "Principal": {\n "AWS": "arn:aws:iam::012345678910:role/myCadoResponseRole"\n },\n "Action": [\n "kms:Encrypt",\n "kms:Decrypt",\n "kms:ReEncrypt*",\n "kms:GenerateDataKey*"\n ],\n "Resource": "*"\n },\n {\n "Sid": "Allow attachment of persistent resources",\n "Effect": "Allow",\n "Principal": {\n "AWS": "arn:aws:iam::012345678910:role/myCadoResponseRole"\n },\n "Action": [\n "kms:CreateGrant"\n ],\n "Resource": "*",\n "Condition": {\n "Bool": {\n "kms:GrantIsForAWSResource": true\n }\n }\n }\n]\n'})}),"\n",(0,t.jsx)(n.h3,{id:"cross-region",children:"Cross Region"}),"\n",(0,t.jsxs)(n.p,{children:["It is important to ensure that if you are acquiring cross region that your relevant policy statements still apply to the region of your Cado platform (e.g. that policy ",(0,t.jsx)(n.code,{children:"Conditions"})," don't preclude the platform's access)."]}),"\n",(0,t.jsx)(n.h3,{id:"cross-account-using-customer-managed-keys",children:"Cross Account using Customer Managed Keys"}),"\n",(0,t.jsx)(n.admonition,{type:"info",children:(0,t.jsx)(n.p,{children:"During both of the following, be sure to reference the specific KMS key your EC2 is encrypted with to ensure minimal scoping."})}),"\n",(0,t.jsxs)(n.p,{children:["The simplest approach is to give ",(0,t.jsx)(n.code,{children:"kms:CreateGrant"})," permissions to the role being assumed ",(0,t.jsx)(n.strong,{children:"in the target account EC2s are being acquired from"}),". See the ",(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"/cado-response/deploy/aws/iam/cross-account-creation",children:"Cross Account Acquisition"})})," instructions for more details on cross account permissions."]}),"\n",(0,t.jsxs)(n.p,{children:["Alternatively the permissions in Custom Keys section are still valid, however both the primary and secondary account roles need to be accessible principals to ",(0,t.jsx)(n.code,{children:'"kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", kms:GenerateDataKey*"'}),"."]}),"\n",(0,t.jsx)(n.h3,{id:"cross-account-using-aws-default-keys",children:"Cross Account using AWS default keys"}),"\n",(0,t.jsxs)(n.admonition,{type:"warning",children:[(0,t.jsxs)(n.p,{children:["When importing a Default KMS encrypted EC2 for the first time, it is recommended that you include the following permission for ",(0,t.jsx)(n.code,{children:'"iam:CreateServiceLinkedRole"'})," in the myCadoResponseRole in the ",(0,t.jsx)(n.strong,{children:"account where the Cado platform has been deployed"}),". Failure to do so may result in IAM errors until the permission has been added. Once added, and a default encrypted EC2 import has suceeded, the permission can be removed. While this permission is present in the supplied Terraform and CloudFormation templates, it is reproduced here for your convenience."]}),(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n\t"Sid": "RequiredForFirstTimeKMSDefaultencryptedImportCanBeDeletedAfter",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"iam:CreateServiceLinkedRole"\n\t],\n\t"Resource": "arn:aws:iam::*:role/aws-service-role/kms.amazonaws.com/*CadoResponse*",\n\t"Condition": {\n\t\t"StringLike": {\n\t\t\t"iam:AWSServiceName": "kms.amazonaws.com"\n\t\t}\n\t}\n}\n'})})]}),"\n",(0,t.jsxs)(n.p,{children:["To import EC2s across accounts that are encrypted with AWS default keys, you will require the following permissions in the ",(0,t.jsx)(n.code,{children:"myCadoResponseRole"})," in the ",(0,t.jsx)(n.strong,{children:"account where the Cado Response platform has been deployed"}),". You will not need to alter your cross-account role. These permissions are also located in the supplied terraform and cloudformation configurations."]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n\t"Sid": "RequiredForKmsEncryptedEc2Import",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"kms:Encrypt",\n\t\t"kms:Decrypt",\n\t\t"kms:ReEncrypt*",\n\t\t"kms:GenerateDataKey*",\n\t\t"kms:CreateGrant"\n\t],\n\t"Resource": "*"\n},\n{\n\t"Sid": "RequiredForCrossAccountDefaultKmsEncryptedEc2Import",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"kms:CreateKey",\n\t\t"kms:CreateAlias",\n\t\t"kms:DescribeKey",\n\t\t"kms:ListAliases"\n\t],\n\t"Resource": "*"\n},\n{\n\t"Sid": "RequiredForOperationsOnTemporaryKMSResourcesduringDefaultEncryptedEc2Import",\n\t"Effect": "Allow",\n\t"Action": [\n\t\t"kms:DeleteAlias",\n\t\t"kms:ReplicateKey",\n\t\t"kms:ScheduleKeyDeletion"\n\t],\n\t"Resource": "*",\n\t"Condition": {\n\t\t "ForAllValues:StringLike": {\n\t\t "kms:ResourceAliases": [\n\t\t "alias/CadoResponse-KMS-Alias*"\n\t\t ]\n\t\t },\n\t\t "ForAnyValue:StringLike": {\n\t\t "kms:ResourceAliases": [\n\t\t "alias/CadoResponse-KMS-Alias*"\n\t\t ]\n\t\t }\n\t}\n}\n'})}),"\n",(0,t.jsx)(n.h3,{id:"resolving-issues-with-kms-support",children:"Resolving Issues with KMS Support"}),"\n",(0,t.jsx)(n.p,{children:"Getting the right KMS policies can prove difficult, particularly for cross-account Default KMS acquisitions and custom configurations."}),"\n",(0,t.jsx)(n.h4,{id:"using-cado-host-to-bypass-kms",children:"Using Cado Host to bypass KMS"}),"\n",(0,t.jsx)(n.p,{children:"If you are unable to obtain a full disk capture, you can bypass KMS by acquiring a system using Cado Host:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:'If the system has SSM enabled, select "Use Alternate Triage Acquisition" when acquiring the system'}),"\n",(0,t.jsx)(n.li,{children:"Conect to the system via SSH or RDP, and perform a collection of Forensic Artifacts by going to Import > Forensic Artifacts"}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"bypassing-kms-by-creating-an-unencrypted-volume",children:"Bypassing KMS by creating an Unencrypted Volume"}),"\n",(0,t.jsxs)(n.p,{children:["You can remove KMS from a volume by following the steps at ",(0,t.jsx)(n.a,{href:"https://aws.amazon.com/premiumsupport/knowledge-center/create-unencrypted-volume-kms-key/",children:"https://aws.amazon.com/premiumsupport/knowledge-center/create-unencrypted-volume-kms-key/"})]}),"\n",(0,t.jsx)(n.h4,{id:"debugging-iam-permissions-for-kms",children:"Debugging IAM Permissions for KMS"}),"\n",(0,t.jsxs)(n.p,{children:["Simple issues can be identified by the automated healthchecks present in Cado Response. Alternatively (Or when more granular output is required), you can debug any IAM permissions using the AWS Policy Simulator at ",(0,t.jsx)(n.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html",children:"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html"}),"."]})]})}function p(e={}){const{wrapper:n}={...(0,o.a)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},1151:(e,n,s)=>{s.d(n,{Z:()=>a,a:()=>r});var t=s(7294);const o={},i=t.createContext(o);function r(e){const n=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),t.createElement(i.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c548a2f3.5af60267.js b/assets/js/c548a2f3.5af60267.js new file mode 100644 index 000000000..080e528c1 --- /dev/null +++ b/assets/js/c548a2f3.5af60267.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5025],{9610:(e,i,s)=>{s.r(i),s.d(i,{assets:()=>a,contentTitle:()=>l,default:()=>h,frontMatter:()=>t,metadata:()=>r,toc:()=>d});var n=s(5893),o=s(1151);const t={title:"Log Types",hide_title:!0,sidebar_position:1},l="Log Types",r={id:"cado-response/discovery-import/import/data-types/logs",title:"Log Types",description:"Cado Response supports the processing of a wide range of evidence types. These may differ slightly based on your cloud platform.",source:"@site/docs/cado-response/discovery-import/import/data-types/logs.md",sourceDirName:"cado-response/discovery-import/import/data-types",slug:"/cado-response/discovery-import/import/data-types/logs",permalink:"/cado-response/discovery-import/import/data-types/logs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/data-types/logs.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Log Types",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"File Types",permalink:"/cado-response/discovery-import/import/data-types/filetypes"},next:{title:"Memory Analysis",permalink:"/cado-response/discovery-import/import/data-types/memory"}},a={},d=[{value:"AWS Log Formats",id:"aws-log-formats",level:3},{value:"Azure Log Formats",id:"azure-log-formats",level:3},{value:"System Log Formats",id:"system-log-formats",level:3}];function c(e){const i={a:"a",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",p:"p",pre:"pre",ul:"ul",...(0,o.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(i.h1,{id:"log-types",children:"Log Types"}),"\n",(0,n.jsx)(i.p,{children:"Cado Response supports the processing of a wide range of evidence types. These may differ slightly based on your cloud platform."}),"\n",(0,n.jsx)(i.h3,{id:"aws-log-formats",children:"AWS Log Formats"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:"Cloud Trail logs"}),"\n",(0,n.jsx)(i.li,{children:"Guard Duty logs"}),"\n",(0,n.jsx)(i.li,{children:"Kubernetes logs"}),"\n",(0,n.jsx)(i.li,{children:"VPC Flow logs"}),"\n",(0,n.jsx)(i.li,{children:"SSM logs"}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"azure-log-formats",children:"Azure Log Formats"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:"Activity logs"}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"system-log-formats",children:"System Log Formats"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:"AppleSystemLog (ASL)"}),"\n",(0,n.jsx)(i.li,{children:"Androidusage-history (appusage)"}),"\n",(0,n.jsx)(i.li,{children:"BasicSecurityModule (BSM)"}),"\n",(0,n.jsx)(i.li,{children:"Bencodefiles"}),"\n",(0,n.jsx)(i.li,{children:"Chrome Disk Cache Format"}),"\n",(0,n.jsx)(i.li,{children:"Chrome preferences"}),"\n",(0,n.jsx)(i.li,{children:"CUPS IPP"}),"\n",(0,n.jsx)(i.li,{children:"ExtensibleStorageEngine (ESE) DatabaseFile (EDB)"}),"\n",(0,n.jsx)(i.li,{children:"Firefox Cache"}),"\n",(0,n.jsx)(i.li,{children:"JavaWeb Start IDX"}),"\n",(0,n.jsx)(i.li,{children:"JumpLists.customDestinations-msfiles"}),"\n",(0,n.jsx)(i.li,{children:"MacOS Application firewall"}),"\n",(0,n.jsx)(i.li,{children:"MacOS Keychain"}),"\n",(0,n.jsx)(i.li,{children:"MacOS Securityd"}),"\n",(0,n.jsx)(i.li,{children:"MacOS Wifi"}),"\n",(0,n.jsx)(i.li,{children:"mactimelogs"}),"\n",(0,n.jsx)(i.li,{children:"McAfee Anti-Virus Logs"}),"\n",(0,n.jsx)(i.li,{children:"Microsoft InternetExplorer History File Format (also known as MSIE4-9 Cache Files or index.dat)"}),"\n",(0,n.jsx)(i.li,{children:"Microsoft IIS log files"}),"\n",(0,n.jsx)(i.li,{children:"NTFS $MFT and $UsnJrnl:$J"}),"\n",(0,n.jsx)(i.li,{children:"OLE Compound File"}),"\n",(0,n.jsx)(i.li,{children:"Opera Browser history"}),"\n",(0,n.jsx)(i.li,{children:"OpenXML"}),"\n",(0,n.jsx)(i.li,{children:"Pcap files"}),"\n",(0,n.jsx)(i.li,{children:"Portable Executable (PE)"}),"\n",(0,n.jsx)(i.li,{children:"PLSQL cache file (PL-SQL developer recall files)"}),"\n",(0,n.jsx)(i.li,{children:"Popularity Contest log"}),"\n",(0,n.jsx)(i.li,{children:"Propertylist (plist)"}),"\n",(0,n.jsx)(i.li,{children:"RestorePointlogs (rp.log)"}),"\n",(0,n.jsx)(i.li,{children:"Safari Binary Cookies"}),"\n",(0,n.jsx)(i.li,{children:"SCCM client logs"}),"\n",(0,n.jsx)(i.li,{children:"SELinux audit logs"}),"\n",(0,n.jsx)(i.li,{children:"SkyDrive log and error log files"}),"\n",(0,n.jsx)(i.li,{children:"SQLite database format using SQLite"}),"\n",(0,n.jsx)(i.li,{children:"Symantec AV Corporate Edition and Endpoint Protection log"}),"\n",(0,n.jsx)(i.li,{children:"Syslog"}),"\n",(0,n.jsx)(i.li,{children:"utmp,utmpx"}),"\n",(0,n.jsx)(i.li,{children:"Windows EventLog (EVT)"}),"\n",(0,n.jsx)(i.li,{children:"Windows Firewall"}),"\n",(0,n.jsx)(i.li,{children:'Windows Job files (also known as "atjobs")'}),"\n",(0,n.jsx)(i.li,{children:"Windows Prefetch files"}),"\n",(0,n.jsx)(i.li,{children:"Windows Recyclebin (INFO2and$I/$R)"}),"\n",(0,n.jsx)(i.li,{children:"Windows NTRegistry File"}),"\n",(0,n.jsx)(i.li,{children:"Windows ShortcutFile (LNK)"}),"\n",(0,n.jsx)(i.li,{children:"WindowsXML EventLog (EVTX)"}),"\n",(0,n.jsx)(i.li,{children:"Xchat and Xchat scroll back files"}),"\n",(0,n.jsx)(i.li,{children:"Zsh history files"}),"\n"]}),"\n",(0,n.jsxs)(i.p,{children:["Cado can also import a number of other log formats that are not listed here; however, these evidence types and file formats are not officially supported. If you have a log format that you would like to see supported, please reach out to ",(0,n.jsx)(i.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," and let us know."]}),"\n",(0,n.jsx)(i.h1,{id:"adding-your-own-events",children:"Adding Your Own Events"}),"\n",(0,n.jsx)(i.p,{children:"During an investigation, you may want to add our own non-computer generated events to the timeline.\nFor example, it is common to keep a Spreadsheet of key events in a large incident.\nThe simplest way to add these events into a Project timeline is to import an ISO Format Log event of the format:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsxs)(i.li,{children:["YYYY-MM-DD HH:MM",":SS"," Log Event Message"]}),"\n"]}),"\n",(0,n.jsx)(i.p,{children:'For example you can save the following text into a file named "custom_events.log" then import into the platform:'}),"\n",(0,n.jsx)(i.pre,{children:(0,n.jsx)(i.code,{children:"2021-01-01 01:01:01 User phoned help desk and reported ransomware\n2021-01-01 01:01:02 Three more phone calls to help desk\n"})}),"\n",(0,n.jsx)(i.p,{children:"Which will result in events such as the following:"}),"\n",(0,n.jsx)(i.p,{children:(0,n.jsx)(i.img,{alt:"Custom logs imported into Cado",src:s(2319).Z+"",width:"433",height:"255"})})]})}function h(e={}){const{wrapper:i}={...(0,o.a)(),...e.components};return i?(0,n.jsx)(i,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},2319:(e,i,s)=>{s.d(i,{Z:()=>n});const n=s.p+"assets/images/custom_log-c23723dfac762109a84bbbdd4a04d760.png"},1151:(e,i,s)=>{s.d(i,{Z:()=>r,a:()=>l});var n=s(7294);const o={},t=n.createContext(o);function l(e){const i=n.useContext(t);return n.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function r(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:l(e.components),n.createElement(t.Provider,{value:i},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c548a2f3.85cd7849.js b/assets/js/c548a2f3.85cd7849.js deleted file mode 100644 index 59db488f4..000000000 --- a/assets/js/c548a2f3.85cd7849.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5025],{9610:(e,i,s)=>{s.r(i),s.d(i,{assets:()=>a,contentTitle:()=>l,default:()=>h,frontMatter:()=>t,metadata:()=>r,toc:()=>d});var n=s(5893),o=s(1151);const t={title:"Log Types",hide_title:!0,sidebar_position:1},l="Log Types",r={id:"cado-response/discovery-import/import/data-types/logs",title:"Log Types",description:"Cado Response supports the processing of a wide range of evidence types. These may differ slightly based on your cloud platform.",source:"@site/docs/cado-response/discovery-import/import/data-types/logs.md",sourceDirName:"cado-response/discovery-import/import/data-types",slug:"/cado-response/discovery-import/import/data-types/logs",permalink:"/cado-response/discovery-import/import/data-types/logs",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/data-types/logs.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Log Types",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"File Types",permalink:"/cado-response/discovery-import/import/data-types/filetypes"},next:{title:"Memory Analysis",permalink:"/cado-response/discovery-import/import/data-types/memory"}},a={},d=[{value:"AWS Log Formats",id:"aws-log-formats",level:3},{value:"Azure Log Formats",id:"azure-log-formats",level:3},{value:"System Log Formats",id:"system-log-formats",level:3}];function c(e){const i={a:"a",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",p:"p",pre:"pre",ul:"ul",...(0,o.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(i.h1,{id:"log-types",children:"Log Types"}),"\n",(0,n.jsx)(i.p,{children:"Cado Response supports the processing of a wide range of evidence types. These may differ slightly based on your cloud platform."}),"\n",(0,n.jsx)(i.h3,{id:"aws-log-formats",children:"AWS Log Formats"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:"Cloud Trail logs"}),"\n",(0,n.jsx)(i.li,{children:"Guard Duty logs"}),"\n",(0,n.jsx)(i.li,{children:"Kubernetes logs"}),"\n",(0,n.jsx)(i.li,{children:"VPC Flow logs"}),"\n",(0,n.jsx)(i.li,{children:"SSM logs"}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"azure-log-formats",children:"Azure Log Formats"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:"Activity logs"}),"\n"]}),"\n",(0,n.jsx)(i.h3,{id:"system-log-formats",children:"System Log Formats"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsx)(i.li,{children:"AppleSystemLog (ASL)"}),"\n",(0,n.jsx)(i.li,{children:"Androidusage-history (appusage)"}),"\n",(0,n.jsx)(i.li,{children:"BasicSecurityModule (BSM)"}),"\n",(0,n.jsx)(i.li,{children:"Bencodefiles"}),"\n",(0,n.jsx)(i.li,{children:"Chrome Disk Cache Format"}),"\n",(0,n.jsx)(i.li,{children:"Chrome preferences"}),"\n",(0,n.jsx)(i.li,{children:"CUPS IPP"}),"\n",(0,n.jsx)(i.li,{children:"ExtensibleStorageEngine (ESE) DatabaseFile (EDB)"}),"\n",(0,n.jsx)(i.li,{children:"Firefox Cache"}),"\n",(0,n.jsx)(i.li,{children:"JavaWeb Start IDX"}),"\n",(0,n.jsx)(i.li,{children:"JumpLists.customDestinations-msfiles"}),"\n",(0,n.jsx)(i.li,{children:"MacOS Application firewall"}),"\n",(0,n.jsx)(i.li,{children:"MacOS Keychain"}),"\n",(0,n.jsx)(i.li,{children:"MacOS Securityd"}),"\n",(0,n.jsx)(i.li,{children:"MacOS Wifi"}),"\n",(0,n.jsx)(i.li,{children:"mactimelogs"}),"\n",(0,n.jsx)(i.li,{children:"McAfee Anti-Virus Logs"}),"\n",(0,n.jsx)(i.li,{children:"Microsoft InternetExplorer History File Format (also known as MSIE4-9 Cache Files or index.dat)"}),"\n",(0,n.jsx)(i.li,{children:"Microsoft IIS log files"}),"\n",(0,n.jsx)(i.li,{children:"NTFS $MFT and $UsnJrnl:$J"}),"\n",(0,n.jsx)(i.li,{children:"OLE Compound File"}),"\n",(0,n.jsx)(i.li,{children:"Opera Browser history"}),"\n",(0,n.jsx)(i.li,{children:"OpenXML"}),"\n",(0,n.jsx)(i.li,{children:"Pcap files"}),"\n",(0,n.jsx)(i.li,{children:"Portable Executable (PE)"}),"\n",(0,n.jsx)(i.li,{children:"PLSQL cache file (PL-SQL developer recall files)"}),"\n",(0,n.jsx)(i.li,{children:"Popularity Contest log"}),"\n",(0,n.jsx)(i.li,{children:"Propertylist (plist)"}),"\n",(0,n.jsx)(i.li,{children:"RestorePointlogs (rp.log)"}),"\n",(0,n.jsx)(i.li,{children:"Safari Binary Cookies"}),"\n",(0,n.jsx)(i.li,{children:"SCCM client logs"}),"\n",(0,n.jsx)(i.li,{children:"SELinux audit logs"}),"\n",(0,n.jsx)(i.li,{children:"SkyDrive log and error log files"}),"\n",(0,n.jsx)(i.li,{children:"SQLite database format using SQLite"}),"\n",(0,n.jsx)(i.li,{children:"Symantec AV Corporate Edition and Endpoint Protection log"}),"\n",(0,n.jsx)(i.li,{children:"Syslog"}),"\n",(0,n.jsx)(i.li,{children:"utmp,utmpx"}),"\n",(0,n.jsx)(i.li,{children:"Windows EventLog (EVT)"}),"\n",(0,n.jsx)(i.li,{children:"Windows Firewall"}),"\n",(0,n.jsx)(i.li,{children:'Windows Job files (also known as "atjobs")'}),"\n",(0,n.jsx)(i.li,{children:"Windows Prefetch files"}),"\n",(0,n.jsx)(i.li,{children:"Windows Recyclebin (INFO2and$I/$R)"}),"\n",(0,n.jsx)(i.li,{children:"Windows NTRegistry File"}),"\n",(0,n.jsx)(i.li,{children:"Windows ShortcutFile (LNK)"}),"\n",(0,n.jsx)(i.li,{children:"WindowsXML EventLog (EVTX)"}),"\n",(0,n.jsx)(i.li,{children:"Xchat and Xchat scroll back files"}),"\n",(0,n.jsx)(i.li,{children:"Zsh history files"}),"\n"]}),"\n",(0,n.jsxs)(i.p,{children:["Cado can also import a number of other log formats that are not listed here; however, these evidence types and file formats are not officially supported. If you have a log format that you would like to see supported, please reach out to ",(0,n.jsx)(i.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," and let us know."]}),"\n",(0,n.jsx)(i.h1,{id:"adding-your-own-events",children:"Adding Your Own Events"}),"\n",(0,n.jsx)(i.p,{children:"During an investigation, you may want to add our own non-computer generated events to the timeline.\nFor example, it is common to keep a Spreadsheet of key events in a large incident.\nThe simplest way to add these events into a Project timeline is to import an ISO Format Log event of the format:"}),"\n",(0,n.jsxs)(i.ul,{children:["\n",(0,n.jsxs)(i.li,{children:["YYYY-MM-DD HH:MM",":SS"," Log Event Message"]}),"\n"]}),"\n",(0,n.jsx)(i.p,{children:'For example you can save the following text into a file named "custom_events.log" then import into the platform:'}),"\n",(0,n.jsx)(i.pre,{children:(0,n.jsx)(i.code,{children:"2021-01-01 01:01:01 User phoned help desk and reported ransomware\n2021-01-01 01:01:02 Three more phone calls to help desk\n"})}),"\n",(0,n.jsx)(i.p,{children:"Which will result in events such as the following:"}),"\n",(0,n.jsx)(i.p,{children:(0,n.jsx)(i.img,{alt:"Custom logs imported into Cado",src:s(2319).Z+"",width:"433",height:"255"})})]})}function h(e={}){const{wrapper:i}={...(0,o.a)(),...e.components};return i?(0,n.jsx)(i,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},2319:(e,i,s)=>{s.d(i,{Z:()=>n});const n=s.p+"assets/images/custom_log-c23723dfac762109a84bbbdd4a04d760.png"},1151:(e,i,s)=>{s.d(i,{Z:()=>r,a:()=>l});var n=s(7294);const o={},t=n.createContext(o);function l(e){const i=n.useContext(t);return n.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function r(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:l(e.components),n.createElement(t.Provider,{value:i},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c7e95ada.14393e00.js b/assets/js/c7e95ada.14393e00.js deleted file mode 100644 index 09add6cae..000000000 --- a/assets/js/c7e95ada.14393e00.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4942],{7250:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>l});var i=n(5893),s=n(1151);const o={title:"Automation Rules (Beta)",hide_title:!0,sidebar_position:3},a="Configuring Automation Rules",r={id:"cado-response/discovery-import/automation",title:"Automation Rules (Beta)",description:"This feature is currently in beta - to enable this feature go to Settings > Experiments",source:"@site/docs/cado-response/discovery-import/automation.md",sourceDirName:"cado-response/discovery-import",slug:"/cado-response/discovery-import/automation",permalink:"/cado-response/discovery-import/automation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/automation.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:3,frontMatter:{title:"Automation Rules (Beta)",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Managing Projects",permalink:"/cado-response/discovery-import/projects"},next:{title:"Readiness (Beta)",permalink:"/cado-response/discovery-import/readiness"}},c={},l=[{value:"Creating a Scope",id:"creating-a-scope",level:2},{value:"Creating an Environment",id:"creating-an-environment",level:2},{value:"Creating a Rule",id:"creating-a-rule",level:2},{value:"Permissions Required",id:"permissions-required",level:3},{value:"Managing Rules",id:"managing-rules",level:2},{value:"Example Scenario",id:"example-scenario",level:2}];function d(e){const t={em:"em",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"configuring-automation-rules",children:"Configuring Automation Rules"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"This feature is currently in beta - to enable this feature go to Settings > Experiments"})}),"\n",(0,i.jsx)(t.p,{children:"The Cado platform allows you to define automation rules to better prepare for incidents in cloud environments. These automation rules allow you to define in advance"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"What data you want to collect"}),"\n",(0,i.jsx)(t.li,{children:"The alert triggers that will trigger a response"}),"\n",(0,i.jsx)(t.li,{children:"Against which cloud resources, and"}),"\n",(0,i.jsx)(t.li,{children:"What response actions you want to take"}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Automation in Cado is based upon three main concepts"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Scopes"})," - Scopes are sets of cloud resources within a single cloud provider (currently only AWS supported). These cloud resources may be defined by the region and/or account in which they reside, the service (e.g. EC2, S3), and any tags applied to those resources"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Environments"})," - Environments are sets of one or more scopes that you want to treat similarly - for example an application that spans multiple services across multiple cloud environments"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Rules"})," - Rules are sets of actions that will automatically take place in the event that an alert gets triggered"]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"to give an example of how the rules work lets take the following. A GuardDuty Alert has been raised with a severirty level of 5, the alert is for an EC2 that has been compromised, we then check the automation rules to determine if ther is a rule set up for GuardDuty alerts for EC2 in region & accouint the EC2 reside in. If a rule matches we then prform the investigation based on the Investigation type defined in the rule i.e full investigation. After the import is complete we can check the click the automated investigation tab to see if all malicous and suspispious activity in relation to the compromised EC2. You can then select the piece of evidence and view the cloud resource there a panel will open with the metadata and actions tab. the metadata tab is just metadata about the resource and the actions tab is the remediationactions that can be preformed on the compromised resource. To autmate the remediation actions you can enable this in the settings -> advanced which will do the above until the full investiagation is complete and will automatically invoke the actions defined in the automation rules for malicious or suspicious activity"}),"\n",(0,i.jsx)(t.h2,{id:"creating-a-scope",children:"Creating a Scope"}),"\n",(0,i.jsx)(t.p,{children:'To create a scope, navigate to the Scopes tab and hit "Create Scope" button. Enter the name of the scope, the regions, the accounts, the services covered and any tags that identify your services. If you specify multiple tags, resources tagged with any one of those tags will be included.'}),"\n",(0,i.jsx)(t.p,{children:"Hit 'Save' to create the scope"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Create Scope",src:n(9486).Z+"",width:"1061",height:"812"})}),"\n",(0,i.jsx)(t.h2,{id:"creating-an-environment",children:"Creating an Environment"}),"\n",(0,i.jsx)(t.p,{children:'To create an Environment, navigate to the Environments tab and hit "Create Environment" button. Enter the name of the environment, and choose the scopes to add to the environment from the bottom of the screen. Click "Add scope" and these will add to the list of selected scopes.'}),"\n",(0,i.jsx)(t.p,{children:"Hit 'Save' to create the environment"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Create Environments",src:n(1024).Z+"",width:"1632",height:"811"})}),"\n",(0,i.jsx)(t.h2,{id:"creating-a-rule",children:"Creating a Rule"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.em,{children:"NOTE: You can create rules without necessarily creating scopes or environments"})}),"\n",(0,i.jsx)(t.p,{children:'To create an rule, navigate to the Rules tab and hit "Create Rule" button.'}),"\n",(0,i.jsx)(t.p,{children:"Enter the name of the rule and a description. Specify"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:(0,i.jsx)(t.strong,{children:"Environments (optional)"})})," - the environments specifying the assets against which the rule will run. If this is left blank, this rule will trigger against any alert identifying an affected workloads","\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:"Monitoring Enabled"})," - if monitoring is checked then GuardDuty Monitoring will be enabled on all regions in the cloud accounts specified within a particular Environment(s), this will run every 5 minutes to check for new alerts that contain a minimum severity of 5"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:(0,i.jsx)(t.strong,{children:"Alert Type"})})," - the type of alert that will trigger the rule (e.g. GuardDuty)"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:(0,i.jsx)(t.strong,{children:"Asset Type"})})," - the type of cloud resource to which the rule will apply (e.g. EC2)"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:(0,i.jsx)(t.strong,{children:"Investigation Type"})})," - the type of invesigation to perform. This currently has three options","\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:"Default"})," - Performs triage collection from any workload specified in the alert"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:"Triage"})," - Performs triage collection from any workload specified in the alert"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:"Full"})," - Performs full disk collection from any workload specified in the alert"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:(0,i.jsx)(t.strong,{children:"Response Actions (optional)"})})," - the actions to take against machines upon which malicious activities have been detected, and machines upon which suspicous activities have been detected. Cado currently supports shutting down EC2 instances, isolating the IAM roles of that the EC2 instance assumes and isolate security group attached to the EC2."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Hit 'Save' to create the rule"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Create Rule",src:n(476).Z+"",width:"2170",height:"1614"})}),"\n",(0,i.jsx)(t.h3,{id:"permissions-required",children:"Permissions Required"}),"\n",(0,i.jsx)(t.p,{children:"Each action requires different permissions and is controlled using IAM roles. The table below details a description of each action and the permissions required. Add these permissions to your Cado role, and ensure it has scope to cover the resource you wish to invoke an action on."}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Action"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Required Permissions"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Stop Instance"}),(0,i.jsx)(t.td,{children:"Stops an EC2 instance using the AWS API"}),(0,i.jsxs)(t.td,{children:["ec2",":StopInstances"]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Isolate Role"}),(0,i.jsx)(t.td,{children:"Isolates the IAM role attached to an EC2 instance. Isolated by adding a deny all inline policy to the given IAM role."}),(0,i.jsxs)(t.td,{children:["iam",":GetInstanceProfile"," iam",":PutRolePolicy"]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Isolate Security Group"}),(0,i.jsx)(t.td,{children:"Isolates the security group attached to and EC2 instance. Isolated by creating a security group, blanking it and replacing it on the EC2."}),(0,i.jsxs)(t.td,{children:["ec2",":CreateSecurityGroup"," ec2",":RevokeSecurityGroupEgress"," ec2",":ModifyInstanceAttribute"]})]})]})]}),"\n",(0,i.jsx)(t.h2,{id:"managing-rules",children:"Managing Rules"}),"\n",(0,i.jsx)(t.p,{children:"You can configure multiple response rules. In the event that a resource is covered by multiple rules, the first rule in the list applies"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Manage Rules",src:n(7228).Z+"",width:"1667",height:"282"})}),"\n",(0,i.jsx)(t.h2,{id:"example-scenario",children:"Example Scenario"}),"\n",(0,i.jsx)(t.p,{children:"A GuardDuty Alert has been raised with a severity level of 5. The alert is for an EC2 that has been compromised. An investigation will be triggered, but before this, we check the Automation Rules defined - if there is a rule set up for GuardDuty alerts for EC2 in the Region & Account the compromised EC2 resides in.\nIf a rule matches, we then perform the investigation based on the Investigation type defined in the rule (i.e full investigation)."}),"\n",(0,i.jsx)(t.p,{children:"After the import is complete we can check the automated investigation tab to view all malicious and suspicious activity in relation to the compromised EC2.\nYou can then select the cloud resource and view the cloud resource. A panel will open with the metadata and actions tab. The metadata tab contains metadata about the resource and the Actions tab contains actions which can be performed on the compromised resource."}),"\n",(0,i.jsx)(t.p,{children:"To automate the remediation actions on the compromised resource, you can enable this under the Settings -> Advanced tab, this would avoid you having to manually invoke the actions via the cloud resource panel. This will automatically invoke the actions defined in the Automation Rule for malicious or suspicious activity after the investigation is complete."})]})}function h(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},1024:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/environments-72cb069d871104cc1b13d33bdfb68916.png"},7228:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/rules-list-079383494a28c8acafa4ad624d3e6231.png"},476:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/rules-7cbd5b97c7cefd78bd295d0cfec3194d.png"},9486:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/scopes-50355401cc62813c6ace8390e10b75bb.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>r,a:()=>a});var i=n(7294);const s={},o=i.createContext(s);function a(e){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),i.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/c7e95ada.c5f50b1b.js b/assets/js/c7e95ada.c5f50b1b.js new file mode 100644 index 000000000..d1bdfa256 --- /dev/null +++ b/assets/js/c7e95ada.c5f50b1b.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4942],{7250:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>l});var i=n(5893),s=n(1151);const o={title:"Automation Rules (Beta)",hide_title:!0,sidebar_position:3},a="Configuring Automation Rules",r={id:"cado-response/discovery-import/automation",title:"Automation Rules (Beta)",description:"This feature is currently in beta - to enable this feature go to Settings > Experiments",source:"@site/docs/cado-response/discovery-import/automation.md",sourceDirName:"cado-response/discovery-import",slug:"/cado-response/discovery-import/automation",permalink:"/cado-response/discovery-import/automation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/automation.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:3,frontMatter:{title:"Automation Rules (Beta)",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Managing Projects",permalink:"/cado-response/discovery-import/projects"},next:{title:"Readiness (Beta)",permalink:"/cado-response/discovery-import/readiness"}},c={},l=[{value:"Creating a Scope",id:"creating-a-scope",level:2},{value:"Creating an Environment",id:"creating-an-environment",level:2},{value:"Creating a Rule",id:"creating-a-rule",level:2},{value:"Permissions Required",id:"permissions-required",level:3},{value:"Managing Rules",id:"managing-rules",level:2},{value:"Example Scenario",id:"example-scenario",level:2}];function d(e){const t={em:"em",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"configuring-automation-rules",children:"Configuring Automation Rules"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.strong,{children:"This feature is currently in beta - to enable this feature go to Settings > Experiments"})}),"\n",(0,i.jsx)(t.p,{children:"The Cado platform allows you to define automation rules to better prepare for incidents in cloud environments. These automation rules allow you to define in advance"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsx)(t.li,{children:"What data you want to collect"}),"\n",(0,i.jsx)(t.li,{children:"The alert triggers that will trigger a response"}),"\n",(0,i.jsx)(t.li,{children:"Against which cloud resources, and"}),"\n",(0,i.jsx)(t.li,{children:"What response actions you want to take"}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Automation in Cado is based upon three main concepts"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Scopes"})," - Scopes are sets of cloud resources within a single cloud provider (currently only AWS supported). These cloud resources may be defined by the region and/or account in which they reside, the service (e.g. EC2, S3), and any tags applied to those resources"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Environments"})," - Environments are sets of one or more scopes that you want to treat similarly - for example an application that spans multiple services across multiple cloud environments"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.strong,{children:"Rules"})," - Rules are sets of actions that will automatically take place in the event that an alert gets triggered"]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"to give an example of how the rules work lets take the following. A GuardDuty Alert has been raised with a severirty level of 5, the alert is for an EC2 that has been compromised, we then check the automation rules to determine if ther is a rule set up for GuardDuty alerts for EC2 in region & accouint the EC2 reside in. If a rule matches we then prform the investigation based on the Investigation type defined in the rule i.e full investigation. After the import is complete we can check the click the automated investigation tab to see if all malicous and suspispious activity in relation to the compromised EC2. You can then select the piece of evidence and view the cloud resource there a panel will open with the metadata and actions tab. the metadata tab is just metadata about the resource and the actions tab is the remediationactions that can be preformed on the compromised resource. To autmate the remediation actions you can enable this in the settings -> advanced which will do the above until the full investiagation is complete and will automatically invoke the actions defined in the automation rules for malicious or suspicious activity"}),"\n",(0,i.jsx)(t.h2,{id:"creating-a-scope",children:"Creating a Scope"}),"\n",(0,i.jsx)(t.p,{children:'To create a scope, navigate to the Scopes tab and hit "Create Scope" button. Enter the name of the scope, the regions, the accounts, the services covered and any tags that identify your services. If you specify multiple tags, resources tagged with any one of those tags will be included.'}),"\n",(0,i.jsx)(t.p,{children:"Hit 'Save' to create the scope"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Create Scope",src:n(9486).Z+"",width:"1061",height:"812"})}),"\n",(0,i.jsx)(t.h2,{id:"creating-an-environment",children:"Creating an Environment"}),"\n",(0,i.jsx)(t.p,{children:'To create an Environment, navigate to the Environments tab and hit "Create Environment" button. Enter the name of the environment, and choose the scopes to add to the environment from the bottom of the screen. Click "Add scope" and these will add to the list of selected scopes.'}),"\n",(0,i.jsx)(t.p,{children:"Hit 'Save' to create the environment"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Create Environments",src:n(1024).Z+"",width:"1632",height:"811"})}),"\n",(0,i.jsx)(t.h2,{id:"creating-a-rule",children:"Creating a Rule"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.em,{children:"NOTE: You can create rules without necessarily creating scopes or environments"})}),"\n",(0,i.jsx)(t.p,{children:'To create an rule, navigate to the Rules tab and hit "Create Rule" button.'}),"\n",(0,i.jsx)(t.p,{children:"Enter the name of the rule and a description. Specify"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:(0,i.jsx)(t.strong,{children:"Environments (optional)"})})," - the environments specifying the assets against which the rule will run. If this is left blank, this rule will trigger against any alert identifying an affected workloads","\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:"Monitoring Enabled"})," - if monitoring is checked then GuardDuty Monitoring will be enabled on all regions in the cloud accounts specified within a particular Environment(s), this will run every 5 minutes to check for new alerts that contain a minimum severity of 5"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:(0,i.jsx)(t.strong,{children:"Alert Type"})})," - the type of alert that will trigger the rule (e.g. GuardDuty)"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:(0,i.jsx)(t.strong,{children:"Asset Type"})})," - the type of cloud resource to which the rule will apply (e.g. EC2)"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:(0,i.jsx)(t.strong,{children:"Investigation Type"})})," - the type of invesigation to perform. This currently has three options","\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:"Default"})," - Performs triage collection from any workload specified in the alert"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:"Triage"})," - Performs triage collection from any workload specified in the alert"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:"Full"})," - Performs full disk collection from any workload specified in the alert"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(t.li,{children:[(0,i.jsx)(t.em,{children:(0,i.jsx)(t.strong,{children:"Response Actions (optional)"})})," - the actions to take against machines upon which malicious activities have been detected, and machines upon which suspicous activities have been detected. Cado currently supports shutting down EC2 instances, isolating the IAM roles of that the EC2 instance assumes and isolate security group attached to the EC2."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:"Hit 'Save' to create the rule"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Create Rule",src:n(476).Z+"",width:"2170",height:"1614"})}),"\n",(0,i.jsx)(t.h3,{id:"permissions-required",children:"Permissions Required"}),"\n",(0,i.jsx)(t.p,{children:"Each action requires different permissions and is controlled using IAM roles. The table below details a description of each action and the permissions required. Add these permissions to your Cado role, and ensure it has scope to cover the resource you wish to invoke an action on."}),"\n",(0,i.jsxs)(t.table,{children:[(0,i.jsx)(t.thead,{children:(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.th,{children:"Action"}),(0,i.jsx)(t.th,{children:"Description"}),(0,i.jsx)(t.th,{children:"Required Permissions"})]})}),(0,i.jsxs)(t.tbody,{children:[(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Stop Instance"}),(0,i.jsx)(t.td,{children:"Stops an EC2 instance using the AWS API"}),(0,i.jsxs)(t.td,{children:["ec2",":StopInstances"]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Isolate Role"}),(0,i.jsx)(t.td,{children:"Isolates the IAM role attached to an EC2 instance. Isolated by adding a deny all inline policy to the given IAM role."}),(0,i.jsxs)(t.td,{children:["iam",":GetInstanceProfile"," iam",":PutRolePolicy"]})]}),(0,i.jsxs)(t.tr,{children:[(0,i.jsx)(t.td,{children:"Isolate Security Group"}),(0,i.jsx)(t.td,{children:"Isolates the security group attached to and EC2 instance. Isolated by creating a security group, blanking it and replacing it on the EC2."}),(0,i.jsxs)(t.td,{children:["ec2",":CreateSecurityGroup"," ec2",":RevokeSecurityGroupEgress"," ec2",":ModifyInstanceAttribute"]})]})]})]}),"\n",(0,i.jsx)(t.h2,{id:"managing-rules",children:"Managing Rules"}),"\n",(0,i.jsx)(t.p,{children:"You can configure multiple response rules. In the event that a resource is covered by multiple rules, the first rule in the list applies"}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Manage Rules",src:n(7228).Z+"",width:"1667",height:"282"})}),"\n",(0,i.jsx)(t.h2,{id:"example-scenario",children:"Example Scenario"}),"\n",(0,i.jsx)(t.p,{children:"A GuardDuty Alert has been raised with a severity level of 5. The alert is for an EC2 that has been compromised. An investigation will be triggered, but before this, we check the Automation Rules defined - if there is a rule set up for GuardDuty alerts for EC2 in the Region & Account the compromised EC2 resides in.\nIf a rule matches, we then perform the investigation based on the Investigation type defined in the rule (i.e full investigation)."}),"\n",(0,i.jsx)(t.p,{children:"After the import is complete we can check the automated investigation tab to view all malicious and suspicious activity in relation to the compromised EC2.\nYou can then select the cloud resource and view the cloud resource. A panel will open with the metadata and actions tab. The metadata tab contains metadata about the resource and the Actions tab contains actions which can be performed on the compromised resource."}),"\n",(0,i.jsx)(t.p,{children:"To automate the remediation actions on the compromised resource, you can enable this under the Settings -> Advanced tab, this would avoid you having to manually invoke the actions via the cloud resource panel. This will automatically invoke the actions defined in the Automation Rule for malicious or suspicious activity after the investigation is complete."})]})}function h(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},1024:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/environments-72cb069d871104cc1b13d33bdfb68916.png"},7228:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/rules-list-079383494a28c8acafa4ad624d3e6231.png"},476:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/rules-7cbd5b97c7cefd78bd295d0cfec3194d.png"},9486:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/scopes-50355401cc62813c6ace8390e10b75bb.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>r,a:()=>a});var i=n(7294);const s={},o=i.createContext(s);function a(e){const t=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),i.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ca1ba999.7321d8a2.js b/assets/js/ca1ba999.7321d8a2.js deleted file mode 100644 index 355d595b3..000000000 --- a/assets/js/ca1ba999.7321d8a2.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6915],{2194:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>d,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>c});var s=t(5893),i=t(1151);const o={title:"Okta SAML",hide_title:!0,sidebar_position:3},a="Okta SAML Integration",r={id:"cado-response/manage/users-authentication/sso/okta_saml",title:"Okta SAML",description:"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.",source:"@site/docs/cado-response/manage/users-authentication/sso/okta_saml.md",sourceDirName:"cado-response/manage/users-authentication/sso",slug:"/cado-response/manage/users-authentication/sso/okta_saml",permalink:"/cado-response/manage/users-authentication/sso/okta_saml",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/users-authentication/sso/okta_saml.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:3,frontMatter:{title:"Okta SAML",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Okta OAuth",permalink:"/cado-response/manage/users-authentication/sso/okta"},next:{title:"Ping SAML",permalink:"/cado-response/manage/users-authentication/sso/ping_saml"}},d={},c=[{value:"Setting up Okta SSO",id:"setting-up-okta-sso",level:3}];function l(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"okta-saml-integration",children:"Okta SAML Integration"}),"\n",(0,s.jsx)(n.admonition,{type:"warning",children:(0,s.jsxs)(n.p,{children:["If you encounter issues, please contact ",(0,s.jsx)(n.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," describing your issue and providing as much detail about your configuration as possible."]})}),"\n",(0,s.jsxs)(n.p,{children:["You can now enable the beta of Okta SAML Integration in the Cado platform by going to ",(0,s.jsx)(n.code,{children:"Settings > SSO > Okta SAML"}),"."]}),"\n",(0,s.jsx)(n.h3,{id:"setting-up-okta-sso",children:"Setting up Okta SSO"}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Open the Okta admin dashboard and navigate to ",(0,s.jsx)(n.code,{children:"Applications > Applications"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Click ",(0,s.jsx)(n.strong,{children:"Create App Integration"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Select"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"SAML 2.0"}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Click ",(0,s.jsx)(n.strong,{children:"Next"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Give the Cado SAML app a name"}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Add a single sign on URL. This should be the URL you use to access cado in the web browser concatenated with the ",(0,s.jsx)(n.code,{children:"/api/v2/auth/saml/okta"})," path. E.g. ",(0,s.jsx)(n.a,{href:"https://my.cado.instance/api/v2/auth/saml/okta",children:"https://my.cado.instance/api/v2/auth/saml/okta"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Add an audience URI (SP Entity ID). Typically this is the instance URI of your application. E.g. ",(0,s.jsx)(n.a,{href:"https://my.cado.instance",children:"https://my.cado.instance"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Add an Attribute Statement to the application:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["In the ",(0,s.jsx)(n.code,{children:"Name"})," field enter ",(0,s.jsx)(n.code,{children:"emailAttrStatement"})]}),"\n",(0,s.jsxs)(n.li,{children:["In the ",(0,s.jsx)(n.code,{children:"Name format"})," field select ",(0,s.jsx)(n.strong,{children:"Unspecified"})]}),"\n",(0,s.jsxs)(n.li,{children:["In the ",(0,s.jsx)(n.code,{children:"Value"})," field select ",(0,s.jsx)(n.strong,{children:"user.email"})]}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.img,{alt:"Okta Attribute Statement",src:t(6070).Z+"",width:"857",height:"196"})}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Add a Group Attribute Statement to the application:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["In the ",(0,s.jsx)(n.code,{children:"Name"})," field enter ",(0,s.jsx)(n.code,{children:"groupAttrStatement"})]}),"\n",(0,s.jsxs)(n.li,{children:["In the ",(0,s.jsx)(n.code,{children:"Name format"})," field select ",(0,s.jsx)(n.strong,{children:"Unspecified"})]}),"\n",(0,s.jsxs)(n.li,{children:["In the ",(0,s.jsx)(n.code,{children:"Filter"})," set the drop down to ",(0,s.jsx)(n.strong,{children:"Equals"})," and set the field to the name of your admin group. In this example the admin group will be called ",(0,s.jsx)(n.code,{children:"CadoAdmin"}),"."]}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.img,{alt:"Okta Group Attribute Statement",src:t(6922).Z+"",width:"821",height:"194"})}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Click ",(0,s.jsx)(n.strong,{children:"Next"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Complete the Okta feedback and click ",(0,s.jsx)(n.strong,{children:"Finish"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Optional: Choose who is granted access to the application"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Go to the ",(0,s.jsx)(n.strong,{children:"Assignments"})," tab of the SAML application and select ",(0,s.jsx)(n.strong,{children:"Limit access to selected groups"})]}),"\n",(0,s.jsx)(n.li,{children:"Add a user group"}),"\n",(0,s.jsx)(n.li,{children:"This can also be done at a later stage"}),"\n",(0,s.jsxs)(n.li,{children:["If you name a group ",(0,s.jsx)(n.code,{children:"CadoAdmin"}),", then any users in that group will become admin users of Cado when logging in"]}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.img,{alt:"Okta Assignments",src:t(7303).Z+"",width:"725",height:"242"})}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(n.admonition,{type:"tip",children:(0,s.jsxs)(n.p,{children:["If you are looking to assign non-admin users within Cado, you can use a group name other than ",(0,s.jsx)(n.code,{children:"CadoAdmin"}),". For example: adding a group ",(0,s.jsx)(n.code,{children:"CadoNonAdmin"})," and assigning users to it will result in those users being Normal Users within the Cado platform."]})}),"\n",(0,s.jsxs)(n.ol,{start:"13",children:["\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Go to the ",(0,s.jsx)(n.strong,{children:"Sign On"})," tab of the SAML application, navigate down to ",(0,s.jsx)(n.strong,{children:"SAML Setup"})," and click ",(0,s.jsx)(n.strong,{children:"View SAML setup instructions"}),". Keep this page to hand; you'll need it shortly"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Go to ",(0,s.jsx)(n.code,{children:"Customizations > Other > IFrame Embedding"}),", make sure that this setting is enabled. We use this to refresh access to the platform"]}),"\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.img,{alt:"Okta IFrame Embedding",src:t(6955).Z+"",width:"623",height:"264"})}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Configure SSO in cado:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Open your cado instance and log in as an admin user"}),"\n",(0,s.jsxs)(n.li,{children:["Go to ",(0,s.jsx)(n.code,{children:"Settings > SSO > Okta SAML"})]}),"\n",(0,s.jsxs)(n.li,{children:["Click ",(0,s.jsx)(n.strong,{children:"Enabled"})]}),"\n",(0,s.jsxs)(n.li,{children:["Populate the fields with the following:","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Enter the ",(0,s.jsx)(n.code,{children:"Identity Provider Issuer"})," value from the SAML setup instructions into the ",(0,s.jsx)(n.code,{children:"Okta SAML App IdP entity ID"})," field"]}),"\n",(0,s.jsxs)(n.li,{children:["Enter the ",(0,s.jsx)(n.code,{children:"Identity Provider Single Sign-On URL"})," value from the SAML setup instructions into the ",(0,s.jsx)(n.code,{children:"Okta SAML App IdP SSO URL"})," field"]}),"\n",(0,s.jsxs)(n.li,{children:["Enter the ",(0,s.jsx)(n.code,{children:"X.509 Certificate"})," value (text inbetween ",(0,s.jsx)(n.code,{children:"-----BEGIN CERTIFICATE-----"})," and ",(0,s.jsx)(n.code,{children:"-----END CERTIFICATE-----"}),") from the SAML setup instructions into the ",(0,s.jsx)(n.code,{children:"Okta SAML App x509 Cert"})," field"]}),"\n",(0,s.jsxs)(n.li,{children:["Enter the exact URL you provided in step 7 into the ",(0,s.jsx)(n.code,{children:"Okta SAML App SP entity ID"})," field"]}),"\n",(0,s.jsxs)(n.li,{children:["Enter the exact URL you provided in step 6 into the ",(0,s.jsx)(n.code,{children:"Okta SAML App SP ACS URL"})," field"]}),"\n",(0,s.jsxs)(n.li,{children:["Enter the exact name of your admin group you configured in step 9 into the ",(0,s.jsx)(n.code,{children:"Admin Group Name"})," field"]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Optional: You can confirm if this was configured correctly by clicking ",(0,s.jsx)(n.strong,{children:"Test new settings"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Click ",(0,s.jsx)(n.strong,{children:"Update"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Log out with your existing user, and login with Okta SAML"}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},7303:(e,n,t)=>{t.d(n,{Z:()=>s});const s=t.p+"assets/images/okta-assignments-3b23b5eb60b1a663656d167431a6126c.png"},6070:(e,n,t)=>{t.d(n,{Z:()=>s});const s=t.p+"assets/images/okta-attribute-statement-b94778a6027d51a31bffd5111af2dfa3.png"},6922:(e,n,t)=>{t.d(n,{Z:()=>s});const s=t.p+"assets/images/okta-group-attribute-statement-90ee5bcdc3598a382d66cc49f725c8bf.png"},6955:(e,n,t)=>{t.d(n,{Z:()=>s});const s=t.p+"assets/images/okta-iframe-embedding-c8e51df1d9547460ddc880d65b3fef53.png"},1151:(e,n,t)=>{t.d(n,{Z:()=>r,a:()=>a});var s=t(7294);const i={},o=s.createContext(i);function a(e){const n=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),s.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ca1ba999.fb6ca6c2.js b/assets/js/ca1ba999.fb6ca6c2.js new file mode 100644 index 000000000..5dba17bd7 --- /dev/null +++ b/assets/js/ca1ba999.fb6ca6c2.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6915],{2194:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>d,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>c});var s=t(5893),i=t(1151);const o={title:"Okta SAML",hide_title:!0,sidebar_position:3},a="Okta SAML Integration",r={id:"cado-response/manage/users-authentication/sso/okta_saml",title:"Okta SAML",description:"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.",source:"@site/docs/cado-response/manage/users-authentication/sso/okta_saml.md",sourceDirName:"cado-response/manage/users-authentication/sso",slug:"/cado-response/manage/users-authentication/sso/okta_saml",permalink:"/cado-response/manage/users-authentication/sso/okta_saml",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/users-authentication/sso/okta_saml.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:3,frontMatter:{title:"Okta SAML",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Okta OAuth",permalink:"/cado-response/manage/users-authentication/sso/okta"},next:{title:"Ping SAML",permalink:"/cado-response/manage/users-authentication/sso/ping_saml"}},d={},c=[{value:"Setting up Okta SSO",id:"setting-up-okta-sso",level:3}];function l(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.h1,{id:"okta-saml-integration",children:"Okta SAML Integration"}),"\n",(0,s.jsx)(n.admonition,{type:"warning",children:(0,s.jsxs)(n.p,{children:["If you encounter issues, please contact ",(0,s.jsx)(n.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," describing your issue and providing as much detail about your configuration as possible."]})}),"\n",(0,s.jsxs)(n.p,{children:["You can now enable the beta of Okta SAML Integration in the Cado platform by going to ",(0,s.jsx)(n.code,{children:"Settings > SSO > Okta SAML"}),"."]}),"\n",(0,s.jsx)(n.h3,{id:"setting-up-okta-sso",children:"Setting up Okta SSO"}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Open the Okta admin dashboard and navigate to ",(0,s.jsx)(n.code,{children:"Applications > Applications"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Click ",(0,s.jsx)(n.strong,{children:"Create App Integration"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Select"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"SAML 2.0"}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Click ",(0,s.jsx)(n.strong,{children:"Next"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Give the Cado SAML app a name"}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Add a single sign on URL. This should be the URL you use to access cado in the web browser concatenated with the ",(0,s.jsx)(n.code,{children:"/api/v2/auth/saml/okta"})," path. E.g. ",(0,s.jsx)(n.a,{href:"https://my.cado.instance/api/v2/auth/saml/okta",children:"https://my.cado.instance/api/v2/auth/saml/okta"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Add an audience URI (SP Entity ID). Typically this is the instance URI of your application. E.g. ",(0,s.jsx)(n.a,{href:"https://my.cado.instance",children:"https://my.cado.instance"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Add an Attribute Statement to the application:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["In the ",(0,s.jsx)(n.code,{children:"Name"})," field enter ",(0,s.jsx)(n.code,{children:"emailAttrStatement"})]}),"\n",(0,s.jsxs)(n.li,{children:["In the ",(0,s.jsx)(n.code,{children:"Name format"})," field select ",(0,s.jsx)(n.strong,{children:"Unspecified"})]}),"\n",(0,s.jsxs)(n.li,{children:["In the ",(0,s.jsx)(n.code,{children:"Value"})," field select ",(0,s.jsx)(n.strong,{children:"user.email"})]}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.img,{alt:"Okta Attribute Statement",src:t(6070).Z+"",width:"857",height:"196"})}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Add a Group Attribute Statement to the application:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["In the ",(0,s.jsx)(n.code,{children:"Name"})," field enter ",(0,s.jsx)(n.code,{children:"groupAttrStatement"})]}),"\n",(0,s.jsxs)(n.li,{children:["In the ",(0,s.jsx)(n.code,{children:"Name format"})," field select ",(0,s.jsx)(n.strong,{children:"Unspecified"})]}),"\n",(0,s.jsxs)(n.li,{children:["In the ",(0,s.jsx)(n.code,{children:"Filter"})," set the drop down to ",(0,s.jsx)(n.strong,{children:"Equals"})," and set the field to the name of your admin group. In this example the admin group will be called ",(0,s.jsx)(n.code,{children:"CadoAdmin"}),"."]}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.img,{alt:"Okta Group Attribute Statement",src:t(6922).Z+"",width:"821",height:"194"})}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Click ",(0,s.jsx)(n.strong,{children:"Next"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Complete the Okta feedback and click ",(0,s.jsx)(n.strong,{children:"Finish"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Optional: Choose who is granted access to the application"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Go to the ",(0,s.jsx)(n.strong,{children:"Assignments"})," tab of the SAML application and select ",(0,s.jsx)(n.strong,{children:"Limit access to selected groups"})]}),"\n",(0,s.jsx)(n.li,{children:"Add a user group"}),"\n",(0,s.jsx)(n.li,{children:"This can also be done at a later stage"}),"\n",(0,s.jsxs)(n.li,{children:["If you name a group ",(0,s.jsx)(n.code,{children:"CadoAdmin"}),", then any users in that group will become admin users of Cado when logging in"]}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.img,{alt:"Okta Assignments",src:t(7303).Z+"",width:"725",height:"242"})}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(n.admonition,{type:"tip",children:(0,s.jsxs)(n.p,{children:["If you are looking to assign non-admin users within Cado, you can use a group name other than ",(0,s.jsx)(n.code,{children:"CadoAdmin"}),". For example: adding a group ",(0,s.jsx)(n.code,{children:"CadoNonAdmin"})," and assigning users to it will result in those users being Normal Users within the Cado platform."]})}),"\n",(0,s.jsxs)(n.ol,{start:"13",children:["\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Go to the ",(0,s.jsx)(n.strong,{children:"Sign On"})," tab of the SAML application, navigate down to ",(0,s.jsx)(n.strong,{children:"SAML Setup"})," and click ",(0,s.jsx)(n.strong,{children:"View SAML setup instructions"}),". Keep this page to hand; you'll need it shortly"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Go to ",(0,s.jsx)(n.code,{children:"Customizations > Other > IFrame Embedding"}),", make sure that this setting is enabled. We use this to refresh access to the platform"]}),"\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.img,{alt:"Okta IFrame Embedding",src:t(6955).Z+"",width:"623",height:"264"})}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Configure SSO in cado:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Open your cado instance and log in as an admin user"}),"\n",(0,s.jsxs)(n.li,{children:["Go to ",(0,s.jsx)(n.code,{children:"Settings > SSO > Okta SAML"})]}),"\n",(0,s.jsxs)(n.li,{children:["Click ",(0,s.jsx)(n.strong,{children:"Enabled"})]}),"\n",(0,s.jsxs)(n.li,{children:["Populate the fields with the following:","\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Enter the ",(0,s.jsx)(n.code,{children:"Identity Provider Issuer"})," value from the SAML setup instructions into the ",(0,s.jsx)(n.code,{children:"Okta SAML App IdP entity ID"})," field"]}),"\n",(0,s.jsxs)(n.li,{children:["Enter the ",(0,s.jsx)(n.code,{children:"Identity Provider Single Sign-On URL"})," value from the SAML setup instructions into the ",(0,s.jsx)(n.code,{children:"Okta SAML App IdP SSO URL"})," field"]}),"\n",(0,s.jsxs)(n.li,{children:["Enter the ",(0,s.jsx)(n.code,{children:"X.509 Certificate"})," value (text inbetween ",(0,s.jsx)(n.code,{children:"-----BEGIN CERTIFICATE-----"})," and ",(0,s.jsx)(n.code,{children:"-----END CERTIFICATE-----"}),") from the SAML setup instructions into the ",(0,s.jsx)(n.code,{children:"Okta SAML App x509 Cert"})," field"]}),"\n",(0,s.jsxs)(n.li,{children:["Enter the exact URL you provided in step 7 into the ",(0,s.jsx)(n.code,{children:"Okta SAML App SP entity ID"})," field"]}),"\n",(0,s.jsxs)(n.li,{children:["Enter the exact URL you provided in step 6 into the ",(0,s.jsx)(n.code,{children:"Okta SAML App SP ACS URL"})," field"]}),"\n",(0,s.jsxs)(n.li,{children:["Enter the exact name of your admin group you configured in step 9 into the ",(0,s.jsx)(n.code,{children:"Admin Group Name"})," field"]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Optional: You can confirm if this was configured correctly by clicking ",(0,s.jsx)(n.strong,{children:"Test new settings"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Click ",(0,s.jsx)(n.strong,{children:"Update"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Log out with your existing user, and login with Okta SAML"}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},7303:(e,n,t)=>{t.d(n,{Z:()=>s});const s=t.p+"assets/images/okta-assignments-3b23b5eb60b1a663656d167431a6126c.png"},6070:(e,n,t)=>{t.d(n,{Z:()=>s});const s=t.p+"assets/images/okta-attribute-statement-b94778a6027d51a31bffd5111af2dfa3.png"},6922:(e,n,t)=>{t.d(n,{Z:()=>s});const s=t.p+"assets/images/okta-group-attribute-statement-90ee5bcdc3598a382d66cc49f725c8bf.png"},6955:(e,n,t)=>{t.d(n,{Z:()=>s});const s=t.p+"assets/images/okta-iframe-embedding-c8e51df1d9547460ddc880d65b3fef53.png"},1151:(e,n,t)=>{t.d(n,{Z:()=>r,a:()=>a});var s=t(7294);const i={},o=s.createContext(i);function a(e){const n=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),s.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/cb5c075c.e444b7fe.js b/assets/js/cb5c075c.e444b7fe.js new file mode 100644 index 000000000..09c8cfc19 --- /dev/null +++ b/assets/js/cb5c075c.e444b7fe.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4760],{3680:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>p,contentTitle:()=>a,default:()=>m,frontMatter:()=>n,metadata:()=>r,toc:()=>c});var s=o(5893),i=o(1151);const n={title:"AMI, EBS Snapshot and Volume",hide_title:!0,sidebar_position:3},a="AWS AMI, EBS Snapshot and Volume support",r={id:"cado-response/discovery-import/import/aws/aws-ami",title:"AMI, EBS Snapshot and Volume",description:'The Cado platform supports acquiring AMIs, EBS Snapshots or volumes of machines, either by using a cross account role, or directly sharing the image/snapshot with the Cado AWS account. If sharing an AMI, you will need to select the option to share the underlying Snapshots ("Edit AMI Permissions" > Tick "Add \'Create volume\' permission"). For more information, see Share an Amazon EBS snapshot.',source:"@site/docs/cado-response/discovery-import/import/aws/aws-ami.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/aws-ami",permalink:"/cado-response/discovery-import/import/aws/aws-ami",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/aws-ami.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:3,frontMatter:{title:"AMI, EBS Snapshot and Volume",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"S3",permalink:"/cado-response/discovery-import/import/aws/aws-s3"},next:{title:"ECS",permalink:"/cado-response/discovery-import/import/aws/aws-ecs"}},p={},c=[];function d(e){const t={a:"a",h1:"h1",img:"img",p:"p",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"aws-ami-ebs-snapshot-and-volume-support",children:"AWS AMI, EBS Snapshot and Volume support"}),"\n",(0,s.jsxs)(t.p,{children:['The Cado platform supports acquiring AMIs, EBS Snapshots or volumes of machines, either by using a cross account role, or directly sharing the image/snapshot with the Cado AWS account. If sharing an AMI, you will need to select the option to share the underlying Snapshots ("Edit AMI Permissions" > Tick "Add \'Create volume\' permission"). For more information, see ',(0,s.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html",children:"Share an Amazon EBS snapshot"}),"."]}),"\n",(0,s.jsxs)(t.p,{children:["Select the region, and specify the identifer of the AMI, snapshot or volume. Click 'Continue', confirm the details and click 'Start Import'.\n",(0,s.jsx)(t.img,{alt:"AWS AMI",src:o(9255).Z+"",width:"952",height:"572"})]})]})}function m(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},9255:(e,t,o)=>{o.d(t,{Z:()=>s});const s=o.p+"assets/images/aws-ami-9b219e37b57c6e0439b69c9297fa4467.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>r,a:()=>a});var s=o(7294);const i={},n=s.createContext(i);function a(e){const t=s.useContext(n);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),s.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/cb5c075c.ecceaf7c.js b/assets/js/cb5c075c.ecceaf7c.js deleted file mode 100644 index d7cfe62ad..000000000 --- a/assets/js/cb5c075c.ecceaf7c.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[4760],{3680:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>p,contentTitle:()=>a,default:()=>m,frontMatter:()=>i,metadata:()=>r,toc:()=>c});var s=o(5893),n=o(1151);const i={title:"AMI, EBS Snapshot and Volume",hide_title:!0,sidebar_position:3},a="AWS AMI, EBS Snapshot and Volume support",r={id:"cado-response/discovery-import/import/aws/aws-ami",title:"AMI, EBS Snapshot and Volume",description:'The Cado platform supports acquiring AMIs, EBS Snapshots or volumes of machines, either by using a cross account role, or directly sharing the image/snapshot with the Cado AWS account. If sharing an AMI, you will need to select the option to share the underlying Snapshots ("Edit AMI Permissions" > Tick "Add \'Create volume\' permission"). For more information, see Share an Amazon EBS snapshot.',source:"@site/docs/cado-response/discovery-import/import/aws/aws-ami.md",sourceDirName:"cado-response/discovery-import/import/aws",slug:"/cado-response/discovery-import/import/aws/aws-ami",permalink:"/cado-response/discovery-import/import/aws/aws-ami",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/aws/aws-ami.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:3,frontMatter:{title:"AMI, EBS Snapshot and Volume",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"S3",permalink:"/cado-response/discovery-import/import/aws/aws-s3"},next:{title:"ECS",permalink:"/cado-response/discovery-import/import/aws/aws-ecs"}},p={},c=[];function d(e){const t={a:"a",h1:"h1",img:"img",p:"p",...(0,n.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"aws-ami-ebs-snapshot-and-volume-support",children:"AWS AMI, EBS Snapshot and Volume support"}),"\n",(0,s.jsxs)(t.p,{children:['The Cado platform supports acquiring AMIs, EBS Snapshots or volumes of machines, either by using a cross account role, or directly sharing the image/snapshot with the Cado AWS account. If sharing an AMI, you will need to select the option to share the underlying Snapshots ("Edit AMI Permissions" > Tick "Add \'Create volume\' permission"). For more information, see ',(0,s.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html",children:"Share an Amazon EBS snapshot"}),"."]}),"\n",(0,s.jsxs)(t.p,{children:["Select the region, and specify the identifer of the AMI, snapshot or volume. Click 'Continue', confirm the details and click 'Start Import'.\n",(0,s.jsx)(t.img,{alt:"AWS AMI",src:o(9255).Z+"",width:"952",height:"572"})]})]})}function m(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},9255:(e,t,o)=>{o.d(t,{Z:()=>s});const s=o.p+"assets/images/aws-ami-9b219e37b57c6e0439b69c9297fa4467.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>r,a:()=>a});var s=o(7294);const n={},i=s.createContext(n);function a(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/cc7fbe29.eedd4110.js b/assets/js/cc7fbe29.eedd4110.js deleted file mode 100644 index 76181927b..000000000 --- a/assets/js/cc7fbe29.eedd4110.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1668],{7486:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>c});var t=i(5893),s=i(1151);const r={title:"Tines",hide_title:!0,sidebar_position:4},o="Tines Integration",a={id:"cado-response/manage/integrations/soar/tines",title:"Tines",description:"Tines is a no-code automation platform for security analysts. Tines allows analysts to spend less time on routine repetitive tasks and allow them to focus on those areas where they can have the most impact. The tools feature pre-configured integrations with a variety of business and security tools, but for more sophisticated users, it also features the ability to hook into any publicly available API, including the Cado API.",source:"@site/docs/cado-response/manage/integrations/soar/tines.md",sourceDirName:"cado-response/manage/integrations/soar",slug:"/cado-response/manage/integrations/soar/tines",permalink:"/cado-response/manage/integrations/soar/tines",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/soar/tines.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:4,frontMatter:{title:"Tines",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"SIEM",permalink:"/cado-response/manage/integrations/siem"},next:{title:"Splunk SOAR",permalink:"/cado-response/manage/integrations/soar/splunk-soar"}},l={},c=[{value:"Getting Started with Tines",id:"getting-started-with-tines",level:2},{value:"Contents",id:"contents",level:3},{value:"Creating and Storing an API Access Key",id:"creating-and-storing-an-api-access-key",level:3},{value:"Adding your Platform Base URL",id:"adding-your-platform-base-url",level:3},{value:"Adding Default Values",id:"adding-default-values",level:3},{value:"Testing your Settings",id:"testing-your-settings",level:3},{value:"List of Actions",id:"list-of-actions",level:2},{value:"Contents",id:"contents-1",level:3},{value:"List EC2 Instances",id:"list-ec2-instances",level:3},{value:"Changing the Default URL",id:"changing-the-default-url",level:4},{value:"Changing the Payload Parameters",id:"changing-the-payload-parameters",level:4},{value:"List S3 Buckets",id:"list-s3-buckets",level:3},{value:"Changing the Default URL",id:"changing-the-default-url-1",level:4},{value:"List Projects",id:"list-projects",level:3},{value:"List Project Pipelines",id:"list-project-pipelines",level:3},{value:"Changing the Payload Parameters",id:"changing-the-payload-parameters-1",level:4},{value:"Create a Project",id:"create-a-project",level:3},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters-",level:4},{value:"Extracting the Return Value",id:"extracting-the-return-value",level:4},{value:"Retrieve a Pipeline",id:"retrieve-a-pipeline",level:3},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters--1",level:4},{value:"Acquire a Disk Image From EC2",id:"acquire-a-disk-image-from-ec2",level:3},{value:"Changing the Default URL",id:"changing-the-default-url-2",level:4},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters--2",level:4},{value:"Extracting the Return Value",id:"extracting-the-return-value-1",level:4},{value:"Acquire a Disk Image From S3",id:"acquire-a-disk-image-from-s3",level:3},{value:"Changing the Default URL",id:"changing-the-default-url-3",level:4},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters--3",level:4},{value:"Extracting the Return Value",id:"extracting-the-return-value-2",level:4},{value:"Creating a Story: Acquiring an EC2 Instance",id:"creating-a-story-acquiring-an-ec2-instance",level:2},{value:"Contents",id:"contents-2",level:3},{value:"Creating the Form",id:"creating-the-form",level:3},{value:"Action: Creating the Project",id:"action-creating-the-project",level:3},{value:"Action: Triggering a EC2 Acquisition",id:"action-triggering-a-ec2-acquisition",level:3},{value:"Action: Looping over Pipeline Status",id:"action-looping-over-pipeline-status",level:3},{value:"Action: Sending an Email",id:"action-sending-an-email",level:3}];function d(e){const n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"tines-integration",children:"Tines Integration"}),"\n",(0,t.jsx)(n.p,{children:"Tines is a no-code automation platform for security analysts. Tines allows analysts to spend less time on routine repetitive tasks and allow them to focus on those areas where they can have the most impact. The tools feature pre-configured integrations with a variety of business and security tools, but for more sophisticated users, it also features the ability to hook into any publicly available API, including the Cado API."}),"\n",(0,t.jsxs)(n.p,{children:["By using the Cado Response integration with Tines, we're allowing security analysts to quickly automate Incident Response and allow them to quickly respond to attacks for further investigation in the Cado Response platform. The Tines and Cado Response integration is easy to use, just search for ",(0,t.jsx)(n.strong,{children:"Cado Security"})," in the Public Templates repository, choose, and then drag and drop."]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["If you're confused by the terminology mentioned here, or have never used Tines before, please consider checking out the ",(0,t.jsx)(n.a,{href:"https://hub.tines.com/docs/quickstart",children:"Tines documentation"}),"."]})}),"\n",(0,t.jsx)(n.h2,{id:"getting-started-with-tines",children:"Getting Started with Tines"}),"\n",(0,t.jsx)(n.p,{children:"Before properly getting started please see the following for general instructions on setting up the Cado Response platform for integrating with third-party tools:"}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"/cado-response/manage/integrations/api-overview",children:"Integrations Overview >"})})}),"\n",(0,t.jsx)(n.h3,{id:"contents",children:"Contents"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#adding-your-platform-base-url",children:"Adding your Platform Base URL"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#adding-default-values",children:"Adding Default Values"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#testing-your-settings",children:"Testing your Settings"})})}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"}),"\n",(0,t.jsx)(n.p,{children:"Cado Response allows you to create an API Access Key that allows third-party services to authenticate and interact with a Cado Response instance; you'll need to create one in order to use Tines with Cado Response."}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["Please see ",(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"/cado-response/manage/integrations/api-overview#creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"})})," to learn how to create the API Access Key."]})}),"\n",(0,t.jsxs)(n.p,{children:["In order to add the Secret Key to Tines, you'll need to open your Tines Dashboard, and go to the ",(0,t.jsx)(n.strong,{children:"Credentials"})," page. Add a new ",(0,t.jsx)(n.strong,{children:"Text Credential"})," and name it ",(0,t.jsx)(n.code,{children:"CadoResponse_APIKey"}),"."]}),"\n",(0,t.jsx)(n.admonition,{type:"note",children:(0,t.jsx)(n.p,{children:"It's important to name all credentials and resources mentioned in the tutorial as given, or else the Actions we provide won't be able to interact with the Cado API."})}),"\n",(0,t.jsx)(n.h3,{id:"adding-your-platform-base-url",children:"Adding your Platform Base URL"}),"\n",(0,t.jsxs)(n.p,{children:["To tell Tines the Platform Base URL of a Cado Response instance, you'll need to add it as a Resource. In order to do this, you'll need to open your Tines Dashboard, and go to the ",(0,t.jsx)(n.strong,{children:"Resources"})," page. Click the ",(0,t.jsx)(n.strong,{children:"New Resource"})," button and name it ",(0,t.jsx)(n.code,{children:"Cadoresponse_URL"})," and paste the Platform Base URL into the builder."]}),"\n",(0,t.jsx)(n.h3,{id:"adding-default-values",children:"Adding Default Values"}),"\n",(0,t.jsx)(n.p,{children:"The actions we provide allow you to set default fallback values, in case a form doesn't get filled in properly, or if an analyst misconfigures an action. To add these values, simply create three Resources with the following names:"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Resource Name"}),(0,t.jsx)(n.th,{children:"Type"}),(0,t.jsx)(n.th,{children:"Example"}),(0,t.jsx)(n.th,{children:"Description"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:(0,t.jsx)(n.code,{children:"CadoResponse_Default_Project_ID"})}),(0,t.jsx)(n.td,{children:"Integer"}),(0,t.jsx)(n.td,{children:"1"}),(0,t.jsx)(n.td,{children:"A numerical value that denotes a project in Cado Response."})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:(0,t.jsx)(n.code,{children:"CadoResponse_Default_Region"})}),(0,t.jsx)(n.td,{children:"String"}),(0,t.jsx)(n.td,{children:"us-east-1"}),(0,t.jsx)(n.td,{children:"A valid name of an AWS region."})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:(0,t.jsx)(n.code,{children:"CadoResponse_Default_S3_Bucket"})}),(0,t.jsx)(n.td,{children:"String"}),(0,t.jsx)(n.td,{children:"bucket_name"}),(0,t.jsx)(n.td,{children:"A name of a valid and accessible S3 bucket."})]})]})]}),"\n",(0,t.jsx)(n.h3,{id:"testing-your-settings",children:"Testing your Settings"}),"\n",(0,t.jsx)(n.p,{children:"To make sure you've done all the following steps correctly, please follow along with the following test procedure:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:"Create a new story in Tines through the Tines Dashboard."}),"\n",(0,t.jsxs)(n.li,{children:["Drag the ",(0,t.jsx)(n.strong,{children:"List Cado Response Projects"})," HTTP Request template from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar."]}),"\n",(0,t.jsxs)(n.li,{children:["Click the new action and click ",(0,t.jsx)(n.strong,{children:"Run"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Check the ",(0,t.jsx)(n.strong,{children:"Action Events"})," for a ",(0,t.jsx)(n.code,{children:"200 OK"})," HTTP code."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:"If the following was successful, then you've correctly setup Tines to interact with the Cado Response API."}),"\n",(0,t.jsx)(n.h2,{id:"list-of-actions",children:"List of Actions"}),"\n",(0,t.jsxs)(n.p,{children:["Actions are the basic actions that can be chained together in ",(0,t.jsx)(n.em,{children:"Stories"}),", which are playbooks that can be run to perform a specific task or workflow."]}),"\n",(0,t.jsx)(n.admonition,{type:"info",children:(0,t.jsxs)(n.p,{children:["All the list actions are available in the Tines Public Templates repository. Just search for ",(0,t.jsx)(n.strong,{children:"Cado Security"}),", choose the action and drag and drop."]})}),"\n",(0,t.jsx)(n.h3,{id:"contents-1",children:"Contents"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-ec2-instances",children:"List EC2 Instances"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-s3-buckets",children:"List S3 Buckets"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-projects",children:"List Projects"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-project-pipelines",children:"List Project Pipelines"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#create-a-project",children:"Create a Project"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#retrieve-a-pipeline",children:"Retrieve a Pipeline"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"})})}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Tines Actions for the Cado Response API",src:i(7110).Z+"",width:"395",height:"1400"})}),"\n",(0,t.jsx)(n.h3,{id:"list-ec2-instances",children:"List EC2 Instances"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List EC2 Instances in Cado Response"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the EC2 instances in an AWS region."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado Response."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/ec2"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters",children:"Changing the Payload Parameters"}),"\n",(0,t.jsxs)(n.p,{children:["You'll also need to adjust the ",(0,t.jsx)(n.code,{children:"region"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to the valid AWS region you want to see instances listed in."]}),"\n",(0,t.jsx)(n.h3,{id:"list-s3-buckets",children:"List S3 Buckets"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List S3 Buckets in Cado Response"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the S3 buckets in an AWS account."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url-1",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado Response."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/s3"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h3,{id:"list-projects",children:"List Projects"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List Cado Response Projects"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the projects in Cado Response."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects"})]}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"list-project-pipelines",children:"List Project Pipelines"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List Pipelines for a Cado Response Project"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the pipelines for a given project in Cado Response."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/tasks/pipelines"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters-1",children:"Changing the Payload Parameters"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"project_id"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to a valid Cado Response Project ID."]}),"\n",(0,t.jsx)(n.h3,{id:"create-a-project",children:"Create a Project"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"Create a new Project in Cado Response"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to create a new project in Cado Response."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{.RESOURCE.cadoresponse_url}}/api/v2/projects"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters-",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.strong,{children:"Payload"})," section you need to change the ",(0,t.jsx)(n.code,{children:"caseName"})," parameter to the name of the project you desire. You can also change the ",(0,t.jsx)(n.code,{children:"description"})," parameter to add a description to your project, or remove it if you don't need one. If you don't add the ",(0,t.jsx)(n.code,{children:"caseName"})," parameter, the action will default to the current UNIX timestamp as the project name. All projects created through Tines will include the ",(0,t.jsx)(n.code,{children:"_TinesProject"})," suffix."]}),"\n",(0,t.jsx)(n.h4,{id:"extracting-the-return-value",children:"Extracting the Return Value"}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Project ID in the response body. You can use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action with the following settings:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .create_a_new_project_in_cado_response.body.id}}",\n "regexp": "\\\\d*",\n "to": "created_project_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"You can then retrieve the value from other actions using the following:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-liquid",children:"{{ .get_new_project_id.created_project_id | first }}\n"})}),"\n",(0,t.jsxs)(n.p,{children:["where ",(0,t.jsx)(n.code,{children:"get_new_project_id"})," is the name of the appropriate Event Transform action in Liquid syntax."]}),"\n",(0,t.jsx)(n.h3,{id:"retrieve-a-pipeline",children:"Retrieve a Pipeline"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"Get Details for a Pipeline in Cado Response"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will retrieve the details of a specific pipeline, including all subtasks."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/tasks/pipelines"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters--1",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"project_id"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to a valid Cado Response Project ID."]}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"pipeline_id"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to a valid Pipeline ID (see ",(0,t.jsx)(n.strong,{children:"Acquisition"})," for more on how to retrieve a Pipeline ID)"]}),"\n",(0,t.jsx)(n.h3,{id:"acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"Trigger an EC2 Disk Acquisition in Cado Response"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will trigger a disk image acquisition task in Cado Response for a specified EC2 instance."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url-2",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado Response."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/ec2"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters--2",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"instance_id"})," and ",(0,t.jsx)(n.code,{children:"region"})," parameters in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to the appropriate values of the EC2 instance you want to acquire."]}),"\n",(0,t.jsxs)(n.p,{children:["You can include the following optional parameter ",(0,t.jsx)(n.code,{children:"bucket"})," in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to change which S3 bucket the disk image is uploaded to."]}),"\n",(0,t.jsxs)(n.p,{children:["Likewise, you can also provide the following optional parameters in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to change the way Cado Response will acquire the disk image. These are the options and their default values:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:' "compress": true,\n "include_disks": true,\n "include_hash": false,\n "include_logs": true,\n "include_screenshot": true,\n'})}),"\n",(0,t.jsx)(n.h4,{id:"extracting-the-return-value-1",children:"Extracting the Return Value"}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Pipeline ID in the response body. You can use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action with the following settings:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .trigger_an_ec2_disk_acquisition_in_cado_response.body.pipeline_id}} }}",\n "regexp": "\\\\d*",\n "to": "created_pipeline_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"You can then retrieve the value from other actions using the following:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-liquid",children:"{{ .get_new_pipeline_id.created_pipeline_id | first }}\n"})}),"\n",(0,t.jsxs)(n.p,{children:["where ",(0,t.jsx)(n.code,{children:"get_new_pipeline_id"})," is the name of the appropriate Event Transform action in Liquid syntax."]}),"\n",(0,t.jsx)(n.h3,{id:"acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Template Name: `Trigger an S3 Disk Acquisition in Cado Response"}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will trigger a disk image acquisition task in Cado Response from a file in a S3 Bucket."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url-3",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado Response."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/s3"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters--3",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"bucket"})," and ",(0,t.jsx)(n.code,{children:"file_name"})," parameters in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to the appropriate values of the file in the S3 bucket you want to acquire and process."]}),"\n",(0,t.jsx)(n.h4,{id:"extracting-the-return-value-2",children:"Extracting the Return Value"}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Pipeline ID in the response body. You can use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action with the following settings:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .trigger_an_s3_disk_acquisition_in_cado_response.body.pipelines[0].pipeline_id}} }}",\n "regexp": "\\\\d*",\n "to": "created_pipeline_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"You can then retrieve the value from other actions using the following:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-liquid",children:"{{ .get_new_pipeline_id.created_pipeline_id | first }}\n"})}),"\n",(0,t.jsxs)(n.p,{children:["where ",(0,t.jsx)(n.code,{children:"get_new_pipeline_id"})," is the name of the appropriate Event Transform action in Liquid syntax."]}),"\n",(0,t.jsx)(n.h2,{id:"creating-a-story-acquiring-an-ec2-instance",children:"Creating a Story: Acquiring an EC2 Instance"}),"\n",(0,t.jsx)(n.admonition,{type:"note",children:(0,t.jsx)(n.p,{children:"If you have a good grasp of the basics of Tines, feel free to skip this section."})}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Tines Example Story for Acquiring an EC2 Instance",src:i(6675).Z+"",width:"433",height:"650"})}),"\n",(0,t.jsx)(n.p,{children:"This section covers a quick tutorial in creating a basic workflow (or story in Tines terms) that:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Allows users to specify details in a form"}),"\n",(0,t.jsx)(n.li,{children:"Creates a new Project"}),"\n",(0,t.jsx)(n.li,{children:"Triggers an EC2 Disk Acquisition"}),"\n",(0,t.jsx)(n.li,{children:"Loops over a pipeline until it has been terminated"}),"\n",(0,t.jsx)(n.li,{children:"Emails the user a success message"}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["You can download the finished story example here: ** ",(0,t.jsx)(n.a,{href:"https://cado-public.s3.amazonaws.com/integrations/cado-response-tines-story.json",children:"Cado Response Basic Story: Create a Project and Acquire EC2 Disk >"})," **"]})}),"\n",(0,t.jsx)(n.h3,{id:"contents-2",children:"Contents"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-ec2-instances",children:"List EC2 Instances"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-s3-buckets",children:"List S3 Buckets"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-projects",children:"List Projects"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-project-pipelines",children:"List Project Pipelines"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#create-a-project",children:"Create a Project"})})}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"creating-the-form",children:"Creating the Form"}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Tines Example Form for Acquiring an EC2 Instance",src:i(6343).Z+"",width:"351",height:"697"})}),"\n",(0,t.jsxs)(n.p,{children:["To create a form in Tines, head to the story editor and click the ",(0,t.jsx)(n.strong,{children:"Form"})," tab. Using the sidebar, add 4 text fields:"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["One for the new Project Name. Name this field ",(0,t.jsx)(n.code,{children:"Project Name"})," and make it required."]}),"\n",(0,t.jsxs)(n.li,{children:["One for the EC2 Instance ID. Name this field ",(0,t.jsx)(n.code,{children:"EC2 Instance ID"})," and make it required."]}),"\n",(0,t.jsxs)(n.li,{children:["One for the EC2 Instance Region. Name this field ",(0,t.jsx)(n.code,{children:"EC2 Instance Region"})," and make it required."]}),"\n",(0,t.jsxs)(n.li,{children:["One fort the email address of the user. Name this field ",(0,t.jsx)(n.code,{children:"Email Address"})," and make it required."]}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsx)(n.p,{children:"We'll use these values throughout the rest of this tutorial, so make sure the names match as above."})}),"\n",(0,t.jsxs)(n.p,{children:["Go back to the ",(0,t.jsx)(n.strong,{children:"Story"})," tab inside the story editor and drag a new ",(0,t.jsx)(n.strong,{children:"Webhook"})," action to the story. Change its name to ",(0,t.jsx)(n.code,{children:"EC2 Webhook"}),". After this, go back into the ",(0,t.jsx)(n.strong,{children:"Form"})," tab and change the ",(0,t.jsx)(n.strong,{children:"Receiving Action"})," in the sidebar to ",(0,t.jsx)(n.code,{children:"EC2 Webhook"}),". This will allow your story to retrieve values from the form."]}),"\n",(0,t.jsx)(n.h3,{id:"action-creating-the-project",children:"Action: Creating the Project"}),"\n",(0,t.jsxs)(n.p,{children:["Return to the ",(0,t.jsx)(n.strong,{children:"Story"})," tab inside the story editor, and drag a ",(0,t.jsx)(n.strong,{children:"Create a new Project in Cado Response"})," action from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar and create a connection from the ",(0,t.jsx)(n.strong,{children:"EC2 Webhook"})," action to it."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"Payload"})," section to match the following: ",(0,t.jsx)(n.em,{children:"(It may be easier to switch to the Plain Code view and paste this in)"})]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "caseName": "{{.ec2_webhook.body.project_name | default: \\"now\\" | date: \\"%s\\" | append: \\"_TinesProject\\" }}",\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON code will retrieve the project name from the form, and will send it to the Cado Response API. You can optionally add the ",(0,t.jsx)(n.code,{children:"description"})," parameter to the ",(0,t.jsx)(n.strong,{children:"Payload"})," to give your new project a description."]}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Project ID in the response body. In order to retrieve this value, we need to use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," which allow us to modify, extract and process responses and data from events. Drag an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action and name it ",(0,t.jsx)(n.code,{children:"Get Project ID"}),". Create a connection from the ",(0,t.jsx)(n.strong,{children:"Create a new Project in Cado Response"})," action to it. Then modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .create_a_new_project_in_cado_response.body.id}}",\n "regexp": "\\\\d*",\n "to": "created_project_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON will extract the Project ID from the previous response, and will store it in the ",(0,t.jsx)(n.code,{children:"{{ .get_project_id.created_project_id | first }}"})," variable."]}),"\n",(0,t.jsx)(n.h3,{id:"action-triggering-a-ec2-acquisition",children:"Action: Triggering a EC2 Acquisition"}),"\n",(0,t.jsxs)(n.p,{children:["Drag a ",(0,t.jsx)(n.strong,{children:"Trigger an EC2 Disk Acquisition in Cado Response"})," action from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar and create a connection from the ",(0,t.jsx)(n.strong,{children:"Get Project ID"})," action."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"URL"})," to the following: ",(0,t.jsx)(n.code,{children:"{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{.get_project_id.created_project_id | first }}/imports/ec2"})," to use the Project ID that was generated earlier on in the workflow."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"Payload"})," section to match the following: ",(0,t.jsx)(n.em,{children:"(It may be easier to switch to the Plain Code view and paste this in)"})]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "compress": "true",\n "include_disks": "true",\n "include_hash": "false",\n "include_logs": "true",\n "include_screenshot": "true",\n "instance_id": "{{.ec2_webhook.body.ec2_instance_id}}",\n "bucket": "{{ .bucket | default: .RESOURCE.cadoresponse_default_s3_bucket }}",\n "region": "{{.ec2_webhook.body.ec2_instance_region}}"\n}\n'})}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsx)(n.p,{children:"Change BUCKET_NAME into the code into an appropriate S3 bucket!"})}),"\n",(0,t.jsx)(n.p,{children:"This JSON code will tell Cado Response to acquire the disk from the EC2 instance described in the form, using the default acquisition settings."}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Pipeline ID in the response body. In order to retrieve this value, drag an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action and name it ",(0,t.jsx)(n.code,{children:"Get Pipeline ID"}),". Create a connection from the ",(0,t.jsx)(n.strong,{children:"Trigger an EC2 Disk Acquisition in Cado Response"})," action to it. Then modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .trigger_an_ec2_disk_acquisition_in_cado_response.body.pipeline_id}} }}",\n "regexp": "\\\\d*",\n "to": "created_pipeline_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON will extract the Pipeline ID from the previous response, and will store it in the ",(0,t.jsx)(n.code,{children:"{{ .get_pipeline_id.created_pipeline_id | first }}"})," variable."]}),"\n",(0,t.jsx)(n.h3,{id:"action-looping-over-pipeline-status",children:"Action: Looping over Pipeline Status"}),"\n",(0,t.jsxs)(n.p,{children:["This is the most complicated part of this example, as it requires a loop, which we can achieve by using two ",(0,t.jsx)(n.strong,{children:"Trigger"})," actions. First, drag a ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado Response"})," action from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar and create a connection from the ",(0,t.jsx)(n.strong,{children:"Get Pipeline ID"})," action."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"Payload"})," section to match the following: ",(0,t.jsx)(n.em,{children:"(It may be easier to switch to the Plain Code view and paste this in)"})]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "project_id": "{{.get_project_id.created_project_id | first }}",\n "pipeline_id": "{{ .get_new_pipeline_id.created_pipeline_id | first }}"\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"This JSON code will retrieve the new Project and Pipeline ID and will tell Cado Response which Pipeline we need to retrieve."}),"\n",(0,t.jsxs)(n.p,{children:["In order to create a loop, we need to drag two ",(0,t.jsx)(n.strong,{children:"Trigger"})," actions to the story. Name one ",(0,t.jsx)(n.code,{children:"Check if Pipeline is Terminated"}),", and the other ",(0,t.jsx)(n.code,{children:"Check if Pipeline isn't Terminated"}),". Create a connection from the ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado Response"})," action for each of them."]}),"\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline is Terminated"})," action, modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "rules": [\n {\n "type": "regex",\n "value": "true",\n "path": "{{ .get_details_for_a_pipeline_in_cado_response.body[0].terminated }}"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON code will check if the pipeline has the ",(0,t.jsx)(n.code,{children:"terminated"})," flag set to ",(0,t.jsx)(n.code,{children:"true"}),". Meaning the pipeline has finished."]}),"\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline isn't Terminated"})," action, modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "rules": [\n {\n "type": "regex",\n "value": "false",\n "path": "{{ .get_details_for_a_pipeline_in_cado_response.body[0].terminated }}"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON code will check if the pipeline has the ",(0,t.jsx)(n.code,{children:"terminated"})," flag set to ",(0,t.jsx)(n.code,{children:"false"}),". Meaning the pipeline hasn't finished."]}),"\n",(0,t.jsxs)(n.p,{children:["Once you have done that, we can re-trigger the ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado Response"})," by dragging an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action to the story and making a connection from the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline isn't Terminated"})," action to it. Then you can modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "delay",\n "seconds": 60\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This will stop execution for 60 seconds, and by creating a connection from it back to the ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado Response"})," action, we can effectively create a looping function. However, every good loop must have an exit condition, which is the role of ",(0,t.jsx)(n.strong,{children:"Check if Pipeline is Terminated"}),"."]}),"\n",(0,t.jsx)(n.h3,{id:"action-sending-an-email",children:"Action: Sending an Email"}),"\n",(0,t.jsxs)(n.p,{children:["Once the Pipeline has finished, we'll want to email the user saying the pipeline has finished. To do this, drag an ",(0,t.jsx)(n.strong,{children:"Email"})," action from the sidebar to the story and make a connection from the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline is Terminated"})," action. Once done, modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "recipients": "{{.ec2_webhook.body.email_address}}",\n "subject": "Tines: EC2 Acquisition is finished",\n "body": "Pipeline has finished!"\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"This will send an email address to the email address given to the form, notifying the user the pipeline has finished."}),"\n",(0,t.jsxs)(n.p,{children:["You've now made the example workflow, to test it out, click on the ",(0,t.jsx)(n.strong,{children:"Form"})," tab in the story editor and submit. Once done, you'll need to manually emit the form response in the ",(0,t.jsx)(n.strong,{children:"EC2 Webhook"})," action, by clicking and going to the ",(0,t.jsx)(n.strong,{children:"Events"})," tab in the right-hand sidebar, and clicking ",(0,t.jsx)(n.strong,{children:"emit"})," on the most recent held event."]})]})}function h(e={}){const{wrapper:n}={...(0,s.a)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},7110:(e,n,i)=>{i.d(n,{Z:()=>t});const t=i.p+"assets/images/tines-actions-5174c3c023f735b4b45782747ac4af44.png"},6343:(e,n,i)=>{i.d(n,{Z:()=>t});const t=i.p+"assets/images/tines-form-47a5eecdbda685957aa11d9f64a5df92.png"},6675:(e,n,i)=>{i.d(n,{Z:()=>t});const t=i.p+"assets/images/tines-story-de36b629830df72c430b4b1a77f23516.png"},1151:(e,n,i)=>{i.d(n,{Z:()=>a,a:()=>o});var t=i(7294);const s={},r=t.createContext(s);function o(e){const n=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),t.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/cc7fbe29.f967413c.js b/assets/js/cc7fbe29.f967413c.js new file mode 100644 index 000000000..e13e968d9 --- /dev/null +++ b/assets/js/cc7fbe29.f967413c.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1668],{7486:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>c});var t=i(5893),s=i(1151);const r={title:"Tines",hide_title:!0,sidebar_position:4},o="Tines Integration",a={id:"cado-response/manage/integrations/soar/tines",title:"Tines",description:"Tines is a no-code automation platform for security analysts. Tines allows analysts to spend less time on routine repetitive tasks and allow them to focus on those areas where they can have the most impact. The tools feature pre-configured integrations with a variety of business and security tools, but for more sophisticated users, it also features the ability to hook into any publicly available API, including the Cado API.",source:"@site/docs/cado-response/manage/integrations/soar/tines.md",sourceDirName:"cado-response/manage/integrations/soar",slug:"/cado-response/manage/integrations/soar/tines",permalink:"/cado-response/manage/integrations/soar/tines",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/soar/tines.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:4,frontMatter:{title:"Tines",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"SIEM",permalink:"/cado-response/manage/integrations/siem"},next:{title:"Splunk SOAR",permalink:"/cado-response/manage/integrations/soar/splunk-soar"}},l={},c=[{value:"Getting Started with Tines",id:"getting-started-with-tines",level:2},{value:"Contents",id:"contents",level:3},{value:"Creating and Storing an API Access Key",id:"creating-and-storing-an-api-access-key",level:3},{value:"Adding your Platform Base URL",id:"adding-your-platform-base-url",level:3},{value:"Adding Default Values",id:"adding-default-values",level:3},{value:"Testing your Settings",id:"testing-your-settings",level:3},{value:"List of Actions",id:"list-of-actions",level:2},{value:"Contents",id:"contents-1",level:3},{value:"List EC2 Instances",id:"list-ec2-instances",level:3},{value:"Changing the Default URL",id:"changing-the-default-url",level:4},{value:"Changing the Payload Parameters",id:"changing-the-payload-parameters",level:4},{value:"List S3 Buckets",id:"list-s3-buckets",level:3},{value:"Changing the Default URL",id:"changing-the-default-url-1",level:4},{value:"List Projects",id:"list-projects",level:3},{value:"List Project Pipelines",id:"list-project-pipelines",level:3},{value:"Changing the Payload Parameters",id:"changing-the-payload-parameters-1",level:4},{value:"Create a Project",id:"create-a-project",level:3},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters-",level:4},{value:"Extracting the Return Value",id:"extracting-the-return-value",level:4},{value:"Retrieve a Pipeline",id:"retrieve-a-pipeline",level:3},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters--1",level:4},{value:"Acquire a Disk Image From EC2",id:"acquire-a-disk-image-from-ec2",level:3},{value:"Changing the Default URL",id:"changing-the-default-url-2",level:4},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters--2",level:4},{value:"Extracting the Return Value",id:"extracting-the-return-value-1",level:4},{value:"Acquire a Disk Image From S3",id:"acquire-a-disk-image-from-s3",level:3},{value:"Changing the Default URL",id:"changing-the-default-url-3",level:4},{value:"Changing the Payload Parameters-",id:"changing-the-payload-parameters--3",level:4},{value:"Extracting the Return Value",id:"extracting-the-return-value-2",level:4},{value:"Creating a Story: Acquiring an EC2 Instance",id:"creating-a-story-acquiring-an-ec2-instance",level:2},{value:"Contents",id:"contents-2",level:3},{value:"Creating the Form",id:"creating-the-form",level:3},{value:"Action: Creating the Project",id:"action-creating-the-project",level:3},{value:"Action: Triggering a EC2 Acquisition",id:"action-triggering-a-ec2-acquisition",level:3},{value:"Action: Looping over Pipeline Status",id:"action-looping-over-pipeline-status",level:3},{value:"Action: Sending an Email",id:"action-sending-an-email",level:3}];function d(e){const n={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,s.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"tines-integration",children:"Tines Integration"}),"\n",(0,t.jsx)(n.p,{children:"Tines is a no-code automation platform for security analysts. Tines allows analysts to spend less time on routine repetitive tasks and allow them to focus on those areas where they can have the most impact. The tools feature pre-configured integrations with a variety of business and security tools, but for more sophisticated users, it also features the ability to hook into any publicly available API, including the Cado API."}),"\n",(0,t.jsxs)(n.p,{children:["By using the Cado Response integration with Tines, we're allowing security analysts to quickly automate Incident Response and allow them to quickly respond to attacks for further investigation in the Cado Response platform. The Tines and Cado Response integration is easy to use, just search for ",(0,t.jsx)(n.strong,{children:"Cado Security"})," in the Public Templates repository, choose, and then drag and drop."]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["If you're confused by the terminology mentioned here, or have never used Tines before, please consider checking out the ",(0,t.jsx)(n.a,{href:"https://hub.tines.com/docs/quickstart",children:"Tines documentation"}),"."]})}),"\n",(0,t.jsx)(n.h2,{id:"getting-started-with-tines",children:"Getting Started with Tines"}),"\n",(0,t.jsx)(n.p,{children:"Before properly getting started please see the following for general instructions on setting up the Cado Response platform for integrating with third-party tools:"}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"/cado-response/manage/integrations/api-overview",children:"Integrations Overview >"})})}),"\n",(0,t.jsx)(n.h3,{id:"contents",children:"Contents"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#adding-your-platform-base-url",children:"Adding your Platform Base URL"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#adding-default-values",children:"Adding Default Values"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#testing-your-settings",children:"Testing your Settings"})})}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"}),"\n",(0,t.jsx)(n.p,{children:"Cado Response allows you to create an API Access Key that allows third-party services to authenticate and interact with a Cado Response instance; you'll need to create one in order to use Tines with Cado Response."}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["Please see ",(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"/cado-response/manage/integrations/api-overview#creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"})})," to learn how to create the API Access Key."]})}),"\n",(0,t.jsxs)(n.p,{children:["In order to add the Secret Key to Tines, you'll need to open your Tines Dashboard, and go to the ",(0,t.jsx)(n.strong,{children:"Credentials"})," page. Add a new ",(0,t.jsx)(n.strong,{children:"Text Credential"})," and name it ",(0,t.jsx)(n.code,{children:"CadoResponse_APIKey"}),"."]}),"\n",(0,t.jsx)(n.admonition,{type:"note",children:(0,t.jsx)(n.p,{children:"It's important to name all credentials and resources mentioned in the tutorial as given, or else the Actions we provide won't be able to interact with the Cado API."})}),"\n",(0,t.jsx)(n.h3,{id:"adding-your-platform-base-url",children:"Adding your Platform Base URL"}),"\n",(0,t.jsxs)(n.p,{children:["To tell Tines the Platform Base URL of a Cado Response instance, you'll need to add it as a Resource. In order to do this, you'll need to open your Tines Dashboard, and go to the ",(0,t.jsx)(n.strong,{children:"Resources"})," page. Click the ",(0,t.jsx)(n.strong,{children:"New Resource"})," button and name it ",(0,t.jsx)(n.code,{children:"Cadoresponse_URL"})," and paste the Platform Base URL into the builder."]}),"\n",(0,t.jsx)(n.h3,{id:"adding-default-values",children:"Adding Default Values"}),"\n",(0,t.jsx)(n.p,{children:"The actions we provide allow you to set default fallback values, in case a form doesn't get filled in properly, or if an analyst misconfigures an action. To add these values, simply create three Resources with the following names:"}),"\n",(0,t.jsxs)(n.table,{children:[(0,t.jsx)(n.thead,{children:(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.th,{children:"Resource Name"}),(0,t.jsx)(n.th,{children:"Type"}),(0,t.jsx)(n.th,{children:"Example"}),(0,t.jsx)(n.th,{children:"Description"})]})}),(0,t.jsxs)(n.tbody,{children:[(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:(0,t.jsx)(n.code,{children:"CadoResponse_Default_Project_ID"})}),(0,t.jsx)(n.td,{children:"Integer"}),(0,t.jsx)(n.td,{children:"1"}),(0,t.jsx)(n.td,{children:"A numerical value that denotes a project in Cado Response."})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:(0,t.jsx)(n.code,{children:"CadoResponse_Default_Region"})}),(0,t.jsx)(n.td,{children:"String"}),(0,t.jsx)(n.td,{children:"us-east-1"}),(0,t.jsx)(n.td,{children:"A valid name of an AWS region."})]}),(0,t.jsxs)(n.tr,{children:[(0,t.jsx)(n.td,{children:(0,t.jsx)(n.code,{children:"CadoResponse_Default_S3_Bucket"})}),(0,t.jsx)(n.td,{children:"String"}),(0,t.jsx)(n.td,{children:"bucket_name"}),(0,t.jsx)(n.td,{children:"A name of a valid and accessible S3 bucket."})]})]})]}),"\n",(0,t.jsx)(n.h3,{id:"testing-your-settings",children:"Testing your Settings"}),"\n",(0,t.jsx)(n.p,{children:"To make sure you've done all the following steps correctly, please follow along with the following test procedure:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:"Create a new story in Tines through the Tines Dashboard."}),"\n",(0,t.jsxs)(n.li,{children:["Drag the ",(0,t.jsx)(n.strong,{children:"List Cado Response Projects"})," HTTP Request template from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar."]}),"\n",(0,t.jsxs)(n.li,{children:["Click the new action and click ",(0,t.jsx)(n.strong,{children:"Run"}),"."]}),"\n",(0,t.jsxs)(n.li,{children:["Check the ",(0,t.jsx)(n.strong,{children:"Action Events"})," for a ",(0,t.jsx)(n.code,{children:"200 OK"})," HTTP code."]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:"If the following was successful, then you've correctly setup Tines to interact with the Cado Response API."}),"\n",(0,t.jsx)(n.h2,{id:"list-of-actions",children:"List of Actions"}),"\n",(0,t.jsxs)(n.p,{children:["Actions are the basic actions that can be chained together in ",(0,t.jsx)(n.em,{children:"Stories"}),", which are playbooks that can be run to perform a specific task or workflow."]}),"\n",(0,t.jsx)(n.admonition,{type:"info",children:(0,t.jsxs)(n.p,{children:["All the list actions are available in the Tines Public Templates repository. Just search for ",(0,t.jsx)(n.strong,{children:"Cado Security"}),", choose the action and drag and drop."]})}),"\n",(0,t.jsx)(n.h3,{id:"contents-1",children:"Contents"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-ec2-instances",children:"List EC2 Instances"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-s3-buckets",children:"List S3 Buckets"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-projects",children:"List Projects"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-project-pipelines",children:"List Project Pipelines"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#create-a-project",children:"Create a Project"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#retrieve-a-pipeline",children:"Retrieve a Pipeline"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"})})}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Tines Actions for the Cado Response API",src:i(7110).Z+"",width:"395",height:"1400"})}),"\n",(0,t.jsx)(n.h3,{id:"list-ec2-instances",children:"List EC2 Instances"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List EC2 Instances in Cado Response"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the EC2 instances in an AWS region."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado Response."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/ec2"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters",children:"Changing the Payload Parameters"}),"\n",(0,t.jsxs)(n.p,{children:["You'll also need to adjust the ",(0,t.jsx)(n.code,{children:"region"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to the valid AWS region you want to see instances listed in."]}),"\n",(0,t.jsx)(n.h3,{id:"list-s3-buckets",children:"List S3 Buckets"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List S3 Buckets in Cado Response"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the S3 buckets in an AWS account."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url-1",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado Response."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/s3"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h3,{id:"list-projects",children:"List Projects"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List Cado Response Projects"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the projects in Cado Response."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects"})]}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"list-project-pipelines",children:"List Project Pipelines"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"List Pipelines for a Cado Response Project"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to list all the pipelines for a given project in Cado Response."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/tasks/pipelines"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters-1",children:"Changing the Payload Parameters"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"project_id"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to a valid Cado Response Project ID."]}),"\n",(0,t.jsx)(n.h3,{id:"create-a-project",children:"Create a Project"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"Create a new Project in Cado Response"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will allow you to create a new project in Cado Response."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{.RESOURCE.cadoresponse_url}}/api/v2/projects"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters-",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.strong,{children:"Payload"})," section you need to change the ",(0,t.jsx)(n.code,{children:"caseName"})," parameter to the name of the project you desire. You can also change the ",(0,t.jsx)(n.code,{children:"description"})," parameter to add a description to your project, or remove it if you don't need one. If you don't add the ",(0,t.jsx)(n.code,{children:"caseName"})," parameter, the action will default to the current UNIX timestamp as the project name. All projects created through Tines will include the ",(0,t.jsx)(n.code,{children:"_TinesProject"})," suffix."]}),"\n",(0,t.jsx)(n.h4,{id:"extracting-the-return-value",children:"Extracting the Return Value"}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Project ID in the response body. You can use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action with the following settings:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .create_a_new_project_in_cado_response.body.id}}",\n "regexp": "\\\\d*",\n "to": "created_project_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"You can then retrieve the value from other actions using the following:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-liquid",children:"{{ .get_new_project_id.created_project_id | first }}\n"})}),"\n",(0,t.jsxs)(n.p,{children:["where ",(0,t.jsx)(n.code,{children:"get_new_project_id"})," is the name of the appropriate Event Transform action in Liquid syntax."]}),"\n",(0,t.jsx)(n.h3,{id:"retrieve-a-pipeline",children:"Retrieve a Pipeline"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"Get Details for a Pipeline in Cado Response"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will retrieve the details of a specific pipeline, including all subtasks."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/tasks/pipelines"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters--1",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"project_id"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to a valid Cado Response Project ID."]}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"pipeline_id"})," parameter in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to a valid Pipeline ID (see ",(0,t.jsx)(n.strong,{children:"Acquisition"})," for more on how to retrieve a Pipeline ID)"]}),"\n",(0,t.jsx)(n.h3,{id:"acquire-a-disk-image-from-ec2",children:"Acquire a Disk Image From EC2"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Template Name: ",(0,t.jsx)(n.code,{children:"Trigger an EC2 Disk Acquisition in Cado Response"})]}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will trigger a disk image acquisition task in Cado Response for a specified EC2 instance."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url-2",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado Response."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/ec2"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/ec2"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters--2",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"instance_id"})," and ",(0,t.jsx)(n.code,{children:"region"})," parameters in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to the appropriate values of the EC2 instance you want to acquire."]}),"\n",(0,t.jsxs)(n.p,{children:["You can include the following optional parameter ",(0,t.jsx)(n.code,{children:"bucket"})," in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to change which S3 bucket the disk image is uploaded to."]}),"\n",(0,t.jsxs)(n.p,{children:["Likewise, you can also provide the following optional parameters in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to change the way Cado Response will acquire the disk image. These are the options and their default values:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:' "compress": true,\n "include_disks": true,\n "include_hash": false,\n "include_logs": true,\n "include_screenshot": true,\n'})}),"\n",(0,t.jsx)(n.h4,{id:"extracting-the-return-value-1",children:"Extracting the Return Value"}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Pipeline ID in the response body. You can use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action with the following settings:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .trigger_an_ec2_disk_acquisition_in_cado_response.body.pipeline_id}} }}",\n "regexp": "\\\\d*",\n "to": "created_pipeline_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"You can then retrieve the value from other actions using the following:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-liquid",children:"{{ .get_new_pipeline_id.created_pipeline_id | first }}\n"})}),"\n",(0,t.jsxs)(n.p,{children:["where ",(0,t.jsx)(n.code,{children:"get_new_pipeline_id"})," is the name of the appropriate Event Transform action in Liquid syntax."]}),"\n",(0,t.jsx)(n.h3,{id:"acquire-a-disk-image-from-s3",children:"Acquire a Disk Image From S3"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Template Name: `Trigger an S3 Disk Acquisition in Cado Response"}),"\n",(0,t.jsx)(n.li,{children:"Description: This action will trigger a disk image acquisition task in Cado Response from a file in a S3 Bucket."}),"\n",(0,t.jsxs)(n.li,{children:["Default URL: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})]}),"\n"]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-default-url-3",children:"Changing the Default URL"}),"\n",(0,t.jsxs)(n.p,{children:["As this API endpoint requires a ",(0,t.jsx)(n.strong,{children:"Project ID"})," you'll need to change the URL field to reflect this by changing the ",(0,t.jsx)(n.code,{children:".projectID"})," placeholder with a valid Project ID from Cado Response."]}),"\n",(0,t.jsxs)(n.p,{children:["For example ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{ .projectID | default: .RESOURCE.cadoresponse_default_project_id }}/imports/s3"})," would become: ",(0,t.jsx)(n.code,{children:"https://{{.RESOURCE.cadoresponse_url}}/api/v2/projects/2/imports/s3"})," for Project ID 2."]}),"\n",(0,t.jsx)(n.h4,{id:"changing-the-payload-parameters--3",children:"Changing the Payload Parameters-"}),"\n",(0,t.jsxs)(n.p,{children:["You'll need to change the ",(0,t.jsx)(n.code,{children:"bucket"})," and ",(0,t.jsx)(n.code,{children:"file_name"})," parameters in the ",(0,t.jsx)(n.strong,{children:"Payload"})," to the appropriate values of the file in the S3 bucket you want to acquire and process."]}),"\n",(0,t.jsx)(n.h4,{id:"extracting-the-return-value-2",children:"Extracting the Return Value"}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Pipeline ID in the response body. You can use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action with the following settings:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .trigger_an_s3_disk_acquisition_in_cado_response.body.pipelines[0].pipeline_id}} }}",\n "regexp": "\\\\d*",\n "to": "created_pipeline_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"You can then retrieve the value from other actions using the following:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-liquid",children:"{{ .get_new_pipeline_id.created_pipeline_id | first }}\n"})}),"\n",(0,t.jsxs)(n.p,{children:["where ",(0,t.jsx)(n.code,{children:"get_new_pipeline_id"})," is the name of the appropriate Event Transform action in Liquid syntax."]}),"\n",(0,t.jsx)(n.h2,{id:"creating-a-story-acquiring-an-ec2-instance",children:"Creating a Story: Acquiring an EC2 Instance"}),"\n",(0,t.jsx)(n.admonition,{type:"note",children:(0,t.jsx)(n.p,{children:"If you have a good grasp of the basics of Tines, feel free to skip this section."})}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Tines Example Story for Acquiring an EC2 Instance",src:i(6675).Z+"",width:"433",height:"650"})}),"\n",(0,t.jsx)(n.p,{children:"This section covers a quick tutorial in creating a basic workflow (or story in Tines terms) that:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Allows users to specify details in a form"}),"\n",(0,t.jsx)(n.li,{children:"Creates a new Project"}),"\n",(0,t.jsx)(n.li,{children:"Triggers an EC2 Disk Acquisition"}),"\n",(0,t.jsx)(n.li,{children:"Loops over a pipeline until it has been terminated"}),"\n",(0,t.jsx)(n.li,{children:"Emails the user a success message"}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["You can download the finished story example here: ** ",(0,t.jsx)(n.a,{href:"https://cado-public.s3.amazonaws.com/integrations/cado-response-tines-story.json",children:"Cado Response Basic Story: Create a Project and Acquire EC2 Disk >"})," **"]})}),"\n",(0,t.jsx)(n.h3,{id:"contents-2",children:"Contents"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-ec2-instances",children:"List EC2 Instances"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-s3-buckets",children:"List S3 Buckets"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-projects",children:"List Projects"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#list-project-pipelines",children:"List Project Pipelines"})})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.strong,{children:(0,t.jsx)(n.a,{href:"#create-a-project",children:"Create a Project"})})}),"\n"]}),"\n",(0,t.jsx)(n.h3,{id:"creating-the-form",children:"Creating the Form"}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Tines Example Form for Acquiring an EC2 Instance",src:i(6343).Z+"",width:"351",height:"697"})}),"\n",(0,t.jsxs)(n.p,{children:["To create a form in Tines, head to the story editor and click the ",(0,t.jsx)(n.strong,{children:"Form"})," tab. Using the sidebar, add 4 text fields:"]}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["One for the new Project Name. Name this field ",(0,t.jsx)(n.code,{children:"Project Name"})," and make it required."]}),"\n",(0,t.jsxs)(n.li,{children:["One for the EC2 Instance ID. Name this field ",(0,t.jsx)(n.code,{children:"EC2 Instance ID"})," and make it required."]}),"\n",(0,t.jsxs)(n.li,{children:["One for the EC2 Instance Region. Name this field ",(0,t.jsx)(n.code,{children:"EC2 Instance Region"})," and make it required."]}),"\n",(0,t.jsxs)(n.li,{children:["One fort the email address of the user. Name this field ",(0,t.jsx)(n.code,{children:"Email Address"})," and make it required."]}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsx)(n.p,{children:"We'll use these values throughout the rest of this tutorial, so make sure the names match as above."})}),"\n",(0,t.jsxs)(n.p,{children:["Go back to the ",(0,t.jsx)(n.strong,{children:"Story"})," tab inside the story editor and drag a new ",(0,t.jsx)(n.strong,{children:"Webhook"})," action to the story. Change its name to ",(0,t.jsx)(n.code,{children:"EC2 Webhook"}),". After this, go back into the ",(0,t.jsx)(n.strong,{children:"Form"})," tab and change the ",(0,t.jsx)(n.strong,{children:"Receiving Action"})," in the sidebar to ",(0,t.jsx)(n.code,{children:"EC2 Webhook"}),". This will allow your story to retrieve values from the form."]}),"\n",(0,t.jsx)(n.h3,{id:"action-creating-the-project",children:"Action: Creating the Project"}),"\n",(0,t.jsxs)(n.p,{children:["Return to the ",(0,t.jsx)(n.strong,{children:"Story"})," tab inside the story editor, and drag a ",(0,t.jsx)(n.strong,{children:"Create a new Project in Cado Response"})," action from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar and create a connection from the ",(0,t.jsx)(n.strong,{children:"EC2 Webhook"})," action to it."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"Payload"})," section to match the following: ",(0,t.jsx)(n.em,{children:"(It may be easier to switch to the Plain Code view and paste this in)"})]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "caseName": "{{.ec2_webhook.body.project_name | default: \\"now\\" | date: \\"%s\\" | append: \\"_TinesProject\\" }}",\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON code will retrieve the project name from the form, and will send it to the Cado Response API. You can optionally add the ",(0,t.jsx)(n.code,{children:"description"})," parameter to the ",(0,t.jsx)(n.strong,{children:"Payload"})," to give your new project a description."]}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Project ID in the response body. In order to retrieve this value, we need to use an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," which allow us to modify, extract and process responses and data from events. Drag an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action and name it ",(0,t.jsx)(n.code,{children:"Get Project ID"}),". Create a connection from the ",(0,t.jsx)(n.strong,{children:"Create a new Project in Cado Response"})," action to it. Then modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .create_a_new_project_in_cado_response.body.id}}",\n "regexp": "\\\\d*",\n "to": "created_project_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON will extract the Project ID from the previous response, and will store it in the ",(0,t.jsx)(n.code,{children:"{{ .get_project_id.created_project_id | first }}"})," variable."]}),"\n",(0,t.jsx)(n.h3,{id:"action-triggering-a-ec2-acquisition",children:"Action: Triggering a EC2 Acquisition"}),"\n",(0,t.jsxs)(n.p,{children:["Drag a ",(0,t.jsx)(n.strong,{children:"Trigger an EC2 Disk Acquisition in Cado Response"})," action from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar and create a connection from the ",(0,t.jsx)(n.strong,{children:"Get Project ID"})," action."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"URL"})," to the following: ",(0,t.jsx)(n.code,{children:"{{.RESOURCE.cadoresponse_url}}/api/v2/projects/{{.get_project_id.created_project_id | first }}/imports/ec2"})," to use the Project ID that was generated earlier on in the workflow."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"Payload"})," section to match the following: ",(0,t.jsx)(n.em,{children:"(It may be easier to switch to the Plain Code view and paste this in)"})]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "compress": "true",\n "include_disks": "true",\n "include_hash": "false",\n "include_logs": "true",\n "include_screenshot": "true",\n "instance_id": "{{.ec2_webhook.body.ec2_instance_id}}",\n "bucket": "{{ .bucket | default: .RESOURCE.cadoresponse_default_s3_bucket }}",\n "region": "{{.ec2_webhook.body.ec2_instance_region}}"\n}\n'})}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsx)(n.p,{children:"Change BUCKET_NAME into the code into an appropriate S3 bucket!"})}),"\n",(0,t.jsx)(n.p,{children:"This JSON code will tell Cado Response to acquire the disk from the EC2 instance described in the form, using the default acquisition settings."}),"\n",(0,t.jsxs)(n.p,{children:["This action will return the newly created Pipeline ID in the response body. In order to retrieve this value, drag an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action and name it ",(0,t.jsx)(n.code,{children:"Get Pipeline ID"}),". Create a connection from the ",(0,t.jsx)(n.strong,{children:"Trigger an EC2 Disk Acquisition in Cado Response"})," action to it. Then modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "extract",\n "matchers": [\n {\n "path": "{{ .trigger_an_ec2_disk_acquisition_in_cado_response.body.pipeline_id}} }}",\n "regexp": "\\\\d*",\n "to": "created_pipeline_id"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON will extract the Pipeline ID from the previous response, and will store it in the ",(0,t.jsx)(n.code,{children:"{{ .get_pipeline_id.created_pipeline_id | first }}"})," variable."]}),"\n",(0,t.jsx)(n.h3,{id:"action-looping-over-pipeline-status",children:"Action: Looping over Pipeline Status"}),"\n",(0,t.jsxs)(n.p,{children:["This is the most complicated part of this example, as it requires a loop, which we can achieve by using two ",(0,t.jsx)(n.strong,{children:"Trigger"})," actions. First, drag a ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado Response"})," action from the ",(0,t.jsx)(n.strong,{children:"Public Templates"})," repository in the left-hand sidebar and create a connection from the ",(0,t.jsx)(n.strong,{children:"Get Pipeline ID"})," action."]}),"\n",(0,t.jsxs)(n.p,{children:["Modify the ",(0,t.jsx)(n.strong,{children:"Payload"})," section to match the following: ",(0,t.jsx)(n.em,{children:"(It may be easier to switch to the Plain Code view and paste this in)"})]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "project_id": "{{.get_project_id.created_project_id | first }}",\n "pipeline_id": "{{ .get_new_pipeline_id.created_pipeline_id | first }}"\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"This JSON code will retrieve the new Project and Pipeline ID and will tell Cado Response which Pipeline we need to retrieve."}),"\n",(0,t.jsxs)(n.p,{children:["In order to create a loop, we need to drag two ",(0,t.jsx)(n.strong,{children:"Trigger"})," actions to the story. Name one ",(0,t.jsx)(n.code,{children:"Check if Pipeline is Terminated"}),", and the other ",(0,t.jsx)(n.code,{children:"Check if Pipeline isn't Terminated"}),". Create a connection from the ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado Response"})," action for each of them."]}),"\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline is Terminated"})," action, modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "rules": [\n {\n "type": "regex",\n "value": "true",\n "path": "{{ .get_details_for_a_pipeline_in_cado_response.body[0].terminated }}"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON code will check if the pipeline has the ",(0,t.jsx)(n.code,{children:"terminated"})," flag set to ",(0,t.jsx)(n.code,{children:"true"}),". Meaning the pipeline has finished."]}),"\n",(0,t.jsxs)(n.p,{children:["In the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline isn't Terminated"})," action, modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," section to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "rules": [\n {\n "type": "regex",\n "value": "false",\n "path": "{{ .get_details_for_a_pipeline_in_cado_response.body[0].terminated }}"\n }\n ]\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This JSON code will check if the pipeline has the ",(0,t.jsx)(n.code,{children:"terminated"})," flag set to ",(0,t.jsx)(n.code,{children:"false"}),". Meaning the pipeline hasn't finished."]}),"\n",(0,t.jsxs)(n.p,{children:["Once you have done that, we can re-trigger the ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado Response"})," by dragging an ",(0,t.jsx)(n.strong,{children:"Event Transform"})," action to the story and making a connection from the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline isn't Terminated"})," action to it. Then you can modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "mode": "delay",\n "seconds": 60\n}\n'})}),"\n",(0,t.jsxs)(n.p,{children:["This will stop execution for 60 seconds, and by creating a connection from it back to the ",(0,t.jsx)(n.strong,{children:"Get Details for a Pipeline in Cado Response"})," action, we can effectively create a looping function. However, every good loop must have an exit condition, which is the role of ",(0,t.jsx)(n.strong,{children:"Check if Pipeline is Terminated"}),"."]}),"\n",(0,t.jsx)(n.h3,{id:"action-sending-an-email",children:"Action: Sending an Email"}),"\n",(0,t.jsxs)(n.p,{children:["Once the Pipeline has finished, we'll want to email the user saying the pipeline has finished. To do this, drag an ",(0,t.jsx)(n.strong,{children:"Email"})," action from the sidebar to the story and make a connection from the ",(0,t.jsx)(n.strong,{children:"Check if Pipeline is Terminated"})," action. Once done, modify the ",(0,t.jsx)(n.strong,{children:"Editor"})," to match the following:"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-json",children:'{\n "recipients": "{{.ec2_webhook.body.email_address}}",\n "subject": "Tines: EC2 Acquisition is finished",\n "body": "Pipeline has finished!"\n}\n'})}),"\n",(0,t.jsx)(n.p,{children:"This will send an email address to the email address given to the form, notifying the user the pipeline has finished."}),"\n",(0,t.jsxs)(n.p,{children:["You've now made the example workflow, to test it out, click on the ",(0,t.jsx)(n.strong,{children:"Form"})," tab in the story editor and submit. Once done, you'll need to manually emit the form response in the ",(0,t.jsx)(n.strong,{children:"EC2 Webhook"})," action, by clicking and going to the ",(0,t.jsx)(n.strong,{children:"Events"})," tab in the right-hand sidebar, and clicking ",(0,t.jsx)(n.strong,{children:"emit"})," on the most recent held event."]})]})}function h(e={}){const{wrapper:n}={...(0,s.a)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},7110:(e,n,i)=>{i.d(n,{Z:()=>t});const t=i.p+"assets/images/tines-actions-5174c3c023f735b4b45782747ac4af44.png"},6343:(e,n,i)=>{i.d(n,{Z:()=>t});const t=i.p+"assets/images/tines-form-47a5eecdbda685957aa11d9f64a5df92.png"},6675:(e,n,i)=>{i.d(n,{Z:()=>t});const t=i.p+"assets/images/tines-story-de36b629830df72c430b4b1a77f23516.png"},1151:(e,n,i)=>{i.d(n,{Z:()=>a,a:()=>o});var t=i(7294);const s={},r=t.createContext(s);function o(e){const n=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),t.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d0643871.280ee6a8.js b/assets/js/d0643871.280ee6a8.js new file mode 100644 index 000000000..94fd53e92 --- /dev/null +++ b/assets/js/d0643871.280ee6a8.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[996],{9508:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>m,frontMatter:()=>s,metadata:()=>i,toc:()=>l});var a=n(5893),o=n(1151);const s={title:"Cost Management",hide_title:!0,sidebar_position:11},r="Estimating the costs for running the Cado platform in AWS",i={id:"cado-response/manage/cost-management",title:"Cost Management",description:"You can view the AWS Cost Calculator for a typical Cado installation at https://calculator.s3.amazonaws.com/index.html#r=IAD&key=files/calc-bca484373bcb2d07322fd6716a197d1cdc629534&v=ver20210903uJ",source:"@site/docs/cado-response/manage/cost-management.md",sourceDirName:"cado-response/manage",slug:"/cado-response/manage/cost-management",permalink:"/cado-response/manage/cost-management",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/cost-management.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:11,frontMatter:{title:"Cost Management",hide_title:!0,sidebar_position:11},sidebar:"tutorialSidebar",previous:{title:"Health Monitoring",permalink:"/cado-response/manage/monitoring"},next:{title:"Summary",permalink:"/cado-response/community-edition/community-intro"}},c={},l=[];function d(e){const t={a:"a",h1:"h1",li:"li",p:"p",ul:"ul",...(0,o.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.h1,{id:"estimating-the-costs-for-running-the-cado-platform-in-aws",children:"Estimating the costs for running the Cado platform in AWS"}),"\n",(0,a.jsxs)(t.p,{children:["You can view the AWS Cost Calculator for a typical Cado installation at ",(0,a.jsx)(t.a,{href:"https://calculator.s3.amazonaws.com/index.html#r=IAD&key=files/calc-bca484373bcb2d07322fd6716a197d1cdc629534&v=ver20210903uJ",children:"https://calculator.s3.amazonaws.com/index.html#r=IAD&key=files/calc-bca484373bcb2d07322fd6716a197d1cdc629534&v=ver20210903uJ"})]}),"\n",(0,a.jsx)(t.p,{children:"This includes:"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsx)(t.li,{children:"A central platform server running permanently with 500 GB of space for hot data access"}),"\n",(0,a.jsx)(t.li,{children:"36.5 hours (5% of the time) worker usage to process data"}),"\n",(0,a.jsx)(t.li,{children:"500 GB of permanent S3 Storage used for forensic images"}),"\n",(0,a.jsx)(t.li,{children:"50 GB of Elastic File System Storage used for file transfer downloads"}),"\n"]})]})}function m(e={}){const{wrapper:t}={...(0,o.a)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(d,{...e})}):d(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>i,a:()=>r});var a=n(7294);const o={},s=a.createContext(o);function r(e){const t=a.useContext(s);return a.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),a.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d0643871.d802cc3c.js b/assets/js/d0643871.d802cc3c.js deleted file mode 100644 index 2dc9f2a5a..000000000 --- a/assets/js/d0643871.d802cc3c.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[996],{9508:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>m,frontMatter:()=>s,metadata:()=>i,toc:()=>l});var a=n(5893),o=n(1151);const s={title:"Cost Management",hide_title:!0,sidebar_position:11},r="Estimating the costs for running the Cado platform in AWS",i={id:"cado-response/manage/cost-management",title:"Cost Management",description:"You can view the AWS Cost Calculator for a typical Cado installation at https://calculator.s3.amazonaws.com/index.html#r=IAD&key=files/calc-bca484373bcb2d07322fd6716a197d1cdc629534&v=ver20210903uJ",source:"@site/docs/cado-response/manage/cost-management.md",sourceDirName:"cado-response/manage",slug:"/cado-response/manage/cost-management",permalink:"/cado-response/manage/cost-management",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/cost-management.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:11,frontMatter:{title:"Cost Management",hide_title:!0,sidebar_position:11},sidebar:"tutorialSidebar",previous:{title:"Health Monitoring",permalink:"/cado-response/manage/monitoring"},next:{title:"Summary",permalink:"/cado-response/community-edition/community-intro"}},c={},l=[];function d(e){const t={a:"a",h1:"h1",li:"li",p:"p",ul:"ul",...(0,o.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.h1,{id:"estimating-the-costs-for-running-the-cado-platform-in-aws",children:"Estimating the costs for running the Cado platform in AWS"}),"\n",(0,a.jsxs)(t.p,{children:["You can view the AWS Cost Calculator for a typical Cado installation at ",(0,a.jsx)(t.a,{href:"https://calculator.s3.amazonaws.com/index.html#r=IAD&key=files/calc-bca484373bcb2d07322fd6716a197d1cdc629534&v=ver20210903uJ",children:"https://calculator.s3.amazonaws.com/index.html#r=IAD&key=files/calc-bca484373bcb2d07322fd6716a197d1cdc629534&v=ver20210903uJ"})]}),"\n",(0,a.jsx)(t.p,{children:"This includes:"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsx)(t.li,{children:"A central platform server running permanently with 500 GB of space for hot data access"}),"\n",(0,a.jsx)(t.li,{children:"36.5 hours (5% of the time) worker usage to process data"}),"\n",(0,a.jsx)(t.li,{children:"500 GB of permanent S3 Storage used for forensic images"}),"\n",(0,a.jsx)(t.li,{children:"50 GB of Elastic File System Storage used for file transfer downloads"}),"\n"]})]})}function m(e={}){const{wrapper:t}={...(0,o.a)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(d,{...e})}):d(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>i,a:()=>r});var a=n(7294);const o={},s=a.createContext(o);function r(e){const t=a.useContext(s);return a.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),a.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d561bd6f.5a7aef24.js b/assets/js/d561bd6f.5a7aef24.js deleted file mode 100644 index 0b4919c24..000000000 --- a/assets/js/d561bd6f.5a7aef24.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3198],{7595:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>a,contentTitle:()=>n,default:()=>l,frontMatter:()=>i,metadata:()=>c,toc:()=>p});var r=t(5893),s=t(1151);const i={title:"Google Cloud Storage",hide_title:!0,sidebar_position:2},n="Google Cloud Storage Support",c={id:"cado-response/discovery-import/import/gcp/storage",title:"Google Cloud Storage",description:"The Cado platform supports acquistion of data from GCP Storage Buckets. The two main use cases for this are:",source:"@site/docs/cado-response/discovery-import/import/gcp/storage.md",sourceDirName:"cado-response/discovery-import/import/gcp",slug:"/cado-response/discovery-import/import/gcp/storage",permalink:"/cado-response/discovery-import/import/gcp/storage",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/gcp/storage.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"Google Cloud Storage",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Google Compute Engine",permalink:"/cado-response/discovery-import/import/gcp/engine-instance"},next:{title:"Google Cloud Kubernetes Engine",permalink:"/cado-response/discovery-import/import/gcp/kubernetes-engine"}},a={},p=[{value:"Uploading On-Premise evidence to GCP Storage for Import",id:"uploading-on-premise-evidence-to-gcp-storage-for-import",level:2}];function d(e){const o={a:"a",h1:"h1",h2:"h2",img:"img",li:"li",p:"p",ul:"ul",...(0,s.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(o.h1,{id:"google-cloud-storage-support",children:"Google Cloud Storage Support"}),"\n",(0,r.jsx)(o.p,{children:"The Cado platform supports acquistion of data from GCP Storage Buckets. The two main use cases for this are:"}),"\n",(0,r.jsxs)(o.ul,{children:["\n",(0,r.jsx)(o.li,{children:"Analyzing disk images or zip files that have been uploaded to an Azure Blob Storage continer as part of an investigation"}),"\n",(0,r.jsx)(o.li,{children:"Analyzing the contents of a GCP Storage Bucket for any uploaded content that could be part of an incident"}),"\n"]}),"\n",(0,r.jsx)(o.p,{children:"Select the project you require, select the bucket and then select the objects to import."}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Import GCP Storage",src:t(863).Z+"",width:"1796",height:"758"})}),"\n",(0,r.jsx)(o.h2,{id:"uploading-on-premise-evidence-to-gcp-storage-for-import",children:"Uploading On-Premise evidence to GCP Storage for Import"}),"\n",(0,r.jsxs)(o.p,{children:["You can use the ",(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/",children:"GCP Console"})," to upload data from your web browser if you have access to it."]}),"\n",(0,r.jsxs)(o.p,{children:["Alternatively, you can use ",(0,r.jsx)(o.a,{href:"https://docs.cyberduck.io/protocols/google_cloud_storage/",children:"oAuth 2.0 Access"})," with a Desktop GUI tool such as ",(0,r.jsx)(o.a,{href:"https://cyberduck.io/",children:"Cyberduck"})," to easily upload files from your desktop, with support for functionality such as resuming failed uploads."]}),"\n",(0,r.jsxs)(o.p,{children:["We reccomend scoping access by giving the associated role ",(0,r.jsx)(o.a,{href:"https://stackoverflow.com/questions/57147765/gcp-write-only-access-to-bucket-gcs",children:"write-only"})," access."]})]})}function l(e={}){const{wrapper:o}={...(0,s.a)(),...e.components};return o?(0,r.jsx)(o,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},863:(e,o,t)=>{t.d(o,{Z:()=>r});const r=t.p+"assets/images/google-cloud-storage-4e82160612df4ceacb5b5934df3de5ba.png"},1151:(e,o,t)=>{t.d(o,{Z:()=>c,a:()=>n});var r=t(7294);const s={},i=r.createContext(s);function n(e){const o=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function c(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:n(e.components),r.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d561bd6f.6fe6e296.js b/assets/js/d561bd6f.6fe6e296.js new file mode 100644 index 000000000..34dfc5d34 --- /dev/null +++ b/assets/js/d561bd6f.6fe6e296.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3198],{7595:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>a,contentTitle:()=>n,default:()=>l,frontMatter:()=>i,metadata:()=>c,toc:()=>p});var r=t(5893),s=t(1151);const i={title:"Google Cloud Storage",hide_title:!0,sidebar_position:2},n="Google Cloud Storage Support",c={id:"cado-response/discovery-import/import/gcp/storage",title:"Google Cloud Storage",description:"The Cado platform supports acquistion of data from GCP Storage Buckets. The two main use cases for this are:",source:"@site/docs/cado-response/discovery-import/import/gcp/storage.md",sourceDirName:"cado-response/discovery-import/import/gcp",slug:"/cado-response/discovery-import/import/gcp/storage",permalink:"/cado-response/discovery-import/import/gcp/storage",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/gcp/storage.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"Google Cloud Storage",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Google Compute Engine",permalink:"/cado-response/discovery-import/import/gcp/engine-instance"},next:{title:"Google Cloud Kubernetes Engine",permalink:"/cado-response/discovery-import/import/gcp/kubernetes-engine"}},a={},p=[{value:"Uploading On-Premise evidence to GCP Storage for Import",id:"uploading-on-premise-evidence-to-gcp-storage-for-import",level:2}];function d(e){const o={a:"a",h1:"h1",h2:"h2",img:"img",li:"li",p:"p",ul:"ul",...(0,s.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(o.h1,{id:"google-cloud-storage-support",children:"Google Cloud Storage Support"}),"\n",(0,r.jsx)(o.p,{children:"The Cado platform supports acquistion of data from GCP Storage Buckets. The two main use cases for this are:"}),"\n",(0,r.jsxs)(o.ul,{children:["\n",(0,r.jsx)(o.li,{children:"Analyzing disk images or zip files that have been uploaded to an Azure Blob Storage continer as part of an investigation"}),"\n",(0,r.jsx)(o.li,{children:"Analyzing the contents of a GCP Storage Bucket for any uploaded content that could be part of an incident"}),"\n"]}),"\n",(0,r.jsx)(o.p,{children:"Select the project you require, select the bucket and then select the objects to import."}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Import GCP Storage",src:t(863).Z+"",width:"1796",height:"758"})}),"\n",(0,r.jsx)(o.h2,{id:"uploading-on-premise-evidence-to-gcp-storage-for-import",children:"Uploading On-Premise evidence to GCP Storage for Import"}),"\n",(0,r.jsxs)(o.p,{children:["You can use the ",(0,r.jsx)(o.a,{href:"https://console.cloud.google.com/",children:"GCP Console"})," to upload data from your web browser if you have access to it."]}),"\n",(0,r.jsxs)(o.p,{children:["Alternatively, you can use ",(0,r.jsx)(o.a,{href:"https://docs.cyberduck.io/protocols/google_cloud_storage/",children:"oAuth 2.0 Access"})," with a Desktop GUI tool such as ",(0,r.jsx)(o.a,{href:"https://cyberduck.io/",children:"Cyberduck"})," to easily upload files from your desktop, with support for functionality such as resuming failed uploads."]}),"\n",(0,r.jsxs)(o.p,{children:["We reccomend scoping access by giving the associated role ",(0,r.jsx)(o.a,{href:"https://stackoverflow.com/questions/57147765/gcp-write-only-access-to-bucket-gcs",children:"write-only"})," access."]})]})}function l(e={}){const{wrapper:o}={...(0,s.a)(),...e.components};return o?(0,r.jsx)(o,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},863:(e,o,t)=>{t.d(o,{Z:()=>r});const r=t.p+"assets/images/google-cloud-storage-4e82160612df4ceacb5b5934df3de5ba.png"},1151:(e,o,t)=>{t.d(o,{Z:()=>c,a:()=>n});var r=t(7294);const s={},i=r.createContext(s);function n(e){const o=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function c(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:n(e.components),r.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d81821f1.d9411964.js b/assets/js/d81821f1.d9411964.js deleted file mode 100644 index 5cbbe04b3..000000000 --- a/assets/js/d81821f1.d9411964.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1390],{2935:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>c,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>i,toc:()=>d});var t=n(5893),r=n(1151);const a={title:"Managing Users",hide_title:!0,sidebar_position:3},o="Managing Cado Users",i={id:"cado-response/manage/users-authentication/users",title:"Managing Users",description:"In the Cado platform you can grant access only to the data to which they need access - to both processed data within the platform, and resources or raw data residing in the cloud.",source:"@site/docs/cado-response/manage/users-authentication/users.md",sourceDirName:"cado-response/manage/users-authentication",slug:"/cado-response/manage/users-authentication/users",permalink:"/cado-response/manage/users-authentication/users",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/users-authentication/users.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:3,frontMatter:{title:"Managing Users",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Applying a License",permalink:"/cado-response/manage/licenses"},next:{title:"Azure AD",permalink:"/cado-response/manage/users-authentication/sso/azure-ad"}},c={},d=[{value:"User Types",id:"user-types",level:3},{value:"Configuring Single Sign On (SSO)",id:"configuring-single-sign-on-sso",level:3},{value:"Managing Roles",id:"managing-roles",level:3},{value:"Managing Groups",id:"managing-groups",level:3},{value:"Creating a New User",id:"creating-a-new-user",level:3},{value:"Granting Administrator Access",id:"granting-administrator-access",level:3},{value:"Granting Access to a Project",id:"granting-access-to-a-project",level:3}];function l(e){const s={a:"a",admonition:"admonition",h1:"h1",h3:"h3",img:"img",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"managing-cado-users",children:"Managing Cado Users"}),"\n",(0,t.jsx)(s.p,{children:"In the Cado platform you can grant access only to the data to which they need access - to both processed data within the platform, and resources or raw data residing in the cloud."}),"\n",(0,t.jsx)(s.h3,{id:"user-types",children:"User Types"}),"\n",(0,t.jsx)(s.p,{children:"There are two roles in the Cado platform."}),"\n",(0,t.jsxs)(s.table,{children:[(0,t.jsx)(s.thead,{children:(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.th,{children:"Name"}),(0,t.jsx)(s.th,{children:"Description"})]})}),(0,t.jsxs)(s.tbody,{children:[(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:"Administrator"}),(0,t.jsx)(s.td,{children:"Can edit users and access all projects and configured cloud resources."})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:"Normal User"}),(0,t.jsx)(s.td,{children:"Users with restricted access to a subset of projects and cloud resources."})]})]})]}),"\n",(0,t.jsx)(s.p,{children:"In order to get access to projects and data a Normal User needs to be added to a project, or a group that has access to that project. In order to acquire cloud data for a project, the user needs to be given access to a CSP Role that has access to that cloud data or resource, or added to a group that has access to that CSP Role"}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Users-Groups-Roles",src:n(1011).Z+"",width:"809",height:"262"})}),"\n",(0,t.jsx)(s.h3,{id:"configuring-single-sign-on-sso",children:"Configuring Single Sign On (SSO)"}),"\n",(0,t.jsxs)(s.p,{children:["Cado also supports authentication via ",(0,t.jsx)(s.a,{href:"/cado-response/manage/users-authentication/sso/azure-ad",children:"Azure AD"}),", Okta (",(0,t.jsx)(s.a,{href:"/cado-response/manage/users-authentication/sso/okta",children:"OAuth"})," or ",(0,t.jsx)(s.a,{href:"/cado-response/manage/users-authentication/sso/okta_saml",children:"SAML"}),") and ",(0,t.jsx)(s.a,{href:"/cado-response/manage/users-authentication/sso/ping_saml",children:"PingID"}),". When you configure SSO access, the Cado platform will automatically create the user at first login. By integrating Cado with your SSO platform you can enforce any authentication mechanism supported by the SSO platform, including two factor authentication."]}),"\n",(0,t.jsx)(s.h3,{id:"managing-roles",children:"Managing Roles"}),"\n",(0,t.jsxs)(s.p,{children:["Roles in Cado correspond to CSP roles in AWS, Azure or GCP that have appropriate levels of access to cloud resources. Only Administrators can manage roles. This list is autopopulated when administrators add CSP credentials to the platform following the instructions for ",(0,t.jsx)(s.a,{href:"/cado-response/deploy/aws/iam/cross-account-creation#adding-the-role-to-cado",children:"AWS"}),", ",(0,t.jsx)(s.a,{href:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions#registering-credentials-within-cado",children:"Azure"}),", and ",(0,t.jsx)(s.a,{href:"/cado-response/deploy/gcp/gcp-settings#entering-settings",children:"GCP"})," respectively."]}),"\n",(0,t.jsx)(s.h3,{id:"managing-groups",children:"Managing Groups"}),"\n",(0,t.jsx)(s.p,{children:"Groups in Cado allow you to define groups of users that you can use to assign or revoke access to projects and/or cloud resources. Only Administrators can manage groups."}),"\n",(0,t.jsx)(s.p,{children:"To create a new group:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Groups"})]}),"\n",(0,t.jsxs)(s.li,{children:["Click the ",(0,t.jsx)(s.strong,{children:"Add Group"})," button"]}),"\n",(0,t.jsx)(s.li,{children:"Enter the name of the group"}),"\n",(0,t.jsx)(s.li,{children:"Enter the name of a group in your SSO platform that corresponds to this group. When selected, any members of your SSO group that log into the Cado Platform will automatically be joined to this group"}),"\n",(0,t.jsx)(s.li,{children:"Select any users that need to assigned to this group"}),"\n",(0,t.jsx)(s.li,{children:"Select any CSP Roles that users in this group need access to"}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Groups",src:n(4903).Z+"",width:"713",height:"465"})}),"\n",(0,t.jsx)(s.h3,{id:"creating-a-new-user",children:"Creating a New User"}),"\n",(0,t.jsx)(s.p,{children:"Only Administrators can create new users. When an Administrator creates a new user, a temporary password must be created by the Administrator. The new user will be asked to change their password when they first login.\nTo add a new user:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Users"})]}),"\n",(0,t.jsxs)(s.li,{children:["Click the ",(0,t.jsx)(s.strong,{children:"Add Users"})," button"]}),"\n",(0,t.jsx)(s.li,{children:"Select any groups the user needs to be assigned"}),"\n",(0,t.jsx)(s.li,{children:"Select any CSP Roles the user need to be assigned"}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"granting-administrator-access",children:"Granting Administrator Access"}),"\n",(0,t.jsx)(s.p,{children:"To elevate privileges and grant Administrator access to a normal user, do the following:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Users"})]}),"\n",(0,t.jsxs)(s.li,{children:["Next to the appropriate user, click the Edit icon ",(0,t.jsx)(s.img,{alt:"Edit",src:n(4647).Z+"",width:"21",height:"19"})]}),"\n",(0,t.jsxs)(s.li,{children:["Select the ",(0,t.jsx)(s.strong,{children:"This user has administrator access"})," checkbox"]}),"\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Update"})]}),"\n"]}),"\n",(0,t.jsx)(s.admonition,{type:"caution",children:(0,t.jsx)(s.p,{children:"It is strongly recommended to follow the principles of least privilege when creating new users and granting Administrator access."})}),"\n",(0,t.jsx)(s.h3,{id:"granting-access-to-a-project",children:"Granting Access to a Project"}),"\n",(0,t.jsx)(s.p,{children:"To grant existing users or groups to a Project, you can add them when you create the Project, or you can follow the below instructions to add users to an existing Project:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Projects"})," and select the project to which you would like to add users"]}),"\n",(0,t.jsxs)(s.li,{children:["Click the ",(0,t.jsx)(s.strong,{children:"Access"})," button"]}),"\n",(0,t.jsxs)(s.li,{children:["Click the ",(0,t.jsx)(s.strong,{children:"Add Users"})," button"]}),"\n",(0,t.jsxs)(s.li,{children:["Select the user and/or group to add and Click ",(0,t.jsx)(s.strong,{children:"Add"})]}),"\n"]})]})}function h(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},4647:(e,s,n)=>{n.d(s,{Z:()=>t});const t="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABUAAAATCAYAAAB/TkaLAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFYSURBVDhPY/wPBAxUBhQbuu/waYbXb98zmBlqMyjKS4PFKDIUZOD9h0+hPAYGJ1tTsMFwQ89dvM5w/vJNsCQ+ICkuwuDlasNw/tINBgF+XrDBMMDFxcEQGeTBwATlE2WgoAAfg5WZPsPRkxcYzgEN/fnrN9h1MCAuKgym4S6du2QDWCA5JgBM4wIgA2/cfgDlMTBYmxswsLOxMtx/9AxuAdylxAB0A0EAJPbh42cUFxNtKDYDQUBBTorBUE8DyoMAogw9ePQsVgNBMe1sZwblIQBBQ0Gxe+f+YygPAUAGInsZGeA1FD0dwgDIQCOgl7ftPgIVQQV4DQVFADqAuRBk4fOXb6CiqACvod++fYeyIADZy+8/fALT2ABeQ0GJm52djUEImOjxhSE6wGsoKCPEhHoxBPo4EW0gCGDkKFIBthwId6mhrjqURTzApYfi8hQbwBum5AEGBgCpB4w70q85UwAAAABJRU5ErkJggg=="},4903:(e,s,n)=>{n.d(s,{Z:()=>t});const t=n.p+"assets/images/groups-b8da3a2285c1b36a6aff417aad36948a.png"},1011:(e,s,n)=>{n.d(s,{Z:()=>t});const t=n.p+"assets/images/users-groups-roles-d8a30a18b94f525420309d2128d0bfa1.png"},1151:(e,s,n)=>{n.d(s,{Z:()=>i,a:()=>o});var t=n(7294);const r={},a=t.createContext(r);function o(e){const s=t.useContext(a);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function i(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),t.createElement(a.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d81821f1.e316776f.js b/assets/js/d81821f1.e316776f.js new file mode 100644 index 000000000..e4e5f9d66 --- /dev/null +++ b/assets/js/d81821f1.e316776f.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1390],{2935:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>c,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>i,toc:()=>d});var t=n(5893),r=n(1151);const a={title:"Managing Users",hide_title:!0,sidebar_position:3},o="Managing Cado Users",i={id:"cado-response/manage/users-authentication/users",title:"Managing Users",description:"In the Cado platform you can grant access only to the data to which they need access - to both processed data within the platform, and resources or raw data residing in the cloud.",source:"@site/docs/cado-response/manage/users-authentication/users.md",sourceDirName:"cado-response/manage/users-authentication",slug:"/cado-response/manage/users-authentication/users",permalink:"/cado-response/manage/users-authentication/users",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/users-authentication/users.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:3,frontMatter:{title:"Managing Users",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Applying a License",permalink:"/cado-response/manage/licenses"},next:{title:"Azure AD",permalink:"/cado-response/manage/users-authentication/sso/azure-ad"}},c={},d=[{value:"User Types",id:"user-types",level:3},{value:"Configuring Single Sign On (SSO)",id:"configuring-single-sign-on-sso",level:3},{value:"Managing Roles",id:"managing-roles",level:3},{value:"Managing Groups",id:"managing-groups",level:3},{value:"Creating a New User",id:"creating-a-new-user",level:3},{value:"Granting Administrator Access",id:"granting-administrator-access",level:3},{value:"Granting Access to a Project",id:"granting-access-to-a-project",level:3}];function l(e){const s={a:"a",admonition:"admonition",h1:"h1",h3:"h3",img:"img",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.h1,{id:"managing-cado-users",children:"Managing Cado Users"}),"\n",(0,t.jsx)(s.p,{children:"In the Cado platform you can grant access only to the data to which they need access - to both processed data within the platform, and resources or raw data residing in the cloud."}),"\n",(0,t.jsx)(s.h3,{id:"user-types",children:"User Types"}),"\n",(0,t.jsx)(s.p,{children:"There are two roles in the Cado platform."}),"\n",(0,t.jsxs)(s.table,{children:[(0,t.jsx)(s.thead,{children:(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.th,{children:"Name"}),(0,t.jsx)(s.th,{children:"Description"})]})}),(0,t.jsxs)(s.tbody,{children:[(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:"Administrator"}),(0,t.jsx)(s.td,{children:"Can edit users and access all projects and configured cloud resources."})]}),(0,t.jsxs)(s.tr,{children:[(0,t.jsx)(s.td,{children:"Normal User"}),(0,t.jsx)(s.td,{children:"Users with restricted access to a subset of projects and cloud resources."})]})]})]}),"\n",(0,t.jsx)(s.p,{children:"In order to get access to projects and data a Normal User needs to be added to a project, or a group that has access to that project. In order to acquire cloud data for a project, the user needs to be given access to a CSP Role that has access to that cloud data or resource, or added to a group that has access to that CSP Role"}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Users-Groups-Roles",src:n(1011).Z+"",width:"809",height:"262"})}),"\n",(0,t.jsx)(s.h3,{id:"configuring-single-sign-on-sso",children:"Configuring Single Sign On (SSO)"}),"\n",(0,t.jsxs)(s.p,{children:["Cado also supports authentication via ",(0,t.jsx)(s.a,{href:"/cado-response/manage/users-authentication/sso/azure-ad",children:"Azure AD"}),", Okta (",(0,t.jsx)(s.a,{href:"/cado-response/manage/users-authentication/sso/okta",children:"OAuth"})," or ",(0,t.jsx)(s.a,{href:"/cado-response/manage/users-authentication/sso/okta_saml",children:"SAML"}),") and ",(0,t.jsx)(s.a,{href:"/cado-response/manage/users-authentication/sso/ping_saml",children:"PingID"}),". When you configure SSO access, the Cado platform will automatically create the user at first login. By integrating Cado with your SSO platform you can enforce any authentication mechanism supported by the SSO platform, including two factor authentication."]}),"\n",(0,t.jsx)(s.h3,{id:"managing-roles",children:"Managing Roles"}),"\n",(0,t.jsxs)(s.p,{children:["Roles in Cado correspond to CSP roles in AWS, Azure or GCP that have appropriate levels of access to cloud resources. Only Administrators can manage roles. This list is autopopulated when administrators add CSP credentials to the platform following the instructions for ",(0,t.jsx)(s.a,{href:"/cado-response/deploy/aws/iam/cross-account-creation#adding-the-role-to-cado",children:"AWS"}),", ",(0,t.jsx)(s.a,{href:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions#registering-credentials-within-cado",children:"Azure"}),", and ",(0,t.jsx)(s.a,{href:"/cado-response/deploy/gcp/gcp-settings#entering-settings",children:"GCP"})," respectively."]}),"\n",(0,t.jsx)(s.h3,{id:"managing-groups",children:"Managing Groups"}),"\n",(0,t.jsx)(s.p,{children:"Groups in Cado allow you to define groups of users that you can use to assign or revoke access to projects and/or cloud resources. Only Administrators can manage groups."}),"\n",(0,t.jsx)(s.p,{children:"To create a new group:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Groups"})]}),"\n",(0,t.jsxs)(s.li,{children:["Click the ",(0,t.jsx)(s.strong,{children:"Add Group"})," button"]}),"\n",(0,t.jsx)(s.li,{children:"Enter the name of the group"}),"\n",(0,t.jsx)(s.li,{children:"Enter the name of a group in your SSO platform that corresponds to this group. When selected, any members of your SSO group that log into the Cado Platform will automatically be joined to this group"}),"\n",(0,t.jsx)(s.li,{children:"Select any users that need to assigned to this group"}),"\n",(0,t.jsx)(s.li,{children:"Select any CSP Roles that users in this group need access to"}),"\n"]}),"\n",(0,t.jsx)(s.p,{children:(0,t.jsx)(s.img,{alt:"Groups",src:n(4903).Z+"",width:"713",height:"465"})}),"\n",(0,t.jsx)(s.h3,{id:"creating-a-new-user",children:"Creating a New User"}),"\n",(0,t.jsx)(s.p,{children:"Only Administrators can create new users. When an Administrator creates a new user, a temporary password must be created by the Administrator. The new user will be asked to change their password when they first login.\nTo add a new user:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Users"})]}),"\n",(0,t.jsxs)(s.li,{children:["Click the ",(0,t.jsx)(s.strong,{children:"Add Users"})," button"]}),"\n",(0,t.jsx)(s.li,{children:"Select any groups the user needs to be assigned"}),"\n",(0,t.jsx)(s.li,{children:"Select any CSP Roles the user need to be assigned"}),"\n"]}),"\n",(0,t.jsx)(s.h3,{id:"granting-administrator-access",children:"Granting Administrator Access"}),"\n",(0,t.jsx)(s.p,{children:"To elevate privileges and grant Administrator access to a normal user, do the following:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Users"})]}),"\n",(0,t.jsxs)(s.li,{children:["Next to the appropriate user, click the Edit icon ",(0,t.jsx)(s.img,{alt:"Edit",src:n(4647).Z+"",width:"21",height:"19"})]}),"\n",(0,t.jsxs)(s.li,{children:["Select the ",(0,t.jsx)(s.strong,{children:"This user has administrator access"})," checkbox"]}),"\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Update"})]}),"\n"]}),"\n",(0,t.jsx)(s.admonition,{type:"caution",children:(0,t.jsx)(s.p,{children:"It is strongly recommended to follow the principles of least privilege when creating new users and granting Administrator access."})}),"\n",(0,t.jsx)(s.h3,{id:"granting-access-to-a-project",children:"Granting Access to a Project"}),"\n",(0,t.jsx)(s.p,{children:"To grant existing users or groups to a Project, you can add them when you create the Project, or you can follow the below instructions to add users to an existing Project:"}),"\n",(0,t.jsxs)(s.ul,{children:["\n",(0,t.jsxs)(s.li,{children:["Click ",(0,t.jsx)(s.strong,{children:"Projects"})," and select the project to which you would like to add users"]}),"\n",(0,t.jsxs)(s.li,{children:["Click the ",(0,t.jsx)(s.strong,{children:"Access"})," button"]}),"\n",(0,t.jsxs)(s.li,{children:["Click the ",(0,t.jsx)(s.strong,{children:"Add Users"})," button"]}),"\n",(0,t.jsxs)(s.li,{children:["Select the user and/or group to add and Click ",(0,t.jsx)(s.strong,{children:"Add"})]}),"\n"]})]})}function h(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},4647:(e,s,n)=>{n.d(s,{Z:()=>t});const t="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABUAAAATCAYAAAB/TkaLAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFYSURBVDhPY/wPBAxUBhQbuu/waYbXb98zmBlqMyjKS4PFKDIUZOD9h0+hPAYGJ1tTsMFwQ89dvM5w/vJNsCQ+ICkuwuDlasNw/tINBgF+XrDBMMDFxcEQGeTBwATlE2WgoAAfg5WZPsPRkxcYzgEN/fnrN9h1MCAuKgym4S6du2QDWCA5JgBM4wIgA2/cfgDlMTBYmxswsLOxMtx/9AxuAdylxAB0A0EAJPbh42cUFxNtKDYDQUBBTorBUE8DyoMAogw9ePQsVgNBMe1sZwblIQBBQ0Gxe+f+YygPAUAGInsZGeA1FD0dwgDIQCOgl7ftPgIVQQV4DQVFADqAuRBk4fOXb6CiqACvod++fYeyIADZy+8/fALT2ABeQ0GJm52djUEImOjxhSE6wGsoKCPEhHoxBPo4EW0gCGDkKFIBthwId6mhrjqURTzApYfi8hQbwBum5AEGBgCpB4w70q85UwAAAABJRU5ErkJggg=="},4903:(e,s,n)=>{n.d(s,{Z:()=>t});const t=n.p+"assets/images/groups-b8da3a2285c1b36a6aff417aad36948a.png"},1011:(e,s,n)=>{n.d(s,{Z:()=>t});const t=n.p+"assets/images/users-groups-roles-d8a30a18b94f525420309d2128d0bfa1.png"},1151:(e,s,n)=>{n.d(s,{Z:()=>i,a:()=>o});var t=n(7294);const r={},a=t.createContext(r);function o(e){const s=t.useContext(a);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function i(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),t.createElement(a.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/dc194df5.63834cb8.js b/assets/js/dc194df5.63834cb8.js deleted file mode 100644 index 0a08bf67d..000000000 --- a/assets/js/dc194df5.63834cb8.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1005],{6810:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>d,contentTitle:()=>a,default:()=>p,frontMatter:()=>s,metadata:()=>i,toc:()=>l});var r=n(5893),t=n(1151);const s={title:"Deployment Options",hide_title:!0,sidebar_position:1},a="Cado Platform Deployment Options",i={id:"cado-response/deploy/intro",title:"Deployment Options",description:"The Cado platform can be deployed in either AWS or Azure.",source:"@site/docs/cado-response/deploy/intro.md",sourceDirName:"cado-response/deploy",slug:"/cado-response/deploy/intro",permalink:"/cado-response/deploy/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/intro.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Deployment Options",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Key Concepts",permalink:"/cado-response/key-concepts"},next:{title:"Overview",permalink:"/cado-response/deploy/aws/overview"}},d={},l=[{value:"Cross Cloud Collection",id:"cross-cloud-collection",level:2},{value:"Tagging Cado Resources",id:"tagging-cado-resources",level:2},{value:"Terraform",id:"terraform",level:4},{value:"CloudFormation",id:"cloudformation",level:4}];function c(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h4:"h4",img:"img",p:"p",pre:"pre",strong:"strong",...(0,t.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(o.h1,{id:"cado-platform-deployment-options",children:"Cado Platform Deployment Options"}),"\n",(0,r.jsx)(o.p,{children:"The Cado platform can be deployed in either AWS or Azure."}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/deploy/aws/overview",children:"Learn how in AWS >"})})}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/deploy/azure/azure-deploy",children:"Learn how in Azure >"})})}),"\n",(0,r.jsx)(o.h2,{id:"cross-cloud-collection",children:"Cross Cloud Collection"}),"\n",(0,r.jsxs)(o.p,{children:['When you deploy Cado in AWS you can import data "cross-cloud" from Azure or GCP. ',(0,r.jsx)(o.strong,{children:"Cross cloud"})," means that Cado is deployed in one cloud environment, but imports data from another."]}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Cross Cloud Collection",src:n(4548).Z+"",width:"1082",height:"583"})}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions",children:"Learn how to set up cross cloud collection from Azure >"})})}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/deploy/gcp/gcp-settings",children:"Learn how to set up cross cloud collection from GCP>"})})}),"\n",(0,r.jsx)(o.h2,{id:"tagging-cado-resources",children:"Tagging Cado Resources"}),"\n",(0,r.jsxs)(o.p,{children:["You also have the option to have workers tagged when they are launched. This can be done by specifying the ",(0,r.jsx)(o.strong,{children:"Tag Key"})," and ",(0,r.jsx)(o.strong,{children:"Tag Value"})," which will be assigned when workers are launched. If you wish to apply more than one tag to workers, please see the below options."]}),"\n",(0,r.jsx)(o.h4,{id:"terraform",children:"Terraform"}),"\n",(0,r.jsx)(o.p,{children:'If you have deployed via Terraform - You can apply multiple tags to workers in both AWS and Azure by updating the "tags" variable in Terraform. If you deployed via Terraform into Azure add the below snippet into the cado_deploy_azure/azure_transient/main.tf script.\nOr, if you deployed via Terraform into AWS add the below snippet into the cado_deploy_aws/aws/main.tf script.\nPlease also note that you will have to run terraform apply again after saving these changes.'}),"\n",(0,r.jsx)(o.pre,{children:(0,r.jsx)(o.code,{children:'variable "tags" {\n type = map(string)\n default = {}\n}\n'})}),"\n",(0,r.jsx)(o.h4,{id:"cloudformation",children:"CloudFormation"}),"\n",(0,r.jsx)(o.p,{children:'If you deployed via CloudFormation Template you can apply multiple tags to workers by adding them to the "UserData" section of the CloudFormation Template. Please note that deploying via CloudFormation requires you to specify tags prior to deployment. To add a worker tag add the below to the "UserData" field.'}),"\n",(0,r.jsx)(o.pre,{children:(0,r.jsx)(o.code,{children:'"echo CUSTOM_TAG_FOO = BAR >> /home/admin/processor/first_run.cfg",\n"\\n",\n'})}),"\n",(0,r.jsx)(o.admonition,{type:"info",children:(0,r.jsxs)(o.p,{children:["The ",(0,r.jsx)(o.code,{children:"CUSTOM_TAG_"}),' prefix is required. If you would like to apply a tag with key "FOO" and value "BAR" then your line should appear as it does in the above example.']})}),"\n",(0,r.jsxs)(o.admonition,{type:"info",children:[(0,r.jsx)(o.p,{children:'The last line of the "UserData" field must contain'}),(0,r.jsx)(o.pre,{children:(0,r.jsx)(o.code,{children:'"sudo /home/admin/processor/release/finalize.sh --main"\n'})})]})]})}function p(e={}){const{wrapper:o}={...(0,t.a)(),...e.components};return o?(0,r.jsx)(o,{...e,children:(0,r.jsx)(c,{...e})}):c(e)}},4548:(e,o,n)=>{n.d(o,{Z:()=>r});const r=n.p+"assets/images/cross-cloud-d567d021d7d7207ba606f160cfd3bf05.png"},1151:(e,o,n)=>{n.d(o,{Z:()=>i,a:()=>a});var r=n(7294);const t={},s=r.createContext(t);function a(e){const o=r.useContext(s);return r.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function i(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:a(e.components),r.createElement(s.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/dc194df5.ced767e0.js b/assets/js/dc194df5.ced767e0.js new file mode 100644 index 000000000..b23f194ca --- /dev/null +++ b/assets/js/dc194df5.ced767e0.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1005],{6810:(e,o,n)=>{n.r(o),n.d(o,{assets:()=>d,contentTitle:()=>a,default:()=>p,frontMatter:()=>s,metadata:()=>i,toc:()=>l});var r=n(5893),t=n(1151);const s={title:"Deployment Options",hide_title:!0,sidebar_position:1},a="Cado Platform Deployment Options",i={id:"cado-response/deploy/intro",title:"Deployment Options",description:"The Cado platform can be deployed in either AWS or Azure.",source:"@site/docs/cado-response/deploy/intro.md",sourceDirName:"cado-response/deploy",slug:"/cado-response/deploy/intro",permalink:"/cado-response/deploy/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/intro.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Deployment Options",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Key Concepts",permalink:"/cado-response/key-concepts"},next:{title:"Overview",permalink:"/cado-response/deploy/aws/overview"}},d={},l=[{value:"Cross Cloud Collection",id:"cross-cloud-collection",level:2},{value:"Tagging Cado Resources",id:"tagging-cado-resources",level:2},{value:"Terraform",id:"terraform",level:4},{value:"CloudFormation",id:"cloudformation",level:4}];function c(e){const o={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h4:"h4",img:"img",p:"p",pre:"pre",strong:"strong",...(0,t.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(o.h1,{id:"cado-platform-deployment-options",children:"Cado Platform Deployment Options"}),"\n",(0,r.jsx)(o.p,{children:"The Cado platform can be deployed in either AWS or Azure."}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/deploy/aws/overview",children:"Learn how in AWS >"})})}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/deploy/azure/azure-deploy",children:"Learn how in Azure >"})})}),"\n",(0,r.jsx)(o.h2,{id:"cross-cloud-collection",children:"Cross Cloud Collection"}),"\n",(0,r.jsxs)(o.p,{children:['When you deploy Cado in AWS you can import data "cross-cloud" from Azure or GCP. ',(0,r.jsx)(o.strong,{children:"Cross cloud"})," means that Cado is deployed in one cloud environment, but imports data from another."]}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Cross Cloud Collection",src:n(4548).Z+"",width:"1082",height:"583"})}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions",children:"Learn how to set up cross cloud collection from Azure >"})})}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/deploy/gcp/gcp-settings",children:"Learn how to set up cross cloud collection from GCP>"})})}),"\n",(0,r.jsx)(o.h2,{id:"tagging-cado-resources",children:"Tagging Cado Resources"}),"\n",(0,r.jsxs)(o.p,{children:["You also have the option to have workers tagged when they are launched. This can be done by specifying the ",(0,r.jsx)(o.strong,{children:"Tag Key"})," and ",(0,r.jsx)(o.strong,{children:"Tag Value"})," which will be assigned when workers are launched. If you wish to apply more than one tag to workers, please see the below options."]}),"\n",(0,r.jsx)(o.h4,{id:"terraform",children:"Terraform"}),"\n",(0,r.jsx)(o.p,{children:'If you have deployed via Terraform - You can apply multiple tags to workers in both AWS and Azure by updating the "tags" variable in Terraform. If you deployed via Terraform into Azure add the below snippet into the cado_deploy_azure/azure_transient/main.tf script.\nOr, if you deployed via Terraform into AWS add the below snippet into the cado_deploy_aws/aws/main.tf script.\nPlease also note that you will have to run terraform apply again after saving these changes.'}),"\n",(0,r.jsx)(o.pre,{children:(0,r.jsx)(o.code,{children:'variable "tags" {\n type = map(string)\n default = {}\n}\n'})}),"\n",(0,r.jsx)(o.h4,{id:"cloudformation",children:"CloudFormation"}),"\n",(0,r.jsx)(o.p,{children:'If you deployed via CloudFormation Template you can apply multiple tags to workers by adding them to the "UserData" section of the CloudFormation Template. Please note that deploying via CloudFormation requires you to specify tags prior to deployment. To add a worker tag add the below to the "UserData" field.'}),"\n",(0,r.jsx)(o.pre,{children:(0,r.jsx)(o.code,{children:'"echo CUSTOM_TAG_FOO = BAR >> /home/admin/processor/first_run.cfg",\n"\\n",\n'})}),"\n",(0,r.jsx)(o.admonition,{type:"info",children:(0,r.jsxs)(o.p,{children:["The ",(0,r.jsx)(o.code,{children:"CUSTOM_TAG_"}),' prefix is required. If you would like to apply a tag with key "FOO" and value "BAR" then your line should appear as it does in the above example.']})}),"\n",(0,r.jsxs)(o.admonition,{type:"info",children:[(0,r.jsx)(o.p,{children:'The last line of the "UserData" field must contain'}),(0,r.jsx)(o.pre,{children:(0,r.jsx)(o.code,{children:'"sudo /home/admin/processor/release/finalize.sh --main"\n'})})]})]})}function p(e={}){const{wrapper:o}={...(0,t.a)(),...e.components};return o?(0,r.jsx)(o,{...e,children:(0,r.jsx)(c,{...e})}):c(e)}},4548:(e,o,n)=>{n.d(o,{Z:()=>r});const r=n.p+"assets/images/cross-cloud-d567d021d7d7207ba606f160cfd3bf05.png"},1151:(e,o,n)=>{n.d(o,{Z:()=>i,a:()=>a});var r=n(7294);const t={},s=r.createContext(t);function a(e){const o=r.useContext(s);return r.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function i(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:a(e.components),r.createElement(s.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/e02d587d.19db3725.js b/assets/js/e02d587d.19db3725.js deleted file mode 100644 index 6e3c6a1a6..000000000 --- a/assets/js/e02d587d.19db3725.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5229],{2293:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>u,frontMatter:()=>r,metadata:()=>p,toc:()=>a});var n=o(5893),i=o(1151);const r={title:"Google Compute Engine",hide_title:!0,sidebar_position:1},s="Google Compute Engine Support",p={id:"cado-response/discovery-import/import/gcp/engine-instance",title:"Google Compute Engine",description:"The Cado platform supports acquisition of GCP Compute instances. Select the GCP project and bucket where you can upload the image prior to importing it into the Cado platform.",source:"@site/docs/cado-response/discovery-import/import/gcp/engine-instance.md",sourceDirName:"cado-response/discovery-import/import/gcp",slug:"/cado-response/discovery-import/import/gcp/engine-instance",permalink:"/cado-response/discovery-import/import/gcp/engine-instance",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/gcp/engine-instance.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Google Compute Engine",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Azure Kubernetes Service",permalink:"/cado-response/discovery-import/import/azure/azure-aks"},next:{title:"Google Cloud Storage",permalink:"/cado-response/discovery-import/import/gcp/storage"}},c={},a=[];function d(e){const t={h1:"h1",img:"img",p:"p",...(0,i.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"google-compute-engine-support",children:"Google Compute Engine Support"}),"\n",(0,n.jsx)(t.p,{children:"The Cado platform supports acquisition of GCP Compute instances. Select the GCP project and bucket where you can upload the image prior to importing it into the Cado platform."}),"\n",(0,n.jsx)(t.p,{children:"Select the GCP project and Compute Instance you need. Review the details and click on 'Start Import'."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"GCP Compute Import",src:o(1009).Z+"",width:"1817",height:"697"})})]})}function u(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},1009:(e,t,o)=>{o.d(t,{Z:()=>n});const n=o.p+"assets/images/gcp-compute-12976728eda89dfe1698796b854663ea.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>p,a:()=>s});var n=o(7294);const i={},r=n.createContext(i);function s(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function p(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:s(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/e02d587d.dfac8113.js b/assets/js/e02d587d.dfac8113.js new file mode 100644 index 000000000..201b50e57 --- /dev/null +++ b/assets/js/e02d587d.dfac8113.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5229],{2293:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>u,frontMatter:()=>r,metadata:()=>p,toc:()=>a});var n=o(5893),i=o(1151);const r={title:"Google Compute Engine",hide_title:!0,sidebar_position:1},s="Google Compute Engine Support",p={id:"cado-response/discovery-import/import/gcp/engine-instance",title:"Google Compute Engine",description:"The Cado platform supports acquisition of GCP Compute instances. Select the GCP project and bucket where you can upload the image prior to importing it into the Cado platform.",source:"@site/docs/cado-response/discovery-import/import/gcp/engine-instance.md",sourceDirName:"cado-response/discovery-import/import/gcp",slug:"/cado-response/discovery-import/import/gcp/engine-instance",permalink:"/cado-response/discovery-import/import/gcp/engine-instance",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/gcp/engine-instance.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Google Compute Engine",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Azure Kubernetes Service",permalink:"/cado-response/discovery-import/import/azure/azure-aks"},next:{title:"Google Cloud Storage",permalink:"/cado-response/discovery-import/import/gcp/storage"}},c={},a=[];function d(e){const t={h1:"h1",img:"img",p:"p",...(0,i.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h1,{id:"google-compute-engine-support",children:"Google Compute Engine Support"}),"\n",(0,n.jsx)(t.p,{children:"The Cado platform supports acquisition of GCP Compute instances. Select the GCP project and bucket where you can upload the image prior to importing it into the Cado platform."}),"\n",(0,n.jsx)(t.p,{children:"Select the GCP project and Compute Instance you need. Review the details and click on 'Start Import'."}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{alt:"GCP Compute Import",src:o(1009).Z+"",width:"1817",height:"697"})})]})}function u(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},1009:(e,t,o)=>{o.d(t,{Z:()=>n});const n=o.p+"assets/images/gcp-compute-12976728eda89dfe1698796b854663ea.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>p,a:()=>s});var n=o(7294);const i={},r=n.createContext(i);function s(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function p(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:s(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/e0692acf.88e140d0.js b/assets/js/e0692acf.88e140d0.js deleted file mode 100644 index d195ed2e8..000000000 --- a/assets/js/e0692acf.88e140d0.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[968],{1930:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>n,default:()=>p,frontMatter:()=>i,metadata:()=>a,toc:()=>d});var r=o(5893),s=o(1151);const i={title:"Memory Analysis",hide_title:!0,sidebar_position:3},n="Memory Analysis",a={id:"cado-response/discovery-import/import/data-types/memory",title:"Memory Analysis",description:"You can perform a memory acquisition of a Windows or Linux system using Cado Host by clicking Import > Forensic Artifacts and running the pre-generated script on the host device. Process memory collection is not currently supported on OSX.",source:"@site/docs/cado-response/discovery-import/import/data-types/memory.md",sourceDirName:"cado-response/discovery-import/import/data-types",slug:"/cado-response/discovery-import/import/data-types/memory",permalink:"/cado-response/discovery-import/import/data-types/memory",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/data-types/memory.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:3,frontMatter:{title:"Memory Analysis",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Log Types",permalink:"/cado-response/discovery-import/import/data-types/logs"},next:{title:"Supported Import Types",permalink:"/cado-response/discovery-import/import/data-types/import-types"}},c={},d=[];function m(e){const t={a:"a",code:"code",h1:"h1",img:"img",p:"p",...(0,s.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"memory-analysis",children:"Memory Analysis"}),"\n",(0,r.jsxs)(t.p,{children:["You can perform a memory acquisition of a Windows or Linux system using Cado Host by clicking ",(0,r.jsx)(t.code,{children:"Import > Forensic Artifacts"})," and running the pre-generated script on the host device. Process memory collection is not currently supported on OSX."]}),"\n",(0,r.jsxs)(t.p,{children:['We collect memory from individual processes as .mem files, viewable under the "process_dumps" folder. We find this allows for more reliable analysis than our previous version which collected a single capture of memory, and utilises our open source tool ',(0,r.jsx)(t.a,{href:"https://github.com/cado-security/varc",children:"varc"})]}),"\n",(0,r.jsxs)(t.p,{children:["For importing externally acquired memory, ensure the memory dump is named with a ",(0,r.jsx)(t.code,{children:".mem"})," file extension so it is recognized as a memory file and upload the memory file to an S3 bucket (or Azure Storage) to which Cado has access. Then click ",(0,r.jsx)(t.code,{children:"Import > AWS S3 Bucket"})," within Cado, navigate to the S3 bucket where the .mem file resides, and import it."]}),"\n",(0,r.jsx)(t.p,{children:'You can acquire memory of Linux systems in EC2 by using the "Alternate Acquisition" option under Import > EC2:'}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"AWS Memory",src:o(877).Z+"",width:"1648",height:"284"})}),"\n",(0,r.jsx)(t.p,{children:"This requires the AWS SSM agent to be running on the EC2 and registered within the AWS Systems Manager. If it is not, you can acquire memory by connecting to the machine over SSH or RDP and executing Cado Host from Import > Forensic Artifacts. You can also use this method to acquire from Windows systems."}),"\n",(0,r.jsx)(t.p,{children:"Any acquisition from a container (e.g. ECS/EKS/AKS) will attempt to collect memory by default."}),"\n",(0,r.jsx)(t.p,{children:"Once processed, you will be able to browse the file system including the contents of files (if they were in memory at the time) and view information from running processes and network connections."})]})}function p(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(m,{...e})}):m(e)}},877:(e,t,o)=>{o.d(t,{Z:()=>r});const r=o.p+"assets/images/alternate-ec2-1d44379783163049a09c15fbf9a92565.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>a,a:()=>n});var r=o(7294);const s={},i=r.createContext(s);function n(e){const t=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:n(e.components),r.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/e0692acf.e0310231.js b/assets/js/e0692acf.e0310231.js new file mode 100644 index 000000000..03fc307c2 --- /dev/null +++ b/assets/js/e0692acf.e0310231.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[968],{1930:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>n,default:()=>p,frontMatter:()=>i,metadata:()=>a,toc:()=>d});var r=o(5893),s=o(1151);const i={title:"Memory Analysis",hide_title:!0,sidebar_position:3},n="Memory Analysis",a={id:"cado-response/discovery-import/import/data-types/memory",title:"Memory Analysis",description:"You can perform a memory acquisition of a Windows or Linux system using Cado Host by clicking Import > Forensic Artifacts and running the pre-generated script on the host device. Process memory collection is not currently supported on OSX.",source:"@site/docs/cado-response/discovery-import/import/data-types/memory.md",sourceDirName:"cado-response/discovery-import/import/data-types",slug:"/cado-response/discovery-import/import/data-types/memory",permalink:"/cado-response/discovery-import/import/data-types/memory",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/data-types/memory.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:3,frontMatter:{title:"Memory Analysis",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Log Types",permalink:"/cado-response/discovery-import/import/data-types/logs"},next:{title:"Supported Import Types",permalink:"/cado-response/discovery-import/import/data-types/import-types"}},c={},d=[];function m(e){const t={a:"a",code:"code",h1:"h1",img:"img",p:"p",...(0,s.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(t.h1,{id:"memory-analysis",children:"Memory Analysis"}),"\n",(0,r.jsxs)(t.p,{children:["You can perform a memory acquisition of a Windows or Linux system using Cado Host by clicking ",(0,r.jsx)(t.code,{children:"Import > Forensic Artifacts"})," and running the pre-generated script on the host device. Process memory collection is not currently supported on OSX."]}),"\n",(0,r.jsxs)(t.p,{children:['We collect memory from individual processes as .mem files, viewable under the "process_dumps" folder. We find this allows for more reliable analysis than our previous version which collected a single capture of memory, and utilises our open source tool ',(0,r.jsx)(t.a,{href:"https://github.com/cado-security/varc",children:"varc"})]}),"\n",(0,r.jsxs)(t.p,{children:["For importing externally acquired memory, ensure the memory dump is named with a ",(0,r.jsx)(t.code,{children:".mem"})," file extension so it is recognized as a memory file and upload the memory file to an S3 bucket (or Azure Storage) to which Cado has access. Then click ",(0,r.jsx)(t.code,{children:"Import > AWS S3 Bucket"})," within Cado, navigate to the S3 bucket where the .mem file resides, and import it."]}),"\n",(0,r.jsx)(t.p,{children:'You can acquire memory of Linux systems in EC2 by using the "Alternate Acquisition" option under Import > EC2:'}),"\n",(0,r.jsx)(t.p,{children:(0,r.jsx)(t.img,{alt:"AWS Memory",src:o(877).Z+"",width:"1648",height:"284"})}),"\n",(0,r.jsx)(t.p,{children:"This requires the AWS SSM agent to be running on the EC2 and registered within the AWS Systems Manager. If it is not, you can acquire memory by connecting to the machine over SSH or RDP and executing Cado Host from Import > Forensic Artifacts. You can also use this method to acquire from Windows systems."}),"\n",(0,r.jsx)(t.p,{children:"Any acquisition from a container (e.g. ECS/EKS/AKS) will attempt to collect memory by default."}),"\n",(0,r.jsx)(t.p,{children:"Once processed, you will be able to browse the file system including the contents of files (if they were in memory at the time) and view information from running processes and network connections."})]})}function p(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,r.jsx)(t,{...e,children:(0,r.jsx)(m,{...e})}):m(e)}},877:(e,t,o)=>{o.d(t,{Z:()=>r});const r=o.p+"assets/images/alternate-ec2-1d44379783163049a09c15fbf9a92565.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>a,a:()=>n});var r=o(7294);const s={},i=r.createContext(s);function n(e){const t=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:n(e.components),r.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/e1df042a.6ed36224.js b/assets/js/e1df042a.6ed36224.js new file mode 100644 index 000000000..919c327a4 --- /dev/null +++ b/assets/js/e1df042a.6ed36224.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[265],{5418:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>c,contentTitle:()=>i,default:()=>h,frontMatter:()=>s,metadata:()=>a,toc:()=>d});var r=o(5893),t=o(1151);const s={title:"Overview",hide_title:!0,sidebar_position:1},i=void 0,a={id:"cado-response/deploy/azure/azure-deploy",title:"Overview",description:"Azure Deployment Overview",source:"@site/docs/cado-response/deploy/azure/azure-deploy.md",sourceDirName:"cado-response/deploy/azure",slug:"/cado-response/deploy/azure/azure-deploy",permalink:"/cado-response/deploy/azure/azure-deploy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/azure/azure-deploy.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Overview",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"High Availability",permalink:"/cado-response/deploy/aws/performance-resiliency/high-availability"},next:{title:"Cross Subscription and Tenancy",permalink:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions"}},c={},d=[{value:"Azure Deployment Overview",id:"azure-deployment-overview",level:2},{value:"Azure Terraform Script",id:"azure-terraform-script",level:2},{value:"How to Add Tags to Resources",id:"how-to-add-tags-to-resources",level:3}];function l(e){const n={a:"a",admonition:"admonition",br:"br",code:"code",em:"em",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.h2,{id:"azure-deployment-overview",children:"Azure Deployment Overview"}),"\n",(0,r.jsx)(n.admonition,{type:"note",children:(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.strong,{children:"Intended Audience and Operating Environment Requirements:"}),"\n",(0,r.jsx)(n.em,{children:"This information is written for proficient Azure cloud administrators who are familiar with Azure technology and cloud operations. This manual assumes familiarity with MS Azure, including: Subscriptions, Resource Groups, Virtual Machines, Storage Accounts, and Storage Containers."})]})}),"\n",(0,r.jsx)(n.p,{children:"Deployment of the Cado platform is performed within your Azure cloud environment via a Terraform Script. When the platform is deployed, it creates its own isolated network in which you can control who has access. From start to finish, you can be up and running in under 25 minutes."}),"\n",(0,r.jsx)(n.h2,{id:"azure-terraform-script",children:"Azure Terraform Script"}),"\n",(0,r.jsx)(n.p,{children:"To set up Cado in Azure you can deploy via our Terraform script. The Terraform script automates the process of configuring the platform stack."}),"\n",(0,r.jsx)(n.p,{children:"If you have signed up for a Free Trial or are working with the Cado Sales team already, you should receive the following pieces of information:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"a link to the Cado VHD image"}),"\n",(0,r.jsxs)(n.li,{children:["the latest Cado Terraform module (",(0,r.jsx)(n.strong,{children:"azure.zip"}),") for deploying into Azure"]}),"\n"]}),"\n",(0,r.jsxs)(n.p,{children:["If you have not received the above items, reach out to ",(0,r.jsx)(n.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})," for more details. Once you receive them, continue on to the steps below."]}),"\n",(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://learn.hashicorp.com/tutorials/terraform/install-cli",children:"Install Terraform"})}),", if you have not already."]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://docs.microsoft.com/en-us/cli/azure/install-azure-cli",children:"Install Azure CLI"})}),", if you have not already."]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Run 'az login'. The account you log in with will be used to deploy. You should store the Cado VHD in your local Azure container for this account as well."}),"\n",(0,r.jsx)(n.admonition,{type:"tip",children:(0,r.jsxs)(n.p,{children:["If you have multiple Subscriptions, please ensure you set the Subscription properly prior to beginning the deployment, as outlined here:",(0,r.jsx)(n.br,{}),"\n",(0,r.jsx)(n.a,{href:"https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/azure_cli#logging-into-the-azure-cli",children:"https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/azure_cli#logging-into-the-azure-cli"})]})}),"\n",(0,r.jsxs)(n.admonition,{type:"tip",children:[(0,r.jsx)(n.p,{children:"Depending on your Azure permissions, you may need to be assigned one or more of the following roles in order to complete the deployment:"}),(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"Storage Blob Data Contributor"}),"\n",(0,r.jsx)(n.li,{children:"Storage Blob Data Reader"}),"\n",(0,r.jsx)(n.li,{children:"Storage Queue Data Contributor"}),"\n",(0,r.jsx)(n.li,{children:"Storage Queue Data Reader"}),"\n"]})]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Create a storage account and container to stage the Cado VHD locally within your Azure tenancy. This will be from where the platform will be deployed. You must copy the image to the same region in which you want to deploy Cado. You can complete these steps using the Azure portal or the Azure CLI"}),"\n",(0,r.jsxs)(n.p,{children:["a. ",(0,r.jsx)(n.strong,{children:"Create a resource group"}),", if you do not have one already, for the local download of the VHD using the Azure portal or the Azure CLI as shown below. Note this needs to be less than 6 characters in length:"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:'az group create --resource-group "" --location "" --subscription ""\n'})}),"\n",(0,r.jsxs)(n.p,{children:["b. ",(0,r.jsx)(n.strong,{children:"Create a storage account"}),", if you do not have one already, using the Azure portal or the Azure CLI as shown below:"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:'az storage account create --name "" --resource-group "" --location "" --sku "Standard_LRS" --subscription ""\n'})}),"\n",(0,r.jsxs)(n.p,{children:["c. ",(0,r.jsx)(n.strong,{children:"Create a container"}),", if you do not have one already, using the Azure portal or the Azure CLI as shown below:"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:'az storage container create -n "" -g "" --account-name "" --account-key "" --subscription ""\n'})}),"\n",(0,r.jsxs)(n.admonition,{type:"tip",children:[(0,r.jsx)(n.p,{children:"You can find your storage account's account key by either running the command below or by locating it within the Azure Portal:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsx)(n.li,{children:"Running the following command:"}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:"az storage account keys list --account-name \n"})}),(0,r.jsxs)(n.ol,{start:"2",children:["\n",(0,r.jsxs)(n.li,{children:["In the ",(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://portal.azure.com/",children:"Azure portal"})}),", navigate to the resource group that you created, then the storage account, then click ",(0,r.jsx)(n.strong,{children:"Settings > Access keys"})," in your storage account's menu blade to see both primary and secondary access keys. You can then click the ",(0,r.jsx)(n.strong,{children:"Show keys"})," button and copy the ",(0,r.jsx)(n.strong,{children:"Key"})," value. Key values should be enclosed in double quotes if working from within bash. You can also use a connection string or SAS token to authenticate the command. More details on this here: ",(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://docs.microsoft.com/en-US/cli/azure/storage/container?view=azure-cli-latest#az_storage_container_create",children:"Creating a container in a storage account"})})]}),"\n"]})]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Copy the VHD to your Azure subscription using the command below. Substitute ",(0,r.jsx)(n.code,{children:"$RELEASE_URI"})," with the VHD URL which was provided by Cado Sales:"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:'az storage blob copy start --subscription "" --account-name "" --account-key "" --destination-blob "cado_response.vhd" --destination-container "" --source-uri "$RELEASE_URI"\n'})}),"\n",(0,r.jsxs)(n.admonition,{type:"caution",children:[(0,r.jsxs)(n.p,{children:["Wait for the copy operation to complete before moving to the next step. You can check the status of the blob copy by running the ",(0,r.jsx)(n.code,{children:"az storage blob show"})," command as outlined below. This example is for Windows. You can pipe the same command to ",(0,r.jsx)(n.em,{children:"grep"})," in Linux. You will know the process is complete when the output ",(0,r.jsx)(n.code,{children:"status"})," field changes from ",(0,r.jsx)(n.strong,{children:"pending"})," to ",(0,r.jsx)(n.strong,{children:"success"})]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:'az storage blob show --account-name "" --account-key "" --name "cado_response.vhd" --container-name "" --subscription "" -o yamlc | findstr status\n'})})]}),"\n",(0,r.jsx)(n.admonition,{type:"tip",children:(0,r.jsx)(n.p,{children:"Also note that if you need to capture very large disks (>=1tb) you will need to deploy in a region where storage optimized (L) instances are available, e.g. US East."})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Extract ",(0,r.jsx)(n.code,{children:"azure.zip"})," This is the ZIP that was provided by Cado Sales"]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Change directories into ",(0,r.jsx)(n.code,{children:"azure/cado"})," which was extracted in the previous step."]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Create a public and private ssh key. Make sure the directory exists before running the command and do not use a passphrase:"}),"\n",(0,r.jsx)(n.admonition,{type:"tip",children:(0,r.jsxs)(n.p,{children:["You will likely need to create the ",(0,r.jsx)(n.code,{children:"keys"})," directory by running ",(0,r.jsx)(n.code,{children:"mkdir ../keys"})," prior to running the next step"]})}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:'ssh-keygen -b 4096 -f ../keys/azure_demo_key -q -N ""\n'})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Customize the file ",(0,r.jsx)(n.code,{children:"azure/cado/main.tf"})," by filling in the default values for the following variables:"]}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Parameter Name"}),(0,r.jsx)(n.th,{children:"Description"}),(0,r.jsx)(n.th,{children:"Example"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"image_id"})}),(0,r.jsxs)(n.td,{children:["Cado VHD blobstore URL. This is the URL to the ",(0,r.jsx)(n.em,{children:"cado_response.vhd"})," blob within your container storage (created in Step 4c above) . It is in the format: ",(0,r.jsx)(n.code,{children:"https:// .blob.core.windows.net/ / cado_response.vhd"}),' and can be found within your Azure Portal by navigating to "Home > Storage accounts", selecting the ',(0,r.jsx)(n.em,{children:"StorageAccountName"}),', clicking "Storage browser (preview)", clicking the ',(0,r.jsx)(n.em,{children:"ContainerName"}),', clicking the "cado_response.vhd" blob and viewing the "URL" value.']}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"https:// mycadostorage.blob.core.windows.net/ cadocontainer/cado_response.vhd"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ip_pattern_https"})}),(0,r.jsx)(n.td,{children:"List of incoming IPs permitted to access HTTPS. CIDR or source IP range or * to match any IP. At least one value is required."}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:'["1.2.3.4/32","1.2.3.5/32"]'})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ip_pattern_all"})}),(0,r.jsx)(n.td,{children:"List of incoming IPs permitted to access HTTPS and SSH. CIDR or source IP range or * to match any IP. At least one value is required. This should be the CIDR of the machine that is running the Terraform deployment script."}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:'["1.2.3.6/32"]'})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"instance_type"})}),(0,r.jsx)(n.td,{children:"Instance type to use for main"}),(0,r.jsxs)(n.td,{children:["Recommended to use ",(0,r.jsx)(n.code,{children:"Standard_D16ds_v4"})," If you have questions on instance sizing, please contact support for guidance."]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"resource_group"})}),(0,r.jsx)(n.td,{children:"Resource group name which will be created. This resource group name must not exist already"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"resgroup123"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"region"})}),(0,r.jsxs)(n.td,{children:["Region to deploy in. You can use the Display Name or Name of the region as shown when running ",(0,r.jsx)(n.code,{children:"az account list-locations -o table"})]}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"North Europe"}),", ",(0,r.jsx)(n.code,{children:"northeurope"}),", ",(0,r.jsx)(n.code,{children:"East US"}),", ",(0,r.jsx)(n.code,{children:"eastus"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"share_size"})}),(0,r.jsx)(n.td,{children:"Size of network file share"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"500"})," This value is depenedent on the amount of data you will be processing into the Cado platform. Please speak with the sales or support team for proper sizing."]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"main_size"})}),(0,r.jsx)(n.td,{children:"Size of main instance local disk in GB"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"30"})," ",(0,r.jsx)(n.em,{children:"Do not change"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"main_data_size"})}),(0,r.jsx)(n.td,{children:"Size of main instance local disk in GB"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"500"})," This value is depenedent on the amount of data you will be processing into the Cado platform. Please speak with the sales or support team for proper sizing."]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"processing_mode"})}),(0,r.jsx)(n.td,{children:"Processing mode to start in"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"scalable-vm"})," ",(0,r.jsx)(n.em,{children:"Do not change"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ssh_key_public"})}),(0,r.jsx)(n.td,{children:"Path to SSH public key"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"../keys/azure_demo_key.pub"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ssh_key_private"})}),(0,r.jsx)(n.td,{children:"Path to SSH private key"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"../keys/azure_demo_key"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"finalize_cmd"})}),(0,r.jsx)(n.td,{children:"Finalize command"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"echo 'not required'"})," ",(0,r.jsx)(n.em,{children:"Do not change"})]})]})]})]}),"\n",(0,r.jsx)(n.admonition,{type:"tip",children:(0,r.jsxs)(n.p,{children:["We recommend a minimum setting of 500GB for ",(0,r.jsx)(n.code,{children:"main_data_size"}),". The instance will roughly need to be sized to be 20% of the amount of data you intend to be on the platform at once. For example, to have 5TB of disk images imported you will need approximately 1000GB of disk space. Projects can always be deleted to recover space."]})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Deploy by running the following commands in the directory ",(0,r.jsx)(n.code,{children:"azure/cado/"})]}),"\n",(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.code,{children:"terraform init"})," followed by ",(0,r.jsx)(n.code,{children:"terraform plan"}),". Once you confirm the plan looks correct, you can then run ",(0,r.jsx)(n.code,{children:"terraform apply"})]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Make a note of the IP Address and the full Resource Id (/subscription/.../cado-main-vm) in the logs e.g.:"}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:"module.cado_scalable.azurerm_linux_virtual_machine.vm (remote-exec): public_ip = 1.2.3.4\nmodule.cado_scalable.azurerm_linux_virtual_machine.vm: Creation complete after 1m53s [id=/subscriptions/2f34c608-91b5-4d14-ac36-b8e0377fbcca/resourceGroups/new_res_three/providers/Microsoft.Compute/virtualMachines/cado-main-vm]\n"})}),"\n",(0,r.jsxs)(n.p,{children:["The Resource ID can also be found within your Azure Portal by navigating to ",(0,r.jsx)(n.code,{children:"Home > Virtual Machines"}),", clicking on the Cado VM name, then clicking ",(0,r.jsx)(n.code,{children:"Properties"})," on the left navigation bar. Scroll down to find the ",(0,r.jsx)(n.code,{children:"Resource ID"}),"."]}),"\n",(0,r.jsxs)(n.p,{children:["It will take about 20 minutes to deploy, then you can ",(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"../../manage/logging-in",children:"Log into Cado"})})]}),"\n",(0,r.jsx)(n.admonition,{type:"tip",children:(0,r.jsxs)(n.p,{children:["After deployment, you can import Test Data from the ",(0,r.jsx)(n.code,{children:"Help"})," menu to confirm that the deployment was successful."]})}),"\n",(0,r.jsx)(n.admonition,{type:"caution",children:(0,r.jsxs)(n.p,{children:["When deploying, the main Cado instance will have the name ",(0,r.jsx)(n.code,{children:"CadoResponse"}),". If you rename your Cado instance, please ensure the name ",(0,r.jsx)(n.strong,{children:"starts with"})," ",(0,r.jsx)(n.code,{children:"CadoResponse"}),", otherwise the default update mechanism may not work properly due to how permissions are configured."]})}),"\n",(0,r.jsx)(n.h3,{id:"how-to-add-tags-to-resources",children:"How to Add Tags to Resources"}),"\n",(0,r.jsxs)(n.p,{children:["Please see the ",(0,r.jsx)(n.a,{href:"/cado-response/deploy/intro#tagging-cado-response-resources",children:"guide on Deployment Options"})]})]})}function h(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(l,{...e})}):l(e)}},1151:(e,n,o)=>{o.d(n,{Z:()=>a,a:()=>i});var r=o(7294);const t={},s=r.createContext(t);function i(e){const n=r.useContext(s);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:i(e.components),r.createElement(s.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/e1df042a.99b9f2ff.js b/assets/js/e1df042a.99b9f2ff.js deleted file mode 100644 index f52af4493..000000000 --- a/assets/js/e1df042a.99b9f2ff.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[265],{5418:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>c,contentTitle:()=>i,default:()=>h,frontMatter:()=>s,metadata:()=>a,toc:()=>d});var r=o(5893),t=o(1151);const s={title:"Overview",hide_title:!0,sidebar_position:1},i=void 0,a={id:"cado-response/deploy/azure/azure-deploy",title:"Overview",description:"Azure Deployment Overview",source:"@site/docs/cado-response/deploy/azure/azure-deploy.md",sourceDirName:"cado-response/deploy/azure",slug:"/cado-response/deploy/azure/azure-deploy",permalink:"/cado-response/deploy/azure/azure-deploy",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/azure/azure-deploy.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Overview",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"High Availability",permalink:"/cado-response/deploy/aws/performance-resiliency/high-availability"},next:{title:"Cross Subscription and Tenancy",permalink:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions"}},c={},d=[{value:"Azure Deployment Overview",id:"azure-deployment-overview",level:2},{value:"Azure Terraform Script",id:"azure-terraform-script",level:2},{value:"How to Add Tags to Resources",id:"how-to-add-tags-to-resources",level:3}];function l(e){const n={a:"a",admonition:"admonition",br:"br",code:"code",em:"em",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.h2,{id:"azure-deployment-overview",children:"Azure Deployment Overview"}),"\n",(0,r.jsx)(n.admonition,{type:"note",children:(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.strong,{children:"Intended Audience and Operating Environment Requirements:"}),"\n",(0,r.jsx)(n.em,{children:"This information is written for proficient Azure cloud administrators who are familiar with Azure technology and cloud operations. This manual assumes familiarity with MS Azure, including: Subscriptions, Resource Groups, Virtual Machines, Storage Accounts, and Storage Containers."})]})}),"\n",(0,r.jsx)(n.p,{children:"Deployment of the Cado platform is performed within your Azure cloud environment via a Terraform Script. When the platform is deployed, it creates its own isolated network in which you can control who has access. From start to finish, you can be up and running in under 25 minutes."}),"\n",(0,r.jsx)(n.h2,{id:"azure-terraform-script",children:"Azure Terraform Script"}),"\n",(0,r.jsx)(n.p,{children:"To set up Cado in Azure you can deploy via our Terraform script. The Terraform script automates the process of configuring the platform stack."}),"\n",(0,r.jsx)(n.p,{children:"If you have signed up for a Free Trial or are working with the Cado Sales team already, you should receive the following pieces of information:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"a link to the Cado VHD image"}),"\n",(0,r.jsxs)(n.li,{children:["the latest Cado Terraform module (",(0,r.jsx)(n.strong,{children:"azure.zip"}),") for deploying into Azure"]}),"\n"]}),"\n",(0,r.jsxs)(n.p,{children:["If you have not received the above items, reach out to ",(0,r.jsx)(n.a,{href:"mailto:sales@cadosecurity.com",children:"sales@cadosecurity.com"})," for more details. Once you receive them, continue on to the steps below."]}),"\n",(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://learn.hashicorp.com/tutorials/terraform/install-cli",children:"Install Terraform"})}),", if you have not already."]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://docs.microsoft.com/en-us/cli/azure/install-azure-cli",children:"Install Azure CLI"})}),", if you have not already."]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Run 'az login'. The account you log in with will be used to deploy. You should store the Cado VHD in your local Azure container for this account as well."}),"\n",(0,r.jsx)(n.admonition,{type:"tip",children:(0,r.jsxs)(n.p,{children:["If you have multiple Subscriptions, please ensure you set the Subscription properly prior to beginning the deployment, as outlined here:",(0,r.jsx)(n.br,{}),"\n",(0,r.jsx)(n.a,{href:"https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/azure_cli#logging-into-the-azure-cli",children:"https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/guides/azure_cli#logging-into-the-azure-cli"})]})}),"\n",(0,r.jsxs)(n.admonition,{type:"tip",children:[(0,r.jsx)(n.p,{children:"Depending on your Azure permissions, you may need to be assigned one or more of the following roles in order to complete the deployment:"}),(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"Storage Blob Data Contributor"}),"\n",(0,r.jsx)(n.li,{children:"Storage Blob Data Reader"}),"\n",(0,r.jsx)(n.li,{children:"Storage Queue Data Contributor"}),"\n",(0,r.jsx)(n.li,{children:"Storage Queue Data Reader"}),"\n"]})]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Create a storage account and container to stage the Cado VHD locally within your Azure tenancy. This will be from where the platform will be deployed. You must copy the image to the same region in which you want to deploy Cado. You can complete these steps using the Azure portal or the Azure CLI"}),"\n",(0,r.jsxs)(n.p,{children:["a. ",(0,r.jsx)(n.strong,{children:"Create a resource group"}),", if you do not have one already, for the local download of the VHD using the Azure portal or the Azure CLI as shown below. Note this needs to be less than 6 characters in length:"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:'az group create --resource-group "" --location "" --subscription ""\n'})}),"\n",(0,r.jsxs)(n.p,{children:["b. ",(0,r.jsx)(n.strong,{children:"Create a storage account"}),", if you do not have one already, using the Azure portal or the Azure CLI as shown below:"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:'az storage account create --name "" --resource-group "" --location "" --sku "Standard_LRS" --subscription ""\n'})}),"\n",(0,r.jsxs)(n.p,{children:["c. ",(0,r.jsx)(n.strong,{children:"Create a container"}),", if you do not have one already, using the Azure portal or the Azure CLI as shown below:"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:'az storage container create -n "" -g "" --account-name "" --account-key "" --subscription ""\n'})}),"\n",(0,r.jsxs)(n.admonition,{type:"tip",children:[(0,r.jsx)(n.p,{children:"You can find your storage account's account key by either running the command below or by locating it within the Azure Portal:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsx)(n.li,{children:"Running the following command:"}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:"az storage account keys list --account-name \n"})}),(0,r.jsxs)(n.ol,{start:"2",children:["\n",(0,r.jsxs)(n.li,{children:["In the ",(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://portal.azure.com/",children:"Azure portal"})}),", navigate to the resource group that you created, then the storage account, then click ",(0,r.jsx)(n.strong,{children:"Settings > Access keys"})," in your storage account's menu blade to see both primary and secondary access keys. You can then click the ",(0,r.jsx)(n.strong,{children:"Show keys"})," button and copy the ",(0,r.jsx)(n.strong,{children:"Key"})," value. Key values should be enclosed in double quotes if working from within bash. You can also use a connection string or SAS token to authenticate the command. More details on this here: ",(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"https://docs.microsoft.com/en-US/cli/azure/storage/container?view=azure-cli-latest#az_storage_container_create",children:"Creating a container in a storage account"})})]}),"\n"]})]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Copy the VHD to your Azure subscription using the command below. Substitute ",(0,r.jsx)(n.code,{children:"$RELEASE_URI"})," with the VHD URL which was provided by Cado Sales:"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:'az storage blob copy start --subscription "" --account-name "" --account-key "" --destination-blob "cado_response.vhd" --destination-container "" --source-uri "$RELEASE_URI"\n'})}),"\n",(0,r.jsxs)(n.admonition,{type:"caution",children:[(0,r.jsxs)(n.p,{children:["Wait for the copy operation to complete before moving to the next step. You can check the status of the blob copy by running the ",(0,r.jsx)(n.code,{children:"az storage blob show"})," command as outlined below. This example is for Windows. You can pipe the same command to ",(0,r.jsx)(n.em,{children:"grep"})," in Linux. You will know the process is complete when the output ",(0,r.jsx)(n.code,{children:"status"})," field changes from ",(0,r.jsx)(n.strong,{children:"pending"})," to ",(0,r.jsx)(n.strong,{children:"success"})]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:'az storage blob show --account-name "" --account-key "" --name "cado_response.vhd" --container-name "" --subscription "" -o yamlc | findstr status\n'})})]}),"\n",(0,r.jsx)(n.admonition,{type:"tip",children:(0,r.jsx)(n.p,{children:"Also note that if you need to capture very large disks (>=1tb) you will need to deploy in a region where storage optimized (L) instances are available, e.g. US East."})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Extract ",(0,r.jsx)(n.code,{children:"azure.zip"})," This is the ZIP that was provided by Cado Sales"]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Change directories into ",(0,r.jsx)(n.code,{children:"azure/cado"})," which was extracted in the previous step."]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Create a public and private ssh key. Make sure the directory exists before running the command and do not use a passphrase:"}),"\n",(0,r.jsx)(n.admonition,{type:"tip",children:(0,r.jsxs)(n.p,{children:["You will likely need to create the ",(0,r.jsx)(n.code,{children:"keys"})," directory by running ",(0,r.jsx)(n.code,{children:"mkdir ../keys"})," prior to running the next step"]})}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:'ssh-keygen -b 4096 -f ../keys/azure_demo_key -q -N ""\n'})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Customize the file ",(0,r.jsx)(n.code,{children:"azure/cado/main.tf"})," by filling in the default values for the following variables:"]}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Parameter Name"}),(0,r.jsx)(n.th,{children:"Description"}),(0,r.jsx)(n.th,{children:"Example"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"image_id"})}),(0,r.jsxs)(n.td,{children:["Cado VHD blobstore URL. This is the URL to the ",(0,r.jsx)(n.em,{children:"cado_response.vhd"})," blob within your container storage (created in Step 4c above) . It is in the format: ",(0,r.jsx)(n.code,{children:"https:// .blob.core.windows.net/ / cado_response.vhd"}),' and can be found within your Azure Portal by navigating to "Home > Storage accounts", selecting the ',(0,r.jsx)(n.em,{children:"StorageAccountName"}),', clicking "Storage browser (preview)", clicking the ',(0,r.jsx)(n.em,{children:"ContainerName"}),', clicking the "cado_response.vhd" blob and viewing the "URL" value.']}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"https:// mycadostorage.blob.core.windows.net/ cadocontainer/cado_response.vhd"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ip_pattern_https"})}),(0,r.jsx)(n.td,{children:"List of incoming IPs permitted to access HTTPS. CIDR or source IP range or * to match any IP. At least one value is required."}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:'["1.2.3.4/32","1.2.3.5/32"]'})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ip_pattern_all"})}),(0,r.jsx)(n.td,{children:"List of incoming IPs permitted to access HTTPS and SSH. CIDR or source IP range or * to match any IP. At least one value is required. This should be the CIDR of the machine that is running the Terraform deployment script."}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:'["1.2.3.6/32"]'})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"instance_type"})}),(0,r.jsx)(n.td,{children:"Instance type to use for main"}),(0,r.jsxs)(n.td,{children:["Recommended to use ",(0,r.jsx)(n.code,{children:"Standard_D16ds_v4"})," If you have questions on instance sizing, please contact support for guidance."]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"resource_group"})}),(0,r.jsx)(n.td,{children:"Resource group name which will be created. This resource group name must not exist already"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"resgroup123"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"region"})}),(0,r.jsxs)(n.td,{children:["Region to deploy in. You can use the Display Name or Name of the region as shown when running ",(0,r.jsx)(n.code,{children:"az account list-locations -o table"})]}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"North Europe"}),", ",(0,r.jsx)(n.code,{children:"northeurope"}),", ",(0,r.jsx)(n.code,{children:"East US"}),", ",(0,r.jsx)(n.code,{children:"eastus"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"share_size"})}),(0,r.jsx)(n.td,{children:"Size of network file share"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"500"})," This value is depenedent on the amount of data you will be processing into the Cado platform. Please speak with the sales or support team for proper sizing."]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"main_size"})}),(0,r.jsx)(n.td,{children:"Size of main instance local disk in GB"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"30"})," ",(0,r.jsx)(n.em,{children:"Do not change"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"main_data_size"})}),(0,r.jsx)(n.td,{children:"Size of main instance local disk in GB"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"500"})," This value is depenedent on the amount of data you will be processing into the Cado platform. Please speak with the sales or support team for proper sizing."]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"processing_mode"})}),(0,r.jsx)(n.td,{children:"Processing mode to start in"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"scalable-vm"})," ",(0,r.jsx)(n.em,{children:"Do not change"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ssh_key_public"})}),(0,r.jsx)(n.td,{children:"Path to SSH public key"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"../keys/azure_demo_key.pub"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"ssh_key_private"})}),(0,r.jsx)(n.td,{children:"Path to SSH private key"}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"../keys/azure_demo_key"})})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"finalize_cmd"})}),(0,r.jsx)(n.td,{children:"Finalize command"}),(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"echo 'not required'"})," ",(0,r.jsx)(n.em,{children:"Do not change"})]})]})]})]}),"\n",(0,r.jsx)(n.admonition,{type:"tip",children:(0,r.jsxs)(n.p,{children:["We recommend a minimum setting of 500GB for ",(0,r.jsx)(n.code,{children:"main_data_size"}),". The instance will roughly need to be sized to be 20% of the amount of data you intend to be on the platform at once. For example, to have 5TB of disk images imported you will need approximately 1000GB of disk space. Projects can always be deleted to recover space."]})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Deploy by running the following commands in the directory ",(0,r.jsx)(n.code,{children:"azure/cado/"})]}),"\n",(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.code,{children:"terraform init"})," followed by ",(0,r.jsx)(n.code,{children:"terraform plan"}),". Once you confirm the plan looks correct, you can then run ",(0,r.jsx)(n.code,{children:"terraform apply"})]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Make a note of the IP Address and the full Resource Id (/subscription/.../cado-main-vm) in the logs e.g.:"}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-console",children:"module.cado_scalable.azurerm_linux_virtual_machine.vm (remote-exec): public_ip = 1.2.3.4\nmodule.cado_scalable.azurerm_linux_virtual_machine.vm: Creation complete after 1m53s [id=/subscriptions/2f34c608-91b5-4d14-ac36-b8e0377fbcca/resourceGroups/new_res_three/providers/Microsoft.Compute/virtualMachines/cado-main-vm]\n"})}),"\n",(0,r.jsxs)(n.p,{children:["The Resource ID can also be found within your Azure Portal by navigating to ",(0,r.jsx)(n.code,{children:"Home > Virtual Machines"}),", clicking on the Cado VM name, then clicking ",(0,r.jsx)(n.code,{children:"Properties"})," on the left navigation bar. Scroll down to find the ",(0,r.jsx)(n.code,{children:"Resource ID"}),"."]}),"\n",(0,r.jsxs)(n.p,{children:["It will take about 20 minutes to deploy, then you can ",(0,r.jsx)(n.strong,{children:(0,r.jsx)(n.a,{href:"../../manage/logging-in",children:"Log into Cado"})})]}),"\n",(0,r.jsx)(n.admonition,{type:"tip",children:(0,r.jsxs)(n.p,{children:["After deployment, you can import Test Data from the ",(0,r.jsx)(n.code,{children:"Help"})," menu to confirm that the deployment was successful."]})}),"\n",(0,r.jsx)(n.admonition,{type:"caution",children:(0,r.jsxs)(n.p,{children:["When deploying, the main Cado instance will have the name ",(0,r.jsx)(n.code,{children:"CadoResponse"}),". If you rename your Cado instance, please ensure the name ",(0,r.jsx)(n.strong,{children:"starts with"})," ",(0,r.jsx)(n.code,{children:"CadoResponse"}),", otherwise the default update mechanism may not work properly due to how permissions are configured."]})}),"\n",(0,r.jsx)(n.h3,{id:"how-to-add-tags-to-resources",children:"How to Add Tags to Resources"}),"\n",(0,r.jsxs)(n.p,{children:["Please see the ",(0,r.jsx)(n.a,{href:"/cado-response/deploy/intro#tagging-cado-response-resources",children:"guide on Deployment Options"})]})]})}function h(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(l,{...e})}):l(e)}},1151:(e,n,o)=>{o.d(n,{Z:()=>a,a:()=>i});var r=o(7294);const t={},s=r.createContext(t);function i(e){const n=r.useContext(s);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:i(e.components),r.createElement(s.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/e4cf30c3.7e821e17.js b/assets/js/e4cf30c3.7e821e17.js deleted file mode 100644 index af48ea83d..000000000 --- a/assets/js/e4cf30c3.7e821e17.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9853],{7341:(e,a,o)=>{o.r(a),o.d(a,{assets:()=>d,contentTitle:()=>i,default:()=>h,frontMatter:()=>r,metadata:()=>l,toc:()=>s});var n=o(5893),t=o(1151);const r={title:"Load Balancer",hide_title:!0,sidebar_position:1},i="How to Add a Load Balancer in AWS",l={id:"cado-response/deploy/aws/networking/aws-load-balancer",title:"Load Balancer",description:"An Application Load Balancer can be placed in front of the Cado web server in order to provide a valid HTTPS connection and add a Web Application Firewall. This can be configured via the provided Terraform or Cloudformation deployment scripts.",source:"@site/docs/cado-response/deploy/aws/networking/aws-load-balancer.md",sourceDirName:"cado-response/deploy/aws/networking",slug:"/cado-response/deploy/aws/networking/aws-load-balancer",permalink:"/cado-response/deploy/aws/networking/aws-load-balancer",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/networking/aws-load-balancer.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Load Balancer",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Logging",permalink:"/cado-response/deploy/aws/logging"},next:{title:"Private IP Addresses",permalink:"/cado-response/deploy/aws/networking/internet-routable-addresses"}},d={},s=[{value:"Get a SSL/TLS Certificate for your domain",id:"get-a-ssltls-certificate-for-your-domain",level:2},{value:"After Deploying the Load Balancer",id:"after-deploying-the-load-balancer",level:2},{value:"(Optional) Adding a Web Application Firewall to your Load Balancer",id:"optional-adding-a-web-application-firewall-to-your-load-balancer",level:2},{value:"Troubleshooting the Load Balancer",id:"troubleshooting-the-load-balancer",level:2}];function c(e){const a={code:"code",h1:"h1",h2:"h2",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,t.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(a.h1,{id:"how-to-add-a-load-balancer-in-aws",children:"How to Add a Load Balancer in AWS"}),"\n",(0,n.jsx)(a.p,{children:"An Application Load Balancer can be placed in front of the Cado web server in order to provide a valid HTTPS connection and add a Web Application Firewall. This can be configured via the provided Terraform or Cloudformation deployment scripts."}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Load Balancer 1",src:o(8460).Z+"",width:"1421",height:"767"})}),"\n",(0,n.jsx)(a.h2,{id:"get-a-ssltls-certificate-for-your-domain",children:"Get a SSL/TLS Certificate for your domain"}),"\n",(0,n.jsxs)(a.p,{children:["In order to deploy with an ALB you will need to provide an ARN for an SSL/TLS certificate for a domain name you own. To do this you will need to visit the Amazon Certificate Manager. Click ",(0,n.jsx)(a.strong,{children:"Request"})," and follow the instructions."]}),"\n",(0,n.jsx)(a.h2,{id:"after-deploying-the-load-balancer",children:"After Deploying the Load Balancer"}),"\n",(0,n.jsxs)(a.p,{children:["Once the load balancer has been created, select the Load Balancer and open the domain name listed under DNS name e.g. ",(0,n.jsx)(a.code,{children:"https://cado-alb-test.us-east-1.elb.amazonaws.com/"})]}),"\n",(0,n.jsxs)(a.p,{children:["If you are using your own domain name, you will then need to point your custom domain name to this DNS name. For example, this is a typical record to point a domain you own (example: ",(0,n.jsx)(a.code,{children:"cado-alb.your-company.com"}),") to the ",(0,n.jsx)(a.code,{children:"*.amazonaws.com"})," DNS name of your Load Balancer:"]}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsxs)(a.li,{children:["Type: ",(0,n.jsx)(a.code,{children:"CNAME"})]}),"\n",(0,n.jsxs)(a.li,{children:["Name: ",(0,n.jsx)(a.code,{children:"cado-alb"})]}),"\n",(0,n.jsxs)(a.li,{children:["Target: ",(0,n.jsx)(a.code,{children:"cado-alb-test.us-east-1.elb.amazonaws.com"})]}),"\n"]}),"\n",(0,n.jsx)(a.p,{children:"You should then be able to visit the domain in your browser and login to Cado."}),"\n",(0,n.jsx)(a.h2,{id:"optional-adding-a-web-application-firewall-to-your-load-balancer",children:"(Optional) Adding a Web Application Firewall to your Load Balancer"}),"\n",(0,n.jsx)(a.p,{children:"You can also add a WAF by:"}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsxs)(a.li,{children:["Selecting your Load Balancer, then ",(0,n.jsx)(a.strong,{children:"Integrated Services"})," then ",(0,n.jsx)(a.strong,{children:"Create Web ACL"}),"."]}),"\n",(0,n.jsxs)(a.li,{children:["Under ",(0,n.jsx)(a.strong,{children:"Associated AWS resources"})," select your Load Balancer."]}),"\n",(0,n.jsxs)(a.li,{children:["Under ",(0,n.jsx)(a.strong,{children:"Add rules and rule groups"})," select the pre-built Firewall rules you want to enable."]}),"\n",(0,n.jsxs)(a.li,{children:["Click through to ",(0,n.jsx)(a.strong,{children:"Create Web ACL"})]}),"\n"]}),"\n",(0,n.jsx)(a.h2,{id:"troubleshooting-the-load-balancer",children:"Troubleshooting the Load Balancer"}),"\n",(0,n.jsx)(a.p,{children:"If your ALB shows a status as unhealthy, check that you have selected 443 (not 80) as the port and HTTPS (not HTTP) as the protocol in all instances."}),"\n",(0,n.jsxs)(a.p,{children:["If the Connection Times Out or you get the error \u201c504 Gateway Timeout\u201d, check that Security Group on both the load balancer and the Cado server allow traffic from Cado to the ALB to the User. Also select the Target Group, and check that under ",(0,n.jsx)(a.strong,{children:"Registered targets"})," the Instance is listed."]})]})}function h(e={}){const{wrapper:a}={...(0,t.a)(),...e.components};return a?(0,n.jsx)(a,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},8460:(e,a,o)=>{o.d(a,{Z:()=>n});const n=o.p+"assets/images/aws-lb-1-cb787acc8f3821d5ce8f41527f37a4fa.png"},1151:(e,a,o)=>{o.d(a,{Z:()=>l,a:()=>i});var n=o(7294);const t={},r=n.createContext(t);function i(e){const a=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(a):{...a,...e}}),[a,e])}function l(e){let a;return a=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:i(e.components),n.createElement(r.Provider,{value:a},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/e4cf30c3.7ecf5d31.js b/assets/js/e4cf30c3.7ecf5d31.js new file mode 100644 index 000000000..1b22566d5 --- /dev/null +++ b/assets/js/e4cf30c3.7ecf5d31.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9853],{7341:(e,a,o)=>{o.r(a),o.d(a,{assets:()=>d,contentTitle:()=>i,default:()=>h,frontMatter:()=>r,metadata:()=>l,toc:()=>s});var n=o(5893),t=o(1151);const r={title:"Load Balancer",hide_title:!0,sidebar_position:1},i="How to Add a Load Balancer in AWS",l={id:"cado-response/deploy/aws/networking/aws-load-balancer",title:"Load Balancer",description:"An Application Load Balancer can be placed in front of the Cado web server in order to provide a valid HTTPS connection and add a Web Application Firewall. This can be configured via the provided Terraform or Cloudformation deployment scripts.",source:"@site/docs/cado-response/deploy/aws/networking/aws-load-balancer.md",sourceDirName:"cado-response/deploy/aws/networking",slug:"/cado-response/deploy/aws/networking/aws-load-balancer",permalink:"/cado-response/deploy/aws/networking/aws-load-balancer",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/networking/aws-load-balancer.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Load Balancer",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Logging",permalink:"/cado-response/deploy/aws/logging"},next:{title:"Private IP Addresses",permalink:"/cado-response/deploy/aws/networking/internet-routable-addresses"}},d={},s=[{value:"Get a SSL/TLS Certificate for your domain",id:"get-a-ssltls-certificate-for-your-domain",level:2},{value:"After Deploying the Load Balancer",id:"after-deploying-the-load-balancer",level:2},{value:"(Optional) Adding a Web Application Firewall to your Load Balancer",id:"optional-adding-a-web-application-firewall-to-your-load-balancer",level:2},{value:"Troubleshooting the Load Balancer",id:"troubleshooting-the-load-balancer",level:2}];function c(e){const a={code:"code",h1:"h1",h2:"h2",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,t.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(a.h1,{id:"how-to-add-a-load-balancer-in-aws",children:"How to Add a Load Balancer in AWS"}),"\n",(0,n.jsx)(a.p,{children:"An Application Load Balancer can be placed in front of the Cado web server in order to provide a valid HTTPS connection and add a Web Application Firewall. This can be configured via the provided Terraform or Cloudformation deployment scripts."}),"\n",(0,n.jsx)(a.p,{children:(0,n.jsx)(a.img,{alt:"AWS Load Balancer 1",src:o(8460).Z+"",width:"1421",height:"767"})}),"\n",(0,n.jsx)(a.h2,{id:"get-a-ssltls-certificate-for-your-domain",children:"Get a SSL/TLS Certificate for your domain"}),"\n",(0,n.jsxs)(a.p,{children:["In order to deploy with an ALB you will need to provide an ARN for an SSL/TLS certificate for a domain name you own. To do this you will need to visit the Amazon Certificate Manager. Click ",(0,n.jsx)(a.strong,{children:"Request"})," and follow the instructions."]}),"\n",(0,n.jsx)(a.h2,{id:"after-deploying-the-load-balancer",children:"After Deploying the Load Balancer"}),"\n",(0,n.jsxs)(a.p,{children:["Once the load balancer has been created, select the Load Balancer and open the domain name listed under DNS name e.g. ",(0,n.jsx)(a.code,{children:"https://cado-alb-test.us-east-1.elb.amazonaws.com/"})]}),"\n",(0,n.jsxs)(a.p,{children:["If you are using your own domain name, you will then need to point your custom domain name to this DNS name. For example, this is a typical record to point a domain you own (example: ",(0,n.jsx)(a.code,{children:"cado-alb.your-company.com"}),") to the ",(0,n.jsx)(a.code,{children:"*.amazonaws.com"})," DNS name of your Load Balancer:"]}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsxs)(a.li,{children:["Type: ",(0,n.jsx)(a.code,{children:"CNAME"})]}),"\n",(0,n.jsxs)(a.li,{children:["Name: ",(0,n.jsx)(a.code,{children:"cado-alb"})]}),"\n",(0,n.jsxs)(a.li,{children:["Target: ",(0,n.jsx)(a.code,{children:"cado-alb-test.us-east-1.elb.amazonaws.com"})]}),"\n"]}),"\n",(0,n.jsx)(a.p,{children:"You should then be able to visit the domain in your browser and login to Cado."}),"\n",(0,n.jsx)(a.h2,{id:"optional-adding-a-web-application-firewall-to-your-load-balancer",children:"(Optional) Adding a Web Application Firewall to your Load Balancer"}),"\n",(0,n.jsx)(a.p,{children:"You can also add a WAF by:"}),"\n",(0,n.jsxs)(a.ul,{children:["\n",(0,n.jsxs)(a.li,{children:["Selecting your Load Balancer, then ",(0,n.jsx)(a.strong,{children:"Integrated Services"})," then ",(0,n.jsx)(a.strong,{children:"Create Web ACL"}),"."]}),"\n",(0,n.jsxs)(a.li,{children:["Under ",(0,n.jsx)(a.strong,{children:"Associated AWS resources"})," select your Load Balancer."]}),"\n",(0,n.jsxs)(a.li,{children:["Under ",(0,n.jsx)(a.strong,{children:"Add rules and rule groups"})," select the pre-built Firewall rules you want to enable."]}),"\n",(0,n.jsxs)(a.li,{children:["Click through to ",(0,n.jsx)(a.strong,{children:"Create Web ACL"})]}),"\n"]}),"\n",(0,n.jsx)(a.h2,{id:"troubleshooting-the-load-balancer",children:"Troubleshooting the Load Balancer"}),"\n",(0,n.jsx)(a.p,{children:"If your ALB shows a status as unhealthy, check that you have selected 443 (not 80) as the port and HTTPS (not HTTP) as the protocol in all instances."}),"\n",(0,n.jsxs)(a.p,{children:["If the Connection Times Out or you get the error \u201c504 Gateway Timeout\u201d, check that Security Group on both the load balancer and the Cado server allow traffic from Cado to the ALB to the User. Also select the Target Group, and check that under ",(0,n.jsx)(a.strong,{children:"Registered targets"})," the Instance is listed."]})]})}function h(e={}){const{wrapper:a}={...(0,t.a)(),...e.components};return a?(0,n.jsx)(a,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},8460:(e,a,o)=>{o.d(a,{Z:()=>n});const n=o.p+"assets/images/aws-lb-1-cb787acc8f3821d5ce8f41527f37a4fa.png"},1151:(e,a,o)=>{o.d(a,{Z:()=>l,a:()=>i});var n=o(7294);const t={},r=n.createContext(t);function i(e){const a=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(a):{...a,...e}}),[a,e])}function l(e){let a;return a=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:i(e.components),n.createElement(r.Provider,{value:a},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/e4d09c46.34dbbbb3.js b/assets/js/e4d09c46.34dbbbb3.js new file mode 100644 index 000000000..9d5f7b886 --- /dev/null +++ b/assets/js/e4d09c46.34dbbbb3.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8918],{9733:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>r,default:()=>p,frontMatter:()=>i,metadata:()=>s,toc:()=>c});var a=n(5893),o=n(1151);const i={title:"Updating",hide_title:!0,sidebar_position:9},r="Updating Your Cado Instance",s={id:"cado-response/manage/updating",title:"Updating",description:"You can view version information and trigger updates by clicking Updates from the Settings menu.",source:"@site/docs/cado-response/manage/updating.md",sourceDirName:"cado-response/manage",slug:"/cado-response/manage/updating",permalink:"/cado-response/manage/updating",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/updating.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:9,frontMatter:{title:"Updating",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Data Management",permalink:"/cado-response/manage/data"},next:{title:"Health Monitoring",permalink:"/cado-response/manage/monitoring"}},d={},c=[];function u(e){const t={code:"code",h1:"h1",li:"li",p:"p",strong:"strong",ul:"ul",...(0,o.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.h1,{id:"updating-your-cado-instance",children:"Updating Your Cado Instance"}),"\n",(0,a.jsxs)(t.p,{children:["You can view version information and trigger updates by clicking ",(0,a.jsx)(t.strong,{children:"Updates"})," from the ",(0,a.jsx)(t.strong,{children:"Settings"})," menu."]}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsx)(t.li,{children:"For AWS, the default update mechanism requires the ability for the Cado instance to connect outbound to a URL hosted at cado-public.s3.amazonaws.com and then deploy a public AMI in the same region in which the Cado platform is deployed."}),"\n",(0,a.jsx)(t.li,{children:"For Azure, the default update mechanism requires the ability to connect outbound to a VHD URL. You can upgrade via the UI, however if you wish to reduce Terraform state drift, it's recommended that you upgrade using the Terraform instructions below."}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:"Alternatively, you can specify an AMI ID in AWS or a VHD URL in Azure using the Alternative Update Method. In all cases, upgrades to the Cado platform are user-initiated and will not be initiated automatically by Cado."}),"\n",(0,a.jsxs)(t.p,{children:["If you have deployed with Terraform, update the AMI ID (AWS) or VHD URL (Azure) and run ",(0,a.jsx)(t.code,{children:"terraform apply"}),"."]})]})}function p(e={}){const{wrapper:t}={...(0,o.a)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(u,{...e})}):u(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>s,a:()=>r});var a=n(7294);const o={},i=a.createContext(o);function r(e){const t=a.useContext(i);return a.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),a.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/e4d09c46.fb67b6d5.js b/assets/js/e4d09c46.fb67b6d5.js deleted file mode 100644 index 6fd792d0f..000000000 --- a/assets/js/e4d09c46.fb67b6d5.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8918],{9733:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>r,default:()=>p,frontMatter:()=>i,metadata:()=>s,toc:()=>c});var a=n(5893),o=n(1151);const i={title:"Updating",hide_title:!0,sidebar_position:9},r="Updating Your Cado Instance",s={id:"cado-response/manage/updating",title:"Updating",description:"You can view version information and trigger updates by clicking Updates from the Settings menu.",source:"@site/docs/cado-response/manage/updating.md",sourceDirName:"cado-response/manage",slug:"/cado-response/manage/updating",permalink:"/cado-response/manage/updating",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/updating.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:9,frontMatter:{title:"Updating",hide_title:!0,sidebar_position:9},sidebar:"tutorialSidebar",previous:{title:"Data Management",permalink:"/cado-response/manage/data"},next:{title:"Health Monitoring",permalink:"/cado-response/manage/monitoring"}},d={},c=[];function u(e){const t={code:"code",h1:"h1",li:"li",p:"p",strong:"strong",ul:"ul",...(0,o.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.h1,{id:"updating-your-cado-instance",children:"Updating Your Cado Instance"}),"\n",(0,a.jsxs)(t.p,{children:["You can view version information and trigger updates by clicking ",(0,a.jsx)(t.strong,{children:"Updates"})," from the ",(0,a.jsx)(t.strong,{children:"Settings"})," menu."]}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsx)(t.li,{children:"For AWS, the default update mechanism requires the ability for the Cado instance to connect outbound to a URL hosted at cado-public.s3.amazonaws.com and then deploy a public AMI in the same region in which the Cado platform is deployed."}),"\n",(0,a.jsx)(t.li,{children:"For Azure, the default update mechanism requires the ability to connect outbound to a VHD URL. You can upgrade via the UI, however if you wish to reduce Terraform state drift, it's recommended that you upgrade using the Terraform instructions below."}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:"Alternatively, you can specify an AMI ID in AWS or a VHD URL in Azure using the Alternative Update Method. In all cases, upgrades to the Cado platform are user-initiated and will not be initiated automatically by Cado."}),"\n",(0,a.jsxs)(t.p,{children:["If you have deployed with Terraform, update the AMI ID (AWS) or VHD URL (Azure) and run ",(0,a.jsx)(t.code,{children:"terraform apply"}),"."]})]})}function p(e={}){const{wrapper:t}={...(0,o.a)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(u,{...e})}):u(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>s,a:()=>r});var a=n(7294);const o={},i=a.createContext(o);function r(e){const t=a.useContext(i);return a.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),a.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ea3ff95a.262308da.js b/assets/js/ea3ff95a.262308da.js deleted file mode 100644 index e41a2b004..000000000 --- a/assets/js/ea3ff95a.262308da.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5984],{9708:(t,e,o)=>{o.r(e),o.d(e,{assets:()=>a,contentTitle:()=>i,default:()=>m,frontMatter:()=>p,metadata:()=>n,toc:()=>d});var r=o(5893),s=o(1151);const p={title:"Supported Import Types",hide_title:!0,sidebar_position:4},i="Import Types",n={id:"cado-response/discovery-import/import/data-types/import-types",title:"Supported Import Types",description:"Import Types",source:"@site/docs/cado-response/discovery-import/import/data-types/import-types.md",sourceDirName:"cado-response/discovery-import/import/data-types",slug:"/cado-response/discovery-import/import/data-types/import-types",permalink:"/cado-response/discovery-import/import/data-types/import-types",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/data-types/import-types.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:4,frontMatter:{title:"Supported Import Types",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Memory Analysis",permalink:"/cado-response/discovery-import/import/data-types/memory"},next:{title:"EC2 and EBS",permalink:"/cado-response/discovery-import/import/aws/aws-ec2"}},a={},d=[];function c(t){const e={h1:"h1",img:"img",p:"p",...(0,s.a)(),...t.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(e.h1,{id:"import-types",children:"Import Types"}),"\n",(0,r.jsx)(e.p,{children:(0,r.jsx)(e.img,{alt:"Import Types",src:o(8010).Z+"",width:"1251",height:"797"})})]})}function m(t={}){const{wrapper:e}={...(0,s.a)(),...t.components};return e?(0,r.jsx)(e,{...t,children:(0,r.jsx)(c,{...t})}):c(t)}},8010:(t,e,o)=>{o.d(e,{Z:()=>r});const r=o.p+"assets/images/import-types-497d2a41fdff0f8d3aa8677fa1e497d0.png"},1151:(t,e,o)=>{o.d(e,{Z:()=>n,a:()=>i});var r=o(7294);const s={},p=r.createContext(s);function i(t){const e=r.useContext(p);return r.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function n(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(s):t.components||s:i(t.components),r.createElement(p.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/ea3ff95a.ecd3515b.js b/assets/js/ea3ff95a.ecd3515b.js new file mode 100644 index 000000000..bbca64bb7 --- /dev/null +++ b/assets/js/ea3ff95a.ecd3515b.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5984],{9708:(t,e,o)=>{o.r(e),o.d(e,{assets:()=>a,contentTitle:()=>i,default:()=>m,frontMatter:()=>p,metadata:()=>n,toc:()=>d});var r=o(5893),s=o(1151);const p={title:"Supported Import Types",hide_title:!0,sidebar_position:4},i="Import Types",n={id:"cado-response/discovery-import/import/data-types/import-types",title:"Supported Import Types",description:"Import Types",source:"@site/docs/cado-response/discovery-import/import/data-types/import-types.md",sourceDirName:"cado-response/discovery-import/import/data-types",slug:"/cado-response/discovery-import/import/data-types/import-types",permalink:"/cado-response/discovery-import/import/data-types/import-types",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/data-types/import-types.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:4,frontMatter:{title:"Supported Import Types",hide_title:!0,sidebar_position:4},sidebar:"tutorialSidebar",previous:{title:"Memory Analysis",permalink:"/cado-response/discovery-import/import/data-types/memory"},next:{title:"EC2 and EBS",permalink:"/cado-response/discovery-import/import/aws/aws-ec2"}},a={},d=[];function c(t){const e={h1:"h1",img:"img",p:"p",...(0,s.a)(),...t.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(e.h1,{id:"import-types",children:"Import Types"}),"\n",(0,r.jsx)(e.p,{children:(0,r.jsx)(e.img,{alt:"Import Types",src:o(8010).Z+"",width:"1251",height:"797"})})]})}function m(t={}){const{wrapper:e}={...(0,s.a)(),...t.components};return e?(0,r.jsx)(e,{...t,children:(0,r.jsx)(c,{...t})}):c(t)}},8010:(t,e,o)=>{o.d(e,{Z:()=>r});const r=o.p+"assets/images/import-types-497d2a41fdff0f8d3aa8677fa1e497d0.png"},1151:(t,e,o)=>{o.d(e,{Z:()=>n,a:()=>i});var r=o(7294);const s={},p=r.createContext(s);function i(t){const e=r.useContext(p);return r.useMemo((function(){return"function"==typeof t?t(e):{...e,...t}}),[e,t])}function n(t){let e;return e=t.disableParentContext?"function"==typeof t.components?t.components(s):t.components||s:i(t.components),r.createElement(p.Provider,{value:e},t.children)}}}]); \ No newline at end of file diff --git a/assets/js/eb8e19ae.7e5bec23.js b/assets/js/eb8e19ae.7e5bec23.js deleted file mode 100644 index c3158b914..000000000 --- a/assets/js/eb8e19ae.7e5bec23.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8913],{1747:(e,t,o)=>{o.r(t),o.d(t,{Highlight:()=>d,assets:()=>r,contentTitle:()=>c,default:()=>u,frontMatter:()=>s,metadata:()=>i,toc:()=>l});var a=o(5893),n=o(1151);const s={title:"Cross Account Creation",hide_title:!0,sidebar_position:3},c="Cross-account Access Creation",i={id:"cado-response/deploy/aws/iam/cross-account-creation",title:"Cross Account Creation",description:"The Cado platform can access resources across multiple AWS accounts. For instance, if you manage 100 AWS accounts, you can deploy Cado in a single AWS account and then grant the Cado platform access to all other AWS accounts, enabling the platform to acquire, process, and analyze evidence from all AWS accounts seamlessly.",source:"@site/docs/cado-response/deploy/aws/iam/cross-account-creation.md",sourceDirName:"cado-response/deploy/aws/iam",slug:"/cado-response/deploy/aws/iam/cross-account-creation",permalink:"/cado-response/deploy/aws/iam/cross-account-creation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/iam/cross-account-creation.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:3,frontMatter:{title:"Cross Account Creation",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Removing and Tightening IAM Permissions",permalink:"/cado-response/deploy/aws/iam/tightening-iam"},next:{title:"Overview",permalink:"/cado-response/deploy/aws/data-encryption/data-encryption-overview"}},r={},l=[{value:"Summary",id:"summary",level:2},{value:"STEP 1: Create IAM Policy and IAM Role in Target AWS Account",id:"step-1-create-iam-policy-and-iam-role-in-target-aws-account",level:3},{value:"STEP 2: Add Target AWS Role ARN to the Cado Platform",id:"step-2-add-target-aws-role-arn-to-the-cado-platform",level:3},{value:"Automating AWS IAM Role and Policy Deployment",id:"automating-aws-iam-role-and-policy-deployment",level:2},{value:"Using CloudFormation StackSets",id:"using-cloudformation-stacksets",level:3},{value:"Automating Cado Cross-account Creation",id:"automating-cado-cross-account-creation",level:2}],d=({children:e,color:t})=>{const o={span:"span",...(0,n.a)()};return(0,a.jsx)(o.span,{style:{backgroundColor:t,borderRadius:"2px",color:"#fff",padding:"0.2rem"},children:e})};function h(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.h1,{id:"cross-account-access-creation",children:"Cross-account Access Creation"}),"\n",(0,a.jsx)(t.p,{children:"The Cado platform can access resources across multiple AWS accounts. For instance, if you manage 100 AWS accounts, you can deploy Cado in a single AWS account and then grant the Cado platform access to all other AWS accounts, enabling the platform to acquire, process, and analyze evidence from all AWS accounts seamlessly."}),"\n",(0,a.jsx)(t.h2,{id:"summary",children:"Summary"}),"\n",(0,a.jsx)(t.p,{children:"The instructions below outline how to grant permissions for the Cado platform to access a target AWS account (outside of the AWS account in which Cado was deployed). This same process can be repeated for all AWS accounts needing cross-account access."}),"\n",(0,a.jsx)(t.p,{children:"Setup for cross-account acquisitions within the Cado platform is a 2 step process:"}),"\n",(0,a.jsxs)(t.ol,{children:["\n",(0,a.jsx)(t.li,{children:'Create a cross-account IAM Policy and IAM Role in the target AWS account from which you would like the Cado platform to be able to acquire data. This allows the Cado platform to "assume" that cross-account role and perform acquisitions.'}),"\n",(0,a.jsx)(t.li,{children:"Add the newly created cross-account IAM Role ARN to the Cado platform. This enables the new AWS account within the Cado platform."}),"\n"]}),"\n",(0,a.jsxs)(t.admonition,{type:"tip",children:[(0,a.jsxs)(t.p,{children:["Creation of the cross-account IAM Policy and IAM Role within each AWS account can be automated via AWS Stacksets and other programmatic methods. See the ",(0,a.jsx)(t.a,{href:"#automating-aws-iam-role-and-policy-deployment",children:"Automating AWS IAM Role and Policy Deployment"})," section below for more details."]}),(0,a.jsxs)(t.p,{children:["Adding the cross-account ARN to the Cado platform can be automated via the Cado APIs. See the ",(0,a.jsx)(t.a,{href:"#automating-cado-cross-account-creation",children:"Automating Cado Cross-account Creation"})," section below for more details."]})]}),"\n",(0,a.jsx)(t.admonition,{type:"info",children:(0,a.jsxs)(t.p,{children:["The examples below reference a primary AWS account which represents the AWS account in which the Cado platform is deployed and running (referred to as AWS account number ",(0,a.jsx)(t.code,{children:"111111111111"}),") and a target AWS account which represents the AWS account from which you wish to enable cross-account acquisitions from (referred to as AWS account number ",(0,a.jsx)(t.code,{children:"222222222222"}),") ."]})}),"\n",(0,a.jsx)(t.h3,{id:"step-1-create-iam-policy-and-iam-role-in-target-aws-account",children:"STEP 1: Create IAM Policy and IAM Role in Target AWS Account"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:["\n",(0,a.jsxs)(t.p,{children:["In the target AWS account (the account from which you would like to acquire data from), navigate to ",(0,a.jsx)(t.strong,{children:"IAM > Policies"})," and click ",(0,a.jsx)(t.strong,{children:"Create Policy"}),". In the Permissions Wizard, attach or paste the Cado Cross-account Policy ",(0,a.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/policy-in-cross-account.json",children:"located here"}),", then click ",(0,a.jsx)(t.strong,{children:"Next"}),". Give the Policy a name (like ",(0,a.jsx)(t.code,{children:"CadoResponseCrossAccountPolicy"}),"), then click ",(0,a.jsx)(t.strong,{children:"Create Policy"}),"."]}),"\n"]}),"\n",(0,a.jsxs)(t.li,{children:["\n",(0,a.jsxs)(t.p,{children:["After the Cado Cross-account Policy is created, navigate to ",(0,a.jsx)(t.strong,{children:"IAM > Roles"})," and click ",(0,a.jsx)(t.strong,{children:"Create Role"}),'. Under "Select type of trusted entity", click ',(0,a.jsx)(t.strong,{children:"Another AWS Account"})," and enter the account ID of your primary account (the account in which the Cado platform is deployed and running. ",(0,a.jsx)(t.code,{children:"111111111111"})," in this example)."]}),"\n"]}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"Create Role",src:o(7358).Z+"",width:"761",height:"323"})}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:["Add the policy you recently created in the steps above, then click ",(0,a.jsx)(t.strong,{children:"Next"})," give the Role a name. The role name ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(t.em,{children:"must"})})," include the text ",(0,a.jsx)(t.code,{children:"CadoResponse"})," (case sensitive, like ",(0,a.jsx)(t.code,{children:"CadoResponseCrossAccountRole"}),"). If the secondary account role name does not contain the text ",(0,a.jsx)(t.code,{children:"CadoResponse"}),", cross-account acquisition will not work properly."]}),"\n"]}),"\n",(0,a.jsxs)(t.admonition,{type:"info",children:[(0,a.jsx)(t.p,{children:"The Cado Cross-account Policy includes permissions to acquire a variety of AWS resources. You can remove permissions that are not needed for your use case."}),(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsx)(t.li,{children:"The EC2 permissions are required are acquire EC2 systems."}),"\n",(0,a.jsx)(t.li,{children:"The KMS permissions are required to acquire KMS encrypted volumes."}),"\n",(0,a.jsx)(t.li,{children:"The SSM permissions are required for Triage captures."}),"\n",(0,a.jsx)(t.li,{children:"The S3 Permissions are required to import from S3 buckets in other accounts."}),"\n",(0,a.jsx)(t.li,{children:"The CloudTrail permissions are required to import CloudTrail logs in other accounts."}),"\n",(0,a.jsx)(t.li,{children:"The ECS permissions are required to import ECS containers in other accounts."}),"\n",(0,a.jsx)(t.li,{children:"The EC2 de-register permission is required to import AMI images cross-account."}),"\n"]}),(0,a.jsxs)(t.p,{children:["Also note that if you choose to change ",(0,a.jsx)(t.strong,{children:"Maximum session duration"}),", the minimum currently supported by Cado is 1 hour."]}),(0,a.jsxs)(t.p,{children:["Lastly, the above steps walk through how to create a new role; however, if you already have an IAM Role with appropriate EC2 access, you can instead edit the trust relationship to include the below AWS ",(0,a.jsx)(t.strong,{children:"Principal"})," (replacing the ",(0,a.jsx)(t.code,{children:"111111111111"})," account number with your own primary AWS account, in which the Cado platform is deployed)."]}),(0,a.jsx)(t.p,{children:"The below JSON is only required if you choose to use an existing role and you didn't create a new role as recommended earlier."}),(0,a.jsx)(t.pre,{children:(0,a.jsx)(t.code,{className:"language-json",children:'{\n "Version": "2012-10-17",\n "Statement": [\n {\n "Effect": "Allow",\n "Principal": {\n "AWS": "111111111111"\n },\n "Action": "sts:AssumeRole",\n "Condition": {}\n }\n ]\n}\n'})}),(0,a.jsxs)(t.p,{children:["You may choose to limit this further and trust only your specific Cado role rather than the entire primary account. See AWS JSON policy elements: ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html",children:"Principal - AWS Identity and Access Management"})})," for more information."]})]}),"\n",(0,a.jsx)(t.h3,{id:"step-2-add-target-aws-role-arn-to-the-cado-platform",children:"STEP 2: Add Target AWS Role ARN to the Cado Platform"}),"\n",(0,a.jsxs)(t.p,{children:["After the target AWS Role is set up in the target AWS account (",(0,a.jsx)(t.code,{children:"222222222222"}),"), you will need to add the Role ARN to the Cado platform. To do this, log into your Cado platform, navigate to ",(0,a.jsx)(t.code,{children:"Settings > Cloud"})," and click on the ",(0,a.jsx)(t.strong,{children:"Create Role"})," button. When prompted, enter the IAM Role ARN created in Step 1 and provide an ",(0,a.jsx)(t.code,{children:"Account Alias (Cloud ID)"})," for the role. The ",(0,a.jsx)(t.code,{children:"Alias"})," is what will appear in the Cado platform UI, so we typically recommended that it includes the AWS account number in the text."]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"Add Role",src:o(5132).Z+"",width:"2134",height:"1248"})}),"\n",(0,a.jsx)(t.p,{children:"Upon submission, the Cado platform will attempt to validate the role, ensuring it is assumable. Once validated, you will see the Alias in the list of available AWS accounts."}),"\n",(0,a.jsx)(t.h2,{id:"automating-aws-iam-role-and-policy-deployment",children:"Automating AWS IAM Role and Policy Deployment"}),"\n",(0,a.jsx)(t.h3,{id:"using-cloudformation-stacksets",children:"Using CloudFormation StackSets"}),"\n",(0,a.jsxs)(t.p,{children:["To automate the creation of the IAM Policy and Role in each target AWS Account via CloudFormation StackSets across your AWS Organisation, you can follow the steps below. More details about CloudFormation StackSets can be found here: ",(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html",children:"Working with AWS CloudFormation StackSets"})]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"Stacks1",src:o(4413).Z+"",width:"614",height:"345"})}),"\n",(0,a.jsxs)(t.ol,{children:["\n",(0,a.jsx)(t.li,{children:'Go to "StackSets" from your master StackSet account that is enabled to deploy into other accounts.'}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"StackSets Role",src:o(231).Z+"",width:"245",height:"82"})}),"\n",(0,a.jsxs)(t.ol,{start:"2",children:["\n",(0,a.jsxs)(t.li,{children:["\n",(0,a.jsxs)(t.p,{children:["Click ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(d,{color:"#F78631",children:"Create StackSet"})})]}),"\n"]}),"\n",(0,a.jsxs)(t.li,{children:["\n",(0,a.jsxs)(t.p,{children:["Enter the S3 URL as ",(0,a.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/cloudformation/template-organization-stackset-iam-only.json",children:"https://cado-public.s3.amazonaws.com/cloudformation/template-organization-stackset-iam-only.json"})," then click ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(d,{color:"#F78631",children:"Next"})}),":"]}),"\n"]}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"Stacks3",src:o(5138).Z+"",width:"592",height:"234"})}),"\n",(0,a.jsxs)(t.ol,{start:"4",children:["\n",(0,a.jsxs)(t.li,{children:["Click ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(d,{color:"#F78631",children:"Next"})}),' through the next two dialogues, and under "Create StackSet" select any region (this works as IAM is global):']}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"Stacks4",src:o(1713).Z+"",width:"582",height:"169"})}),"\n",(0,a.jsxs)(t.ol,{start:"5",children:["\n",(0,a.jsx)(t.li,{children:"Once deployed, this will then create a IAM Policy and IAM Role in each target AWS account, that you can view in IAM:"}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"Stacks5",src:o(3823).Z+"",width:"434",height:"115"})}),"\n",(0,a.jsx)(t.admonition,{type:"tip",children:(0,a.jsxs)(t.p,{children:["You will then need to add the newly created cross-account IAM Role ARN to the Cado platform, using the steps outlined ",(0,a.jsx)(t.a,{href:"#step-2-add-the-target-aws-role-arn-to-the-cado-platform",children:"here"})," or if you choose to automate the process, the steps outlined ",(0,a.jsx)(t.a,{href:"#automating-cado-cross-account-creation",children:"here"})]})}),"\n",(0,a.jsx)(t.h2,{id:"automating-cado-cross-account-creation",children:"Automating Cado Cross-account Creation"}),"\n",(0,a.jsxs)(t.p,{children:["As mentioned previously, the second step to adding cross-account access is to add the newly created cross-account IAM Role ARN to the Cado platform. This enables the new AWS account within the Cado platform. To automate this process via the Cado APIs, please see the example Cado API for adding AWS credentials ",(0,a.jsx)(t.a,{href:"https://github.com/cado-security/cado-api-examples/blob/main/examples/saving_credentials.py",children:"here"}),"."]})]})}function u(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(h,{...e})}):h(e)}},5132:(e,t,o)=>{o.d(t,{Z:()=>a});const a=o.p+"assets/images/add-role-cf34be238a0b5ac245ac1c0ddf70fcb6.png"},7358:(e,t,o)=>{o.d(t,{Z:()=>a});const a=o.p+"assets/images/create-role-fa83b0fb86d9d71fcea59dc0f7103a94.png"},4413:(e,t,o)=>{o.d(t,{Z:()=>a});const a=o.p+"assets/images/stacks1-ccd441458e148ad57f8c89f48c540f90.png"},231:(e,t,o)=>{o.d(t,{Z:()=>a});const a="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPUAAABSCAYAAACMqJIzAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAACKkSURBVHhe7Z3Xd1xXduZ35SpkEJkECRBMAHOmJJKSOij0tNse27PGXqvfPI8zr15+9avX8n8x8zKrPZ52t1tWt6hMipTEKOYIBpAEiRwKKAAVZv/2rQsUoQJJFSGNVDqfdFhVt84994T97XQOgEBOIQ4ODmWDwD/84z/nrl7vzX90cHD4ocNI/Yc/fZz/6ODg8ENHMP/q4OBQJnCkdnAoMzhSOziUGRypHRzKDI7UDg5lBkdqB4cygyO1g0OZwZHawaHM4Ejt4FBmcKR2cCgzOFI7OJQZHKkdHMoMjtQODmWGHwepQyEJ1tRKqK5eAhUV+YsODuWJ0KHX3/zH6zfv5D9+QwQCEohGJVRbJ5FVayTStkrCLa0Sqm+QQCQikstJLpux1/+fCFZWSeWh1yW+badIJivpx/35b54CxpaokHBjs0RWd0iktU1CTc0Sqq7R71QXMq5sNl/ZweH7gxf6eepALC7RNR2S2H1Awg2NIpGoXlUCZzKSnZyU2b67MnXiU8kmJxeIHQxJIB6zOrm5ue+EGKEVjVL3l38jISXo1OdHZfKT95/53KAqqsT23RJdv8kjcjBg9+RmZyUzPiapSxckdf60jaMk4D3o/OVoM63zkE7nv3BweDGU7n6rJYtv2SbVv/gLia3baMKZ7n8gc/fuSmZ4SK1cQi33Ss/d1boGFeRwc4us+PV/k+o3fqnkTnjXv28IR6Tq9Tek4qXDElHrnBkdsXHNPXwgudS0RHQMkbY2U1ClIqyKpv7Xfye1f/W3Oiet+asODi+O0kitJCU+jW3oUfc7JjM3r8nEu7+Xiff+IBPvvyvjf/x3Gf/dv8jEkXclOza6YBWDQQmq1QtWV5uVD+DGfs8QUG8jtm6DxDq61CqnJKmexsS7v9Nx/YdMHnlHxt/5Nxn9v/9bpr48rla6dOsaiMXUG6iVoLr4AVV2Dg7LhZJJHayqsVga93Pm+lW1YvfNQmfHRiQzNCBz9+9J+mGf5GZmvFuU/KGqanWFNd4ORyUYj2vsXW+fSWKJxua0S4werK6VsMbn0bXrJKpeQHTtegm3YvUrTTF8DRq/oyy4J9LZJZE1azX+bTHFUbR+IXhe/QrtywqLockFRNs71IuIS3Z0VFIXz0t64JG+13GNDFs8PnenVzKDA1934dVyB3WM4ZXtEu1ab30nHkeJSTjs1dH2GQdjRoHwPPrOPNjcMA/A5jjflo4/2rVBItovwgKbKweHJVBaoswsdZ3ENN5ECGfv9koaIX+K5UIwK3bvN1edGDUQjVgSKqoWMdzaZhY9Oz0lsc51UrH3gCR27Jb4tl0S79kqsY09StROtWoJL8lFLO5DyRJpXyOVBw7qPXsksWW79qvbrhHHZ0Y0FFDy0E5QyTR3/67MKiktxs9b5Up1s6PafnY6aX2IqlKItK6SzNSkKqzLqphSz072qfJAMdCPit0HLCkX795q40b5oexoG+VUsXufxHXuLA+hVpr7UCQxJW6GehMTSugqqXj5VZ2LlySxdafENm2WmCq5sIYD5CjMA3JwKILSLLUKeHZ8TDKTExYXI3hYVSzLUsDNNNdbLSBKwawyGXIsF698DoUlvGq1ufbZ6WmLY2dv3zJChCHMS4eUnNvMdfUR794iNW//uZGWdtLqLWSGB7WPyheUh28hC8HzlYTx7s0WO0Po9OBjL2ZWAqOkcrMzGju3StXhnxoRn2UdUVBVP3lLErv22fzM9Wnf7922fsQ3b5fKg6/bXAW14LGQc9CO6H/6r8bwzIPNhYYkoZoaL6ZXJcVnEo6zd27p2AYlqB7P0+bZwaHkLS3L2KrAhpuazG2M5re0QlifHBldtdq4p3kLhwLIqBsLubE2aSXQ5MdHZPbqZSXuTVMSObX0OSUzlnTm6kWL1Wd7b6hQ35GQ3hdRVzQ7lTTXPjc3a1tnVa+/qSSoUwVwW5LHPpLUhXMye+OKtZF+9FCtWtKyzIWWmlAB5VD5yqvmaaTOn5Hpc6clp22z5YUlNNe3boX2tVUiqmgiuP/aBzL23tgLLLcqjgReiHoUc/rM5KcfqNv+lczeuiHp/vtmhXGbM0ODXjJRx0M7eAmZ8VGZOvaxpL46o/WvS1pDF7L1lQcOWd8Y09Spz+07mwsdJ2GAeQ8ODkVQeqZKSTtz/Yolw2bVomL9Ih1rpULdz5pf/qVZpjBxrW1zKQeUMFjR7NSUkT2bSlkMTrzqCanG3hqfI/RpJS0ZZ9xVSmZ42IgNkYjNzfpqierzwqpQsqkpSX5+1JQDVpp7M+qmm8WGgAUgzo6sVnfdLGdcUlcu6r3HTKnY9hQKSZ85pdemzp6UtHoJIY1/45u3SfVP35SaX/21xNXFx+vws994BLj7JLxmLmkMrs/N6fhyM+ptPOgzoqJYIqtWmQfg5R7UfVa9kJtL2xYZ80CxecB8kwvQ8ebok841not5RwOPnevt8FSUTmoFwj9746qM/uZ/ysQff69W8qxZEFxRYkvcYpJX33jrR91wizNXd1rhPW0U2EbPVW9pNZc7o0KeVmH/WuKqCIjNa976lbZZLyklIFnsHPvoi+4lFsfijv3mf8nkR++pS66utLrJuOo1/0mV1iuvWdyLMgupRQ9Veu+D6jpjsePbdkh8qxYUgFp4SMohGOo8C1n1akgy4pbjTVRoQRGZi/4c9zv8uPFiJ8p8qDXB2szdu2OWKpucMBcbC0fBomNtsNpRTmepG411RiFwmGMeSlTc3Oq3/sxIE+/ZIvFNm5UYOyTWtV7jyaiRF4vMM/ku3NhiFhl3fakDHJAK99uy78Sz2g9c8+Rnn6hVH15aGWApsazqNtNXXGBiYXPLVdGwZ40lDrettEy3ta/hR1StNi43Y6UQHjBO4mLyBPQ93NhksTau/qyGGYXWNzc7ZyFCsFLb02fh/jNWEpOWJCNMWGKsDg4vZKmfALEmrrIK59SZkzLTq8TDiqnwmqV6loXByqk7XHHwNYlCenWhp059IVMnT8j0mS9NYRTGsfwJMIvbsd+4qs+x5809xLxkmDn8QbY8VFuf/3YJKOEhNmSCaMlP3lc3eNTc+FBDkz0XF9oPKabPnpKp459K8vgn82Xy4/dk8pMjMnPtiuUNngmtg9Kb/PBPMvnBu9rmSfuMIqh545fqAex89nw6/GixfKT2AQkgNzGqvrcDJhyxnEeemItlki0hJVq0s8vumz51wgiUPPqhWdSZa5eMlPPIqncwQXItY0oDkj1T0CG1xuskprJqOdkmSuze57nFKIZ5LNGOKi6Ov2b9vXd7Xs48E4uhVcmgfKaU2NMnP3+ipM6dtnyBxe0FWLLLOgd4ESTcONY69s5vzUNhfxsPBq/GwaEYSic1p6CW2C4iy4wbDVHIemfVTZ23snmhtmRX4Ukq9ms5aaav1Ceu9BEIBZW0iSeolktnLIOOW8sWWGLLtuL9WQQUTurGFbOg9CmxbZfFreZNAO2/bZk9QfI8LNZvsFgai5uZGLfxWHJOLSnJsMTOPaokKvM3PAX6bJsRjZvJDzwVnDe3Az195jXYoZVnKTCHHy1KP3zS2CzVP31bErv22tlli/80noxv3GwkIW7OJZOWRU6r2+pbbQhvBzKqajQubbDYmyw2LidWMNa9RUJaB4ISO4Zb2rz9aY0/2eNlPxmLRTYd4uOScojDtp20H1hsrsW0PttsuNqBYOiJLa1ZDQ2Ik9kWCze3eZlrJTFZaxDfvkuqXvu5neLCTYfEHEbBqlfsP2h5AhQKSTZTPigqvZ9YOqL9Jc5HaaGgwuqix3ROzGVWGpsHo4TmRF6iW/vE3jW5B50LYmZ+qs32vH/2pva3yggcrKiwM/OcB7Ax9N3zcgi+onRwKEDJpOZ0F6e/sMhsXUHMmJIVMpMJJrae/uqMzFy54G3TABVC4k6SPwgqJ60Qeiybbf0M9JvFRMghfFTb56fAsGRYwkA4ZCfXOJCCu+vFnkNmIdlWIj6OQu7VHdpugxcHa7s8N7amU4kXsj1ii89xpSGYAqWAIkGJEC+T2OJUGQqHvXfGxeEalAXk52DJlFr6OdxpVVYAD4D9az85GG1fLZyeo9gPtijB7XhpntSED4G4jpV50PmiDyTfrE0dl51G07lEscQ2dttps6B6KyjI6dNf2LgdHIqh9B+9VEsUXqFWskmLCj7k5LCE7bmqFbNDElhDdRefAFZehRdFgPDz0124r5AVq8e5aCOmkioYj6mQPzQS2RFLvSc7OW4En1cUCjso0tJqVhdiEPOmHz2we0m4QUQy1Fg928NWa++D5/Gz0mwf2VbSsEcWs7hKasbG9hfuPue9OW2GojALnSe0D8ZvfdBnca+51WrFSc6lH/XrqxJWlYlXGTc/bl4CR24BngptE5szVqwzPyVm8bM+a1aVEUqJfW4Hh6XwYn+fmrgznwjzYzzzCHMq7Aj8IqGfB3Xt3nxcaJZL6/I6/x1l0Xdc9z8XorA9v80s9ThMoq+AvfLC9nz49wL7jvpaqE+CT/vhJ8QsUce9fn+Kgbb8vngPzLebv28xyCv4fS7sm59gLGxn8ZgcHIogL80lAgFUV9G2s2ZnrYjGqbaHWkyAfSCUxKHUo/DeF9T579SiYdX8tvzrxdotbI97KPTLbxNAhmL3+/fOf5e/h/rWHuOayY+NdvV6YbuLQRvz/cjf44+hGPx+U/y2KfPPL2hn8ZgcHIrgxUjt4ODwvYMjtYNDmcGR2sGhzOBI7eBQZnCkdnAoMzhSOziUGRypHRzKDI7UDg5lBkdqB4cygyO1g0OZwZHawaHMUBKpAzmR2mxQGrIhr+QoYWksLBKWJiuRhRKISLOV6HxpCUYl+sSvP3BwcHgRlPRTWhEl9d+lVkiFhCQYCEgg/1Na9j5fgvPXvJ9yWqjDDx4F5+tS75+St2Q4N5dv3cHB4UVQEqkTuYD883ib1AXCRkqIa69Bj8DBUFBCRliu57/L1+Fnm3kN+d9pvf86flbuZd0vp3dwWA6UFlOrpQ5lcxKmZNRyZxdKVL+LcE2JX3gd6841vo9m+S7/vV77Jp2IRiNSWZmQmpoqqaqqkEgkrIqE39kQku3bN8mePVtkxYrafO3vBk1NK2Tv3m3S3d1lSg3Qr4qK+NdLIm59/SGDIcbjUVlRX/udjgVjUF1dKS+9tFN+8far8sYbB2Xjxk677rCAkn6dEUR8M1Up8ZzS0dxpruYnFndbLXWwOmElENFFzyh7lcweuMF7yd8ov5l7JGO5tL0vBix6PB6T5uYVsnbtatm8eb1s3NApK1c2G8lTqRnJqoI5dGiPtK9qkUePB2VkZDx/97cLSLx6dZuSeqvEolG5efOuCfr6dWukp2ed9ae9vdXKKop+np6ekcnJqXwL319AFuadOQbZ/M+Eh8NhU6CvvLJLHj8e/s7GEo/HZdeuzXJg/w6JJ7RfkYjMzMzJ/fuP5InfNPsCQBnHYlEJqQxn+Pn2HyBKzn7za4hYZMiU4e9P5bz3WWVvoLZCEr/YLZW/flXif75PRD/ndJJUF1i9HPXm79fPz1gPJnnHjk3yX/76LXlTtfOWzRuU0C3S071OXnt1v3R2rDJyRfgVS0oolMB3BfRSKBSafzZA2Nav75RXXt5lFnz37q1W9uzeIrtVKJubGqy/33dAXhTo/n3bpaa6Kn/V84pqa6vVQ2kwywkBvgvU1VWbAkVmPvjghPz2396XM2cu2eflAGvS1tYk+/dvU/lqyl/94aFkS/3zZEJisBTwkidmMKZu56tbJTs8IdOfXjKpr/yrl9Vqe38rOjuqWv0JFgfkX9JqqaW4VoSgu3b1yN4928wif/jRCfn4oy/kzNnLtqBnz12WgcFhrRmQzWoZ0bS379yX4WHvlwp+20AQcL/XrGmTZHJKrl27bWTAoyA8QPCOHj0lJ0+el1OnLsrp05ek/9HgD8IKYKUPHNhh47vX1y/j45N2HSXep5/PfXVFLfWQpNPfzVjq6mpkXddqCalSOXfuioyOTmhflvbwvimQtQ3qAVLGtO3+fu+3y/7QUDKpf5YndUhd7No3dknl/o2S2NYp8e0dEmmrl3BjjeRSc5I616tEj0igKiGhjmbjf3ZciW2/ukc/6IX/kxkoSmoIQ3y8f982iWkMd/TTk3Lz1j1JTk3J7OzcfEGozKoUITVWvkXd9u3bu2XD+g7pXLvKLOXM7KzMzaVNy0fVbd6yZb1UVlTI+ERy3pVrbW2UdepGZ7WvMzOzdg1Bx/XfvGWDCRgudXVVpbS0NMrExOQTpMaynFXlMzIyZvf7/YUUjA23Fi9jq7ZF39Z2tluuYGZmRhWY97wVK+q0D6utj/X1NRa3tzQ3yOOBIesbHgtJx271WjZtXGttNDbU2/ja21t0XLS9xtz/ubk5UzwAS8sze9QS0/7ate02hrTOSUqfX6/x8kZtjzYTibi54owHwUe58owO7fuEzhdjwlqjxPCeWIcunZs1alXxYhg7cw1aWhrUi+nQ8YTNKhKi8Nn3tlKp1NeUBNcJWxgvbbKmeIX0EQ9pQt3/Wp23Tf6zde7bNDRjHQkNeCUPwxi32HjXyNqudmuTduhfTGWUfmzatFaVWL31Gy+kqrLC+kNfGe/0dGpeFujHhg0d0thYb2vMHKxZs9IK4+3qWmN9CWtb9KNO55z56dE15HqrtonXmkxOz8vccqBkUv90Mm6kjjRUS/1/flnSQ+MSCKsbptcyQxMSVmKH6qtk+vgVSd8flrkbD43QFX+xTzL9o5Ib4+9BsXgB+dclSM0kIZjdm7pkUhXB8c/PmUAVG38xUiOAq1Y1y09ef8mErLFxhcblDbaYDSqUfff7dfIztuBvv31YhTcmvbf75q0orueB/dvVIozLkLYXiYRs0V89vE9W6oLQRpMqDNqEoNQrJDUK6fr1OyoEntDjtrJ4FOojRIQP7e1tJhjNzY3mXqI4Hj58bOTHAzj4ym4je7c+u0MFplIF7erVXjl0cI/2cZ0qnyYlxUojJWNjrDx7/boOyzvQP8gOKXtv3zeBQ7D37N1qMT+WuFXvbWtrNtLd0fkzN1SVKcTBMtbV1tj7qamUDA6O6Fx3ycsv7ZR79x6qBU9KPBaTw4f3mPKkP006Hoi1SpUOAj08zN8Ky5mieOXlndLW2qyC3a6vTfaszs5VUq997ut7ZEJeCNZxx45uW18UBwqO+WCMM6pQaHufhjk7tQ5jWdFQJ6tVblbqeB72D5iiYO1f1nAIwjVrHRQj3zNf/Q8HTHEcOrh7Pk8DoRtUoaJ8RnTtkYXt2zZZ/8bGJqw+6/D6a/utnSu6HigCwi3mAFnatnWD9WdqaloVT9LCGHIRDTo3DdrH9lWtOj/NKoePTFEsF7FLInXYSB2TWDYowcqYVG7rkOTJG1Khljqk8fP4kXMSwBpp3dRXt0WUODKblszjMZm71S+Jt3ZJ+vZjyY17i/ev2UEZL0JqFrNThRHtPKKEuXTpxpLxUzFSV6kFPXxoj05sgxz77JT86b1jcvnyDbNsW3XCmcN+XXTu3bWzx6zYjRt3VNd4fUEAIFlf30N18UdM4H/+M1VgOrb3jhyTI+9/JucvXFNtrgKgi8RiF5Ka+mh5hA+rD7mwaigm3v/qz35iQvnJp1/IH/90VIl6y4jZoQIOoXH/EECsM6Sn7QsXr8tN7SPP2rplowler3ovjO3zL84ZYTduWCuzqkg+O35GPvjwhJw6fdEIVFNTbePAqoB7dx/os0/afVeu3DKrhOvJHNy580AeqLCv7cI6zcj77x+X48fPyv0Hj3RMaZsbLNcV7TPWmiw0As69jOXosVMyMDBsFgnBvXev38aNkkbpMC88++OPv9Q1uWlrxBhRjA/1uYVA2B9pyDKs/Waes9mM/OGdj+SUhjR4LMz1zp3dcvfuQ/ntb4/Il3o9o3KC9cfLQHnzvAGte+zYaTlx4qxcvHjDiMl4aYN7kRtyByjV0xoqva/re+PmXetDhypNCHrt+m3rI/cmtF5Pz3rzYlgX5BXLjaJM6ZxdvnLTxjY0OGpeQo8qwt7ePuvjqVMXvHbVc8SwsdbM63KgxAwHiS4tJMfyliedTMnYB1/J5LHLEqxJyNzIpCS/vG6TCxEp1MtC5FDAu9/K0kkOnTcdLqrBW1j9/7nBpJMtx7ogDNfMYs5aXMgCoDmxELihT4CHFgFXIRAZ2MuXb8mDBwMmKLPaZv+jASPrYkBuXFw0/PZt3aq5N6rbWqfuWFDqNT5E4K5f6zUC0dbY2KSRhPe49pZ11gczR1gj4kiy65CNuWMdGBOaHusGoSF7WuNMiEtmmn5xfVoJxQEgrAlA6T1W0iGIFRUJ7/njEyagXEPAfK8IFxEhTarFoa3F68D9WCuUIcqBvtLeXVUaKAE8IYuFddwAhTU0NGKCTP9QGtTlmSjcYpjVcIKQhHEjC15/Uva5e1OnzRGECatSZ15ZZ/rP+oZDYfMWUBbcixWlL2Nah+XGhec6XgheGu/p16TOqTcHCwP2peMJKXniA32ds3wDhDZPRsMylGpajRt9ZF2tj6oM57QusuAnWZcDpZFax+gT1SY5X+JbOySuVrvi5U32PtRWJxGNo2N71kls73qJ7ulSK71TZr66IxklvZ8xtwaLgLn0Jlk7qovwTfYjITUuFJZ7ShcHF4j+IlDERVOqhNDIWKfnAYKeqIibEEAY4lPAgtNmjt91vggs7lfnr8pxtQzHT5yRExo+4A7SCHvWCNaoktCPn+kfwoei8PuOxPjPINalzcIkG/dABl/w7FULBFuo511DQdJ/CkTD/T+oLicF9xVX2AfN2Np4zVq7/jMWg9gStxgiT6q3wyt16StWnLWoq6+xOQR8Rx2fQFZX59PaX2KJ+YrO8B/wjQlkqFPFTR8IRchcHziw3fIefI/SQ86wqnh97HEfPrRX623XUKbN6xMTQpvIsTbvFa994D/zecGaoKh4NkqQ8RMu0EdievpIYduTeSD/wT3LhdJIrWACvEnwtqQyuoD8ZYmsCmh6WK306RswQaUnJsHGagk21UigtlJmrj2Q5NHLkp5QkmU8S52fuyLImZCw+FgDP2HzvOC0GrDmFz2DhbKjq0tYhsUwKzdfd2HBnwaIjzt6QV308+evWfhAxhYFaH8NdB4LbXlzmrNxIgzfFnDpXz2812Jr1gCFRdxcCuinty5F5iQ/T8yd73UtJ5hH2uYpeB+jI+NWHqiHQJISi4nSW60EJjzYosT38xtk059ch28HKA5foRX28b6GBac1NLqoniMKcLlQ8ogQBEomL4Tp6VlJXrqn5a5MX78vkdWNElnbIskLt2Xs3TMy9s5JGf+PU5I8cVUy41NKaN/SL62hEHDiMrR9jVoukhq4tM8D+oTVQyFUqsCS8PA5ggvKyS5z4dQNpy6y5x1hLT4laFTcT61lwuBZ0dKAFaUtrA1xf+GYqtXi4UF47jQLXYQoL4yAxbpzKuy/+/0HFtceOfKZhSWlgGw9GWjcWJJYPiB7Rd4Tsu2np6x1qWCOcLVxY3H1z2qI4hfyHbdv37e1JaZlXsk9fPDh5/LRR1/I6TOXVT6eHcdyP2tlSrYERQthkUUsN1uDhX1kztkexKIvF16A1OoS5kkJKebGkzJ+8rqMKWknTt+ULLEX9TSOyKh7kZlRt5GiA2SLyAitVh6lsBRolwUjs4j7SdaZ00SrV7davOxvibBdA5h4hArXFfeWpNDQ0KjF1Zt7NlgGlOTV7l09UlmV0Nj0scbb456bpAJOzExSjq0jnkHCw48DwcDAiCkYEnJYOPpAwot4kec9LxgXGdVxjaE3buiwxBHPpq3uni44Z0kWsubfFrCsuINsBeEaMpeMuRCsEXMTiUQsQUVZCAsWQCz68IH398m2b99obVGXeWE+8bbIBRSGDcsFyHBJY1fCMw72kGgkIUgsTazqbU95XgL9Zqw1NZWWIWdn4Ukl7rnroVDA+k/izovJvW057mdstNmopUetPm09C4ybXRDm0Q4f6Tr7fcRAkEhdzpi6xOy3yOGRkMSyAQmre129e7253ZHGGok2axzdUieJjaskp0RMnrrp3WRazt54Lwbv3b+HRmUiUFyLozwm1ZoiYEw0E9qhsRFEQGjYgphUopH0YcsGF5IzyVg6MqY+WSE+dYljIPbA4xH54svzStJJIxlbMMR9LBqxJRloP4FCEmdQlQMWCYttW0crW4wEbBXhujIWtnrYR0eI8CoIF0gcIfSLQb9QbiwwmWSeS+YUobujz+OQCoJUq4vPd2h6Mq883wfWFkG71dunyk/del0X7idTy3yQ0fVj/66udhMqtrRwASHnivo6234iM8+WEpYMa3RFFYp/0IT2ETq2uxgzHg6JQTLBrAcZebLBjBEvA8VJW8w3mWW8kgsaety8ddfWkO+5d0jn6vadBybwKBj249n7Zsvo0aPifwCQEIxMOmvClh5xK0T0PLkqa7c9r4w71TIjI8gdcsCaQFK2sihrtY+Mhe26Ozon/fZMz8A05bc+/e2+B/2PzbNke5R+2nx1rDJS8oNKeF1XrvTavaw7/WStWDP6Srsk3VAAyJ53ZLjFkmfeTkDaDAbzsxwoidQh7eehISW1vvInWjlcUrmlQxJdrRJb06yFhEtAptRiz/RxKsen8cKrR239V1/+EB5bktQA94WFwbJypntCvYIxFSSI1tt735JPbEeRwMLNG9brjx4PWXKM+g/7B42QUe0nk4sgsmXBNpkXw3qxDplONDdZ6OvXe+XmjXvm0iFk06mU1w9tl+wu1mdCBZ/v2R5hy4aTYpCBhZyaTlld78TV110ryMmZZWIr2o0poUia0RbbbggqoC36dl8tIeQpXHgSLMwJAkF2GDAexkV/aAMPB7DF9UDbgOyMk3mhHqEISvO6xv5s30BYssRYQAjHmMgSs1swODRi/UBh2n61fqYu/Wd+WQvmBUCivnsPzcXs7b2n7XnKiDYHB0ftPhQq/UUGaIPrhFvFlCBgLuhL/8NBrTtic8ja0Ve2q/C6yKNE1QNB0bOrgLsLuVgX7iHEmpqeltva16vXem1LkzGRPKV99tyRI8bLbkCfziPtIlOsN3LL81C8F85ftzVkXtlhgbzMLXPGuqNQ6R+F64xtZNQ7pIKCZfxso6HIFmfZXwQl/ehlTNfnH65FpCYblFAkJGGdxKDGrF5CIP9jlTq57FWzR+1fn39V7cb7UP7af08oeYLPdjWZDOoXJpAQCgSdwnXqoCz8a4B7cKFIdgGuewKxMInWn3z7XKeO/7Wdcy+oCxEYB8/z6/oKy3cxaYc6hZa1GGiL5/pj4n6v797z/HZ4vN+2D397yuurV9+bAw65eOP3u724rj9XXt2F8Xp9fnLbCtfQSyj5c+0RMRgMWZ/8ZwPq+mvAdX88fpWF8XgZfR/efC7MfTHQZ+7n2d5z818o5sej31sF66v3DNrz7w2HeYYnN8wRz2Tf259v4MsB9/j3014oFM6PzZtHvqMO8NeG7/37CucFMEba9deCjlgfFz3/RVEyqf/+ashIDUF9cvqdRhsasflsBOa6X8cv3nfc+z8q+uRBaPkSBQ4OP2Z4aucbAp2SDGosE8xaGaeE8q+BjJUxivCa9t6re22ftYxKWkZz3qs6UZLm9yM5ODgsC0qy1Mpf2TvEL0TwYmK1zfoP0YbnBi2U/Gf+K7jGP+ae05i+fhhNyqQqBAcHhxdHSaTGVMeUg/MGFvLm3xaFT+AlMKMNZZ7agIODw/OiJPcbhs5orJ8K54u+n35aUVd96inFEdrBYflQGqkdHBy+t3CkdnAoMzhSOziUGRypHRzKDI7UDg5lBkdqB4cygyO1g0OZwZHawaHM4Ejt4FBmcKR2cCgzOFI7OJQZHKkdHMoKIv8PJF/1wGcNjX4AAAAASUVORK5CYII="},5138:(e,t,o)=>{o.d(t,{Z:()=>a});const a=o.p+"assets/images/stacks3-f7fad534fd7186ff5e760dae641666bf.png"},1713:(e,t,o)=>{o.d(t,{Z:()=>a});const a=o.p+"assets/images/stacks4-cf49641e0dcf69bcf71c4388cd810900.png"},3823:(e,t,o)=>{o.d(t,{Z:()=>a});const a=o.p+"assets/images/stacks5-f70b7cbaade6620d157c90ee895402ce.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>i,a:()=>c});var a=o(7294);const n={},s=a.createContext(n);function c(e){const t=a.useContext(s);return a.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:c(e.components),a.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/eb8e19ae.920ac169.js b/assets/js/eb8e19ae.920ac169.js new file mode 100644 index 000000000..3ee5a4bba --- /dev/null +++ b/assets/js/eb8e19ae.920ac169.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8913],{1747:(e,t,o)=>{o.r(t),o.d(t,{Highlight:()=>d,assets:()=>r,contentTitle:()=>c,default:()=>u,frontMatter:()=>s,metadata:()=>i,toc:()=>l});var a=o(5893),n=o(1151);const s={title:"Cross Account Creation",hide_title:!0,sidebar_position:3},c="Cross-account Access Creation",i={id:"cado-response/deploy/aws/iam/cross-account-creation",title:"Cross Account Creation",description:"The Cado platform can access resources across multiple AWS accounts. For instance, if you manage 100 AWS accounts, you can deploy Cado in a single AWS account and then grant the Cado platform access to all other AWS accounts, enabling the platform to acquire, process, and analyze evidence from all AWS accounts seamlessly.",source:"@site/docs/cado-response/deploy/aws/iam/cross-account-creation.md",sourceDirName:"cado-response/deploy/aws/iam",slug:"/cado-response/deploy/aws/iam/cross-account-creation",permalink:"/cado-response/deploy/aws/iam/cross-account-creation",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/deploy/aws/iam/cross-account-creation.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:3,frontMatter:{title:"Cross Account Creation",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Removing and Tightening IAM Permissions",permalink:"/cado-response/deploy/aws/iam/tightening-iam"},next:{title:"Overview",permalink:"/cado-response/deploy/aws/data-encryption/data-encryption-overview"}},r={},l=[{value:"Summary",id:"summary",level:2},{value:"STEP 1: Create IAM Policy and IAM Role in Target AWS Account",id:"step-1-create-iam-policy-and-iam-role-in-target-aws-account",level:3},{value:"STEP 2: Add Target AWS Role ARN to the Cado Platform",id:"step-2-add-target-aws-role-arn-to-the-cado-platform",level:3},{value:"Automating AWS IAM Role and Policy Deployment",id:"automating-aws-iam-role-and-policy-deployment",level:2},{value:"Using CloudFormation StackSets",id:"using-cloudformation-stacksets",level:3},{value:"Automating Cado Cross-account Creation",id:"automating-cado-cross-account-creation",level:2}],d=({children:e,color:t})=>{const o={span:"span",...(0,n.a)()};return(0,a.jsx)(o.span,{style:{backgroundColor:t,borderRadius:"2px",color:"#fff",padding:"0.2rem"},children:e})};function h(e){const t={a:"a",admonition:"admonition",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.h1,{id:"cross-account-access-creation",children:"Cross-account Access Creation"}),"\n",(0,a.jsx)(t.p,{children:"The Cado platform can access resources across multiple AWS accounts. For instance, if you manage 100 AWS accounts, you can deploy Cado in a single AWS account and then grant the Cado platform access to all other AWS accounts, enabling the platform to acquire, process, and analyze evidence from all AWS accounts seamlessly."}),"\n",(0,a.jsx)(t.h2,{id:"summary",children:"Summary"}),"\n",(0,a.jsx)(t.p,{children:"The instructions below outline how to grant permissions for the Cado platform to access a target AWS account (outside of the AWS account in which Cado was deployed). This same process can be repeated for all AWS accounts needing cross-account access."}),"\n",(0,a.jsx)(t.p,{children:"Setup for cross-account acquisitions within the Cado platform is a 2 step process:"}),"\n",(0,a.jsxs)(t.ol,{children:["\n",(0,a.jsx)(t.li,{children:'Create a cross-account IAM Policy and IAM Role in the target AWS account from which you would like the Cado platform to be able to acquire data. This allows the Cado platform to "assume" that cross-account role and perform acquisitions.'}),"\n",(0,a.jsx)(t.li,{children:"Add the newly created cross-account IAM Role ARN to the Cado platform. This enables the new AWS account within the Cado platform."}),"\n"]}),"\n",(0,a.jsxs)(t.admonition,{type:"tip",children:[(0,a.jsxs)(t.p,{children:["Creation of the cross-account IAM Policy and IAM Role within each AWS account can be automated via AWS Stacksets and other programmatic methods. See the ",(0,a.jsx)(t.a,{href:"#automating-aws-iam-role-and-policy-deployment",children:"Automating AWS IAM Role and Policy Deployment"})," section below for more details."]}),(0,a.jsxs)(t.p,{children:["Adding the cross-account ARN to the Cado platform can be automated via the Cado APIs. See the ",(0,a.jsx)(t.a,{href:"#automating-cado-cross-account-creation",children:"Automating Cado Cross-account Creation"})," section below for more details."]})]}),"\n",(0,a.jsx)(t.admonition,{type:"info",children:(0,a.jsxs)(t.p,{children:["The examples below reference a primary AWS account which represents the AWS account in which the Cado platform is deployed and running (referred to as AWS account number ",(0,a.jsx)(t.code,{children:"111111111111"}),") and a target AWS account which represents the AWS account from which you wish to enable cross-account acquisitions from (referred to as AWS account number ",(0,a.jsx)(t.code,{children:"222222222222"}),") ."]})}),"\n",(0,a.jsx)(t.h3,{id:"step-1-create-iam-policy-and-iam-role-in-target-aws-account",children:"STEP 1: Create IAM Policy and IAM Role in Target AWS Account"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:["\n",(0,a.jsxs)(t.p,{children:["In the target AWS account (the account from which you would like to acquire data from), navigate to ",(0,a.jsx)(t.strong,{children:"IAM > Policies"})," and click ",(0,a.jsx)(t.strong,{children:"Create Policy"}),". In the Permissions Wizard, attach or paste the Cado Cross-account Policy ",(0,a.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/policy-in-cross-account.json",children:"located here"}),", then click ",(0,a.jsx)(t.strong,{children:"Next"}),". Give the Policy a name (like ",(0,a.jsx)(t.code,{children:"CadoResponseCrossAccountPolicy"}),"), then click ",(0,a.jsx)(t.strong,{children:"Create Policy"}),"."]}),"\n"]}),"\n",(0,a.jsxs)(t.li,{children:["\n",(0,a.jsxs)(t.p,{children:["After the Cado Cross-account Policy is created, navigate to ",(0,a.jsx)(t.strong,{children:"IAM > Roles"})," and click ",(0,a.jsx)(t.strong,{children:"Create Role"}),'. Under "Select type of trusted entity", click ',(0,a.jsx)(t.strong,{children:"Another AWS Account"})," and enter the account ID of your primary account (the account in which the Cado platform is deployed and running. ",(0,a.jsx)(t.code,{children:"111111111111"})," in this example)."]}),"\n"]}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"Create Role",src:o(7358).Z+"",width:"761",height:"323"})}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:["Add the policy you recently created in the steps above, then click ",(0,a.jsx)(t.strong,{children:"Next"})," give the Role a name. The role name ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(t.em,{children:"must"})})," include the text ",(0,a.jsx)(t.code,{children:"CadoResponse"})," (case sensitive, like ",(0,a.jsx)(t.code,{children:"CadoResponseCrossAccountRole"}),"). If the secondary account role name does not contain the text ",(0,a.jsx)(t.code,{children:"CadoResponse"}),", cross-account acquisition will not work properly."]}),"\n"]}),"\n",(0,a.jsxs)(t.admonition,{type:"info",children:[(0,a.jsx)(t.p,{children:"The Cado Cross-account Policy includes permissions to acquire a variety of AWS resources. You can remove permissions that are not needed for your use case."}),(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsx)(t.li,{children:"The EC2 permissions are required are acquire EC2 systems."}),"\n",(0,a.jsx)(t.li,{children:"The KMS permissions are required to acquire KMS encrypted volumes."}),"\n",(0,a.jsx)(t.li,{children:"The SSM permissions are required for Triage captures."}),"\n",(0,a.jsx)(t.li,{children:"The S3 Permissions are required to import from S3 buckets in other accounts."}),"\n",(0,a.jsx)(t.li,{children:"The CloudTrail permissions are required to import CloudTrail logs in other accounts."}),"\n",(0,a.jsx)(t.li,{children:"The ECS permissions are required to import ECS containers in other accounts."}),"\n",(0,a.jsx)(t.li,{children:"The EC2 de-register permission is required to import AMI images cross-account."}),"\n"]}),(0,a.jsxs)(t.p,{children:["Also note that if you choose to change ",(0,a.jsx)(t.strong,{children:"Maximum session duration"}),", the minimum currently supported by Cado is 1 hour."]}),(0,a.jsxs)(t.p,{children:["Lastly, the above steps walk through how to create a new role; however, if you already have an IAM Role with appropriate EC2 access, you can instead edit the trust relationship to include the below AWS ",(0,a.jsx)(t.strong,{children:"Principal"})," (replacing the ",(0,a.jsx)(t.code,{children:"111111111111"})," account number with your own primary AWS account, in which the Cado platform is deployed)."]}),(0,a.jsx)(t.p,{children:"The below JSON is only required if you choose to use an existing role and you didn't create a new role as recommended earlier."}),(0,a.jsx)(t.pre,{children:(0,a.jsx)(t.code,{className:"language-json",children:'{\n "Version": "2012-10-17",\n "Statement": [\n {\n "Effect": "Allow",\n "Principal": {\n "AWS": "111111111111"\n },\n "Action": "sts:AssumeRole",\n "Condition": {}\n }\n ]\n}\n'})}),(0,a.jsxs)(t.p,{children:["You may choose to limit this further and trust only your specific Cado role rather than the entire primary account. See AWS JSON policy elements: ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html",children:"Principal - AWS Identity and Access Management"})})," for more information."]})]}),"\n",(0,a.jsx)(t.h3,{id:"step-2-add-target-aws-role-arn-to-the-cado-platform",children:"STEP 2: Add Target AWS Role ARN to the Cado Platform"}),"\n",(0,a.jsxs)(t.p,{children:["After the target AWS Role is set up in the target AWS account (",(0,a.jsx)(t.code,{children:"222222222222"}),"), you will need to add the Role ARN to the Cado platform. To do this, log into your Cado platform, navigate to ",(0,a.jsx)(t.code,{children:"Settings > Cloud"})," and click on the ",(0,a.jsx)(t.strong,{children:"Create Role"})," button. When prompted, enter the IAM Role ARN created in Step 1 and provide an ",(0,a.jsx)(t.code,{children:"Account Alias (Cloud ID)"})," for the role. The ",(0,a.jsx)(t.code,{children:"Alias"})," is what will appear in the Cado platform UI, so we typically recommended that it includes the AWS account number in the text."]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"Add Role",src:o(5132).Z+"",width:"2134",height:"1248"})}),"\n",(0,a.jsx)(t.p,{children:"Upon submission, the Cado platform will attempt to validate the role, ensuring it is assumable. Once validated, you will see the Alias in the list of available AWS accounts."}),"\n",(0,a.jsx)(t.h2,{id:"automating-aws-iam-role-and-policy-deployment",children:"Automating AWS IAM Role and Policy Deployment"}),"\n",(0,a.jsx)(t.h3,{id:"using-cloudformation-stacksets",children:"Using CloudFormation StackSets"}),"\n",(0,a.jsxs)(t.p,{children:["To automate the creation of the IAM Policy and Role in each target AWS Account via CloudFormation StackSets across your AWS Organisation, you can follow the steps below. More details about CloudFormation StackSets can be found here: ",(0,a.jsx)(t.a,{href:"https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html",children:"Working with AWS CloudFormation StackSets"})]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"Stacks1",src:o(4413).Z+"",width:"614",height:"345"})}),"\n",(0,a.jsxs)(t.ol,{children:["\n",(0,a.jsx)(t.li,{children:'Go to "StackSets" from your master StackSet account that is enabled to deploy into other accounts.'}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"StackSets Role",src:o(231).Z+"",width:"245",height:"82"})}),"\n",(0,a.jsxs)(t.ol,{start:"2",children:["\n",(0,a.jsxs)(t.li,{children:["\n",(0,a.jsxs)(t.p,{children:["Click ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(d,{color:"#F78631",children:"Create StackSet"})})]}),"\n"]}),"\n",(0,a.jsxs)(t.li,{children:["\n",(0,a.jsxs)(t.p,{children:["Enter the S3 URL as ",(0,a.jsx)(t.a,{href:"https://cado-public.s3.amazonaws.com/cloudformation/template-organization-stackset-iam-only.json",children:"https://cado-public.s3.amazonaws.com/cloudformation/template-organization-stackset-iam-only.json"})," then click ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(d,{color:"#F78631",children:"Next"})}),":"]}),"\n"]}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"Stacks3",src:o(5138).Z+"",width:"592",height:"234"})}),"\n",(0,a.jsxs)(t.ol,{start:"4",children:["\n",(0,a.jsxs)(t.li,{children:["Click ",(0,a.jsx)(t.strong,{children:(0,a.jsx)(d,{color:"#F78631",children:"Next"})}),' through the next two dialogues, and under "Create StackSet" select any region (this works as IAM is global):']}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"Stacks4",src:o(1713).Z+"",width:"582",height:"169"})}),"\n",(0,a.jsxs)(t.ol,{start:"5",children:["\n",(0,a.jsx)(t.li,{children:"Once deployed, this will then create a IAM Policy and IAM Role in each target AWS account, that you can view in IAM:"}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.img,{alt:"Stacks5",src:o(3823).Z+"",width:"434",height:"115"})}),"\n",(0,a.jsx)(t.admonition,{type:"tip",children:(0,a.jsxs)(t.p,{children:["You will then need to add the newly created cross-account IAM Role ARN to the Cado platform, using the steps outlined ",(0,a.jsx)(t.a,{href:"#step-2-add-the-target-aws-role-arn-to-the-cado-platform",children:"here"})," or if you choose to automate the process, the steps outlined ",(0,a.jsx)(t.a,{href:"#automating-cado-cross-account-creation",children:"here"})]})}),"\n",(0,a.jsx)(t.h2,{id:"automating-cado-cross-account-creation",children:"Automating Cado Cross-account Creation"}),"\n",(0,a.jsxs)(t.p,{children:["As mentioned previously, the second step to adding cross-account access is to add the newly created cross-account IAM Role ARN to the Cado platform. This enables the new AWS account within the Cado platform. To automate this process via the Cado APIs, please see the example Cado API for adding AWS credentials ",(0,a.jsx)(t.a,{href:"https://github.com/cado-security/cado-api-examples/blob/main/examples/saving_credentials.py",children:"here"}),"."]})]})}function u(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(h,{...e})}):h(e)}},5132:(e,t,o)=>{o.d(t,{Z:()=>a});const a=o.p+"assets/images/add-role-cf34be238a0b5ac245ac1c0ddf70fcb6.png"},7358:(e,t,o)=>{o.d(t,{Z:()=>a});const a=o.p+"assets/images/create-role-fa83b0fb86d9d71fcea59dc0f7103a94.png"},4413:(e,t,o)=>{o.d(t,{Z:()=>a});const a=o.p+"assets/images/stacks1-ccd441458e148ad57f8c89f48c540f90.png"},231:(e,t,o)=>{o.d(t,{Z:()=>a});const a="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPUAAABSCAYAAACMqJIzAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAACKkSURBVHhe7Z3Xd1xXduZ35SpkEJkECRBMAHOmJJKSOij0tNse27PGXqvfPI8zr15+9avX8n8x8zKrPZ52t1tWt6hMipTEKOYIBpAEiRwKKAAVZv/2rQsUoQJJFSGNVDqfdFhVt84994T97XQOgEBOIQ4ODmWDwD/84z/nrl7vzX90cHD4ocNI/Yc/fZz/6ODg8ENHMP/q4OBQJnCkdnAoMzhSOziUGRypHRzKDI7UDg5lBkdqB4cygyO1g0OZwZHawaHM4Ejt4FBmcKR2cCgzOFI7OJQZHKkdHMoMjtQODmWGHwepQyEJ1tRKqK5eAhUV+YsODuWJ0KHX3/zH6zfv5D9+QwQCEohGJVRbJ5FVayTStkrCLa0Sqm+QQCQikstJLpux1/+fCFZWSeWh1yW+badIJivpx/35b54CxpaokHBjs0RWd0iktU1CTc0Sqq7R71QXMq5sNl/ZweH7gxf6eepALC7RNR2S2H1Awg2NIpGoXlUCZzKSnZyU2b67MnXiU8kmJxeIHQxJIB6zOrm5ue+EGKEVjVL3l38jISXo1OdHZfKT95/53KAqqsT23RJdv8kjcjBg9+RmZyUzPiapSxckdf60jaMk4D3o/OVoM63zkE7nv3BweDGU7n6rJYtv2SbVv/gLia3baMKZ7n8gc/fuSmZ4SK1cQi33Ss/d1boGFeRwc4us+PV/k+o3fqnkTnjXv28IR6Tq9Tek4qXDElHrnBkdsXHNPXwgudS0RHQMkbY2U1ClIqyKpv7Xfye1f/W3Oiet+asODi+O0kitJCU+jW3oUfc7JjM3r8nEu7+Xiff+IBPvvyvjf/x3Gf/dv8jEkXclOza6YBWDQQmq1QtWV5uVD+DGfs8QUG8jtm6DxDq61CqnJKmexsS7v9Nx/YdMHnlHxt/5Nxn9v/9bpr48rla6dOsaiMXUG6iVoLr4AVV2Dg7LhZJJHayqsVga93Pm+lW1YvfNQmfHRiQzNCBz9+9J+mGf5GZmvFuU/KGqanWFNd4ORyUYj2vsXW+fSWKJxua0S4werK6VsMbn0bXrJKpeQHTtegm3YvUrTTF8DRq/oyy4J9LZJZE1azX+bTHFUbR+IXhe/QrtywqLockFRNs71IuIS3Z0VFIXz0t64JG+13GNDFs8PnenVzKDA1934dVyB3WM4ZXtEu1ab30nHkeJSTjs1dH2GQdjRoHwPPrOPNjcMA/A5jjflo4/2rVBItovwgKbKweHJVBaoswsdZ3ENN5ECGfv9koaIX+K5UIwK3bvN1edGDUQjVgSKqoWMdzaZhY9Oz0lsc51UrH3gCR27Jb4tl0S79kqsY09StROtWoJL8lFLO5DyRJpXyOVBw7qPXsksWW79qvbrhHHZ0Y0FFDy0E5QyTR3/67MKiktxs9b5Up1s6PafnY6aX2IqlKItK6SzNSkKqzLqphSz072qfJAMdCPit0HLCkX795q40b5oexoG+VUsXufxHXuLA+hVpr7UCQxJW6GehMTSugqqXj5VZ2LlySxdafENm2WmCq5sIYD5CjMA3JwKILSLLUKeHZ8TDKTExYXI3hYVSzLUsDNNNdbLSBKwawyGXIsF698DoUlvGq1ufbZ6WmLY2dv3zJChCHMS4eUnNvMdfUR794iNW//uZGWdtLqLWSGB7WPyheUh28hC8HzlYTx7s0WO0Po9OBjL2ZWAqOkcrMzGju3StXhnxoRn2UdUVBVP3lLErv22fzM9Wnf7922fsQ3b5fKg6/bXAW14LGQc9CO6H/6r8bwzIPNhYYkoZoaL6ZXJcVnEo6zd27p2AYlqB7P0+bZwaHkLS3L2KrAhpuazG2M5re0QlifHBldtdq4p3kLhwLIqBsLubE2aSXQ5MdHZPbqZSXuTVMSObX0OSUzlnTm6kWL1Wd7b6hQ35GQ3hdRVzQ7lTTXPjc3a1tnVa+/qSSoUwVwW5LHPpLUhXMye+OKtZF+9FCtWtKyzIWWmlAB5VD5yqvmaaTOn5Hpc6clp22z5YUlNNe3boX2tVUiqmgiuP/aBzL23tgLLLcqjgReiHoUc/rM5KcfqNv+lczeuiHp/vtmhXGbM0ODXjJRx0M7eAmZ8VGZOvaxpL46o/WvS1pDF7L1lQcOWd8Y09Spz+07mwsdJ2GAeQ8ODkVQeqZKSTtz/Yolw2bVomL9Ih1rpULdz5pf/qVZpjBxrW1zKQeUMFjR7NSUkT2bSlkMTrzqCanG3hqfI/RpJS0ZZ9xVSmZ42IgNkYjNzfpqierzwqpQsqkpSX5+1JQDVpp7M+qmm8WGgAUgzo6sVnfdLGdcUlcu6r3HTKnY9hQKSZ85pdemzp6UtHoJIY1/45u3SfVP35SaX/21xNXFx+vws994BLj7JLxmLmkMrs/N6fhyM+ptPOgzoqJYIqtWmQfg5R7UfVa9kJtL2xYZ80CxecB8kwvQ8ebok841not5RwOPnevt8FSUTmoFwj9746qM/uZ/ysQff69W8qxZEFxRYkvcYpJX33jrR91wizNXd1rhPW0U2EbPVW9pNZc7o0KeVmH/WuKqCIjNa976lbZZLyklIFnsHPvoi+4lFsfijv3mf8nkR++pS66utLrJuOo1/0mV1iuvWdyLMgupRQ9Veu+D6jpjsePbdkh8qxYUgFp4SMohGOo8C1n1akgy4pbjTVRoQRGZi/4c9zv8uPFiJ8p8qDXB2szdu2OWKpucMBcbC0fBomNtsNpRTmepG411RiFwmGMeSlTc3Oq3/sxIE+/ZIvFNm5UYOyTWtV7jyaiRF4vMM/ku3NhiFhl3fakDHJAK99uy78Sz2g9c8+Rnn6hVH15aGWApsazqNtNXXGBiYXPLVdGwZ40lDrettEy3ta/hR1StNi43Y6UQHjBO4mLyBPQ93NhksTau/qyGGYXWNzc7ZyFCsFLb02fh/jNWEpOWJCNMWGKsDg4vZKmfALEmrrIK59SZkzLTq8TDiqnwmqV6loXByqk7XHHwNYlCenWhp059IVMnT8j0mS9NYRTGsfwJMIvbsd+4qs+x5809xLxkmDn8QbY8VFuf/3YJKOEhNmSCaMlP3lc3eNTc+FBDkz0XF9oPKabPnpKp459K8vgn82Xy4/dk8pMjMnPtiuUNngmtg9Kb/PBPMvnBu9rmSfuMIqh545fqAex89nw6/GixfKT2AQkgNzGqvrcDJhyxnEeemItlki0hJVq0s8vumz51wgiUPPqhWdSZa5eMlPPIqncwQXItY0oDkj1T0CG1xuskprJqOdkmSuze57nFKIZ5LNGOKi6Ov2b9vXd7Xs48E4uhVcmgfKaU2NMnP3+ipM6dtnyBxe0FWLLLOgd4ESTcONY69s5vzUNhfxsPBq/GwaEYSic1p6CW2C4iy4wbDVHIemfVTZ23snmhtmRX4Ukq9ms5aaav1Ceu9BEIBZW0iSeolktnLIOOW8sWWGLLtuL9WQQUTurGFbOg9CmxbZfFreZNAO2/bZk9QfI8LNZvsFgai5uZGLfxWHJOLSnJsMTOPaokKvM3PAX6bJsRjZvJDzwVnDe3Az195jXYoZVnKTCHHy1KP3zS2CzVP31bErv22tlli/80noxv3GwkIW7OJZOWRU6r2+pbbQhvBzKqajQubbDYmyw2LidWMNa9RUJaB4ISO4Zb2rz9aY0/2eNlPxmLRTYd4uOScojDtp20H1hsrsW0PttsuNqBYOiJLa1ZDQ2Ik9kWCze3eZlrJTFZaxDfvkuqXvu5neLCTYfEHEbBqlfsP2h5AhQKSTZTPigqvZ9YOqL9Jc5HaaGgwuqix3ROzGVWGpsHo4TmRF6iW/vE3jW5B50LYmZ+qs32vH/2pva3yggcrKiwM/OcB7Ax9N3zcgi+onRwKEDJpOZ0F6e/sMhsXUHMmJIVMpMJJrae/uqMzFy54G3TABVC4k6SPwgqJ60Qeiybbf0M9JvFRMghfFTb56fAsGRYwkA4ZCfXOJCCu+vFnkNmIdlWIj6OQu7VHdpugxcHa7s8N7amU4kXsj1ii89xpSGYAqWAIkGJEC+T2OJUGQqHvXfGxeEalAXk52DJlFr6OdxpVVYAD4D9az85GG1fLZyeo9gPtijB7XhpntSED4G4jpV50PmiDyTfrE0dl51G07lEscQ2dttps6B6KyjI6dNf2LgdHIqh9B+9VEsUXqFWskmLCj7k5LCE7bmqFbNDElhDdRefAFZehRdFgPDz0124r5AVq8e5aCOmkioYj6mQPzQS2RFLvSc7OW4En1cUCjso0tJqVhdiEPOmHz2we0m4QUQy1Fg928NWa++D5/Gz0mwf2VbSsEcWs7hKasbG9hfuPue9OW2GojALnSe0D8ZvfdBnca+51WrFSc6lH/XrqxJWlYlXGTc/bl4CR24BngptE5szVqwzPyVm8bM+a1aVEUqJfW4Hh6XwYn+fmrgznwjzYzzzCHMq7Aj8IqGfB3Xt3nxcaJZL6/I6/x1l0Xdc9z8XorA9v80s9ThMoq+AvfLC9nz49wL7jvpaqE+CT/vhJ8QsUce9fn+Kgbb8vngPzLebv28xyCv4fS7sm59gLGxn8ZgcHIogL80lAgFUV9G2s2ZnrYjGqbaHWkyAfSCUxKHUo/DeF9T579SiYdX8tvzrxdotbI97KPTLbxNAhmL3+/fOf5e/h/rWHuOayY+NdvV6YbuLQRvz/cjf44+hGPx+U/y2KfPPL2hn8ZgcHIrgxUjt4ODwvYMjtYNDmcGR2sGhzOBI7eBQZnCkdnAoMzhSOziUGRypHRzKDI7UDg5lBkdqB4cygyO1g0OZwZHawaHMUBKpAzmR2mxQGrIhr+QoYWksLBKWJiuRhRKISLOV6HxpCUYl+sSvP3BwcHgRlPRTWhEl9d+lVkiFhCQYCEgg/1Na9j5fgvPXvJ9yWqjDDx4F5+tS75+St2Q4N5dv3cHB4UVQEqkTuYD883ib1AXCRkqIa69Bj8DBUFBCRliu57/L1+Fnm3kN+d9pvf86flbuZd0vp3dwWA6UFlOrpQ5lcxKmZNRyZxdKVL+LcE2JX3gd6841vo9m+S7/vV77Jp2IRiNSWZmQmpoqqaqqkEgkrIqE39kQku3bN8mePVtkxYrafO3vBk1NK2Tv3m3S3d1lSg3Qr4qK+NdLIm59/SGDIcbjUVlRX/udjgVjUF1dKS+9tFN+8far8sYbB2Xjxk677rCAkn6dEUR8M1Up8ZzS0dxpruYnFndbLXWwOmElENFFzyh7lcweuMF7yd8ov5l7JGO5tL0vBix6PB6T5uYVsnbtatm8eb1s3NApK1c2G8lTqRnJqoI5dGiPtK9qkUePB2VkZDx/97cLSLx6dZuSeqvEolG5efOuCfr6dWukp2ed9ae9vdXKKop+np6ekcnJqXwL319AFuadOQbZ/M+Eh8NhU6CvvLJLHj8e/s7GEo/HZdeuzXJg/w6JJ7RfkYjMzMzJ/fuP5InfNPsCQBnHYlEJqQxn+Pn2HyBKzn7za4hYZMiU4e9P5bz3WWVvoLZCEr/YLZW/flXif75PRD/ndJJUF1i9HPXm79fPz1gPJnnHjk3yX/76LXlTtfOWzRuU0C3S071OXnt1v3R2rDJyRfgVS0oolMB3BfRSKBSafzZA2Nav75RXXt5lFnz37q1W9uzeIrtVKJubGqy/33dAXhTo/n3bpaa6Kn/V84pqa6vVQ2kwywkBvgvU1VWbAkVmPvjghPz2396XM2cu2eflAGvS1tYk+/dvU/lqyl/94aFkS/3zZEJisBTwkidmMKZu56tbJTs8IdOfXjKpr/yrl9Vqe38rOjuqWv0JFgfkX9JqqaW4VoSgu3b1yN4928wif/jRCfn4oy/kzNnLtqBnz12WgcFhrRmQzWoZ0bS379yX4WHvlwp+20AQcL/XrGmTZHJKrl27bWTAoyA8QPCOHj0lJ0+el1OnLsrp05ek/9HgD8IKYKUPHNhh47vX1y/j45N2HSXep5/PfXVFLfWQpNPfzVjq6mpkXddqCalSOXfuioyOTmhflvbwvimQtQ3qAVLGtO3+fu+3y/7QUDKpf5YndUhd7No3dknl/o2S2NYp8e0dEmmrl3BjjeRSc5I616tEj0igKiGhjmbjf3ZciW2/ukc/6IX/kxkoSmoIQ3y8f982iWkMd/TTk3Lz1j1JTk3J7OzcfEGozKoUITVWvkXd9u3bu2XD+g7pXLvKLOXM7KzMzaVNy0fVbd6yZb1UVlTI+ERy3pVrbW2UdepGZ7WvMzOzdg1Bx/XfvGWDCRgudXVVpbS0NMrExOQTpMaynFXlMzIyZvf7/YUUjA23Fi9jq7ZF39Z2tluuYGZmRhWY97wVK+q0D6utj/X1NRa3tzQ3yOOBIesbHgtJx271WjZtXGttNDbU2/ja21t0XLS9xtz/ubk5UzwAS8sze9QS0/7ate02hrTOSUqfX6/x8kZtjzYTibi54owHwUe58owO7fuEzhdjwlqjxPCeWIcunZs1alXxYhg7cw1aWhrUi+nQ8YTNKhKi8Nn3tlKp1NeUBNcJWxgvbbKmeIX0EQ9pQt3/Wp23Tf6zde7bNDRjHQkNeCUPwxi32HjXyNqudmuTduhfTGWUfmzatFaVWL31Gy+kqrLC+kNfGe/0dGpeFujHhg0d0thYb2vMHKxZs9IK4+3qWmN9CWtb9KNO55z56dE15HqrtonXmkxOz8vccqBkUv90Mm6kjjRUS/1/flnSQ+MSCKsbptcyQxMSVmKH6qtk+vgVSd8flrkbD43QFX+xTzL9o5Ib4+9BsXgB+dclSM0kIZjdm7pkUhXB8c/PmUAVG38xUiOAq1Y1y09ef8mErLFxhcblDbaYDSqUfff7dfIztuBvv31YhTcmvbf75q0orueB/dvVIozLkLYXiYRs0V89vE9W6oLQRpMqDNqEoNQrJDUK6fr1OyoEntDjtrJ4FOojRIQP7e1tJhjNzY3mXqI4Hj58bOTHAzj4ym4je7c+u0MFplIF7erVXjl0cI/2cZ0qnyYlxUojJWNjrDx7/boOyzvQP8gOKXtv3zeBQ7D37N1qMT+WuFXvbWtrNtLd0fkzN1SVKcTBMtbV1tj7qamUDA6O6Fx3ycsv7ZR79x6qBU9KPBaTw4f3mPKkP006Hoi1SpUOAj08zN8Ky5mieOXlndLW2qyC3a6vTfaszs5VUq997ut7ZEJeCNZxx45uW18UBwqO+WCMM6pQaHufhjk7tQ5jWdFQJ6tVblbqeB72D5iiYO1f1nAIwjVrHRQj3zNf/Q8HTHEcOrh7Pk8DoRtUoaJ8RnTtkYXt2zZZ/8bGJqw+6/D6a/utnSu6HigCwi3mAFnatnWD9WdqaloVT9LCGHIRDTo3DdrH9lWtOj/NKoePTFEsF7FLInXYSB2TWDYowcqYVG7rkOTJG1Khljqk8fP4kXMSwBpp3dRXt0WUODKblszjMZm71S+Jt3ZJ+vZjyY17i/ev2UEZL0JqFrNThRHtPKKEuXTpxpLxUzFSV6kFPXxoj05sgxz77JT86b1jcvnyDbNsW3XCmcN+XXTu3bWzx6zYjRt3VNd4fUEAIFlf30N18UdM4H/+M1VgOrb3jhyTI+9/JucvXFNtrgKgi8RiF5Ka+mh5hA+rD7mwaigm3v/qz35iQvnJp1/IH/90VIl6y4jZoQIOoXH/EECsM6Sn7QsXr8tN7SPP2rplowler3ovjO3zL84ZYTduWCuzqkg+O35GPvjwhJw6fdEIVFNTbePAqoB7dx/os0/afVeu3DKrhOvJHNy580AeqLCv7cI6zcj77x+X48fPyv0Hj3RMaZsbLNcV7TPWmiw0As69jOXosVMyMDBsFgnBvXev38aNkkbpMC88++OPv9Q1uWlrxBhRjA/1uYVA2B9pyDKs/Waes9mM/OGdj+SUhjR4LMz1zp3dcvfuQ/ntb4/Il3o9o3KC9cfLQHnzvAGte+zYaTlx4qxcvHjDiMl4aYN7kRtyByjV0xoqva/re+PmXetDhypNCHrt+m3rI/cmtF5Pz3rzYlgX5BXLjaJM6ZxdvnLTxjY0OGpeQo8qwt7ePuvjqVMXvHbVc8SwsdbM63KgxAwHiS4tJMfyliedTMnYB1/J5LHLEqxJyNzIpCS/vG6TCxEp1MtC5FDAu9/K0kkOnTcdLqrBW1j9/7nBpJMtx7ogDNfMYs5aXMgCoDmxELihT4CHFgFXIRAZ2MuXb8mDBwMmKLPaZv+jASPrYkBuXFw0/PZt3aq5N6rbWqfuWFDqNT5E4K5f6zUC0dbY2KSRhPe49pZ11gczR1gj4kiy65CNuWMdGBOaHusGoSF7WuNMiEtmmn5xfVoJxQEgrAlA6T1W0iGIFRUJ7/njEyagXEPAfK8IFxEhTarFoa3F68D9WCuUIcqBvtLeXVUaKAE8IYuFddwAhTU0NGKCTP9QGtTlmSjcYpjVcIKQhHEjC15/Uva5e1OnzRGECatSZ15ZZ/rP+oZDYfMWUBbcixWlL2Nah+XGhec6XgheGu/p16TOqTcHCwP2peMJKXniA32ds3wDhDZPRsMylGpajRt9ZF2tj6oM57QusuAnWZcDpZFax+gT1SY5X+JbOySuVrvi5U32PtRWJxGNo2N71kls73qJ7ulSK71TZr66IxklvZ8xtwaLgLn0Jlk7qovwTfYjITUuFJZ7ShcHF4j+IlDERVOqhNDIWKfnAYKeqIibEEAY4lPAgtNmjt91vggs7lfnr8pxtQzHT5yRExo+4A7SCHvWCNaoktCPn+kfwoei8PuOxPjPINalzcIkG/dABl/w7FULBFuo511DQdJ/CkTD/T+oLicF9xVX2AfN2Np4zVq7/jMWg9gStxgiT6q3wyt16StWnLWoq6+xOQR8Rx2fQFZX59PaX2KJ+YrO8B/wjQlkqFPFTR8IRchcHziw3fIefI/SQ86wqnh97HEfPrRX623XUKbN6xMTQpvIsTbvFa994D/zecGaoKh4NkqQ8RMu0EdievpIYduTeSD/wT3LhdJIrWACvEnwtqQyuoD8ZYmsCmh6WK306RswQaUnJsHGagk21UigtlJmrj2Q5NHLkp5QkmU8S52fuyLImZCw+FgDP2HzvOC0GrDmFz2DhbKjq0tYhsUwKzdfd2HBnwaIjzt6QV308+evWfhAxhYFaH8NdB4LbXlzmrNxIgzfFnDpXz2812Jr1gCFRdxcCuinty5F5iQ/T8yd73UtJ5hH2uYpeB+jI+NWHqiHQJISi4nSW60EJjzYosT38xtk059ch28HKA5foRX28b6GBac1NLqoniMKcLlQ8ogQBEomL4Tp6VlJXrqn5a5MX78vkdWNElnbIskLt2Xs3TMy9s5JGf+PU5I8cVUy41NKaN/SL62hEHDiMrR9jVoukhq4tM8D+oTVQyFUqsCS8PA5ggvKyS5z4dQNpy6y5x1hLT4laFTcT61lwuBZ0dKAFaUtrA1xf+GYqtXi4UF47jQLXYQoL4yAxbpzKuy/+/0HFtceOfKZhSWlgGw9GWjcWJJYPiB7Rd4Tsu2np6x1qWCOcLVxY3H1z2qI4hfyHbdv37e1JaZlXsk9fPDh5/LRR1/I6TOXVT6eHcdyP2tlSrYERQthkUUsN1uDhX1kztkexKIvF16A1OoS5kkJKebGkzJ+8rqMKWknTt+ULLEX9TSOyKh7kZlRt5GiA2SLyAitVh6lsBRolwUjs4j7SdaZ00SrV7davOxvibBdA5h4hArXFfeWpNDQ0KjF1Zt7NlgGlOTV7l09UlmV0Nj0scbb456bpAJOzExSjq0jnkHCw48DwcDAiCkYEnJYOPpAwot4kec9LxgXGdVxjaE3buiwxBHPpq3uni44Z0kWsubfFrCsuINsBeEaMpeMuRCsEXMTiUQsQUVZCAsWQCz68IH398m2b99obVGXeWE+8bbIBRSGDcsFyHBJY1fCMw72kGgkIUgsTazqbU95XgL9Zqw1NZWWIWdn4Ukl7rnroVDA+k/izovJvW057mdstNmopUetPm09C4ybXRDm0Q4f6Tr7fcRAkEhdzpi6xOy3yOGRkMSyAQmre129e7253ZHGGok2axzdUieJjaskp0RMnrrp3WRazt54Lwbv3b+HRmUiUFyLozwm1ZoiYEw0E9qhsRFEQGjYgphUopH0YcsGF5IzyVg6MqY+WSE+dYljIPbA4xH54svzStJJIxlbMMR9LBqxJRloP4FCEmdQlQMWCYttW0crW4wEbBXhujIWtnrYR0eI8CoIF0gcIfSLQb9QbiwwmWSeS+YUobujz+OQCoJUq4vPd2h6Mq883wfWFkG71dunyk/del0X7idTy3yQ0fVj/66udhMqtrRwASHnivo6234iM8+WEpYMa3RFFYp/0IT2ETq2uxgzHg6JQTLBrAcZebLBjBEvA8VJW8w3mWW8kgsaety8ddfWkO+5d0jn6vadBybwKBj249n7Zsvo0aPifwCQEIxMOmvClh5xK0T0PLkqa7c9r4w71TIjI8gdcsCaQFK2sihrtY+Mhe26Ozon/fZMz8A05bc+/e2+B/2PzbNke5R+2nx1rDJS8oNKeF1XrvTavaw7/WStWDP6Srsk3VAAyJ53ZLjFkmfeTkDaDAbzsxwoidQh7eehISW1vvInWjlcUrmlQxJdrRJb06yFhEtAptRiz/RxKsen8cKrR239V1/+EB5bktQA94WFwbJypntCvYIxFSSI1tt735JPbEeRwMLNG9brjx4PWXKM+g/7B42QUe0nk4sgsmXBNpkXw3qxDplONDdZ6OvXe+XmjXvm0iFk06mU1w9tl+wu1mdCBZ/v2R5hy4aTYpCBhZyaTlld78TV110ryMmZZWIr2o0poUia0RbbbggqoC36dl8tIeQpXHgSLMwJAkF2GDAexkV/aAMPB7DF9UDbgOyMk3mhHqEISvO6xv5s30BYssRYQAjHmMgSs1swODRi/UBh2n61fqYu/Wd+WQvmBUCivnsPzcXs7b2n7XnKiDYHB0ftPhQq/UUGaIPrhFvFlCBgLuhL/8NBrTtic8ja0Ve2q/C6yKNE1QNB0bOrgLsLuVgX7iHEmpqeltva16vXem1LkzGRPKV99tyRI8bLbkCfziPtIlOsN3LL81C8F85ftzVkXtlhgbzMLXPGuqNQ6R+F64xtZNQ7pIKCZfxso6HIFmfZXwQl/ehlTNfnH65FpCYblFAkJGGdxKDGrF5CIP9jlTq57FWzR+1fn39V7cb7UP7af08oeYLPdjWZDOoXJpAQCgSdwnXqoCz8a4B7cKFIdgGuewKxMInWn3z7XKeO/7Wdcy+oCxEYB8/z6/oKy3cxaYc6hZa1GGiL5/pj4n6v797z/HZ4vN+2D397yuurV9+bAw65eOP3u724rj9XXt2F8Xp9fnLbCtfQSyj5c+0RMRgMWZ/8ZwPq+mvAdX88fpWF8XgZfR/efC7MfTHQZ+7n2d5z818o5sej31sF66v3DNrz7w2HeYYnN8wRz2Tf259v4MsB9/j3014oFM6PzZtHvqMO8NeG7/37CucFMEba9deCjlgfFz3/RVEyqf/+ashIDUF9cvqdRhsasflsBOa6X8cv3nfc+z8q+uRBaPkSBQ4OP2Z4aucbAp2SDGosE8xaGaeE8q+BjJUxivCa9t6re22ftYxKWkZz3qs6UZLm9yM5ODgsC0qy1Mpf2TvEL0TwYmK1zfoP0YbnBi2U/Gf+K7jGP+ae05i+fhhNyqQqBAcHhxdHSaTGVMeUg/MGFvLm3xaFT+AlMKMNZZ7agIODw/OiJPcbhs5orJ8K54u+n35aUVd96inFEdrBYflQGqkdHBy+t3CkdnAoMzhSOziUGRypHRzKDI7UDg5lBkdqB4cygyO1g0OZwZHawaHM4Ejt4FBmcKR2cCgzOFI7OJQZHKkdHMoKIv8PJF/1wGcNjX4AAAAASUVORK5CYII="},5138:(e,t,o)=>{o.d(t,{Z:()=>a});const a=o.p+"assets/images/stacks3-f7fad534fd7186ff5e760dae641666bf.png"},1713:(e,t,o)=>{o.d(t,{Z:()=>a});const a=o.p+"assets/images/stacks4-cf49641e0dcf69bcf71c4388cd810900.png"},3823:(e,t,o)=>{o.d(t,{Z:()=>a});const a=o.p+"assets/images/stacks5-f70b7cbaade6620d157c90ee895402ce.png"},1151:(e,t,o)=>{o.d(t,{Z:()=>i,a:()=>c});var a=o(7294);const n={},s=a.createContext(n);function c(e){const t=a.useContext(s);return a.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:c(e.components),a.createElement(s.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/eb95926b.b35c3f17.js b/assets/js/eb95926b.b35c3f17.js new file mode 100644 index 000000000..b5659de74 --- /dev/null +++ b/assets/js/eb95926b.b35c3f17.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5191],{2514:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>h,frontMatter:()=>a,metadata:()=>r,toc:()=>d});var i=n(5893),o=n(1151);const a={title:"Overview & API",hide_title:!0,sidebar_position:1},s="Overview & API",r={id:"cado-response/manage/integrations/api-overview",title:"Overview & API",description:"The Cado API enables third party tools and automation scripts to integrate with the Cado platform.",source:"@site/docs/cado-response/manage/integrations/api-overview.md",sourceDirName:"cado-response/manage/integrations",slug:"/cado-response/manage/integrations/api-overview",permalink:"/cado-response/manage/integrations/api-overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/api-overview.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Overview & API",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Ping SAML",permalink:"/cado-response/manage/users-authentication/sso/ping_saml"},next:{title:"GuardDuty via Lambda",permalink:"/cado-response/manage/integrations/aws-lambda"}},c={},d=[{value:"Creating and Storing an API Access Key",id:"creating-and-storing-an-api-access-key",level:3},{value:"Platform Base URL",id:"platform-base-url",level:3},{value:"Full API Documentation",id:"full-api-documentation",level:3}];function l(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,o.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"overview--api",children:"Overview & API"}),"\n",(0,i.jsx)(t.p,{children:"The Cado API enables third party tools and automation scripts to integrate with the Cado platform."}),"\n",(0,i.jsx)(t.p,{children:"You can use the API and the pre-made out-of-the-box integrations to trigger operations in the platform (e.g. acquire instances from your cloud environments), retrieve data that our system captured (e.g. suspicious events), manage and control investigation projects, and more."}),"\n",(0,i.jsx)(t.p,{children:"This section provides a quick onboarding flow that is required for every integration followed in this section."}),"\n",(0,i.jsx)(t.h3,{id:"creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"}),"\n",(0,i.jsx)(t.p,{children:"Before diving into any of the integrations we have with the Cado platform - we first need to understand the correct way to authenticate and access the Cado API."}),"\n",(0,i.jsx)(t.p,{children:"To be able to access the different resources of the API, any request must be provided with a valid API Key generated by our authentication server."}),"\n",(0,i.jsx)(t.p,{children:"To generate that key you can do the following inside Cado Repsonse:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Go to ",(0,i.jsx)(t.strong,{children:"Settings"})," in the bottom left and click the ",(0,i.jsx)(t.strong,{children:"API"})," tab."]}),"\n",(0,i.jsxs)(t.li,{children:["Under ",(0,i.jsx)(t.strong,{children:"Access Tokens"})," click the ",(0,i.jsx)(t.strong,{children:"Create New Key"})," button."]}),"\n",(0,i.jsxs)(t.li,{children:["Take note of the ",(0,i.jsx)(t.strong,{children:"Public Key"}),", this is the identifier that we can use for revoking the key later on if needed."]}),"\n",(0,i.jsxs)(t.li,{children:["Take note of the ",(0,i.jsx)(t.strong,{children:"Secret Key"}),", you'll need to save this somewhere private (like a password manager), as you won't be able to see it again after you close the dialog. This is the key we need to provide to the third-party integration providers."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Get API Key",src:n(9436).Z+"",width:"833",height:"655"})}),"\n",(0,i.jsx)(t.p,{children:"The Secret Key is used as the Access Token."}),"\n",(0,i.jsx)(t.admonition,{type:"tip",children:(0,i.jsx)(t.p,{children:"The API Secret Key will only be shown once, so it is recommended to save it to a secure place, like password manager."})}),"\n",(0,i.jsx)(t.h3,{id:"platform-base-url",children:"Platform Base URL"}),"\n",(0,i.jsx)(t.p,{children:'Often you\'ll see in the following tutorials that we are referring to "Platform Base URL" - which is the IP or Domain of where the platform was deployed, for example:'}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{children:"https://ec2example.compute.amazonaws.com\n"})}),"\n",(0,i.jsx)(t.h3,{id:"full-api-documentation",children:"Full API Documentation"}),"\n",(0,i.jsxs)(t.p,{children:["From version 2.8.0 onwards you can view the Swagger docs for the API at /apidocs\nYou can view examples at ",(0,i.jsx)(t.a,{href:"https://github.com/cado-security/cado-api-examples",children:"https://github.com/cado-security/cado-api-examples"})]})]})}function h(e={}){const{wrapper:t}={...(0,o.a)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},9436:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/api-e5f87fa2f8d4399e9b134c464dbf1ca2.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>r,a:()=>s});var i=n(7294);const o={},a=i.createContext(o);function s(e){const t=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),i.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/eb95926b.f02c5bcd.js b/assets/js/eb95926b.f02c5bcd.js deleted file mode 100644 index 641cd22ae..000000000 --- a/assets/js/eb95926b.f02c5bcd.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[5191],{2514:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>s,default:()=>h,frontMatter:()=>a,metadata:()=>r,toc:()=>d});var i=n(5893),o=n(1151);const a={title:"Overview & API",hide_title:!0,sidebar_position:1},s="Overview & API",r={id:"cado-response/manage/integrations/api-overview",title:"Overview & API",description:"The Cado API enables third party tools and automation scripts to integrate with the Cado platform.",source:"@site/docs/cado-response/manage/integrations/api-overview.md",sourceDirName:"cado-response/manage/integrations",slug:"/cado-response/manage/integrations/api-overview",permalink:"/cado-response/manage/integrations/api-overview",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/integrations/api-overview.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Overview & API",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Ping SAML",permalink:"/cado-response/manage/users-authentication/sso/ping_saml"},next:{title:"GuardDuty via Lambda",permalink:"/cado-response/manage/integrations/aws-lambda"}},c={},d=[{value:"Creating and Storing an API Access Key",id:"creating-and-storing-an-api-access-key",level:3},{value:"Platform Base URL",id:"platform-base-url",level:3},{value:"Full API Documentation",id:"full-api-documentation",level:3}];function l(e){const t={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,o.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"overview--api",children:"Overview & API"}),"\n",(0,i.jsx)(t.p,{children:"The Cado API enables third party tools and automation scripts to integrate with the Cado platform."}),"\n",(0,i.jsx)(t.p,{children:"You can use the API and the pre-made out-of-the-box integrations to trigger operations in the platform (e.g. acquire instances from your cloud environments), retrieve data that our system captured (e.g. suspicious events), manage and control investigation projects, and more."}),"\n",(0,i.jsx)(t.p,{children:"This section provides a quick onboarding flow that is required for every integration followed in this section."}),"\n",(0,i.jsx)(t.h3,{id:"creating-and-storing-an-api-access-key",children:"Creating and Storing an API Access Key"}),"\n",(0,i.jsx)(t.p,{children:"Before diving into any of the integrations we have with the Cado platform - we first need to understand the correct way to authenticate and access the Cado API."}),"\n",(0,i.jsx)(t.p,{children:"To be able to access the different resources of the API, any request must be provided with a valid API Key generated by our authentication server."}),"\n",(0,i.jsx)(t.p,{children:"To generate that key you can do the following inside Cado Repsonse:"}),"\n",(0,i.jsxs)(t.ol,{children:["\n",(0,i.jsxs)(t.li,{children:["Go to ",(0,i.jsx)(t.strong,{children:"Settings"})," in the bottom left and click the ",(0,i.jsx)(t.strong,{children:"API"})," tab."]}),"\n",(0,i.jsxs)(t.li,{children:["Under ",(0,i.jsx)(t.strong,{children:"Access Tokens"})," click the ",(0,i.jsx)(t.strong,{children:"Create New Key"})," button."]}),"\n",(0,i.jsxs)(t.li,{children:["Take note of the ",(0,i.jsx)(t.strong,{children:"Public Key"}),", this is the identifier that we can use for revoking the key later on if needed."]}),"\n",(0,i.jsxs)(t.li,{children:["Take note of the ",(0,i.jsx)(t.strong,{children:"Secret Key"}),", you'll need to save this somewhere private (like a password manager), as you won't be able to see it again after you close the dialog. This is the key we need to provide to the third-party integration providers."]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Get API Key",src:n(9436).Z+"",width:"833",height:"655"})}),"\n",(0,i.jsx)(t.p,{children:"The Secret Key is used as the Access Token."}),"\n",(0,i.jsx)(t.admonition,{type:"tip",children:(0,i.jsx)(t.p,{children:"The API Secret Key will only be shown once, so it is recommended to save it to a secure place, like password manager."})}),"\n",(0,i.jsx)(t.h3,{id:"platform-base-url",children:"Platform Base URL"}),"\n",(0,i.jsx)(t.p,{children:'Often you\'ll see in the following tutorials that we are referring to "Platform Base URL" - which is the IP or Domain of where the platform was deployed, for example:'}),"\n",(0,i.jsx)(t.pre,{children:(0,i.jsx)(t.code,{children:"https://ec2example.compute.amazonaws.com\n"})}),"\n",(0,i.jsx)(t.h3,{id:"full-api-documentation",children:"Full API Documentation"}),"\n",(0,i.jsxs)(t.p,{children:["From version 2.8.0 onwards you can view the Swagger docs for the API at /apidocs\nYou can view examples at ",(0,i.jsx)(t.a,{href:"https://github.com/cado-security/cado-api-examples",children:"https://github.com/cado-security/cado-api-examples"})]})]})}function h(e={}){const{wrapper:t}={...(0,o.a)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(l,{...e})}):l(e)}},9436:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/api-e5f87fa2f8d4399e9b134c464dbf1ca2.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>r,a:()=>s});var i=n(7294);const o={},a=i.createContext(o);function s(e){const t=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:s(e.components),i.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ec12bbb6.4e1d09d7.js b/assets/js/ec12bbb6.4e1d09d7.js new file mode 100644 index 000000000..63eb2548e --- /dev/null +++ b/assets/js/ec12bbb6.4e1d09d7.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3710],{583:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>c,contentTitle:()=>n,default:()=>l,frontMatter:()=>i,metadata:()=>a,toc:()=>d});var r=t(5893),s=t(1151);const i={title:"Overview",hide_title:!0,sidebar_position:1},n="Importing Data",a={id:"cado-response/discovery-import/import/intro",title:"Overview",description:"There are a number of options for importing data into the Cado platform. Once you select the data you would like to import, the Cado platform begins processing the data based on the platforms Processing Settings. Check out our help section on Processing Settings for more details.",source:"@site/docs/cado-response/discovery-import/import/intro.md",sourceDirName:"cado-response/discovery-import/import",slug:"/cado-response/discovery-import/import/intro",permalink:"/cado-response/discovery-import/import/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/intro.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:1,frontMatter:{title:"Overview",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Readiness (Beta)",permalink:"/cado-response/discovery-import/readiness"},next:{title:"Import from Cloud",permalink:"/cado-response/discovery-import/import/import-from-cloud"}},c={},d=[{value:"Importing from Cloud Services",id:"importing-from-cloud-services",level:3},{value:"Importing from XDR",id:"importing-from-xdr",level:3},{value:"Importing from Cado Host",id:"importing-from-cado-host",level:3},{value:"Importing from URL",id:"importing-from-url",level:3}];function p(e){const o={a:"a",admonition:"admonition",blockquote:"blockquote",em:"em",h1:"h1",h3:"h3",img:"img",p:"p",strong:"strong",...(0,s.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(o.h1,{id:"importing-data",children:"Importing Data"}),"\n",(0,r.jsxs)(o.p,{children:["There are a number of options for importing data into the Cado platform. Once you select the data you would like to import, the Cado platform begins processing the data based on the platforms Processing Settings. Check out our help section on ",(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/manage/workers#processing",children:"Processing Settings"})})," for more details."]}),"\n",(0,r.jsxs)(o.p,{children:["Cado supports a wide range of ",(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/discovery-import/import/data-types/filetypes",children:"file types"})})," across a number of ",(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/discovery-import/import/data-types/import-types",children:"cloud services"})})," which can be imported. To begin importing data, you simply select a Project and click the ",(0,r.jsx)(o.strong,{children:"Import"})," button"]}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Import Button",src:t(6848).Z+"",width:"351",height:"138"})}),"\n",(0,r.jsx)(o.p,{children:"Based on the evidence you would like to import, follow the on-screen instructions and select your source."}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Import Data",src:t(263).Z+"",width:"842",height:"242"})}),"\n",(0,r.jsx)(o.h3,{id:"importing-from-cloud-services",children:"Importing from Cloud Services"}),"\n",(0,r.jsxs)(o.p,{children:["You can import evidence from cloud services across AWS, Azure and GCP, provided you have the correct credentials entered into the system, and your role has been assigned access to those credentials. ",(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/discovery-import/import/import-from-cloud",children:"Learn more"})})]}),"\n",(0,r.jsx)(o.h3,{id:"importing-from-xdr",children:"Importing from XDR"}),"\n",(0,r.jsxs)(o.p,{children:["You can import data into the Cado platform via an eXtended Detection and Response (XDR) system. Currently Cado supports importing from SentinelOne. For more infomation about setting up this integration see the ",(0,r.jsx)(o.a,{href:"/cado-response/manage/integrations/xdr/sentinelone",children:"SentinelOne Integration Setup page"})]}),"\n",(0,r.jsxs)(o.p,{children:["Once the integration is set up, from within a project click ",(0,r.jsx)(o.strong,{children:"Import from XDR"})]}),"\n",(0,r.jsxs)(o.p,{children:["Then choose the XDR Platform you have set up, and click ",(0,r.jsx)(o.em,{children:"Continue"})]}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Choose XDR Platform",src:t(8061).Z+"",width:"957",height:"197"})}),"\n",(0,r.jsxs)(o.p,{children:["Then search for or select the endpoint from which you want to collect, and click ",(0,r.jsx)(o.em,{children:"Continue"})]}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Import XDR Endpoints",src:t(953).Z+"",width:"1847",height:"408"})}),"\n",(0,r.jsxs)(o.p,{children:["Finally, confirm your selections and click ",(0,r.jsx)(o.em,{children:"Start Import"})]}),"\n",(0,r.jsx)(o.h3,{id:"importing-from-cado-host",children:"Importing from Cado Host"}),"\n",(0,r.jsx)(o.p,{children:"The Cado platform can use Cado Host to acquire forensic artifacts from on-premises system for analysis in the cloud.\nIt can also generate credentials for Cado Host to upload evidence, such as a previously collected disk image."}),"\n",(0,r.jsxs)(o.p,{children:["For more information see the ",(0,r.jsx)(o.a,{href:"/cado-host/intro",children:"Cado Host Documentation"})]}),"\n",(0,r.jsx)(o.h3,{id:"importing-from-url",children:"Importing from URL"}),"\n",(0,r.jsxs)(o.p,{children:["You can import supported ",(0,r.jsx)(o.a,{href:"/cado-response/discovery-import/import/data-types/filetypes",children:"file types"})," from a URL where you are storing forensic artifacts collected from on-premises systems."]}),"\n",(0,r.jsxs)(o.blockquote,{children:["\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"On-Premises URL",src:t(8731).Z+"",width:"953",height:"181"})}),"\n"]}),"\n",(0,r.jsx)(o.admonition,{type:"info",children:(0,r.jsxs)(o.p,{children:["During the EC2 Import process, an i3.4xlarge worker instance is deployed to allow for proper disk acquisition. During the Azure Instance Import process, a Standard_D8ds_v4 worker instance is deployed to allow for proper disk acquisition. You can configure the size of the worker instance in the Cado platform under ",(0,r.jsx)(o.strong,{children:"Settings/Processing"}),". This worker is spun down once the target disk is acquired."]})}),"\n",(0,r.jsxs)(o.admonition,{type:"warning",children:[(0,r.jsx)(o.p,{children:"By default when processing archive files Cado processes two layers of recursion and twenty folder branches. This provides faster processing but there is a slight risk that some malicious files or activites may be missed."}),(0,r.jsxs)(o.p,{children:["You can configure this at ",(0,r.jsx)(o.strong,{children:"Settings/Processing Speed"})," but increasing these numbers will increase the time taken to process disk images with archives."]}),(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Processing Speed",src:t(9247).Z+"",width:"1256",height:"547"})})]})]})}function l(e={}){const{wrapper:o}={...(0,s.a)(),...e.components};return o?(0,r.jsx)(o,{...e,children:(0,r.jsx)(p,{...e})}):p(e)}},6848:(e,o,t)=>{t.d(o,{Z:()=>r});const r=t.p+"assets/images/import-button-798e13611cef2958b7fd5bbfc5c3ff91.png"},263:(e,o,t)=>{t.d(o,{Z:()=>r});const r=t.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},8731:(e,o,t)=>{t.d(o,{Z:()=>r});const r=t.p+"assets/images/on-premises-url-5f43b688a1a7f0eb65001e51adb5744c.png"},9247:(e,o,t)=>{t.d(o,{Z:()=>r});const r=t.p+"assets/images/settings-processing-speed-b108aef674310ab3f0119abaf88f8c92.png"},8061:(e,o,t)=>{t.d(o,{Z:()=>r});const r=t.p+"assets/images/xdr-import-2-5b5410836dbf05bb46ef55a7674385a2.png"},953:(e,o,t)=>{t.d(o,{Z:()=>r});const r=t.p+"assets/images/xdr-import-3-94a70eb2c01cb4fad976f534c453edb3.png"},1151:(e,o,t)=>{t.d(o,{Z:()=>a,a:()=>n});var r=t(7294);const s={},i=r.createContext(s);function n(e){const o=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function a(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:n(e.components),r.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ec12bbb6.6a3edcbf.js b/assets/js/ec12bbb6.6a3edcbf.js deleted file mode 100644 index 4b7c02e87..000000000 --- a/assets/js/ec12bbb6.6a3edcbf.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[3710],{583:(e,o,t)=>{t.r(o),t.d(o,{assets:()=>c,contentTitle:()=>n,default:()=>l,frontMatter:()=>i,metadata:()=>a,toc:()=>d});var r=t(5893),s=t(1151);const i={title:"Overview",hide_title:!0,sidebar_position:1},n="Importing Data",a={id:"cado-response/discovery-import/import/intro",title:"Overview",description:"There are a number of options for importing data into the Cado platform. Once you select the data you would like to import, the Cado platform begins processing the data based on the platforms Processing Settings. Check out our help section on Processing Settings for more details.",source:"@site/docs/cado-response/discovery-import/import/intro.md",sourceDirName:"cado-response/discovery-import/import",slug:"/cado-response/discovery-import/import/intro",permalink:"/cado-response/discovery-import/import/intro",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/import/intro.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:1,frontMatter:{title:"Overview",hide_title:!0,sidebar_position:1},sidebar:"tutorialSidebar",previous:{title:"Readiness (Beta)",permalink:"/cado-response/discovery-import/readiness"},next:{title:"Import from Cloud",permalink:"/cado-response/discovery-import/import/import-from-cloud"}},c={},d=[{value:"Importing from Cloud Services",id:"importing-from-cloud-services",level:3},{value:"Importing from XDR",id:"importing-from-xdr",level:3},{value:"Importing from Cado Host",id:"importing-from-cado-host",level:3},{value:"Importing from URL",id:"importing-from-url",level:3}];function p(e){const o={a:"a",admonition:"admonition",blockquote:"blockquote",em:"em",h1:"h1",h3:"h3",img:"img",p:"p",strong:"strong",...(0,s.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(o.h1,{id:"importing-data",children:"Importing Data"}),"\n",(0,r.jsxs)(o.p,{children:["There are a number of options for importing data into the Cado platform. Once you select the data you would like to import, the Cado platform begins processing the data based on the platforms Processing Settings. Check out our help section on ",(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/manage/workers#processing",children:"Processing Settings"})})," for more details."]}),"\n",(0,r.jsxs)(o.p,{children:["Cado supports a wide range of ",(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/discovery-import/import/data-types/filetypes",children:"file types"})})," across a number of ",(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/discovery-import/import/data-types/import-types",children:"cloud services"})})," which can be imported. To begin importing data, you simply select a Project and click the ",(0,r.jsx)(o.strong,{children:"Import"})," button"]}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Import Button",src:t(6848).Z+"",width:"351",height:"138"})}),"\n",(0,r.jsx)(o.p,{children:"Based on the evidence you would like to import, follow the on-screen instructions and select your source."}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Import Data",src:t(263).Z+"",width:"842",height:"242"})}),"\n",(0,r.jsx)(o.h3,{id:"importing-from-cloud-services",children:"Importing from Cloud Services"}),"\n",(0,r.jsxs)(o.p,{children:["You can import evidence from cloud services across AWS, Azure and GCP, provided you have the correct credentials entered into the system, and your role has been assigned access to those credentials. ",(0,r.jsx)(o.strong,{children:(0,r.jsx)(o.a,{href:"/cado-response/discovery-import/import/import-from-cloud",children:"Learn more"})})]}),"\n",(0,r.jsx)(o.h3,{id:"importing-from-xdr",children:"Importing from XDR"}),"\n",(0,r.jsxs)(o.p,{children:["You can import data into the Cado platform via an eXtended Detection and Response (XDR) system. Currently Cado supports importing from SentinelOne. For more infomation about setting up this integration see the ",(0,r.jsx)(o.a,{href:"/cado-response/manage/integrations/xdr/sentinelone",children:"SentinelOne Integration Setup page"})]}),"\n",(0,r.jsxs)(o.p,{children:["Once the integration is set up, from within a project click ",(0,r.jsx)(o.strong,{children:"Import from XDR"})]}),"\n",(0,r.jsxs)(o.p,{children:["Then choose the XDR Platform you have set up, and click ",(0,r.jsx)(o.em,{children:"Continue"})]}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Choose XDR Platform",src:t(8061).Z+"",width:"957",height:"197"})}),"\n",(0,r.jsxs)(o.p,{children:["Then search for or select the endpoint from which you want to collect, and click ",(0,r.jsx)(o.em,{children:"Continue"})]}),"\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Import XDR Endpoints",src:t(953).Z+"",width:"1847",height:"408"})}),"\n",(0,r.jsxs)(o.p,{children:["Finally, confirm your selections and click ",(0,r.jsx)(o.em,{children:"Start Import"})]}),"\n",(0,r.jsx)(o.h3,{id:"importing-from-cado-host",children:"Importing from Cado Host"}),"\n",(0,r.jsx)(o.p,{children:"The Cado platform can use Cado Host to acquire forensic artifacts from on-premises system for analysis in the cloud.\nIt can also generate credentials for Cado Host to upload evidence, such as a previously collected disk image."}),"\n",(0,r.jsxs)(o.p,{children:["For more information see the ",(0,r.jsx)(o.a,{href:"/cado-host/intro",children:"Cado Host Documentation"})]}),"\n",(0,r.jsx)(o.h3,{id:"importing-from-url",children:"Importing from URL"}),"\n",(0,r.jsxs)(o.p,{children:["You can import supported ",(0,r.jsx)(o.a,{href:"/cado-response/discovery-import/import/data-types/filetypes",children:"file types"})," from a URL where you are storing forensic artifacts collected from on-premises systems."]}),"\n",(0,r.jsxs)(o.blockquote,{children:["\n",(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"On-Premises URL",src:t(8731).Z+"",width:"953",height:"181"})}),"\n"]}),"\n",(0,r.jsx)(o.admonition,{type:"info",children:(0,r.jsxs)(o.p,{children:["During the EC2 Import process, an i3.4xlarge worker instance is deployed to allow for proper disk acquisition. During the Azure Instance Import process, a Standard_D8ds_v4 worker instance is deployed to allow for proper disk acquisition. You can configure the size of the worker instance in the Cado platform under ",(0,r.jsx)(o.strong,{children:"Settings/Processing"}),". This worker is spun down once the target disk is acquired."]})}),"\n",(0,r.jsxs)(o.admonition,{type:"warning",children:[(0,r.jsx)(o.p,{children:"By default when processing archive files Cado processes two layers of recursion and twenty folder branches. This provides faster processing but there is a slight risk that some malicious files or activites may be missed."}),(0,r.jsxs)(o.p,{children:["You can configure this at ",(0,r.jsx)(o.strong,{children:"Settings/Processing Speed"})," but increasing these numbers will increase the time taken to process disk images with archives."]}),(0,r.jsx)(o.p,{children:(0,r.jsx)(o.img,{alt:"Processing Speed",src:t(9247).Z+"",width:"1256",height:"547"})})]})]})}function l(e={}){const{wrapper:o}={...(0,s.a)(),...e.components};return o?(0,r.jsx)(o,{...e,children:(0,r.jsx)(p,{...e})}):p(e)}},6848:(e,o,t)=>{t.d(o,{Z:()=>r});const r=t.p+"assets/images/import-button-798e13611cef2958b7fd5bbfc5c3ff91.png"},263:(e,o,t)=>{t.d(o,{Z:()=>r});const r=t.p+"assets/images/import-c255e755b777d62c8e12f8b312b4f9ea.png"},8731:(e,o,t)=>{t.d(o,{Z:()=>r});const r=t.p+"assets/images/on-premises-url-5f43b688a1a7f0eb65001e51adb5744c.png"},9247:(e,o,t)=>{t.d(o,{Z:()=>r});const r=t.p+"assets/images/settings-processing-speed-b108aef674310ab3f0119abaf88f8c92.png"},8061:(e,o,t)=>{t.d(o,{Z:()=>r});const r=t.p+"assets/images/xdr-import-2-5b5410836dbf05bb46ef55a7674385a2.png"},953:(e,o,t)=>{t.d(o,{Z:()=>r});const r=t.p+"assets/images/xdr-import-3-94a70eb2c01cb4fad976f534c453edb3.png"},1151:(e,o,t)=>{t.d(o,{Z:()=>a,a:()=>n});var r=t(7294);const s={},i=r.createContext(s);function n(e){const o=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(o):{...o,...e}}),[o,e])}function a(e){let o;return o=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:n(e.components),r.createElement(i.Provider,{value:o},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/efb6f929.5a4800e5.js b/assets/js/efb6f929.5a4800e5.js new file mode 100644 index 000000000..c26cbd357 --- /dev/null +++ b/assets/js/efb6f929.5a4800e5.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6787],{1304:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>o,contentTitle:()=>a,default:()=>h,frontMatter:()=>i,metadata:()=>c,toc:()=>l});var s=n(5893),r=n(1151);const i={title:"AWS Credentials",hide_title:!0,sidebar_position:3},a="Creating Secure Credentials for AWS",c={id:"cado-host/aws-credentials",title:"AWS Credentials",description:"We now recommend using the automatically created temporary credentials generated by Cado Response. See our documentation here for more details.",source:"@site/docs/cado-host/aws-credentials.md",sourceDirName:"cado-host",slug:"/cado-host/aws-credentials",permalink:"/cado-host/aws-credentials",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-host/aws-credentials.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:3,frontMatter:{title:"AWS Credentials",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Collected Artifacts",permalink:"/cado-host/artifacts"},next:{title:"Azure Credentials",permalink:"/cado-host/azure-credentials"}},o={},l=[{value:"Creating an S3 Bucket",id:"creating-an-s3-bucket",level:2},{value:"Creating an AWS User with Limited Access",id:"creating-an-aws-user-with-limited-access",level:2},{value:"Creating The Policy",id:"creating-the-policy",level:2},{value:"Creating a User",id:"creating-a-user",level:2}];function d(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.admonition,{type:"warning",children:(0,s.jsxs)(t.p,{children:["We now recommend using the automatically created temporary credentials generated by Cado Response. See our documentation ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(t.a,{href:"deploy#deploy-through-cado-response-platform",children:"here"})})," for more details."]})}),"\n",(0,s.jsx)(t.h1,{id:"creating-secure-credentials-for-aws",children:"Creating Secure Credentials for AWS"}),"\n",(0,s.jsx)(t.p,{children:"Below we will create credentials with write-only access to AWS S3."}),"\n",(0,s.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/OW6fwaUNVXU",title:"YouTube video player",frameborder:"0",allowfullscreen:!0}),"\n",(0,s.jsx)(t.h2,{id:"creating-an-s3-bucket",children:"Creating an S3 Bucket"}),"\n",(0,s.jsxs)(t.p,{children:["If you haven't already, ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(t.a,{href:"https://docs.aws.amazon.com/quickstarts/latest/s3backup/step-1-create-bucket.html",children:"Create a new S3 bucket"})}),". Make sure that you do not enable public access to the bucket."]}),"\n",(0,s.jsx)(t.h2,{id:"creating-an-aws-user-with-limited-access",children:"Creating an AWS User with Limited Access"}),"\n",(0,s.jsx)(t.p,{children:"First we need to create a policy with write-only access to the bucket"}),"\n",(0,s.jsx)(t.h2,{id:"creating-the-policy",children:"Creating The Policy"}),"\n",(0,s.jsx)(t.p,{children:"It is important to use a user that has limited access, so if an attacker steals the credentials you use with Cado Live Imager they cannot abuse them."}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsxs)(t.li,{children:["First access the ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(t.a,{href:"https://console.aws.amazon.com/iam/home#/policies",children:"Access Management Policies"})})," page."]}),"\n",(0,s.jsx)(t.li,{children:"Click Create Policy."}),"\n",(0,s.jsx)(t.li,{children:"Select Service as S3 and Actions as Write->PutObject"}),"\n",(0,s.jsx)(t.li,{children:"Click Specific Resources then under bucket, click Add ARN"}),"\n",(0,s.jsx)(t.li,{children:"Enter the name of your bucket, then click Add"}),"\n",(0,s.jsx)(t.li,{children:"Then Click through to create the policy."}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"creating-a-user",children:"Creating a User"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsxs)(t.li,{children:["First access the ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(t.a,{href:"https://console.aws.amazon.com/iam/home#/users",children:"IAM User Page"})})," and select Add User."]}),"\n",(0,s.jsx)(t.li,{children:"Create a new user with Programmatic access."}),"\n",(0,s.jsx)(t.li,{children:"Next select the permissions policy you just created."}),"\n",(0,s.jsx)(t.li,{children:"Then Click through to Create the User and retrieve the Access Key and Secret Key."}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"In the end, you are ready to go when you have:"}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsx)(t.li,{children:"The Access Key"}),"\n",(0,s.jsx)(t.li,{children:"The Secret Key"}),"\n",(0,s.jsx)(t.li,{children:"The Bucket Name"}),"\n"]})]})}function h(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>c,a:()=>a});var s=n(7294);const r={},i=s.createContext(r);function a(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/efb6f929.eb463c7d.js b/assets/js/efb6f929.eb463c7d.js deleted file mode 100644 index 5e2903b4f..000000000 --- a/assets/js/efb6f929.eb463c7d.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6787],{1304:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>o,contentTitle:()=>a,default:()=>h,frontMatter:()=>i,metadata:()=>c,toc:()=>l});var s=n(5893),r=n(1151);const i={title:"AWS Credentials",hide_title:!0,sidebar_position:3},a="Creating Secure Credentials for AWS",c={id:"cado-host/aws-credentials",title:"AWS Credentials",description:"We now recommend using the automatically created temporary credentials generated by Cado Response. See our documentation here for more details.",source:"@site/docs/cado-host/aws-credentials.md",sourceDirName:"cado-host",slug:"/cado-host/aws-credentials",permalink:"/cado-host/aws-credentials",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-host/aws-credentials.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:3,frontMatter:{title:"AWS Credentials",hide_title:!0,sidebar_position:3},sidebar:"tutorialSidebar",previous:{title:"Collected Artifacts",permalink:"/cado-host/artifacts"},next:{title:"Azure Credentials",permalink:"/cado-host/azure-credentials"}},o={},l=[{value:"Creating an S3 Bucket",id:"creating-an-s3-bucket",level:2},{value:"Creating an AWS User with Limited Access",id:"creating-an-aws-user-with-limited-access",level:2},{value:"Creating The Policy",id:"creating-the-policy",level:2},{value:"Creating a User",id:"creating-a-user",level:2}];function d(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.admonition,{type:"warning",children:(0,s.jsxs)(t.p,{children:["We now recommend using the automatically created temporary credentials generated by Cado Response. See our documentation ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(t.a,{href:"deploy#deploy-through-cado-response-platform",children:"here"})})," for more details."]})}),"\n",(0,s.jsx)(t.h1,{id:"creating-secure-credentials-for-aws",children:"Creating Secure Credentials for AWS"}),"\n",(0,s.jsx)(t.p,{children:"Below we will create credentials with write-only access to AWS S3."}),"\n",(0,s.jsx)("iframe",{width:"100%",height:"628",src:"https://www.youtube.com/embed/OW6fwaUNVXU",title:"YouTube video player",frameborder:"0",allowfullscreen:!0}),"\n",(0,s.jsx)(t.h2,{id:"creating-an-s3-bucket",children:"Creating an S3 Bucket"}),"\n",(0,s.jsxs)(t.p,{children:["If you haven't already, ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(t.a,{href:"https://docs.aws.amazon.com/quickstarts/latest/s3backup/step-1-create-bucket.html",children:"Create a new S3 bucket"})}),". Make sure that you do not enable public access to the bucket."]}),"\n",(0,s.jsx)(t.h2,{id:"creating-an-aws-user-with-limited-access",children:"Creating an AWS User with Limited Access"}),"\n",(0,s.jsx)(t.p,{children:"First we need to create a policy with write-only access to the bucket"}),"\n",(0,s.jsx)(t.h2,{id:"creating-the-policy",children:"Creating The Policy"}),"\n",(0,s.jsx)(t.p,{children:"It is important to use a user that has limited access, so if an attacker steals the credentials you use with Cado Live Imager they cannot abuse them."}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsxs)(t.li,{children:["First access the ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(t.a,{href:"https://console.aws.amazon.com/iam/home#/policies",children:"Access Management Policies"})})," page."]}),"\n",(0,s.jsx)(t.li,{children:"Click Create Policy."}),"\n",(0,s.jsx)(t.li,{children:"Select Service as S3 and Actions as Write->PutObject"}),"\n",(0,s.jsx)(t.li,{children:"Click Specific Resources then under bucket, click Add ARN"}),"\n",(0,s.jsx)(t.li,{children:"Enter the name of your bucket, then click Add"}),"\n",(0,s.jsx)(t.li,{children:"Then Click through to create the policy."}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"creating-a-user",children:"Creating a User"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsxs)(t.li,{children:["First access the ",(0,s.jsx)(t.strong,{children:(0,s.jsx)(t.a,{href:"https://console.aws.amazon.com/iam/home#/users",children:"IAM User Page"})})," and select Add User."]}),"\n",(0,s.jsx)(t.li,{children:"Create a new user with Programmatic access."}),"\n",(0,s.jsx)(t.li,{children:"Next select the permissions policy you just created."}),"\n",(0,s.jsx)(t.li,{children:"Then Click through to Create the User and retrieve the Access Key and Secret Key."}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"In the end, you are ready to go when you have:"}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsx)(t.li,{children:"The Access Key"}),"\n",(0,s.jsx)(t.li,{children:"The Secret Key"}),"\n",(0,s.jsx)(t.li,{children:"The Bucket Name"}),"\n"]})]})}function h(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>c,a:()=>a});var s=n(7294);const r={},i=s.createContext(r);function a(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/f191d22a.096a059d.js b/assets/js/f191d22a.096a059d.js new file mode 100644 index 000000000..eae2aeab6 --- /dev/null +++ b/assets/js/f191d22a.096a059d.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9625],{7167:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>p,frontMatter:()=>a,metadata:()=>r,toc:()=>d});var s=i(5893),n=i(1151);const a={title:"AI Investigator",hide_title:!0,sidebar_position:10},o=void 0,r={id:"cado-response/investigate/ai investigator",title:"AI Investigator",description:"Cado AI Investigator",source:"@site/docs/cado-response/investigate/ai investigator.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/ai investigator",permalink:"/cado-response/investigate/ai investigator",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/ai investigator.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:10,frontMatter:{title:"AI Investigator",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"Detections",permalink:"/cado-response/investigate/detections"},next:{title:"Logging In",permalink:"/cado-response/manage/logging-in"}},c={},d=[{value:"Cado AI Investigator",id:"cado-ai-investigator",level:2}];function l(e){const t={h2:"h2",img:"img",p:"p",...(0,n.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h2,{id:"cado-ai-investigator",children:"Cado AI Investigator"}),"\n",(0,s.jsx)(t.p,{children:"Cado AI Investigator currently performs two key tasks:"}),"\n",(0,s.jsxs)(t.p,{children:["Investigation Summarization: It provides a concise and informative overview of your investigation, presented directly on the project overview tab. This summary highlights key findings:\n",(0,s.jsx)(t.img,{alt:"File Details 1",src:i(8646).Z+"",width:"1999",height:"866"})]}),"\n",(0,s.jsxs)(t.p,{children:["Malicious File Analysis: It analyses malicious files, such as scripts, executables, or documents, and tells you what they do.\nFor example, it can tell you if a script downloads and executes a payload, modifies registry keys, or creates persistence mechanisms:\n",(0,s.jsx)(t.img,{alt:"File Details 1",src:i(4190).Z+"",width:"1999",height:"685"})]}),"\n",(0,s.jsx)(t.p,{children:"Cado AI Investigator is available now for customers running version v2.107.0 or later.\nThis is a beta feature, and can be enabled under Settings > Experiments.\nIt will run on all new imports."})]})}function p(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},8646:(e,t,i)=>{i.d(t,{Z:()=>s});const s=i.p+"assets/images/ai_image1-2478ed08c1236d68878ecb6cca833325.png"},4190:(e,t,i)=>{i.d(t,{Z:()=>s});const s=i.p+"assets/images/ai_image2-5315b2c38c2fd96ee6059b87e316ae80.png"},1151:(e,t,i)=>{i.d(t,{Z:()=>r,a:()=>o});var s=i(7294);const n={},a=s.createContext(n);function o(e){const t=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:o(e.components),s.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/f191d22a.8aac0766.js b/assets/js/f191d22a.8aac0766.js deleted file mode 100644 index ebb0b2870..000000000 --- a/assets/js/f191d22a.8aac0766.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[9625],{7167:(e,t,i)=>{i.r(t),i.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>p,frontMatter:()=>a,metadata:()=>r,toc:()=>d});var s=i(5893),n=i(1151);const a={title:"AI Investigator",hide_title:!0,sidebar_position:10},o=void 0,r={id:"cado-response/investigate/ai investigator",title:"AI Investigator",description:"Cado AI Investigator",source:"@site/docs/cado-response/investigate/ai investigator.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/ai investigator",permalink:"/cado-response/investigate/ai investigator",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/ai investigator.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:10,frontMatter:{title:"AI Investigator",hide_title:!0,sidebar_position:10},sidebar:"tutorialSidebar",previous:{title:"Detections",permalink:"/cado-response/investigate/detections"},next:{title:"Logging In",permalink:"/cado-response/manage/logging-in"}},c={},d=[{value:"Cado AI Investigator",id:"cado-ai-investigator",level:2}];function l(e){const t={h2:"h2",img:"img",p:"p",...(0,n.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h2,{id:"cado-ai-investigator",children:"Cado AI Investigator"}),"\n",(0,s.jsx)(t.p,{children:"Cado AI Investigator currently performs two key tasks:"}),"\n",(0,s.jsxs)(t.p,{children:["Investigation Summarization: It provides a concise and informative overview of your investigation, presented directly on the project overview tab. This summary highlights key findings:\n",(0,s.jsx)(t.img,{alt:"File Details 1",src:i(8646).Z+"",width:"1999",height:"866"})]}),"\n",(0,s.jsxs)(t.p,{children:["Malicious File Analysis: It analyses malicious files, such as scripts, executables, or documents, and tells you what they do.\nFor example, it can tell you if a script downloads and executes a payload, modifies registry keys, or creates persistence mechanisms:\n",(0,s.jsx)(t.img,{alt:"File Details 1",src:i(4190).Z+"",width:"1999",height:"685"})]}),"\n",(0,s.jsx)(t.p,{children:"Cado AI Investigator is available now for customers running version v2.107.0 or later.\nThis is a beta feature, and can be enabled under Settings > Experiments.\nIt will run on all new imports."})]})}function p(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},8646:(e,t,i)=>{i.d(t,{Z:()=>s});const s=i.p+"assets/images/ai_image1-2478ed08c1236d68878ecb6cca833325.png"},4190:(e,t,i)=>{i.d(t,{Z:()=>s});const s=i.p+"assets/images/ai_image2-5315b2c38c2fd96ee6059b87e316ae80.png"},1151:(e,t,i)=>{i.d(t,{Z:()=>r,a:()=>o});var s=i(7294);const n={},a=s.createContext(n);function o(e){const t=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:o(e.components),s.createElement(a.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/f6441ffe.163b7740.js b/assets/js/f6441ffe.163b7740.js new file mode 100644 index 000000000..80adbe7a3 --- /dev/null +++ b/assets/js/f6441ffe.163b7740.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8754],{3068:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>d});var t=s(5893),i=s(1151);const o={title:"Okta OAuth",hide_title:!0,sidebar_position:2},a="Okta OAuth Integration",r={id:"cado-response/manage/users-authentication/sso/okta",title:"Okta OAuth",description:"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.",source:"@site/docs/cado-response/manage/users-authentication/sso/okta.md",sourceDirName:"cado-response/manage/users-authentication/sso",slug:"/cado-response/manage/users-authentication/sso/okta",permalink:"/cado-response/manage/users-authentication/sso/okta",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/users-authentication/sso/okta.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"Okta OAuth",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Azure AD",permalink:"/cado-response/manage/users-authentication/sso/azure-ad"},next:{title:"Okta SAML",permalink:"/cado-response/manage/users-authentication/sso/okta_saml"}},c={},d=[{value:"Setting up Okta SSO",id:"setting-up-okta-sso",level:3}];function l(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"okta-oauth-integration",children:"Okta OAuth Integration"}),"\n",(0,t.jsx)(n.admonition,{type:"warning",children:(0,t.jsxs)(n.p,{children:["If you encounter issues, please contact ",(0,t.jsx)(n.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," describing your issue and providing as much detail about your configuration as possible."]})}),"\n",(0,t.jsxs)(n.p,{children:["You can now enable the beta of Okta OAuth Integration in the Cado platform by going to ",(0,t.jsx)(n.code,{children:"Settings > SSO > Okta OAuth"}),"."]}),"\n",(0,t.jsx)(n.h3,{id:"setting-up-okta-sso",children:"Setting up Okta SSO"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Open the Okta admin dashboard and navigate to ",(0,t.jsx)(n.code,{children:"Applications > Applications"})]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Click ",(0,t.jsx)(n.strong,{children:"Create App Integration"})]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Select"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"OIDC - OpenID Connect"}),"\n",(0,t.jsx)(n.li,{children:"Web Application"}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Click ",(0,t.jsx)(n.strong,{children:"Next"})]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Give the Cado OAuth app a name"}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Add a Sign-in redirect URI. This should be the url you use to access cado in the web browser, with the ",(0,t.jsx)(n.code,{children:"/login"})," path. E.g. ",(0,t.jsx)(n.a,{href:"https://my.cado.instance/login",children:"https://my.cado.instance/login"})]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Choose who is granted access to the application"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["In Assignments select ",(0,t.jsx)(n.strong,{children:"Limit access to selected groups"})]}),"\n",(0,t.jsx)(n.li,{children:"Add a user group"}),"\n",(0,t.jsx)(n.li,{children:"This can also be done at a later stage"}),"\n",(0,t.jsxs)(n.li,{children:["In this example the admin group will be called ",(0,t.jsx)(n.code,{children:"CadoAdmin"}),", but you can name this as you like. Just make note of what you call this; you'll need it later"]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Okta Assignments",src:s(7303).Z+"",width:"725",height:"242"})}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["If you are looking to assign non-admin users within Cado, you can use a group name other than ",(0,t.jsx)(n.code,{children:"CadoAdmin"}),". For example: adding a group ",(0,t.jsx)(n.code,{children:"CadoNonAdmin"})," and assigning users to it will result in those users being Normal Users within Cado."]})}),"\n",(0,t.jsxs)(n.ol,{start:"8",children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["If you wish to edit access control at a later time then you can do so in the ",(0,t.jsx)(n.strong,{children:"Assignments"})," tab of the OAuth application where you can add individual people or groups. Only users in a group named ",(0,t.jsx)(n.code,{children:"CadoAdmin"})," will be granted admin user status inside the Cado platform."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Add a groups claim for the application:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Go to the ",(0,t.jsx)(n.strong,{children:"Sign On"})," tab of the OAuth application"]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Edit"})," in the OpenID Connect ID Token section"]}),"\n",(0,t.jsx)(n.li,{children:"For the Issuer field specify \u201cOkta URL\u201d"}),"\n",(0,t.jsxs)(n.li,{children:["In the ",(0,t.jsx)(n.code,{children:"Groups claim type"})," field select ",(0,t.jsx)(n.strong,{children:"Filter"})]}),"\n",(0,t.jsxs)(n.li,{children:["In the ",(0,t.jsx)(n.code,{children:"Groups claim filter"})," leave its name ",(0,t.jsx)(n.strong,{children:"groups"})," and enter ",(0,t.jsx)(n.strong,{children:"Matches regex"})," ",(0,t.jsx)(n.code,{children:".*"})]}),"\n",(0,t.jsxs)(n.li,{children:["Then click ",(0,t.jsx)(n.strong,{children:"Save"})]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Okta Groups Claim",src:s(8769).Z+"",width:"696",height:"91"})}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Go to the ",(0,t.jsx)(n.strong,{children:"General settings"})," tab of the OAuth application and note down the ",(0,t.jsx)(n.code,{children:"Client ID"}),", ",(0,t.jsx)(n.code,{children:"Client Secret"})," and ",(0,t.jsx)(n.code,{children:"Okta Domain"})," settings."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Configure SSO in cado:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Open your cado instance and log in as an admin user"}),"\n",(0,t.jsxs)(n.li,{children:["Go to ",(0,t.jsx)(n.code,{children:"Settings > SSO > Okta OAuth"})]}),"\n",(0,t.jsxs)(n.li,{children:["Enter the details from step before and click update. For the domain field please add ",(0,t.jsx)(n.code,{children:"https://"})," to the beginning and ",(0,t.jsx)(n.code,{children:"/oauth2"})," to the end of the Okta domain setting. The complete Domain should be of this format: ",(0,t.jsx)(n.code,{children:"https:///oauth2"})]}),"\n",(0,t.jsxs)(n.li,{children:["In the ",(0,t.jsx)(n.code,{children:"Admin Group Name"})," enter in the value you configured in step 7"]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Log out with your existing user, and login with Okta OAuth"}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},7303:(e,n,s)=>{s.d(n,{Z:()=>t});const t=s.p+"assets/images/okta-assignments-3b23b5eb60b1a663656d167431a6126c.png"},8769:(e,n,s)=>{s.d(n,{Z:()=>t});const t=s.p+"assets/images/okta-groups-claim-0a2dfcb9c5c3f572132da5cdcc4ffe63.png"},1151:(e,n,s)=>{s.d(n,{Z:()=>r,a:()=>a});var t=s(7294);const i={},o=t.createContext(i);function a(e){const n=t.useContext(o);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),t.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/f6441ffe.b2fa4b37.js b/assets/js/f6441ffe.b2fa4b37.js deleted file mode 100644 index d5cdae93c..000000000 --- a/assets/js/f6441ffe.b2fa4b37.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[8754],{3068:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>c,contentTitle:()=>a,default:()=>h,frontMatter:()=>o,metadata:()=>r,toc:()=>d});var t=s(5893),i=s(1151);const o={title:"Okta OAuth",hide_title:!0,sidebar_position:2},a="Okta OAuth Integration",r={id:"cado-response/manage/users-authentication/sso/okta",title:"Okta OAuth",description:"If you encounter issues, please contact support@cadosecurity.com describing your issue and providing as much detail about your configuration as possible.",source:"@site/docs/cado-response/manage/users-authentication/sso/okta.md",sourceDirName:"cado-response/manage/users-authentication/sso",slug:"/cado-response/manage/users-authentication/sso/okta",permalink:"/cado-response/manage/users-authentication/sso/okta",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/manage/users-authentication/sso/okta.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"Okta OAuth",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Azure AD",permalink:"/cado-response/manage/users-authentication/sso/azure-ad"},next:{title:"Okta SAML",permalink:"/cado-response/manage/users-authentication/sso/okta_saml"}},c={},d=[{value:"Setting up Okta SSO",id:"setting-up-okta-sso",level:3}];function l(e){const n={a:"a",admonition:"admonition",code:"code",h1:"h1",h3:"h3",img:"img",li:"li",ol:"ol",p:"p",strong:"strong",ul:"ul",...(0,i.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h1,{id:"okta-oauth-integration",children:"Okta OAuth Integration"}),"\n",(0,t.jsx)(n.admonition,{type:"warning",children:(0,t.jsxs)(n.p,{children:["If you encounter issues, please contact ",(0,t.jsx)(n.a,{href:"mailto:support@cadosecurity.com",children:"support@cadosecurity.com"})," describing your issue and providing as much detail about your configuration as possible."]})}),"\n",(0,t.jsxs)(n.p,{children:["You can now enable the beta of Okta OAuth Integration in the Cado platform by going to ",(0,t.jsx)(n.code,{children:"Settings > SSO > Okta OAuth"}),"."]}),"\n",(0,t.jsx)(n.h3,{id:"setting-up-okta-sso",children:"Setting up Okta SSO"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Open the Okta admin dashboard and navigate to ",(0,t.jsx)(n.code,{children:"Applications > Applications"})]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Click ",(0,t.jsx)(n.strong,{children:"Create App Integration"})]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Select"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"OIDC - OpenID Connect"}),"\n",(0,t.jsx)(n.li,{children:"Web Application"}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Click ",(0,t.jsx)(n.strong,{children:"Next"})]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Give the Cado OAuth app a name"}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Add a Sign-in redirect URI. This should be the url you use to access cado in the web browser, with the ",(0,t.jsx)(n.code,{children:"/login"})," path. E.g. ",(0,t.jsx)(n.a,{href:"https://my.cado.instance/login",children:"https://my.cado.instance/login"})]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Choose who is granted access to the application"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["In Assignments select ",(0,t.jsx)(n.strong,{children:"Limit access to selected groups"})]}),"\n",(0,t.jsx)(n.li,{children:"Add a user group"}),"\n",(0,t.jsx)(n.li,{children:"This can also be done at a later stage"}),"\n",(0,t.jsxs)(n.li,{children:["In this example the admin group will be called ",(0,t.jsx)(n.code,{children:"CadoAdmin"}),", but you can name this as you like. Just make note of what you call this; you'll need it later"]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Okta Assignments",src:s(7303).Z+"",width:"725",height:"242"})}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["If you are looking to assign non-admin users within Cado, you can use a group name other than ",(0,t.jsx)(n.code,{children:"CadoAdmin"}),". For example: adding a group ",(0,t.jsx)(n.code,{children:"CadoNonAdmin"})," and assigning users to it will result in those users being Normal Users within Cado."]})}),"\n",(0,t.jsxs)(n.ol,{start:"8",children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["If you wish to edit access control at a later time then you can do so in the ",(0,t.jsx)(n.strong,{children:"Assignments"})," tab of the OAuth application where you can add individual people or groups. Only users in a group named ",(0,t.jsx)(n.code,{children:"CadoAdmin"})," will be granted admin user status inside the Cado platform."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Add a groups claim for the application:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Go to the ",(0,t.jsx)(n.strong,{children:"Sign On"})," tab of the OAuth application"]}),"\n",(0,t.jsxs)(n.li,{children:["Click ",(0,t.jsx)(n.strong,{children:"Edit"})," in the OpenID Connect ID Token section"]}),"\n",(0,t.jsx)(n.li,{children:"For the Issuer field specify \u201cOkta URL\u201d"}),"\n",(0,t.jsxs)(n.li,{children:["In the ",(0,t.jsx)(n.code,{children:"Groups claim type"})," field select ",(0,t.jsx)(n.strong,{children:"Filter"})]}),"\n",(0,t.jsxs)(n.li,{children:["In the ",(0,t.jsx)(n.code,{children:"Groups claim filter"})," leave its name ",(0,t.jsx)(n.strong,{children:"groups"})," and enter ",(0,t.jsx)(n.strong,{children:"Matches regex"})," ",(0,t.jsx)(n.code,{children:".*"})]}),"\n",(0,t.jsxs)(n.li,{children:["Then click ",(0,t.jsx)(n.strong,{children:"Save"})]}),"\n"]}),"\n",(0,t.jsx)(n.p,{children:(0,t.jsx)(n.img,{alt:"Okta Groups Claim",src:s(8769).Z+"",width:"696",height:"91"})}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Go to the ",(0,t.jsx)(n.strong,{children:"General settings"})," tab of the OAuth application and note down the ",(0,t.jsx)(n.code,{children:"Client ID"}),", ",(0,t.jsx)(n.code,{children:"Client Secret"})," and ",(0,t.jsx)(n.code,{children:"Okta Domain"})," settings."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Configure SSO in cado:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Open your cado instance and log in as an admin user"}),"\n",(0,t.jsxs)(n.li,{children:["Go to ",(0,t.jsx)(n.code,{children:"Settings > SSO > Okta OAuth"})]}),"\n",(0,t.jsxs)(n.li,{children:["Enter the details from step before and click update. For the domain field please add ",(0,t.jsx)(n.code,{children:"https://"})," to the beginning and ",(0,t.jsx)(n.code,{children:"/oauth2"})," to the end of the Okta domain setting. The complete Domain should be of this format: ",(0,t.jsx)(n.code,{children:"https:///oauth2"})]}),"\n",(0,t.jsxs)(n.li,{children:["In the ",(0,t.jsx)(n.code,{children:"Admin Group Name"})," enter in the value you configured in step 7"]}),"\n"]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"Log out with your existing user, and login with Okta OAuth"}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(l,{...e})}):l(e)}},7303:(e,n,s)=>{s.d(n,{Z:()=>t});const t=s.p+"assets/images/okta-assignments-3b23b5eb60b1a663656d167431a6126c.png"},8769:(e,n,s)=>{s.d(n,{Z:()=>t});const t=s.p+"assets/images/okta-groups-claim-0a2dfcb9c5c3f572132da5cdcc4ffe63.png"},1151:(e,n,s)=>{s.d(n,{Z:()=>r,a:()=>a});var t=s(7294);const i={},o=t.createContext(i);function a(e){const n=t.useContext(o);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),t.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/f694cc41.aa6090ce.js b/assets/js/f694cc41.aa6090ce.js new file mode 100644 index 000000000..77c10a84f --- /dev/null +++ b/assets/js/f694cc41.aa6090ce.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1461],{1078:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>o,default:()=>p,frontMatter:()=>r,metadata:()=>c,toc:()=>d});var i=n(5893),s=n(1151);const r={title:"Managing Projects",hide_title:!0,sidebar_position:2},o="Managing Projects",c={id:"cado-response/discovery-import/projects",title:"Managing Projects",description:"Cado groups evidence items into projects.",source:"@site/docs/cado-response/discovery-import/projects.md",sourceDirName:"cado-response/discovery-import",slug:"/cado-response/discovery-import/projects",permalink:"/cado-response/discovery-import/projects",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/projects.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"Managing Projects",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Overview",permalink:"/cado-response/discovery-import/intro"},next:{title:"Automation Rules (Beta)",permalink:"/cado-response/discovery-import/automation"}},l={},d=[{value:"Creating a Project",id:"creating-a-project",level:3},{value:"Deleting a Project",id:"deleting-a-project",level:3},{value:"Updating a Project",id:"updating-a-project",level:3},{value:"Project Processing",id:"project-processing",level:3}];function a(e){const t={admonition:"admonition",h1:"h1",h3:"h3",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(t.h1,{id:"managing-projects",children:"Managing Projects"}),"\n",(0,i.jsx)(t.p,{children:"Cado groups evidence items into projects."}),"\n",(0,i.jsx)(t.h3,{id:"creating-a-project",children:"Creating a Project"}),"\n",(0,i.jsx)(t.p,{children:"To create a new Project:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Projects"})]}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Create Project"})]}),"\n",(0,i.jsx)(t.li,{children:"Give the Project a unique name"}),"\n",(0,i.jsx)(t.li,{children:"Optionally, grant users access to the project and give it a description"}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Create"})]}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"deleting-a-project",children:"Deleting a Project"}),"\n",(0,i.jsx)(t.p,{children:"You may want to delete old projects to free up disk space. To delete a Project:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Projects"})," and select the project you would like to delete"]}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Manage"})]}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Delete Project"})]}),"\n",(0,i.jsx)(t.li,{children:"You will be asked to confirm that you would like the Project deleted"}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Delete"})]}),"\n"]}),"\n",(0,i.jsx)(t.admonition,{type:"info",children:(0,i.jsxs)(t.p,{children:["You can view free disk space by clicking on the ",(0,i.jsx)(t.strong,{children:"Platform"})," menu button."]})}),"\n",(0,i.jsx)(t.h3,{id:"updating-a-project",children:"Updating a Project"}),"\n",(0,i.jsx)(t.p,{children:"You can update a Project name and the description. To update a Project:"}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Projects"})," and select the project you would like to update"]}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Manage"})]}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Details"})]}),"\n",(0,i.jsxs)(t.li,{children:["Make your updates and click ",(0,i.jsx)(t.strong,{children:"Update"})]}),"\n"]}),"\n",(0,i.jsx)(t.h3,{id:"project-processing",children:"Project Processing"}),"\n",(0,i.jsxs)(t.p,{children:["The ",(0,i.jsx)(t.strong,{children:"Processing"})," page gives you a high level summary of the processing status of evidence items. Evidence items go through a number of different stages of analysis before they are complete. Some data, such as file listings, will be available before the processing is complete.\nTo view the Project Processing:"]}),"\n",(0,i.jsxs)(t.ul,{children:["\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Projects"})," and select the project you would like to view"]}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Manage"})]}),"\n",(0,i.jsxs)(t.li,{children:["Click ",(0,i.jsx)(t.strong,{children:"Processing"})]}),"\n"]}),"\n",(0,i.jsx)(t.p,{children:(0,i.jsx)(t.img,{alt:"Processing",src:n(1726).Z+"",width:"1292",height:"364"})}),"\n",(0,i.jsx)(t.p,{children:"Individual evidence items can be expanded to view their processing status."})]})}function p(e={}){const{wrapper:t}={...(0,s.a)(),...e.components};return t?(0,i.jsx)(t,{...e,children:(0,i.jsx)(a,{...e})}):a(e)}},1726:(e,t,n)=>{n.d(t,{Z:()=>i});const i=n.p+"assets/images/processing-4bd4cac04455083b6240d7bed5c2d07a.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>c,a:()=>o});var i=n(7294);const s={},r=i.createContext(s);function o(e){const t=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),i.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/f694cc41.c99d9c57.js b/assets/js/f694cc41.c99d9c57.js deleted file mode 100644 index dd6beb44f..000000000 --- a/assets/js/f694cc41.c99d9c57.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1461],{1078:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>p,frontMatter:()=>r,metadata:()=>c,toc:()=>d});var i=t(5893),s=t(1151);const r={title:"Managing Projects",hide_title:!0,sidebar_position:2},o="Managing Projects",c={id:"cado-response/discovery-import/projects",title:"Managing Projects",description:"Cado groups evidence items into projects.",source:"@site/docs/cado-response/discovery-import/projects.md",sourceDirName:"cado-response/discovery-import",slug:"/cado-response/discovery-import/projects",permalink:"/cado-response/discovery-import/projects",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/discovery-import/projects.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"Managing Projects",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Overview",permalink:"/cado-response/discovery-import/intro"},next:{title:"Automation Rules (Beta)",permalink:"/cado-response/discovery-import/automation"}},l={},d=[{value:"Creating a Project",id:"creating-a-project",level:3},{value:"Deleting a Project",id:"deleting-a-project",level:3},{value:"Updating a Project",id:"updating-a-project",level:3},{value:"Project Processing",id:"project-processing",level:3}];function a(e){const n={admonition:"admonition",h1:"h1",h3:"h3",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h1,{id:"managing-projects",children:"Managing Projects"}),"\n",(0,i.jsx)(n.p,{children:"Cado groups evidence items into projects."}),"\n",(0,i.jsx)(n.h3,{id:"creating-a-project",children:"Creating a Project"}),"\n",(0,i.jsx)(n.p,{children:"To create a new Project:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Projects"})]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Create Project"})]}),"\n",(0,i.jsx)(n.li,{children:"Give the Project a unique name"}),"\n",(0,i.jsx)(n.li,{children:"Optionally, grant users access to the project and give it a description"}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Create"})]}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"deleting-a-project",children:"Deleting a Project"}),"\n",(0,i.jsx)(n.p,{children:"You may want to delete old projects to free up disk space. To delete a Project:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Projects"})," and select the project you would like to delete"]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Manage"})]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Delete Project"})]}),"\n",(0,i.jsx)(n.li,{children:"You will be asked to confirm that you would like the Project deleted"}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Delete"})]}),"\n"]}),"\n",(0,i.jsx)(n.admonition,{type:"info",children:(0,i.jsxs)(n.p,{children:["You can view free disk space by clicking on the ",(0,i.jsx)(n.strong,{children:"Platform"})," menu button."]})}),"\n",(0,i.jsx)(n.h3,{id:"updating-a-project",children:"Updating a Project"}),"\n",(0,i.jsx)(n.p,{children:"You can update a Project name and the description. To update a Project:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Projects"})," and select the project you would like to update"]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Manage"})]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Details"})]}),"\n",(0,i.jsxs)(n.li,{children:["Make your updates and click ",(0,i.jsx)(n.strong,{children:"Update"})]}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"project-processing",children:"Project Processing"}),"\n",(0,i.jsxs)(n.p,{children:["The ",(0,i.jsx)(n.strong,{children:"Processing"})," page gives you a high level summary of the processing status of evidence items. Evidence items go through a number of different stages of analysis before they are complete. Some data, such as file listings, will be available before the processing is complete.\nTo view the Project Processing:"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Projects"})," and select the project you would like to view"]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Manage"})]}),"\n",(0,i.jsxs)(n.li,{children:["Click ",(0,i.jsx)(n.strong,{children:"Processing"})]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.img,{alt:"Processing",src:t(1726).Z+"",width:"1292",height:"364"})}),"\n",(0,i.jsx)(n.p,{children:"Individual evidence items can be expanded to view their processing status."})]})}function p(e={}){const{wrapper:n}={...(0,s.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(a,{...e})}):a(e)}},1726:(e,n,t)=>{t.d(n,{Z:()=>i});const i=t.p+"assets/images/processing-4bd4cac04455083b6240d7bed5c2d07a.png"},1151:(e,n,t)=>{t.d(n,{Z:()=>c,a:()=>o});var i=t(7294);const s={},r=i.createContext(s);function o(e){const n=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),i.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/fd860755.06d8865f.js b/assets/js/fd860755.06d8865f.js deleted file mode 100644 index c6c9b516d..000000000 --- a/assets/js/fd860755.06d8865f.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6460],{9890:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>d,frontMatter:()=>i,metadata:()=>s,toc:()=>c});var o=n(5893),r=n(1151);const i={title:"Community Edition EULA",hide_title:!0,sidebar_position:2},a="DOCUMENT B",s={id:"eula/community-eula",title:"Community Edition EULA",description:"FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, DOCUMENT A - END USER LICENSE AGREEMENT SHALL APPLY.",source:"@site/docs/eula/community-eula.md",sourceDirName:"eula",slug:"/eula/community-eula",permalink:"/eula/community-eula",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/eula/community-eula.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:2,frontMatter:{title:"Community Edition EULA",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Commercial EULA",permalink:"/eula/commercial-eula"},next:{title:"Sep 23 2022 - AWS Role Update",permalink:"/support-bulletins/role-update"}},l={},c=[{value:"Community Edition License Agreement",id:"community-edition-license-agreement",level:2}];function h(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",hr:"hr",li:"li",ol:"ol",p:"p",strong:"strong",...(0,r.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"document-b",children:"DOCUMENT B"}),"\n",(0,o.jsxs)(t.admonition,{type:"info",children:[(0,o.jsxs)(t.p,{children:["FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, ",(0,o.jsx)(t.a,{href:"/eula/commercial-eula#end-user-license-agreement",children:(0,o.jsx)(t.strong,{children:"DOCUMENT A - END USER LICENSE AGREEMENT"})})," SHALL APPLY."]}),(0,o.jsxs)(t.p,{children:["FOR ALL COMMUNITY EDITION USERS OF CADO SOFTWARE, ",(0,o.jsx)(t.a,{href:"/eula/community-eula#community-edition-license-agreement",children:(0,o.jsx)(t.strong,{children:"DOCUMENT B - COMMUNITY EDITION LICENSE AGREEMENT"})})," SHALL APPLY."]})]}),"\n",(0,o.jsx)(t.hr,{}),"\n",(0,o.jsx)(t.h2,{id:"community-edition-license-agreement",children:"Community Edition License Agreement"}),"\n",(0,o.jsx)(t.p,{children:'IMPORTANT \u2013 READ THIS COMMUNITY EDITION LICENSE AGREEMENT (\u201cAGREEMENT\u201d) BEFORE AGREEING TO USE THE SOFTWARE. BY PROCEEDING, YOU ACKNOWLEDGE THAT YOU HAVE READ AND AGREE TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT WITH CADO SECURITY LIMITED. IF YOU DO NOT AGREE WITH THE TERMS AND CONDITIONS OF THIS AGREEMENT DO NOT PROCEED WITH ANY INSTALLATION AND/OR USE OF THE SOFTWARE. THE DATE THAT YOU AGREE TO BE BOUND BY THIS AGREEMENT BY INSTALLATION AND/OR USE IS THE "EFFECTIVE DATE."'}),"\n",(0,o.jsx)(t.p,{children:'This Community Edition License Agreement governs use of the Software (as defined below) provided by Cado Security Limited, or its subsidiaries or affiliates (collectively, the \u201cCompany\u201d). This Agreement sets out the terms on which Company makes the Software available to you ("You\u201d or \u201cYour\u201d).'}),"\n",(0,o.jsxs)(t.ol,{children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Grant of Rights; Reservation of Rights."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Subject to Your acceptance and compliance with the terms and conditions of this Agreement Company grants You a limited, non-sublicensable, non-exclusive, non-transferable revocable right to access, install, download and use the Software (as defined below) in object code form only, exclusively within Your cloud based environment, for internal and non-commercial purposes only."}),"\n",(0,o.jsxs)(t.ol,{start:"2",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Restrictions."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"You may not:"}),"\n",(0,o.jsx)(t.p,{children:"copy the Software or any part of it, except as expressly permitted in this Agreement;\nrent, sell, lease, sublicense, distribute, pledge, assign or otherwise transfer, or commercially exploit, or encumber rights to, the Software or any part of it in any manner or for any purpose, or make the Software available for use by any third party in any manner including provide commercial hosting services, time-sharing, service bureau;\naccess the Software for the purpose of building a competitive product or service or copying its features or user interface;\nremove, delete, obscure, alter or add to any copyright or proprietary notices appearing within the Software;\ndisassemble, decrypt, extract, reverse engineer or reverse compile the Software, or otherwise attempt to discover the confidential algorithms and techniques incorporated in the Software, or disclose or use any confidential information of Company in any manner, other than to the extent such actions cannot be prohibited under applicable law;\nmodify, translate, adapt, or create derivative works from the Software; or\nobtain or have access to the source code or systems and programming documentation of the Software or any part thereof."}),"\n",(0,o.jsxs)(t.ol,{start:"3",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Proprietary Rights."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"The Cado Security software including any (a) software that the Company uses to make the Software available; and (b) any published documentation that Company generally makes available to its customers (\u201cDocumentation\u201d) (collectively, the \u201cSoftware\u201d), is subject to the protection of copyright laws, which prohibit unauthorized copying and distribution of copyrighted works. The Software incorporates Company\u2019s proprietary and confidential algorithms and techniques that are subject to legal protection as know-how and trade secrets. All right, title and interest to any intellectual property rights included but not limited to patents, copyright works, know how, trade secrets and trademarks in the Software are owned by the Company."}),"\n",(0,o.jsxs)(t.ol,{start:"4",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Support; Compliance."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"You are solely responsible for installing any updates and modifications that the Company may make available from time to time. Company will only support the most recent version of the Software. Company may, at any time, with or without notice, inspect Your use of the Software to verify compliance with this Agreement."}),"\n",(0,o.jsxs)(t.ol,{start:"5",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Data."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Company may collect, process, aggregate, and use certain information, analysis, statistics, and other data generated by Your use of the Software (a) to confirm that the Software is being used in accordance with the rights granted under this Agreement, and (b) to drive improvements in the Software, and Company will retain ownership of such Software use data. Company agrees not to publish any of this information in a form that identifies You or any User. In the event Company processes personal data as a processor, such personal data will be processed by Company in accordance with applicable data protection laws."}),"\n",(0,o.jsxs)(t.ol,{start:"6",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Community Edition Slack Channel."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"In connection with Your use of the Software, the Company may automatically register you in a Cado Community Edition Slack collaboration space. Company reserves the right to refuse entry and/or remove Your access at any time. You remain responsible at all times for Your behavior and any content posted. You agree to accept and observe Slack's terms of use at all times. Company has a zero tolerance policy for any illegal, illicit, defamatory, derogatory behavior or content and reserves the right to report any such violation to Slack and/or to the appropriate authorities."}),"\n",(0,o.jsxs)(t.ol,{start:"7",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Term; Termination."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Company may terminate this Agreement and all rights granted herein at any time, with or without cause. The term of this Agreement and Your right to use the Software will automatically terminate without notice in the event of any failure by You to comply with any of the above restrictions or any term of this Agreement. Upon expiration or earlier termination of this Agreement, You will cease using the Software and expunge and destroy all copies of the Software in Your possession. All provisions of this Agreement intended by their nature will survive termination."}),"\n",(0,o.jsxs)(t.ol,{start:"8",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Warranty and Disclaimer."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Each party warrants to the other that it has the required authority to enter into this Agreement. YOU AGREE THAT COMPANY AND ITS LICENSORS PROVIDE THE SOFTWARE ON AN \u201cAS IS\u201d AND \u201cWHERE-AS\u201d BASIS. NEITHER COMPANY NOR ITS LICENSORS MAKE ANY WARRANTIES WITH RESPECT TO THE PERFORMANCE OF THE SOFTWARE, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, AND COMPANY AND ITS LICENSORS EXPRESSLY DISCLAIM ALL OTHER WARRANTIES, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF NON-INFRINGEMENT OF THIRD PARTY RIGHTS, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE."}),"\n",(0,o.jsxs)(t.ol,{start:"9",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Limitation of Liability."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"In no event will Company be liable under or in connection with this Agreement for (a) any lost profits, loss of revenue, loss of business, loss of contract, loss of goodwill or loss of anticipated savings (whether direct or indirect); (b) error or interruption of use, loss or inaccuracy or corruption of data; or (c) any incidental, special, punitive, exemplary, indirect or consequential damages, arising out of or related to the Software, or the use thereof, even if Company has been advised, or is otherwise aware, of the possibility of such damages. The aggregate liability of Company under or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, in respect of any and all claims, will not exceed $100 USD."}),"\n",(0,o.jsxs)(t.ol,{start:"10",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Intellectual Property Rights."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"As between You and Company, all right, title and interest in and to the Software and Company\u2019s trademarks and service marks are owned exclusively by Company and its licensors. Other than as expressly set forth in this Agreement, no license or other rights in or to the Software thereto are granted to You, and all such licenses and rights are hereby expressly reserved."}),"\n",(0,o.jsxs)(t.ol,{start:"11",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Miscellaneous."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"This Agreement does not create any agency or partnership relationship between the parties\nhereto. This Agreement, and any dispute arising out of or in connection with it or its subject matter, whether of\na contractual or non-contractual nature, shall be governed by and construed in accordance with the laws of\nDelaware (if You are located in the United States), or England (if You are located outside of the United States).\nThe sole and exclusive jurisdiction and venue for any litigation arising out of this Agreement shall be the courts\nof Delaware (if You are located in the United States), or England (if You are located outside of the United\nStates). This Agreement constitutes the entire agreement between the parties with respect to the subject\nmatter hereof and supersedes all prior agreements and understandings whether written or oral, express or\nimplied. If any provision of this Agreement is held invalid, illegal or unenforceable by a court of competent\njurisdiction, such shall not affect any other provision of this Agreement, which shall remain in full force and\neffect. No amendment or alteration of the terms of this Agreement shall be effective unless made in writing and\nexecuted by Company. A failure or delay in exercising any right in respect to this Agreement will not be\npresumed to operate as a waiver, and a single or partial exercise of any right will not be presumed to preclude\nany subsequent or further exercise of that right or the exercise of any other right."})]})}function d(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(h,{...e})}):h(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>s,a:()=>a});var o=n(7294);const r={},i=o.createContext(r);function a(e){const t=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),o.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/fd860755.efd8f66b.js b/assets/js/fd860755.efd8f66b.js new file mode 100644 index 000000000..d476a3a7f --- /dev/null +++ b/assets/js/fd860755.efd8f66b.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[6460],{9890:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>d,frontMatter:()=>i,metadata:()=>s,toc:()=>c});var o=n(5893),r=n(1151);const i={title:"Community Edition EULA",hide_title:!0,sidebar_position:2},a="DOCUMENT B",s={id:"eula/community-eula",title:"Community Edition EULA",description:"FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, DOCUMENT A - END USER LICENSE AGREEMENT SHALL APPLY.",source:"@site/docs/eula/community-eula.md",sourceDirName:"eula",slug:"/eula/community-eula",permalink:"/eula/community-eula",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/eula/community-eula.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:2,frontMatter:{title:"Community Edition EULA",hide_title:!0,sidebar_position:2},sidebar:"tutorialSidebar",previous:{title:"Commercial EULA",permalink:"/eula/commercial-eula"},next:{title:"Sep 23 2022 - AWS Role Update",permalink:"/support-bulletins/role-update"}},l={},c=[{value:"Community Edition License Agreement",id:"community-edition-license-agreement",level:2}];function h(e){const t={a:"a",admonition:"admonition",h1:"h1",h2:"h2",hr:"hr",li:"li",ol:"ol",p:"p",strong:"strong",...(0,r.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{id:"document-b",children:"DOCUMENT B"}),"\n",(0,o.jsxs)(t.admonition,{type:"info",children:[(0,o.jsxs)(t.p,{children:["FOR ALL COMMERCIAL CUSTOMERS AND USERS OF CADO SOFTWARE, ",(0,o.jsx)(t.a,{href:"/eula/commercial-eula#end-user-license-agreement",children:(0,o.jsx)(t.strong,{children:"DOCUMENT A - END USER LICENSE AGREEMENT"})})," SHALL APPLY."]}),(0,o.jsxs)(t.p,{children:["FOR ALL COMMUNITY EDITION USERS OF CADO SOFTWARE, ",(0,o.jsx)(t.a,{href:"/eula/community-eula#community-edition-license-agreement",children:(0,o.jsx)(t.strong,{children:"DOCUMENT B - COMMUNITY EDITION LICENSE AGREEMENT"})})," SHALL APPLY."]})]}),"\n",(0,o.jsx)(t.hr,{}),"\n",(0,o.jsx)(t.h2,{id:"community-edition-license-agreement",children:"Community Edition License Agreement"}),"\n",(0,o.jsx)(t.p,{children:'IMPORTANT \u2013 READ THIS COMMUNITY EDITION LICENSE AGREEMENT (\u201cAGREEMENT\u201d) BEFORE AGREEING TO USE THE SOFTWARE. BY PROCEEDING, YOU ACKNOWLEDGE THAT YOU HAVE READ AND AGREE TO ALL THE TERMS AND CONDITIONS OF THIS AGREEMENT WITH CADO SECURITY LIMITED. IF YOU DO NOT AGREE WITH THE TERMS AND CONDITIONS OF THIS AGREEMENT DO NOT PROCEED WITH ANY INSTALLATION AND/OR USE OF THE SOFTWARE. THE DATE THAT YOU AGREE TO BE BOUND BY THIS AGREEMENT BY INSTALLATION AND/OR USE IS THE "EFFECTIVE DATE."'}),"\n",(0,o.jsx)(t.p,{children:'This Community Edition License Agreement governs use of the Software (as defined below) provided by Cado Security Limited, or its subsidiaries or affiliates (collectively, the \u201cCompany\u201d). This Agreement sets out the terms on which Company makes the Software available to you ("You\u201d or \u201cYour\u201d).'}),"\n",(0,o.jsxs)(t.ol,{children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Grant of Rights; Reservation of Rights."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Subject to Your acceptance and compliance with the terms and conditions of this Agreement Company grants You a limited, non-sublicensable, non-exclusive, non-transferable revocable right to access, install, download and use the Software (as defined below) in object code form only, exclusively within Your cloud based environment, for internal and non-commercial purposes only."}),"\n",(0,o.jsxs)(t.ol,{start:"2",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Restrictions."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"You may not:"}),"\n",(0,o.jsx)(t.p,{children:"copy the Software or any part of it, except as expressly permitted in this Agreement;\nrent, sell, lease, sublicense, distribute, pledge, assign or otherwise transfer, or commercially exploit, or encumber rights to, the Software or any part of it in any manner or for any purpose, or make the Software available for use by any third party in any manner including provide commercial hosting services, time-sharing, service bureau;\naccess the Software for the purpose of building a competitive product or service or copying its features or user interface;\nremove, delete, obscure, alter or add to any copyright or proprietary notices appearing within the Software;\ndisassemble, decrypt, extract, reverse engineer or reverse compile the Software, or otherwise attempt to discover the confidential algorithms and techniques incorporated in the Software, or disclose or use any confidential information of Company in any manner, other than to the extent such actions cannot be prohibited under applicable law;\nmodify, translate, adapt, or create derivative works from the Software; or\nobtain or have access to the source code or systems and programming documentation of the Software or any part thereof."}),"\n",(0,o.jsxs)(t.ol,{start:"3",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Proprietary Rights."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"The Cado Security software including any (a) software that the Company uses to make the Software available; and (b) any published documentation that Company generally makes available to its customers (\u201cDocumentation\u201d) (collectively, the \u201cSoftware\u201d), is subject to the protection of copyright laws, which prohibit unauthorized copying and distribution of copyrighted works. The Software incorporates Company\u2019s proprietary and confidential algorithms and techniques that are subject to legal protection as know-how and trade secrets. All right, title and interest to any intellectual property rights included but not limited to patents, copyright works, know how, trade secrets and trademarks in the Software are owned by the Company."}),"\n",(0,o.jsxs)(t.ol,{start:"4",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Support; Compliance."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"You are solely responsible for installing any updates and modifications that the Company may make available from time to time. Company will only support the most recent version of the Software. Company may, at any time, with or without notice, inspect Your use of the Software to verify compliance with this Agreement."}),"\n",(0,o.jsxs)(t.ol,{start:"5",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Data."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Company may collect, process, aggregate, and use certain information, analysis, statistics, and other data generated by Your use of the Software (a) to confirm that the Software is being used in accordance with the rights granted under this Agreement, and (b) to drive improvements in the Software, and Company will retain ownership of such Software use data. Company agrees not to publish any of this information in a form that identifies You or any User. In the event Company processes personal data as a processor, such personal data will be processed by Company in accordance with applicable data protection laws."}),"\n",(0,o.jsxs)(t.ol,{start:"6",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Community Edition Slack Channel."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"In connection with Your use of the Software, the Company may automatically register you in a Cado Community Edition Slack collaboration space. Company reserves the right to refuse entry and/or remove Your access at any time. You remain responsible at all times for Your behavior and any content posted. You agree to accept and observe Slack's terms of use at all times. Company has a zero tolerance policy for any illegal, illicit, defamatory, derogatory behavior or content and reserves the right to report any such violation to Slack and/or to the appropriate authorities."}),"\n",(0,o.jsxs)(t.ol,{start:"7",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Term; Termination."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Company may terminate this Agreement and all rights granted herein at any time, with or without cause. The term of this Agreement and Your right to use the Software will automatically terminate without notice in the event of any failure by You to comply with any of the above restrictions or any term of this Agreement. Upon expiration or earlier termination of this Agreement, You will cease using the Software and expunge and destroy all copies of the Software in Your possession. All provisions of this Agreement intended by their nature will survive termination."}),"\n",(0,o.jsxs)(t.ol,{start:"8",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Warranty and Disclaimer."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"Each party warrants to the other that it has the required authority to enter into this Agreement. YOU AGREE THAT COMPANY AND ITS LICENSORS PROVIDE THE SOFTWARE ON AN \u201cAS IS\u201d AND \u201cWHERE-AS\u201d BASIS. NEITHER COMPANY NOR ITS LICENSORS MAKE ANY WARRANTIES WITH RESPECT TO THE PERFORMANCE OF THE SOFTWARE, WHETHER EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, AND COMPANY AND ITS LICENSORS EXPRESSLY DISCLAIM ALL OTHER WARRANTIES, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF NON-INFRINGEMENT OF THIRD PARTY RIGHTS, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE."}),"\n",(0,o.jsxs)(t.ol,{start:"9",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Limitation of Liability."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"In no event will Company be liable under or in connection with this Agreement for (a) any lost profits, loss of revenue, loss of business, loss of contract, loss of goodwill or loss of anticipated savings (whether direct or indirect); (b) error or interruption of use, loss or inaccuracy or corruption of data; or (c) any incidental, special, punitive, exemplary, indirect or consequential damages, arising out of or related to the Software, or the use thereof, even if Company has been advised, or is otherwise aware, of the possibility of such damages. The aggregate liability of Company under or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise, in respect of any and all claims, will not exceed $100 USD."}),"\n",(0,o.jsxs)(t.ol,{start:"10",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Intellectual Property Rights."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"As between You and Company, all right, title and interest in and to the Software and Company\u2019s trademarks and service marks are owned exclusively by Company and its licensors. Other than as expressly set forth in this Agreement, no license or other rights in or to the Software thereto are granted to You, and all such licenses and rights are hereby expressly reserved."}),"\n",(0,o.jsxs)(t.ol,{start:"11",children:["\n",(0,o.jsx)(t.li,{children:(0,o.jsx)(t.strong,{children:"Miscellaneous."})}),"\n"]}),"\n",(0,o.jsx)(t.p,{children:"This Agreement does not create any agency or partnership relationship between the parties\nhereto. This Agreement, and any dispute arising out of or in connection with it or its subject matter, whether of\na contractual or non-contractual nature, shall be governed by and construed in accordance with the laws of\nDelaware (if You are located in the United States), or England (if You are located outside of the United States).\nThe sole and exclusive jurisdiction and venue for any litigation arising out of this Agreement shall be the courts\nof Delaware (if You are located in the United States), or England (if You are located outside of the United\nStates). This Agreement constitutes the entire agreement between the parties with respect to the subject\nmatter hereof and supersedes all prior agreements and understandings whether written or oral, express or\nimplied. If any provision of this Agreement is held invalid, illegal or unenforceable by a court of competent\njurisdiction, such shall not affect any other provision of this Agreement, which shall remain in full force and\neffect. No amendment or alteration of the terms of this Agreement shall be effective unless made in writing and\nexecuted by Company. A failure or delay in exercising any right in respect to this Agreement will not be\npresumed to operate as a waiver, and a single or partial exercise of any right will not be presumed to preclude\nany subsequent or further exercise of that right or the exercise of any other right."})]})}function d(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(h,{...e})}):h(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>s,a:()=>a});var o=n(7294);const r={},i=o.createContext(r);function a(e){const t=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function s(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),o.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/fe10be31.159ce809.js b/assets/js/fe10be31.159ce809.js deleted file mode 100644 index e52ca3930..000000000 --- a/assets/js/fe10be31.159ce809.js +++ /dev/null @@ -1 +0,0 @@ -"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1961],{4455:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>l,frontMatter:()=>o,metadata:()=>a,toc:()=>d});var s=n(5893),i=n(1151);const o={title:"Network",hide_title:!0,sidebar_position:7},r="Network",a={id:"cado-response/investigate/network",title:"Network",description:"This tab shows connections between systems identified in processed evidence and the number of timeline events associated with them",source:"@site/docs/cado-response/investigate/network.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/network",permalink:"/cado-response/investigate/network",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/network.md",tags:[],version:"current",lastUpdatedAt:1706709910,formattedLastUpdatedAt:"Jan 31, 2024",sidebarPosition:7,frontMatter:{title:"Network",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Indicators",permalink:"/cado-response/investigate/indicators"},next:{title:"Detections",permalink:"/cado-response/investigate/detections"}},c={},d=[];function p(e){const t={h1:"h1",img:"img",p:"p",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"network",children:"Network"}),"\n",(0,s.jsx)(t.p,{children:"This tab shows connections between systems identified in processed evidence and the number of timeline events associated with them"}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Network",src:n(4049).Z+"",width:"943",height:"496"})})]})}function l(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(p,{...e})}):p(e)}},4049:(e,t,n)=>{n.d(t,{Z:()=>s});const s=n.p+"assets/images/network-abeb04e5574620194ebd1f7efabc5724.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>a,a:()=>r});var s=n(7294);const i={},o=s.createContext(i);function r(e){const t=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),s.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/fe10be31.b9107d73.js b/assets/js/fe10be31.b9107d73.js new file mode 100644 index 000000000..93aaf8297 --- /dev/null +++ b/assets/js/fe10be31.b9107d73.js @@ -0,0 +1 @@ +"use strict";(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[1961],{4455:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>r,default:()=>l,frontMatter:()=>o,metadata:()=>a,toc:()=>d});var s=n(5893),i=n(1151);const o={title:"Network",hide_title:!0,sidebar_position:7},r="Network",a={id:"cado-response/investigate/network",title:"Network",description:"This tab shows connections between systems identified in processed evidence and the number of timeline events associated with them",source:"@site/docs/cado-response/investigate/network.md",sourceDirName:"cado-response/investigate",slug:"/cado-response/investigate/network",permalink:"/cado-response/investigate/network",draft:!1,unlisted:!1,editUrl:"https://github.com/cado-security/product-help/tree/master/docs/cado-response/investigate/network.md",tags:[],version:"current",lastUpdatedAt:1706971022,formattedLastUpdatedAt:"Feb 3, 2024",sidebarPosition:7,frontMatter:{title:"Network",hide_title:!0,sidebar_position:7},sidebar:"tutorialSidebar",previous:{title:"Indicators",permalink:"/cado-response/investigate/indicators"},next:{title:"Detections",permalink:"/cado-response/investigate/detections"}},c={},d=[];function p(e){const t={h1:"h1",img:"img",p:"p",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.h1,{id:"network",children:"Network"}),"\n",(0,s.jsx)(t.p,{children:"This tab shows connections between systems identified in processed evidence and the number of timeline events associated with them"}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.img,{alt:"Network",src:n(4049).Z+"",width:"943",height:"496"})})]})}function l(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(p,{...e})}):p(e)}},4049:(e,t,n)=>{n.d(t,{Z:()=>s});const s=n.p+"assets/images/network-abeb04e5574620194ebd1f7efabc5724.png"},1151:(e,t,n)=>{n.d(t,{Z:()=>a,a:()=>r});var s=n(7294);const i={},o=s.createContext(i);function r(e){const t=s.useContext(o);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),s.createElement(o.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/main.0577c4aa.js b/assets/js/main.0577c4aa.js new file mode 100644 index 000000000..01a826527 --- /dev/null +++ b/assets/js/main.0577c4aa.js @@ -0,0 +1,2 @@ +/*! For license information please see main.0577c4aa.js.LICENSE.txt */ +(self.webpackChunkproduct_help=self.webpackChunkproduct_help||[]).push([[179],{997:(e,t,n)=>{"use strict";n.d(t,{Z:()=>p});n(7294);var r=n(8356),o=n.n(r),a=n(6887);const i={"028717eb":[()=>n.e(5036).then(n.bind(n,3200)),"@site/docs/cado-response/manage/licenses.md",3200],"03a24dd5":[()=>n.e(6683).then(n.bind(n,9333)),"@site/docs/cado-response/investigate/automated-investigation.md",9333],"03e97922":[()=>n.e(2427).then(n.bind(n,2426)),"@site/docs/cado-response/investigate/key-events.md",2426],"0718c59c":[()=>n.e(170).then(n.bind(n,2698)),"@site/docs/cado-response/deploy/gcp/gcp-cross-project.md",2698],"0a48197e":[()=>n.e(2891).then(n.bind(n,9134)),"@site/docs/cado-response/deploy/aws/networking/internet-routable-addresses.md",9134],"0b3c7d72":[()=>n.e(990).then(n.bind(n,958)),"@site/docs/cado-response/community-edition/intro.md",958],"0d8bf183":[()=>n.e(354).then(n.bind(n,5791)),"@site/docs/cado-response/manage/integrations/xdr/crowdstrike.md",5791],"13c5f577":[()=>n.e(8403).then(n.bind(n,9014)),"@site/docs/cado-response/discovery-import/import/oracle/virtual-machine.md",9014],"176bafeb":[()=>n.e(4442).then(n.bind(n,1297)),"@site/docs/cado-response/manage/integrations/webhooks.md",1297],17896441:[()=>Promise.all([n.e(532),n.e(7918)]).then(n.bind(n,5075)),"@theme/DocItem",5075],"1a958a62":[()=>n.e(7017).then(n.bind(n,1978)),"@site/docs/cado-response/discovery-import/readiness.md",1978],"22183dc2":[()=>n.e(1186).then(n.bind(n,2991)),"@site/docs/cado-response/manage/integrations/siem.md",2991],"22b9ab39":[()=>n.e(10).then(n.bind(n,8086)),"@site/docs/cado-response/discovery-import/import/openshift/openshift.md",8086],"29faa1db":[()=>n.e(7618).then(n.bind(n,9)),"@site/docs/cado-response/discovery-import/import/aws/aws-s3.md",9],"2d5956c8":[()=>n.e(703).then(n.t.bind(n,5745,19)),"/home/runner/work/product-help/product-help/.docusaurus/docusaurus-plugin-content-pages/default/plugin-route-context-module-100.json",5745],"34fa7a81":[()=>n.e(4368).then(n.bind(n,3201)),"@site/docs/cado-response/manage/integrations/aws-lambda.md",3201],"3c595458":[()=>n.e(7605).then(n.bind(n,1525)),"@site/docs/cado-response/manage/users-authentication/sso/ping_saml.md",1525],"3f319406":[()=>n.e(9497).then(n.t.bind(n,3769,19)),"/home/runner/work/product-help/product-help/.docusaurus/docusaurus-plugin-content-docs/default/plugin-route-context-module-100.json",3769],"40e7ab60":[()=>n.e(4692).then(n.bind(n,4474)),"@site/docs/cado-response/discovery-import/import/aws/aws-ecs.md",4474],"41db3c92":[()=>n.e(449).then(n.bind(n,1190)),"@site/docs/cado-response/deploy/gcp/gcp-auto-setup.md",1190],"42a8c3d6":[()=>n.e(9188).then(n.bind(n,7068)),"@site/docs/cado-response/investigate/evidence.md",7068],"4302dc3e":[()=>n.e(2309).then(n.bind(n,1939)),"@site/docs/cado-response/discovery-import/import/azure/azure-aks.md",1939],"465ec75b":[()=>n.e(4808).then(n.bind(n,1148)),"@site/docs/cado-response/discovery-import/import/data-types/filetypes.md",1148],"4745e9e4":[()=>n.e(8935).then(n.bind(n,6347)),"@site/docs/release-notes/release-notes.md",6347],"49bed03d":[()=>n.e(1432).then(n.bind(n,140)),"@site/docs/cado-response/manage/integrations/xdr/sentinelone.md",140],"4b19fcdc":[()=>n.e(5971).then(n.bind(n,5337)),"@site/docs/cado-host/azure-credentials.md",5337],"4b281177":[()=>n.e(444).then(n.bind(n,402)),"@site/docs/cado-response/deploy/aws/logging.md",402],"4c34ab8e":[()=>n.e(9280).then(n.bind(n,7493)),"@site/docs/cado-response/deploy/aws/data-encryption/data-encryption-overview.md",7493],"4dd9ac21":[()=>n.e(9715).then(n.bind(n,4242)),"@site/docs/cado-response/manage/data.md",4242],55865376:[()=>n.e(8669).then(n.bind(n,6270)),"@site/docs/eula/commercial-eula.md",6270],"56c19fd2":[()=>n.e(5339).then(n.bind(n,5576)),"@site/docs/troubleshooting/faq.md",5576],"587867c6":[()=>n.e(3142).then(n.bind(n,5604)),"@site/docs/cado-response/discovery-import/import/aws/memory.md",5604],"58f8757e":[()=>n.e(7305).then(n.bind(n,6104)),"@site/docs/cado-response/discovery-import/import/aws/aws-ec2.md",6104],"5a1b009a":[()=>n.e(8320).then(n.bind(n,4776)),"@site/docs/cado-host/artifacts.md",4776],"5b106f4a":[()=>n.e(4827).then(n.bind(n,2261)),"@site/docs/cado-response/manage/monitoring.md",2261],"5cd525ef":[()=>n.e(7997).then(n.bind(n,4166)),"@site/docs/cado-response/key-concepts.md",4166],"5d9d5fe7":[()=>n.e(7245).then(n.bind(n,8011)),"@site/docs/cado-response/intro.md",8011],"5e95c892":[()=>n.e(9661).then(n.bind(n,4942)),"@theme/DocsRoot",4942],"5e9f5e1a":[()=>Promise.resolve().then(n.bind(n,6809)),"@generated/docusaurus.config",6809],"60efa465":[()=>n.e(745).then(n.bind(n,956)),"@site/docs/cado-response/deploy/aws/iam/deployment-iam-considerations.md",956],"6408d69a":[()=>n.e(1619).then(n.bind(n,116)),"@site/docs/cado-response/discovery-import/import/import-from-cloud.md",116],"6c7fca99":[()=>n.e(2376).then(n.bind(n,1424)),"@site/docs/cado-response/investigate/detections.md",1424],"706d580c":[()=>n.e(3474).then(n.bind(n,1366)),"@site/docs/cado-response/discovery-import/import/aws/aws-lightsail.md",1366],"73b7c9ed":[()=>n.e(7688).then(n.bind(n,2137)),"@site/docs/cado-response/investigate/intro.md",2137],75771170:[()=>n.e(9615).then(n.bind(n,8561)),"@site/docs/cado-host/google-credentials.md",8561],"77ebc470":[()=>n.e(4514).then(n.bind(n,7975)),"@site/docs/cado-response/manage/logging-in.md",7975],"7aefa8e1":[()=>n.e(4084).then(n.bind(n,9730)),"@site/docs/cado-response/deploy/gcp/gcp-settings.md",9730],"7e4ce108":[()=>n.e(2666).then(n.bind(n,4282)),"@site/docs/cado-response/manage/integrations/sandbox/intelix.md",4282],"88d214b7":[()=>n.e(8387).then(n.bind(n,8944)),"@site/docs/cado-response/manage/integrations/soar/cortex-xsoar.md",8944],"8cbd68b3":[()=>n.e(2978).then(n.bind(n,173)),"@site/docs/cado-response/deploy/gcp/gcp-deploy.md",173],"90eb2a60":[()=>n.e(9609).then(n.bind(n,6e3)),"@site/docs/cado-host/intro.md",6e3],"9256c05a":[()=>n.e(1084).then(n.bind(n,3988)),"@site/docs/cado-response/investigate/browse-disk.md",3988],"93485a32":[()=>n.e(3002).then(n.bind(n,8267)),"@site/docs/cado-response/discovery-import/import/aws/aws-lambda.md",8267],"935f2afb":[()=>n.e(53).then(n.t.bind(n,1109,19)),"~docs/default/version-current-metadata-prop-751.json",1109],96218945:[()=>n.e(7715).then(n.bind(n,1717)),"@site/docs/cado-response/export/intro.md",1717],"97af6bc6":[()=>n.e(8399).then(n.bind(n,5915)),"@site/docs/cado-response/manage/workers.md",5915],"9bdcf68b":[()=>n.e(7721).then(n.bind(n,5617)),"@site/docs/cado-response/investigate/indicators.md",5617],"9e607239":[()=>n.e(4877).then(n.bind(n,3137)),"@site/docs/cado-response/deploy/aws/overview.md",3137],a47ab00a:[()=>n.e(572).then(n.bind(n,2861)),"@site/docs/cado-response/deploy/aws/performance-resiliency/aws-backups.md",2861],a739b8a8:[()=>n.e(3698).then(n.bind(n,8147)),"@site/docs/cado-response/deploy/azure/azure-cross-tenancy-subscriptions.md",8147],a7bd4aaa:[()=>n.e(8518).then(n.bind(n,604)),"@theme/DocVersionRoot",604],a86077fa:[()=>n.e(4858).then(n.bind(n,4913)),"@site/docs/cado-response/manage/users-authentication/sso/azure-ad.md",4913],a94703ab:[()=>Promise.all([n.e(532),n.e(7107)]).then(n.bind(n,163)),"@theme/DocRoot",163],aa26b973:[()=>n.e(7214).then(n.bind(n,2092)),"@site/docs/cado-host/deploy.md",2092],aa6d861f:[()=>n.e(5185).then(n.bind(n,9257)),"@site/docs/cado-response/manage/integrations/soar/splunk-soar.md",9257],b038dc2c:[()=>n.e(2616).then(n.bind(n,489)),"@site/docs/cado-response/investigate/timeline-search.md",489],b309980d:[()=>n.e(3622).then(n.bind(n,1130)),"@site/docs/cado-response/discovery-import/import/gcp/kubernetes-engine.md",1130],b4399082:[()=>n.e(6272).then(n.bind(n,8488)),"@site/docs/cado-response/discovery-import/import/azure/azure-storage.md",8488],b4ca64e0:[()=>n.e(5e3).then(n.bind(n,9495)),"@site/docs/cado-response/deploy/aws/iam/tightening-iam.md",9495],b6cd3a1b:[()=>n.e(1886).then(n.bind(n,2629)),"@site/docs/cado-response/discovery-import/intro.md",2629],ba4c554d:[()=>n.e(8701).then(n.bind(n,7101)),"@site/docs/cado-response/discovery-import/import/azure/azure-compute.md",7101],ba6e6a6f:[()=>n.e(2090).then(n.bind(n,5009)),"@site/docs/support-bulletins/092322-role-update.md",5009],c1224519:[()=>n.e(5357).then(n.bind(n,8826)),"@site/docs/cado-response/deploy/aws/performance-resiliency/large-aws-imports.md",8826],c30a38de:[()=>n.e(6909).then(n.bind(n,2009)),"@site/docs/cado-response/discovery-import/import/aws/aws-eks.md",2009],c46214b8:[()=>n.e(2480).then(n.bind(n,8578)),"@site/docs/cado-response/discovery-import/import/aws/monitoring.md",8578],c4c8013b:[()=>n.e(9297).then(n.bind(n,4594)),"@site/docs/cado-response/deploy/aws/performance-resiliency/high-availability.md",4594],c4f5d8e4:[()=>n.e(4195).then(n.bind(n,2295)),"@site/src/pages/index.js",2295],c4f709c5:[()=>n.e(2159).then(n.bind(n,5029)),"@site/docs/cado-response/deploy/aws/data-encryption/aws-kms.md",5029],c548a2f3:[()=>n.e(5025).then(n.bind(n,9610)),"@site/docs/cado-response/discovery-import/import/data-types/logs.md",9610],c7e95ada:[()=>n.e(4942).then(n.bind(n,7250)),"@site/docs/cado-response/discovery-import/automation.md",7250],ca1ba999:[()=>n.e(6915).then(n.bind(n,2194)),"@site/docs/cado-response/manage/users-authentication/sso/okta_saml.md",2194],cb5c075c:[()=>n.e(4760).then(n.bind(n,3680)),"@site/docs/cado-response/discovery-import/import/aws/aws-ami.md",3680],cc7fbe29:[()=>n.e(1668).then(n.bind(n,7486)),"@site/docs/cado-response/manage/integrations/soar/tines.md",7486],d0643871:[()=>n.e(996).then(n.bind(n,9508)),"@site/docs/cado-response/manage/cost-management.md",9508],d561bd6f:[()=>n.e(3198).then(n.bind(n,7595)),"@site/docs/cado-response/discovery-import/import/gcp/storage.md",7595],d81821f1:[()=>n.e(1390).then(n.bind(n,2935)),"@site/docs/cado-response/manage/users-authentication/users.md",2935],dc194df5:[()=>n.e(1005).then(n.bind(n,6810)),"@site/docs/cado-response/deploy/intro.md",6810],e02d587d:[()=>n.e(5229).then(n.bind(n,2293)),"@site/docs/cado-response/discovery-import/import/gcp/engine-instance.md",2293],e0692acf:[()=>n.e(968).then(n.bind(n,1930)),"@site/docs/cado-response/discovery-import/import/data-types/memory.md",1930],e1df042a:[()=>n.e(265).then(n.bind(n,5418)),"@site/docs/cado-response/deploy/azure/azure-deploy.md",5418],e4cf30c3:[()=>n.e(9853).then(n.bind(n,7341)),"@site/docs/cado-response/deploy/aws/networking/aws-load-balancer.md",7341],e4d09c46:[()=>n.e(8918).then(n.bind(n,9733)),"@site/docs/cado-response/manage/updating.md",9733],ea3ff95a:[()=>n.e(5984).then(n.bind(n,9708)),"@site/docs/cado-response/discovery-import/import/data-types/import-types.md",9708],eb8e19ae:[()=>n.e(8913).then(n.bind(n,1747)),"@site/docs/cado-response/deploy/aws/iam/cross-account-creation.md",1747],eb95926b:[()=>n.e(5191).then(n.bind(n,2514)),"@site/docs/cado-response/manage/integrations/api-overview.md",2514],ec12bbb6:[()=>n.e(3710).then(n.bind(n,583)),"@site/docs/cado-response/discovery-import/import/intro.md",583],efb6f929:[()=>n.e(6787).then(n.bind(n,1304)),"@site/docs/cado-host/aws-credentials.md",1304],f191d22a:[()=>n.e(9625).then(n.bind(n,7167)),"@site/docs/cado-response/investigate/ai investigator.md",7167],f6441ffe:[()=>n.e(8754).then(n.bind(n,3068)),"@site/docs/cado-response/manage/users-authentication/sso/okta.md",3068],f694cc41:[()=>n.e(1461).then(n.bind(n,1078)),"@site/docs/cado-response/discovery-import/projects.md",1078],fd860755:[()=>n.e(6460).then(n.bind(n,9890)),"@site/docs/eula/community-eula.md",9890],fe10be31:[()=>n.e(1961).then(n.bind(n,4455)),"@site/docs/cado-response/investigate/network.md",4455]};var s=n(5893);function l(e){let{error:t,retry:n,pastDelay:r}=e;return t?(0,s.jsxs)("div",{style:{textAlign:"center",color:"#fff",backgroundColor:"#fa383e",borderColor:"#fa383e",borderStyle:"solid",borderRadius:"0.25rem",borderWidth:"1px",boxSizing:"border-box",display:"block",padding:"1rem",flex:"0 0 50%",marginLeft:"25%",marginRight:"25%",marginTop:"5rem",maxWidth:"50%",width:"100%"},children:[(0,s.jsx)("p",{children:String(t)}),(0,s.jsx)("div",{children:(0,s.jsx)("button",{type:"button",onClick:n,children:"Retry"})})]}):r?(0,s.jsx)("div",{style:{display:"flex",justifyContent:"center",alignItems:"center",height:"100vh"},children:(0,s.jsx)("svg",{id:"loader",style:{width:128,height:110,position:"absolute",top:"calc(100vh - 64%)"},viewBox:"0 0 45 45",xmlns:"http://www.w3.org/2000/svg",stroke:"#61dafb",children:(0,s.jsxs)("g",{fill:"none",fillRule:"evenodd",transform:"translate(1 1)",strokeWidth:"2",children:[(0,s.jsxs)("circle",{cx:"22",cy:"22",r:"6",strokeOpacity:"0",children:[(0,s.jsx)("animate",{attributeName:"r",begin:"1.5s",dur:"3s",values:"6;22",calcMode:"linear",repeatCount:"indefinite"}),(0,s.jsx)("animate",{attributeName:"stroke-opacity",begin:"1.5s",dur:"3s",values:"1;0",calcMode:"linear",repeatCount:"indefinite"}),(0,s.jsx)("animate",{attributeName:"stroke-width",begin:"1.5s",dur:"3s",values:"2;0",calcMode:"linear",repeatCount:"indefinite"})]}),(0,s.jsxs)("circle",{cx:"22",cy:"22",r:"6",strokeOpacity:"0",children:[(0,s.jsx)("animate",{attributeName:"r",begin:"3s",dur:"3s",values:"6;22",calcMode:"linear",repeatCount:"indefinite"}),(0,s.jsx)("animate",{attributeName:"stroke-opacity",begin:"3s",dur:"3s",values:"1;0",calcMode:"linear",repeatCount:"indefinite"}),(0,s.jsx)("animate",{attributeName:"stroke-width",begin:"3s",dur:"3s",values:"2;0",calcMode:"linear",repeatCount:"indefinite"})]}),(0,s.jsx)("circle",{cx:"22",cy:"22",r:"8",children:(0,s.jsx)("animate",{attributeName:"r",begin:"0s",dur:"1.5s",values:"6;1;2;3;4;5;6",calcMode:"linear",repeatCount:"indefinite"})})]})})}):null}var c=n(5304),u=n(9656);function d(e,t){if("*"===e)return o()({loading:l,loader:()=>n.e(868).then(n.bind(n,4336)),modules:["@theme/NotFound"],webpack:()=>[4336],render(e,t){const n=e.default;return(0,s.jsx)(u.z,{value:{plugin:{name:"native",id:"default"}},children:(0,s.jsx)(n,{...t})})}});const r=a[`${e}-${t}`],d={},p=[],f=[],m=(0,c.Z)(r);return Object.entries(m).forEach((e=>{let[t,n]=e;const r=i[n];r&&(d[t]=r[0],p.push(r[1]),f.push(r[2]))})),o().Map({loading:l,loader:d,modules:p,webpack:()=>f,render(t,n){const o=JSON.parse(JSON.stringify(r));Object.entries(t).forEach((t=>{let[n,r]=t;const a=r.default;if(!a)throw new Error(`The page component at ${e} doesn't have a default export. This makes it impossible to render anything. Consider default-exporting a React component.`);"object"!=typeof a&&"function"!=typeof a||Object.keys(r).filter((e=>"default"!==e)).forEach((e=>{a[e]=r[e]}));let i=o;const s=n.split(".");s.slice(0,-1).forEach((e=>{i=i[e]})),i[s[s.length-1]]=a}));const a=o.__comp;delete o.__comp;const i=o.__context;return delete o.__context,(0,s.jsx)(u.z,{value:i,children:(0,s.jsx)(a,{...o,...n})})}})}const p=[{path:"/",component:d("/","4c7"),exact:!0},{path:"/",component:d("/","c7e"),routes:[{path:"/",component:d("/","39c"),routes:[{path:"/",component:d("/","cb5"),routes:[{path:"/cado-host/artifacts",component:d("/cado-host/artifacts","666"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-host/aws-credentials",component:d("/cado-host/aws-credentials","831"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-host/azure-credentials",component:d("/cado-host/azure-credentials","28f"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-host/deploy",component:d("/cado-host/deploy","3da"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-host/google-credentials",component:d("/cado-host/google-credentials","b77"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-host/intro",component:d("/cado-host/intro","04c"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/community-edition/community-intro",component:d("/cado-response/community-edition/community-intro","398"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/aws/data-encryption/aws-kms",component:d("/cado-response/deploy/aws/data-encryption/aws-kms","076"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/aws/data-encryption/data-encryption-overview",component:d("/cado-response/deploy/aws/data-encryption/data-encryption-overview","276"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/aws/iam/cross-account-creation",component:d("/cado-response/deploy/aws/iam/cross-account-creation","e4e"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/aws/iam/deployment-iam-considerations",component:d("/cado-response/deploy/aws/iam/deployment-iam-considerations","b4e"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/aws/iam/tightening-iam",component:d("/cado-response/deploy/aws/iam/tightening-iam","c6e"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/aws/logging",component:d("/cado-response/deploy/aws/logging","675"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/aws/networking/aws-load-balancer",component:d("/cado-response/deploy/aws/networking/aws-load-balancer","983"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/aws/networking/internet-routable-addresses",component:d("/cado-response/deploy/aws/networking/internet-routable-addresses","392"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/aws/overview",component:d("/cado-response/deploy/aws/overview","ad1"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/aws/performance-resiliency/aws-backups",component:d("/cado-response/deploy/aws/performance-resiliency/aws-backups","562"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/aws/performance-resiliency/high-availability",component:d("/cado-response/deploy/aws/performance-resiliency/high-availability","7f6"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/aws/performance-resiliency/large-aws-imports",component:d("/cado-response/deploy/aws/performance-resiliency/large-aws-imports","583"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions",component:d("/cado-response/deploy/azure/azure-cross-tenancy-subscriptions","608"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/azure/azure-deploy",component:d("/cado-response/deploy/azure/azure-deploy","82a"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/gcp/gcp-auto-setup",component:d("/cado-response/deploy/gcp/gcp-auto-setup","f1d"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/gcp/gcp-cross-project",component:d("/cado-response/deploy/gcp/gcp-cross-project","120"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/gcp/gcp-deploy",component:d("/cado-response/deploy/gcp/gcp-deploy","c71"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/gcp/gcp-settings",component:d("/cado-response/deploy/gcp/gcp-settings","62f"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/deploy/intro",component:d("/cado-response/deploy/intro","a38"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/automation",component:d("/cado-response/discovery-import/automation","1ab"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/aws/aws-ami",component:d("/cado-response/discovery-import/import/aws/aws-ami","567"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/aws/aws-ec2",component:d("/cado-response/discovery-import/import/aws/aws-ec2","ecd"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/aws/aws-ecs",component:d("/cado-response/discovery-import/import/aws/aws-ecs","c05"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/aws/aws-eks",component:d("/cado-response/discovery-import/import/aws/aws-eks","ad9"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/aws/aws-lambda",component:d("/cado-response/discovery-import/import/aws/aws-lambda","1b3"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/aws/aws-lightsail",component:d("/cado-response/discovery-import/import/aws/aws-lightsail","eeb"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/aws/aws-s3",component:d("/cado-response/discovery-import/import/aws/aws-s3","130"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/aws/memory",component:d("/cado-response/discovery-import/import/aws/memory","f50"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/aws/monitoring",component:d("/cado-response/discovery-import/import/aws/monitoring","71b"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/azure/azure-aks",component:d("/cado-response/discovery-import/import/azure/azure-aks","450"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/azure/azure-compute",component:d("/cado-response/discovery-import/import/azure/azure-compute","135"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/azure/azure-storage",component:d("/cado-response/discovery-import/import/azure/azure-storage","6f5"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/data-types/filetypes",component:d("/cado-response/discovery-import/import/data-types/filetypes","6b9"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/data-types/import-types",component:d("/cado-response/discovery-import/import/data-types/import-types","e63"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/data-types/logs",component:d("/cado-response/discovery-import/import/data-types/logs","b22"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/data-types/memory",component:d("/cado-response/discovery-import/import/data-types/memory","5b8"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/gcp/engine-instance",component:d("/cado-response/discovery-import/import/gcp/engine-instance","a69"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/gcp/kubernetes-engine",component:d("/cado-response/discovery-import/import/gcp/kubernetes-engine","da5"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/gcp/storage",component:d("/cado-response/discovery-import/import/gcp/storage","f1b"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/import-from-cloud",component:d("/cado-response/discovery-import/import/import-from-cloud","77f"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/intro",component:d("/cado-response/discovery-import/import/intro","fe7"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/openshift",component:d("/cado-response/discovery-import/import/openshift","14f"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/import/oracle/virtual-machine",component:d("/cado-response/discovery-import/import/oracle/virtual-machine","856"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/intro",component:d("/cado-response/discovery-import/intro","f6c"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/projects",component:d("/cado-response/discovery-import/projects","e7b"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/discovery-import/readiness",component:d("/cado-response/discovery-import/readiness","e12"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/export/intro",component:d("/cado-response/export/intro","9aa"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/intro",component:d("/cado-response/intro","f05"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/investigate/ai investigator",component:d("/cado-response/investigate/ai investigator","c38"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/investigate/automated-investigation",component:d("/cado-response/investigate/automated-investigation","a21"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/investigate/browse-disk",component:d("/cado-response/investigate/browse-disk","f80"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/investigate/detections",component:d("/cado-response/investigate/detections","b32"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/investigate/evidence",component:d("/cado-response/investigate/evidence","916"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/investigate/indicators",component:d("/cado-response/investigate/indicators","4b7"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/investigate/intro",component:d("/cado-response/investigate/intro","ebe"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/investigate/key-events",component:d("/cado-response/investigate/key-events","c32"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/investigate/network",component:d("/cado-response/investigate/network","3f7"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/investigate/timeline-search",component:d("/cado-response/investigate/timeline-search","680"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/key-concepts",component:d("/cado-response/key-concepts","438"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/cost-management",component:d("/cado-response/manage/cost-management","e48"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/data",component:d("/cado-response/manage/data","507"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/integrations/api-overview",component:d("/cado-response/manage/integrations/api-overview","753"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/integrations/aws-lambda",component:d("/cado-response/manage/integrations/aws-lambda","aa7"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/integrations/sandbox/intelix",component:d("/cado-response/manage/integrations/sandbox/intelix","704"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/integrations/siem",component:d("/cado-response/manage/integrations/siem","8a0"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/integrations/soar/cortex-xsoar",component:d("/cado-response/manage/integrations/soar/cortex-xsoar","9c0"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/integrations/soar/splunk-soar",component:d("/cado-response/manage/integrations/soar/splunk-soar","82e"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/integrations/soar/tines",component:d("/cado-response/manage/integrations/soar/tines","892"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/integrations/webhooks",component:d("/cado-response/manage/integrations/webhooks","efd"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/integrations/xdr/crowdstrike",component:d("/cado-response/manage/integrations/xdr/crowdstrike","0df"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/integrations/xdr/sentinelone",component:d("/cado-response/manage/integrations/xdr/sentinelone","aa7"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/licenses",component:d("/cado-response/manage/licenses","5c3"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/logging-in",component:d("/cado-response/manage/logging-in","7bf"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/monitoring",component:d("/cado-response/manage/monitoring","0ea"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/updating",component:d("/cado-response/manage/updating","40a"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/users-authentication/sso/azure-ad",component:d("/cado-response/manage/users-authentication/sso/azure-ad","548"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/users-authentication/sso/okta",component:d("/cado-response/manage/users-authentication/sso/okta","ab0"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/users-authentication/sso/okta_saml",component:d("/cado-response/manage/users-authentication/sso/okta_saml","8be"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/users-authentication/sso/ping_saml",component:d("/cado-response/manage/users-authentication/sso/ping_saml","f14"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/users-authentication/users",component:d("/cado-response/manage/users-authentication/users","30d"),exact:!0,sidebar:"tutorialSidebar"},{path:"/cado-response/manage/workers",component:d("/cado-response/manage/workers","b18"),exact:!0,sidebar:"tutorialSidebar"},{path:"/eula/commercial-eula",component:d("/eula/commercial-eula","245"),exact:!0,sidebar:"tutorialSidebar"},{path:"/eula/community-eula",component:d("/eula/community-eula","faa"),exact:!0,sidebar:"tutorialSidebar"},{path:"/release-notes",component:d("/release-notes","b6e"),exact:!0,sidebar:"tutorialSidebar"},{path:"/support-bulletins/role-update",component:d("/support-bulletins/role-update","267"),exact:!0,sidebar:"tutorialSidebar"},{path:"/troubleshooting/faq",component:d("/troubleshooting/faq","6b1"),exact:!0,sidebar:"tutorialSidebar"}]}]}]},{path:"*",component:d("*")}]},5351:(e,t,n)=>{var r,o;!function(){var a,i,s,l,c,u,d,p,f,m,h,g,y,b,v,w,S,k,x,_,E,O,j,C,P,T,I,A,N,L,R=function(e){var t=new R.Builder;return t.pipeline.add(R.trimmer,R.stopWordFilter,R.stemmer),t.searchPipeline.add(R.stemmer),e.call(t,t),t.build()};R.version="2.3.9",R.utils={},R.utils.warn=(a=this,function(e){a.console&&console.warn&&console.warn(e)}),R.utils.asString=function(e){return null==e?"":e.toString()},R.utils.clone=function(e){if(null==e)return e;for(var t=Object.create(null),n=Object.keys(e),r=0;r0){var l=R.utils.clone(t)||{};l.position=[i,s],l.index=o.length,o.push(new R.Token(n.slice(i,a),l))}i=a+1}}return o},R.tokenizer.separator=/[\s\-]+/,R.Pipeline=function(){this._stack=[]},R.Pipeline.registeredFunctions=Object.create(null),R.Pipeline.registerFunction=function(e,t){t in this.registeredFunctions&&R.utils.warn("Overwriting existing registered function: "+t),e.label=t,R.Pipeline.registeredFunctions[e.label]=e},R.Pipeline.warnIfFunctionNotRegistered=function(e){e.label&&e.label in this.registeredFunctions||R.utils.warn("Function is not registered with pipeline. This may cause problems when serialising the index.\n",e)},R.Pipeline.load=function(e){var t=new R.Pipeline;return e.forEach((function(e){var n=R.Pipeline.registeredFunctions[e];if(!n)throw new Error("Cannot load unregistered function: "+e);t.add(n)})),t},R.Pipeline.prototype.add=function(){Array.prototype.slice.call(arguments).forEach((function(e){R.Pipeline.warnIfFunctionNotRegistered(e),this._stack.push(e)}),this)},R.Pipeline.prototype.after=function(e,t){R.Pipeline.warnIfFunctionNotRegistered(t);var n=this._stack.indexOf(e);if(-1==n)throw new Error("Cannot find existingFn");n+=1,this._stack.splice(n,0,t)},R.Pipeline.prototype.before=function(e,t){R.Pipeline.warnIfFunctionNotRegistered(t);var n=this._stack.indexOf(e);if(-1==n)throw new Error("Cannot find existingFn");this._stack.splice(n,0,t)},R.Pipeline.prototype.remove=function(e){var t=this._stack.indexOf(e);-1!=t&&this._stack.splice(t,1)},R.Pipeline.prototype.run=function(e){for(var t=this._stack.length,n=0;n1&&(ae&&(n=o),a!=e);)r=n-t,o=t+Math.floor(r/2),a=this.elements[2*o];return a==e||a>e?2*o:as?c+=2:i==s&&(t+=n[l+1]*r[c+1],l+=2,c+=2);return t},R.Vector.prototype.similarity=function(e){return this.dot(e)/this.magnitude()||0},R.Vector.prototype.toArray=function(){for(var e=new Array(this.elements.length/2),t=1,n=0;t0){var a,i=o.str.charAt(0);i in o.node.edges?a=o.node.edges[i]:(a=new R.TokenSet,o.node.edges[i]=a),1==o.str.length&&(a.final=!0),r.push({node:a,editsRemaining:o.editsRemaining,str:o.str.slice(1)})}if(0!=o.editsRemaining){if("*"in o.node.edges)var s=o.node.edges["*"];else{s=new R.TokenSet;o.node.edges["*"]=s}if(0==o.str.length&&(s.final=!0),r.push({node:s,editsRemaining:o.editsRemaining-1,str:o.str}),o.str.length>1&&r.push({node:o.node,editsRemaining:o.editsRemaining-1,str:o.str.slice(1)}),1==o.str.length&&(o.node.final=!0),o.str.length>=1){if("*"in o.node.edges)var l=o.node.edges["*"];else{l=new R.TokenSet;o.node.edges["*"]=l}1==o.str.length&&(l.final=!0),r.push({node:l,editsRemaining:o.editsRemaining-1,str:o.str.slice(1)})}if(o.str.length>1){var c,u=o.str.charAt(0),d=o.str.charAt(1);d in o.node.edges?c=o.node.edges[d]:(c=new R.TokenSet,o.node.edges[d]=c),1==o.str.length&&(c.final=!0),r.push({node:c,editsRemaining:o.editsRemaining-1,str:u+o.str.slice(2)})}}}return n},R.TokenSet.fromString=function(e){for(var t=new R.TokenSet,n=t,r=0,o=e.length;r=e;t--){var n=this.uncheckedNodes[t],r=n.child.toString();r in this.minimizedNodes?n.parent.edges[n.char]=this.minimizedNodes[r]:(n.child._str=r,this.minimizedNodes[r]=n.child),this.uncheckedNodes.pop()}},R.Index=function(e){this.invertedIndex=e.invertedIndex,this.fieldVectors=e.fieldVectors,this.tokenSet=e.tokenSet,this.fields=e.fields,this.pipeline=e.pipeline},R.Index.prototype.search=function(e){return this.query((function(t){new R.QueryParser(e,t).parse()}))},R.Index.prototype.query=function(e){for(var t=new R.Query(this.fields),n=Object.create(null),r=Object.create(null),o=Object.create(null),a=Object.create(null),i=Object.create(null),s=0;s1?1:e},R.Builder.prototype.k1=function(e){this._k1=e},R.Builder.prototype.add=function(e,t){var n=e[this._ref],r=Object.keys(this._fields);this._documents[n]=t||{},this.documentCount+=1;for(var o=0;o=this.length)return R.QueryLexer.EOS;var e=this.str.charAt(this.pos);return this.pos+=1,e},R.QueryLexer.prototype.width=function(){return this.pos-this.start},R.QueryLexer.prototype.ignore=function(){this.start==this.pos&&(this.pos+=1),this.start=this.pos},R.QueryLexer.prototype.backup=function(){this.pos-=1},R.QueryLexer.prototype.acceptDigitRun=function(){var e,t;do{t=(e=this.next()).charCodeAt(0)}while(t>47&&t<58);e!=R.QueryLexer.EOS&&this.backup()},R.QueryLexer.prototype.more=function(){return this.pos1&&(e.backup(),e.emit(R.QueryLexer.TERM)),e.ignore(),e.more())return R.QueryLexer.lexText},R.QueryLexer.lexEditDistance=function(e){return e.ignore(),e.acceptDigitRun(),e.emit(R.QueryLexer.EDIT_DISTANCE),R.QueryLexer.lexText},R.QueryLexer.lexBoost=function(e){return e.ignore(),e.acceptDigitRun(),e.emit(R.QueryLexer.BOOST),R.QueryLexer.lexText},R.QueryLexer.lexEOS=function(e){e.width()>0&&e.emit(R.QueryLexer.TERM)},R.QueryLexer.termSeparator=R.tokenizer.separator,R.QueryLexer.lexText=function(e){for(;;){var t=e.next();if(t==R.QueryLexer.EOS)return R.QueryLexer.lexEOS;if(92!=t.charCodeAt(0)){if(":"==t)return R.QueryLexer.lexField;if("~"==t)return e.backup(),e.width()>0&&e.emit(R.QueryLexer.TERM),R.QueryLexer.lexEditDistance;if("^"==t)return e.backup(),e.width()>0&&e.emit(R.QueryLexer.TERM),R.QueryLexer.lexBoost;if("+"==t&&1===e.width())return e.emit(R.QueryLexer.PRESENCE),R.QueryLexer.lexText;if("-"==t&&1===e.width())return e.emit(R.QueryLexer.PRESENCE),R.QueryLexer.lexText;if(t.match(R.QueryLexer.termSeparator))return R.QueryLexer.lexTerm}else e.escapeCharacter()}},R.QueryParser=function(e,t){this.lexer=new R.QueryLexer(e),this.query=t,this.currentClause={},this.lexemeIdx=0},R.QueryParser.prototype.parse=function(){this.lexer.run(),this.lexemes=this.lexer.lexemes;for(var e=R.QueryParser.parseClause;e;)e=e(this);return this.query},R.QueryParser.prototype.peekLexeme=function(){return this.lexemes[this.lexemeIdx]},R.QueryParser.prototype.consumeLexeme=function(){var e=this.peekLexeme();return this.lexemeIdx+=1,e},R.QueryParser.prototype.nextClause=function(){var e=this.currentClause;this.query.clause(e),this.currentClause={}},R.QueryParser.parseClause=function(e){var t=e.peekLexeme();if(null!=t)switch(t.type){case R.QueryLexer.PRESENCE:return R.QueryParser.parsePresence;case R.QueryLexer.FIELD:return R.QueryParser.parseField;case R.QueryLexer.TERM:return R.QueryParser.parseTerm;default:var n="expected either a field or a term, found "+t.type;throw t.str.length>=1&&(n+=" with value '"+t.str+"'"),new R.QueryParseError(n,t.start,t.end)}},R.QueryParser.parsePresence=function(e){var t=e.consumeLexeme();if(null!=t){switch(t.str){case"-":e.currentClause.presence=R.Query.presence.PROHIBITED;break;case"+":e.currentClause.presence=R.Query.presence.REQUIRED;break;default:var n="unrecognised presence operator'"+t.str+"'";throw new R.QueryParseError(n,t.start,t.end)}var r=e.peekLexeme();if(null==r){n="expecting term or field, found nothing";throw new R.QueryParseError(n,t.start,t.end)}switch(r.type){case R.QueryLexer.FIELD:return R.QueryParser.parseField;case R.QueryLexer.TERM:return R.QueryParser.parseTerm;default:n="expecting term or field, found '"+r.type+"'";throw new R.QueryParseError(n,r.start,r.end)}}},R.QueryParser.parseField=function(e){var t=e.consumeLexeme();if(null!=t){if(-1==e.query.allFields.indexOf(t.str)){var n=e.query.allFields.map((function(e){return"'"+e+"'"})).join(", "),r="unrecognised field '"+t.str+"', possible fields: "+n;throw new R.QueryParseError(r,t.start,t.end)}e.currentClause.fields=[t.str];var o=e.peekLexeme();if(null==o){r="expecting term, found nothing";throw new R.QueryParseError(r,t.start,t.end)}if(o.type===R.QueryLexer.TERM)return R.QueryParser.parseTerm;r="expecting term, found '"+o.type+"'";throw new R.QueryParseError(r,o.start,o.end)}},R.QueryParser.parseTerm=function(e){var t=e.consumeLexeme();if(null!=t){e.currentClause.term=t.str.toLowerCase(),-1!=t.str.indexOf("*")&&(e.currentClause.usePipeline=!1);var n=e.peekLexeme();if(null!=n)switch(n.type){case R.QueryLexer.TERM:return e.nextClause(),R.QueryParser.parseTerm;case R.QueryLexer.FIELD:return e.nextClause(),R.QueryParser.parseField;case R.QueryLexer.EDIT_DISTANCE:return R.QueryParser.parseEditDistance;case R.QueryLexer.BOOST:return R.QueryParser.parseBoost;case R.QueryLexer.PRESENCE:return e.nextClause(),R.QueryParser.parsePresence;default:var r="Unexpected lexeme type '"+n.type+"'";throw new R.QueryParseError(r,n.start,n.end)}else e.nextClause()}},R.QueryParser.parseEditDistance=function(e){var t=e.consumeLexeme();if(null!=t){var n=parseInt(t.str,10);if(isNaN(n)){var r="edit distance must be numeric";throw new R.QueryParseError(r,t.start,t.end)}e.currentClause.editDistance=n;var o=e.peekLexeme();if(null!=o)switch(o.type){case R.QueryLexer.TERM:return e.nextClause(),R.QueryParser.parseTerm;case R.QueryLexer.FIELD:return e.nextClause(),R.QueryParser.parseField;case R.QueryLexer.EDIT_DISTANCE:return R.QueryParser.parseEditDistance;case R.QueryLexer.BOOST:return R.QueryParser.parseBoost;case R.QueryLexer.PRESENCE:return e.nextClause(),R.QueryParser.parsePresence;default:r="Unexpected lexeme type '"+o.type+"'";throw new R.QueryParseError(r,o.start,o.end)}else e.nextClause()}},R.QueryParser.parseBoost=function(e){var t=e.consumeLexeme();if(null!=t){var n=parseInt(t.str,10);if(isNaN(n)){var r="boost must be numeric";throw new R.QueryParseError(r,t.start,t.end)}e.currentClause.boost=n;var o=e.peekLexeme();if(null!=o)switch(o.type){case R.QueryLexer.TERM:return e.nextClause(),R.QueryParser.parseTerm;case R.QueryLexer.FIELD:return e.nextClause(),R.QueryParser.parseField;case R.QueryLexer.EDIT_DISTANCE:return R.QueryParser.parseEditDistance;case R.QueryLexer.BOOST:return R.QueryParser.parseBoost;case R.QueryLexer.PRESENCE:return e.nextClause(),R.QueryParser.parsePresence;default:r="Unexpected lexeme type '"+o.type+"'";throw new R.QueryParseError(r,o.start,o.end)}else e.nextClause()}},void 0===(o="function"==typeof(r=function(){return R})?r.call(t,n,t,e):r)||(e.exports=o)}()},8121:(e,t,n)=>{"use strict";n.d(t,{_:()=>a,t:()=>i});var r=n(7294),o=n(5893);const a=r.createContext(!1);function i(e){let{children:t}=e;const[n,i]=(0,r.useState)(!1);return(0,r.useEffect)((()=>{i(!0)}),[]),(0,o.jsx)(a.Provider,{value:n,children:t})}},9717:(e,t,n)=>{"use strict";var r=n(7294),o=n(745),a=n(3727),i=n(405),s=n(6136);const l=[n(4313),n(984),n(2251),n(9957),n(6930)];var c=n(997),u=n(6550),d=n(8790),p=n(5893);function f(e){let{children:t}=e;return(0,p.jsx)(p.Fragment,{children:t})}var m=n(1514),h=n(9962),g=n(9524),y=n(107),b=n(5463),v=n(626),w=n(8181),S=n(246),k=n(3905),x=n(3647);function _(){const{i18n:{currentLocale:e,defaultLocale:t,localeConfigs:n}}=(0,h.Z)(),r=(0,v.l)(),o=n[e].htmlLang,a=e=>e.replace("-","_");return(0,p.jsxs)(m.Z,{children:[Object.entries(n).map((e=>{let[t,{htmlLang:n}]=e;return(0,p.jsx)("link",{rel:"alternate",href:r.createUrl({locale:t,fullyQualified:!0}),hrefLang:n},t)})),(0,p.jsx)("link",{rel:"alternate",href:r.createUrl({locale:t,fullyQualified:!0}),hrefLang:"x-default"}),(0,p.jsx)("meta",{property:"og:locale",content:a(o)}),Object.values(n).filter((e=>o!==e.htmlLang)).map((e=>(0,p.jsx)("meta",{property:"og:locale:alternate",content:a(e.htmlLang)},`meta-og-${e.htmlLang}`)))]})}function E(e){let{permalink:t}=e;const{siteConfig:{url:n}}=(0,h.Z)(),r=function(){const{siteConfig:{url:e,baseUrl:t,trailingSlash:n}}=(0,h.Z)(),{pathname:r}=(0,u.TH)();return e+(0,k.applyTrailingSlash)((0,g.Z)(r),{trailingSlash:n,baseUrl:t})}(),o=t?`${n}${t}`:r;return(0,p.jsxs)(m.Z,{children:[(0,p.jsx)("meta",{property:"og:url",content:o}),(0,p.jsx)("link",{rel:"canonical",href:o})]})}function O(){const{i18n:{currentLocale:e}}=(0,h.Z)(),{metadata:t,image:n}=(0,y.L)();return(0,p.jsxs)(p.Fragment,{children:[(0,p.jsxs)(m.Z,{children:[(0,p.jsx)("meta",{name:"twitter:card",content:"summary_large_image"}),(0,p.jsx)("body",{className:w.h})]}),n&&(0,p.jsx)(b.d,{image:n}),(0,p.jsx)(E,{}),(0,p.jsx)(_,{}),(0,p.jsx)(x.Z,{tag:S.HX,locale:e}),(0,p.jsx)(m.Z,{children:t.map(((e,t)=>(0,p.jsx)("meta",{...e},t)))})]})}const j=new Map;function C(e){if(j.has(e.pathname))return{...e,pathname:j.get(e.pathname)};if((0,d.f)(c.Z,e.pathname).some((e=>{let{route:t}=e;return!0===t.exact})))return j.set(e.pathname,e.pathname),e;const t=e.pathname.trim().replace(/(?:\/index)?\.html$/,"")||"/";return j.set(e.pathname,t),{...e,pathname:t}}var P=n(8121),T=n(694),I=n(1270);function A(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),r=1;r{const r=t.default?.[e]??t[e];return r?.(...n)}));return()=>o.forEach((e=>e?.()))}const N=function(e){let{children:t,location:n,previousLocation:r}=e;return(0,I.Z)((()=>{r!==n&&(!function(e){let{location:t,previousLocation:n}=e;if(!n)return;const r=t.pathname===n.pathname,o=t.hash===n.hash,a=t.search===n.search;if(r&&o&&!a)return;const{hash:i}=t;if(i){const e=decodeURIComponent(i.substring(1)),t=document.getElementById(e);t?.scrollIntoView()}else window.scrollTo(0,0)}({location:n,previousLocation:r}),A("onRouteDidUpdate",{previousLocation:r,location:n}))}),[r,n]),t};function L(e){const t=Array.from(new Set([e,decodeURI(e)])).map((e=>(0,d.f)(c.Z,e))).flat();return Promise.all(t.map((e=>e.route.component.preload?.())))}class R extends r.Component{previousLocation;routeUpdateCleanupCb;constructor(e){super(e),this.previousLocation=null,this.routeUpdateCleanupCb=s.Z.canUseDOM?A("onRouteUpdate",{previousLocation:null,location:this.props.location}):()=>{},this.state={nextRouteHasLoaded:!0}}shouldComponentUpdate(e,t){if(e.location===this.props.location)return t.nextRouteHasLoaded;const n=e.location;return this.previousLocation=this.props.location,this.setState({nextRouteHasLoaded:!1}),this.routeUpdateCleanupCb=A("onRouteUpdate",{previousLocation:this.previousLocation,location:n}),L(n.pathname).then((()=>{this.routeUpdateCleanupCb(),this.setState({nextRouteHasLoaded:!0})})).catch((e=>{console.warn(e),window.location.reload()})),!1}render(){const{children:e,location:t}=this.props;return(0,p.jsx)(N,{previousLocation:this.previousLocation,location:t,children:(0,p.jsx)(u.AW,{location:t,render:()=>e})})}}const D=R,F="__docusaurus-base-url-issue-banner-container",M="__docusaurus-base-url-issue-banner",z="__docusaurus-base-url-issue-banner-suggestion-container";function B(e){return`\ndocument.addEventListener('DOMContentLoaded', function maybeInsertBanner() {\n var shouldInsert = typeof window['docusaurus'] === 'undefined';\n shouldInsert && insertBanner();\n});\n\nfunction insertBanner() {\n var bannerContainer = document.createElement('div');\n bannerContainer.id = '${F}';\n var bannerHtml = ${JSON.stringify(function(e){return`\n
\n

Your Docusaurus site did not load properly.

\n

A very common reason is a wrong site baseUrl configuration.

\n

Current configured baseUrl = ${e} ${"/"===e?" (default value)":""}

\n

We suggest trying baseUrl =

\n
\n`}(e)).replace(/{if("undefined"==typeof document)return void n();const r=document.createElement("link");r.setAttribute("rel","prefetch"),r.setAttribute("href",e),r.onload=()=>t(),r.onerror=()=>n();const o=document.getElementsByTagName("head")[0]??document.getElementsByName("script")[0]?.parentNode;o?.appendChild(r)}))}:function(e){return new Promise(((t,n)=>{const r=new XMLHttpRequest;r.open("GET",e,!0),r.withCredentials=!0,r.onload=()=>{200===r.status?t():n()},r.send(null)}))};var K=n(5304);const Y=new Set,J=new Set,X=()=>navigator.connection?.effectiveType.includes("2g")||navigator.connection?.saveData,ee={prefetch(e){if(!(e=>!X()&&!J.has(e)&&!Y.has(e))(e))return!1;Y.add(e);const t=(0,d.f)(c.Z,e).flatMap((e=>{return t=e.route.path,Object.entries(Z).filter((e=>{let[n]=e;return n.replace(/-[^-]+$/,"")===t})).flatMap((e=>{let[,t]=e;return Object.values((0,K.Z)(t))}));var t}));return Promise.all(t.map((e=>{const t=n.gca(e);return t&&!t.includes("undefined")?G(t).catch((()=>{})):Promise.resolve()})))},preload:e=>!!(e=>!X()&&!J.has(e))(e)&&(J.add(e),L(e))},te=Object.freeze(ee),ne=Boolean(!0);if(s.Z.canUseDOM){window.docusaurus=te;const e=document.getElementById("__docusaurus"),t=(0,p.jsx)(i.B6,{children:(0,p.jsx)(a.VK,{children:(0,p.jsx)(W,{})})}),n=(e,t)=>{console.error("Docusaurus React Root onRecoverableError:",e,t)},s=()=>{if(ne)r.startTransition((()=>{o.hydrateRoot(e,t,{onRecoverableError:n})}));else{const a=o.createRoot(e,{onRecoverableError:n});r.startTransition((()=>{a.render(t)}))}};L(window.location.pathname).then(s)}},694:(e,t,n)=>{"use strict";n.d(t,{_:()=>d,M:()=>p});var r=n(7294),o=n(6809);const a=JSON.parse('{"@cmfcmf/docusaurus-search-local":{"default":{"titleBoost":5,"contentBoost":1,"tagsBoost":3,"parentCategoriesBoost":2,"indexDocSidebarParentCategories":0,"maxSearchResults":8}},"docusaurus-plugin-google-gtag":{"default":{"trackingID":["G-9BVXSKWB6Z"],"anonymizeIP":false,"id":"default"}},"docusaurus-plugin-content-docs":{"default":{"path":"/","versions":[{"name":"current","label":"Next","isLast":true,"path":"/","mainDocId":"cado-response/intro","docs":[{"id":"cado-host/artifacts","path":"/cado-host/artifacts","sidebar":"tutorialSidebar"},{"id":"cado-host/aws-credentials","path":"/cado-host/aws-credentials","sidebar":"tutorialSidebar"},{"id":"cado-host/azure-credentials","path":"/cado-host/azure-credentials","sidebar":"tutorialSidebar"},{"id":"cado-host/deploy","path":"/cado-host/deploy","sidebar":"tutorialSidebar"},{"id":"cado-host/google-credentials","path":"/cado-host/google-credentials","sidebar":"tutorialSidebar"},{"id":"cado-host/intro","path":"/cado-host/intro","sidebar":"tutorialSidebar"},{"id":"cado-response/community-edition/community-intro","path":"/cado-response/community-edition/community-intro","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/aws/data-encryption/aws-kms","path":"/cado-response/deploy/aws/data-encryption/aws-kms","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/aws/data-encryption/data-encryption-overview","path":"/cado-response/deploy/aws/data-encryption/data-encryption-overview","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/aws/iam/cross-account-creation","path":"/cado-response/deploy/aws/iam/cross-account-creation","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/aws/iam/deployment-iam-considerations","path":"/cado-response/deploy/aws/iam/deployment-iam-considerations","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/aws/iam/tightening-iam","path":"/cado-response/deploy/aws/iam/tightening-iam","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/aws/logging","path":"/cado-response/deploy/aws/logging","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/aws/networking/aws-load-balancer","path":"/cado-response/deploy/aws/networking/aws-load-balancer","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/aws/networking/internet-routable-addresses","path":"/cado-response/deploy/aws/networking/internet-routable-addresses","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/aws/overview","path":"/cado-response/deploy/aws/overview","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/aws/performance-resiliency/aws-backups","path":"/cado-response/deploy/aws/performance-resiliency/aws-backups","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/aws/performance-resiliency/high-availability","path":"/cado-response/deploy/aws/performance-resiliency/high-availability","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/aws/performance-resiliency/large-aws-imports","path":"/cado-response/deploy/aws/performance-resiliency/large-aws-imports","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/azure/azure-cross-tenancy-subscriptions","path":"/cado-response/deploy/azure/azure-cross-tenancy-subscriptions","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/azure/azure-deploy","path":"/cado-response/deploy/azure/azure-deploy","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/gcp/gcp-auto-setup","path":"/cado-response/deploy/gcp/gcp-auto-setup","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/gcp/gcp-cross-project","path":"/cado-response/deploy/gcp/gcp-cross-project","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/gcp/gcp-deploy","path":"/cado-response/deploy/gcp/gcp-deploy","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/gcp/gcp-settings","path":"/cado-response/deploy/gcp/gcp-settings","sidebar":"tutorialSidebar"},{"id":"cado-response/deploy/intro","path":"/cado-response/deploy/intro","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/automation","path":"/cado-response/discovery-import/automation","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/aws/aws-ami","path":"/cado-response/discovery-import/import/aws/aws-ami","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/aws/aws-ec2","path":"/cado-response/discovery-import/import/aws/aws-ec2","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/aws/aws-ecs","path":"/cado-response/discovery-import/import/aws/aws-ecs","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/aws/aws-eks","path":"/cado-response/discovery-import/import/aws/aws-eks","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/aws/aws-lambda","path":"/cado-response/discovery-import/import/aws/aws-lambda","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/aws/aws-lightsail","path":"/cado-response/discovery-import/import/aws/aws-lightsail","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/aws/aws-s3","path":"/cado-response/discovery-import/import/aws/aws-s3","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/aws/memory","path":"/cado-response/discovery-import/import/aws/memory","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/aws/monitoring","path":"/cado-response/discovery-import/import/aws/monitoring","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/azure/azure-aks","path":"/cado-response/discovery-import/import/azure/azure-aks","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/azure/azure-compute","path":"/cado-response/discovery-import/import/azure/azure-compute","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/azure/azure-storage","path":"/cado-response/discovery-import/import/azure/azure-storage","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/data-types/filetypes","path":"/cado-response/discovery-import/import/data-types/filetypes","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/data-types/import-types","path":"/cado-response/discovery-import/import/data-types/import-types","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/data-types/logs","path":"/cado-response/discovery-import/import/data-types/logs","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/data-types/memory","path":"/cado-response/discovery-import/import/data-types/memory","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/gcp/engine-instance","path":"/cado-response/discovery-import/import/gcp/engine-instance","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/gcp/kubernetes-engine","path":"/cado-response/discovery-import/import/gcp/kubernetes-engine","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/gcp/storage","path":"/cado-response/discovery-import/import/gcp/storage","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/import-from-cloud","path":"/cado-response/discovery-import/import/import-from-cloud","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/intro","path":"/cado-response/discovery-import/import/intro","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/openshift/openshift","path":"/cado-response/discovery-import/import/openshift/","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/import/oracle/virtual-machine","path":"/cado-response/discovery-import/import/oracle/virtual-machine","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/intro","path":"/cado-response/discovery-import/intro","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/projects","path":"/cado-response/discovery-import/projects","sidebar":"tutorialSidebar"},{"id":"cado-response/discovery-import/readiness","path":"/cado-response/discovery-import/readiness","sidebar":"tutorialSidebar"},{"id":"cado-response/export/intro","path":"/cado-response/export/intro","sidebar":"tutorialSidebar"},{"id":"cado-response/intro","path":"/cado-response/intro","sidebar":"tutorialSidebar"},{"id":"cado-response/investigate/ai investigator","path":"/cado-response/investigate/ai investigator","sidebar":"tutorialSidebar"},{"id":"cado-response/investigate/automated-investigation","path":"/cado-response/investigate/automated-investigation","sidebar":"tutorialSidebar"},{"id":"cado-response/investigate/browse-disk","path":"/cado-response/investigate/browse-disk","sidebar":"tutorialSidebar"},{"id":"cado-response/investigate/detections","path":"/cado-response/investigate/detections","sidebar":"tutorialSidebar"},{"id":"cado-response/investigate/evidence","path":"/cado-response/investigate/evidence","sidebar":"tutorialSidebar"},{"id":"cado-response/investigate/indicators","path":"/cado-response/investigate/indicators","sidebar":"tutorialSidebar"},{"id":"cado-response/investigate/intro","path":"/cado-response/investigate/intro","sidebar":"tutorialSidebar"},{"id":"cado-response/investigate/key-events","path":"/cado-response/investigate/key-events","sidebar":"tutorialSidebar"},{"id":"cado-response/investigate/network","path":"/cado-response/investigate/network","sidebar":"tutorialSidebar"},{"id":"cado-response/investigate/timeline-search","path":"/cado-response/investigate/timeline-search","sidebar":"tutorialSidebar"},{"id":"cado-response/key-concepts","path":"/cado-response/key-concepts","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/cost-management","path":"/cado-response/manage/cost-management","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/data","path":"/cado-response/manage/data","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/integrations/api-overview","path":"/cado-response/manage/integrations/api-overview","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/integrations/aws-lambda","path":"/cado-response/manage/integrations/aws-lambda","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/integrations/sandbox/intelix","path":"/cado-response/manage/integrations/sandbox/intelix","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/integrations/siem","path":"/cado-response/manage/integrations/siem","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/integrations/soar/cortex-xsoar","path":"/cado-response/manage/integrations/soar/cortex-xsoar","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/integrations/soar/splunk-soar","path":"/cado-response/manage/integrations/soar/splunk-soar","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/integrations/soar/tines","path":"/cado-response/manage/integrations/soar/tines","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/integrations/webhooks","path":"/cado-response/manage/integrations/webhooks","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/integrations/xdr/crowdstrike","path":"/cado-response/manage/integrations/xdr/crowdstrike","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/integrations/xdr/sentinelone","path":"/cado-response/manage/integrations/xdr/sentinelone","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/licenses","path":"/cado-response/manage/licenses","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/logging-in","path":"/cado-response/manage/logging-in","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/monitoring","path":"/cado-response/manage/monitoring","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/updating","path":"/cado-response/manage/updating","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/users-authentication/sso/azure-ad","path":"/cado-response/manage/users-authentication/sso/azure-ad","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/users-authentication/sso/okta","path":"/cado-response/manage/users-authentication/sso/okta","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/users-authentication/sso/okta_saml","path":"/cado-response/manage/users-authentication/sso/okta_saml","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/users-authentication/sso/ping_saml","path":"/cado-response/manage/users-authentication/sso/ping_saml","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/users-authentication/users","path":"/cado-response/manage/users-authentication/users","sidebar":"tutorialSidebar"},{"id":"cado-response/manage/workers","path":"/cado-response/manage/workers","sidebar":"tutorialSidebar"},{"id":"eula/commercial-eula","path":"/eula/commercial-eula","sidebar":"tutorialSidebar"},{"id":"eula/community-eula","path":"/eula/community-eula","sidebar":"tutorialSidebar"},{"id":"release-notes/release-notes","path":"/release-notes/","sidebar":"tutorialSidebar"},{"id":"support-bulletins/role-update","path":"/support-bulletins/role-update","sidebar":"tutorialSidebar"},{"id":"troubleshooting/faq","path":"/troubleshooting/faq","sidebar":"tutorialSidebar"}],"draftIds":[],"sidebars":{"tutorialSidebar":{"link":{"path":"/cado-response/intro","label":"cado-response/intro"}}}}],"breadcrumbs":true}}}'),i=JSON.parse('{"defaultLocale":"en","locales":["en"],"path":"i18n","currentLocale":"en","localeConfigs":{"en":{"label":"English","direction":"ltr","htmlLang":"en","calendar":"gregory","path":"en"}}}');var s=n(7529);const l=JSON.parse('{"docusaurusVersion":"3.0.1","siteVersion":"2.0.0","pluginVersions":{"docusaurus-plugin-content-docs":{"type":"package","name":"@docusaurus/plugin-content-docs","version":"3.0.1"},"docusaurus-plugin-content-pages":{"type":"package","name":"@docusaurus/plugin-content-pages","version":"3.0.1"},"docusaurus-plugin-google-gtag":{"type":"package","name":"@docusaurus/plugin-google-gtag","version":"3.0.1"},"docusaurus-plugin-sitemap":{"type":"package","name":"@docusaurus/plugin-sitemap","version":"3.0.1"},"docusaurus-theme-classic":{"type":"package","name":"@docusaurus/theme-classic","version":"3.0.1"},"@cmfcmf/docusaurus-search-local":{"type":"package","name":"@cmfcmf/docusaurus-search-local","version":"1.1.0"},"docusaurus-plugin-client-redirects":{"type":"package","name":"@docusaurus/plugin-client-redirects","version":"3.0.1"}}}');var c=n(5893);const u={siteConfig:o.default,siteMetadata:l,globalData:a,i18n:i,codeTranslations:s},d=r.createContext(u);function p(e){let{children:t}=e;return(0,c.jsx)(d.Provider,{value:u,children:t})}},3256:(e,t,n)=>{"use strict";n.d(t,{Z:()=>f});var r=n(7294),o=n(6136),a=n(1514),i=n(3905),s=n(8030),l=n(5893);function c(e){let{error:t,tryAgain:n}=e;return(0,l.jsxs)("div",{style:{display:"flex",flexDirection:"column",justifyContent:"center",alignItems:"flex-start",minHeight:"100vh",width:"100%",maxWidth:"80ch",fontSize:"20px",margin:"0 auto",padding:"1rem"},children:[(0,l.jsx)("h1",{style:{fontSize:"3rem"},children:"This page crashed"}),(0,l.jsx)("button",{type:"button",onClick:n,style:{margin:"1rem 0",fontSize:"2rem",cursor:"pointer",borderRadius:20,padding:"1rem"},children:"Try again"}),(0,l.jsx)(u,{error:t})]})}function u(e){let{error:t}=e;const n=(0,i.getErrorCausalChain)(t).map((e=>e.message)).join("\n\nCause:\n");return(0,l.jsx)("p",{style:{whiteSpace:"pre-wrap"},children:n})}function d(e){let{error:t,tryAgain:n}=e;return(0,l.jsxs)(f,{fallback:()=>(0,l.jsx)(c,{error:t,tryAgain:n}),children:[(0,l.jsx)(a.Z,{children:(0,l.jsx)("title",{children:"Page Error"})}),(0,l.jsx)(s.Z,{children:(0,l.jsx)(c,{error:t,tryAgain:n})})]})}const p=e=>(0,l.jsx)(d,{...e});class f extends r.Component{constructor(e){super(e),this.state={error:null}}componentDidCatch(e){o.Z.canUseDOM&&this.setState({error:e})}render(){const{children:e}=this.props,{error:t}=this.state;if(t){const e={error:t,tryAgain:()=>this.setState({error:null})};return(this.props.fallback??p)(e)}return e??null}}},6136:(e,t,n)=>{"use strict";n.d(t,{Z:()=>o});const r="undefined"!=typeof window&&"document"in window&&"createElement"in window.document,o={canUseDOM:r,canUseEventListeners:r&&("addEventListener"in window||"attachEvent"in window),canUseIntersectionObserver:r&&"IntersectionObserver"in window,canUseViewport:r&&"screen"in window}},1514:(e,t,n)=>{"use strict";n.d(t,{Z:()=>a});n(7294);var r=n(405),o=n(5893);function a(e){return(0,o.jsx)(r.ql,{...e})}},3699:(e,t,n)=>{"use strict";n.d(t,{Z:()=>f});var r=n(7294),o=n(3727),a=n(3905),i=n(9962),s=n(2735),l=n(6136),c=n(5893);const u=r.createContext({collectLink:()=>{}});var d=n(9524);function p(e,t){let{isNavLink:n,to:p,href:f,activeClassName:m,isActive:h,"data-noBrokenLinkCheck":g,autoAddBaseUrl:y=!0,...b}=e;const{siteConfig:{trailingSlash:v,baseUrl:w}}=(0,i.Z)(),{withBaseUrl:S}=(0,d.C)(),k=(0,r.useContext)(u),x=(0,r.useRef)(null);(0,r.useImperativeHandle)(t,(()=>x.current));const _=p||f;const E=(0,s.Z)(_),O=_?.replace("pathname://","");let j=void 0!==O?(C=O,y&&(e=>e.startsWith("/"))(C)?S(C):C):void 0;var C;j&&E&&(j=(0,a.applyTrailingSlash)(j,{trailingSlash:v,baseUrl:w}));const P=(0,r.useRef)(!1),T=n?o.OL:o.rU,I=l.Z.canUseIntersectionObserver,A=(0,r.useRef)(),N=()=>{P.current||null==j||(window.docusaurus.preload(j),P.current=!0)};(0,r.useEffect)((()=>(!I&&E&&null!=j&&window.docusaurus.prefetch(j),()=>{I&&A.current&&A.current.disconnect()})),[A,j,I,E]);const L=j?.startsWith("#")??!1,R=!j||!E||L;return R||g||k.collectLink(j),R?(0,c.jsx)("a",{ref:x,href:j,..._&&!E&&{target:"_blank",rel:"noopener noreferrer"},...b}):(0,c.jsx)(T,{...b,onMouseEnter:N,onTouchStart:N,innerRef:e=>{x.current=e,I&&e&&E&&(A.current=new window.IntersectionObserver((t=>{t.forEach((t=>{e===t.target&&(t.isIntersecting||t.intersectionRatio>0)&&(A.current.unobserve(e),A.current.disconnect(),null!=j&&window.docusaurus.prefetch(j))}))})),A.current.observe(e))},to:j,...n&&{isActive:h,activeClassName:m}})}const f=r.forwardRef(p)},7325:(e,t,n)=>{"use strict";n.d(t,{Z:()=>c,I:()=>l});var r=n(7294),o=n(5893);function a(e,t){const n=e.split(/(\{\w+\})/).map(((e,n)=>{if(n%2==1){const n=t?.[e.slice(1,-1)];if(void 0!==n)return n}return e}));return n.some((e=>(0,r.isValidElement)(e)))?n.map(((e,t)=>(0,r.isValidElement)(e)?r.cloneElement(e,{key:t}):e)).filter((e=>""!==e)):n.join("")}var i=n(7529);function s(e){let{id:t,message:n}=e;if(void 0===t&&void 0===n)throw new Error("Docusaurus translation declarations must have at least a translation id or a default translation message");return i[t??n]??n??t}function l(e,t){let{message:n,id:r}=e;return a(s({message:n,id:r}),t)}function c(e){let{children:t,id:n,values:r}=e;if(t&&"string"!=typeof t)throw console.warn("Illegal children",t),new Error("The Docusaurus component only accept simple string values");const i=s({message:t,id:n});return(0,o.jsx)(o.Fragment,{children:a(i,r)})}},6875:(e,t,n)=>{"use strict";n.d(t,{m:()=>r});const r="default"},2735:(e,t,n)=>{"use strict";function r(e){return/^(?:\w*:|\/\/)/.test(e)}function o(e){return void 0!==e&&!r(e)}n.d(t,{Z:()=>o,b:()=>r})},9524:(e,t,n)=>{"use strict";n.d(t,{C:()=>i,Z:()=>s});var r=n(7294),o=n(9962),a=n(2735);function i(){const{siteConfig:{baseUrl:e,url:t}}=(0,o.Z)(),n=(0,r.useCallback)(((n,r)=>function(e,t,n,r){let{forcePrependBaseUrl:o=!1,absolute:i=!1}=void 0===r?{}:r;if(!n||n.startsWith("#")||(0,a.b)(n))return n;if(o)return t+n.replace(/^\//,"");if(n===t.replace(/\/$/,""))return t;const s=n.startsWith(t)?n:t+n.replace(/^\//,"");return i?e+s:s}(t,e,n,r)),[t,e]);return{withBaseUrl:n}}function s(e,t){void 0===t&&(t={});const{withBaseUrl:n}=i();return n(e,t)}},9962:(e,t,n)=>{"use strict";n.d(t,{Z:()=>a});var r=n(7294),o=n(694);function a(){return(0,r.useContext)(o._)}},1610:(e,t,n)=>{"use strict";n.d(t,{OD:()=>a,eZ:()=>i});var r=n(9962),o=n(6875);function a(e,t){void 0===t&&(t={});const n=function(){const{globalData:e}=(0,r.Z)();return e}()[e];if(!n&&t.failfast)throw new Error(`Docusaurus plugin global data not found for "${e}" plugin.`);return n}function i(e,t,n){void 0===t&&(t=o.m),void 0===n&&(n={});const r=a(e),i=r?.[t];if(!i&&n.failfast)throw new Error(`Docusaurus plugin global data not found for "${e}" plugin with id "${t}".`);return i}},1048:(e,t,n)=>{"use strict";n.d(t,{Z:()=>a});var r=n(7294),o=n(8121);function a(){return(0,r.useContext)(o._)}},1270:(e,t,n)=>{"use strict";n.d(t,{Z:()=>o});var r=n(7294);const o=n(6136).Z.canUseDOM?r.useLayoutEffect:r.useEffect},5304:(e,t,n)=>{"use strict";n.d(t,{Z:()=>o});const r=e=>"object"==typeof e&&!!e&&Object.keys(e).length>0;function o(e){const t={};return function e(n,o){Object.entries(n).forEach((n=>{let[a,i]=n;const s=o?`${o}.${a}`:a;r(i)?e(i,s):t[s]=i}))}(e),t}},9656:(e,t,n)=>{"use strict";n.d(t,{_:()=>a,z:()=>i});var r=n(7294),o=n(5893);const a=r.createContext(null);function i(e){let{children:t,value:n}=e;const i=r.useContext(a),s=(0,r.useMemo)((()=>function(e){let{parent:t,value:n}=e;if(!t){if(!n)throw new Error("Unexpected: no Docusaurus route context found");if(!("plugin"in n))throw new Error("Unexpected: Docusaurus topmost route context has no `plugin` attribute");return n}const r={...t.data,...n?.data};return{plugin:t.plugin,data:r}}({parent:i,value:n})),[i,n]);return(0,o.jsx)(a.Provider,{value:s,children:t})}},868:(e,t,n)=>{"use strict";n.d(t,{Iw:()=>h,gA:()=>d,WS:()=>p,_r:()=>c,Jo:()=>g,zh:()=>u,yW:()=>m,gB:()=>f});var r=n(6550),o=n(1610);const a=e=>e.versions.find((e=>e.isLast));function i(e,t){const n=a(e);return[...e.versions.filter((e=>e!==n)),n].find((e=>!!(0,r.LX)(t,{path:e.path,exact:!1,strict:!1})))}function s(e,t){const n=i(e,t),o=n?.docs.find((e=>!!(0,r.LX)(t,{path:e.path,exact:!0,strict:!1})));return{activeVersion:n,activeDoc:o,alternateDocVersions:o?function(t){const n={};return e.versions.forEach((e=>{e.docs.forEach((r=>{r.id===t&&(n[e.name]=r)}))})),n}(o.id):{}}}const l={},c=()=>(0,o.OD)("docusaurus-plugin-content-docs")??l,u=e=>(0,o.eZ)("docusaurus-plugin-content-docs",e,{failfast:!0});function d(e){void 0===e&&(e={});const t=c(),{pathname:n}=(0,r.TH)();return function(e,t,n){void 0===n&&(n={});const o=Object.entries(e).sort(((e,t)=>t[1].path.localeCompare(e[1].path))).find((e=>{let[,n]=e;return!!(0,r.LX)(t,{path:n.path,exact:!1,strict:!1})})),a=o?{pluginId:o[0],pluginData:o[1]}:void 0;if(!a&&n.failfast)throw new Error(`Can't find active docs plugin for "${t}" pathname, while it was expected to be found. Maybe you tried to use a docs feature that can only be used on a docs-related page? Existing docs plugin paths are: ${Object.values(e).map((e=>e.path)).join(", ")}`);return a}(t,n,e)}function p(e){void 0===e&&(e={});const t=d(e),{pathname:n}=(0,r.TH)();if(!t)return;return{activePlugin:t,activeVersion:i(t.pluginData,n)}}function f(e){return u(e).versions}function m(e){const t=u(e);return a(t)}function h(e){const t=u(e),{pathname:n}=(0,r.TH)();return s(t,n)}function g(e){const t=u(e),{pathname:n}=(0,r.TH)();return function(e,t){const n=a(e);return{latestDocSuggestion:s(e,t).alternateDocVersions[n.name],latestVersionSuggestion:n}}(t,n)}},4313:(e,t,n)=>{"use strict";n.r(t),n.d(t,{default:()=>r});const r={onRouteDidUpdate(e){let{location:t,previousLocation:n}=e;!n||t.pathname===n.pathname&&t.search===n.search&&t.hash===n.hash||setTimeout((()=>{window.gtag("set","page_path",t.pathname+t.search+t.hash),window.gtag("event","page_view")}))}}},9957:(e,t,n)=>{"use strict";n.r(t),n.d(t,{default:()=>a});var r=n(4865),o=n.n(r);o().configure({showSpinner:!1});const a={onRouteUpdate(e){let{location:t,previousLocation:n}=e;if(n&&t.pathname!==n.pathname){const e=window.setTimeout((()=>{o().start()}),200);return()=>window.clearTimeout(e)}},onRouteDidUpdate(){o().done()}}},2251:(e,t,n)=>{"use strict";n.r(t);var r=n(4965),o=n(6809);!function(e){const{themeConfig:{prism:t}}=o.default,{additionalLanguages:r}=t;globalThis.Prism=e,r.forEach((e=>{"php"===e&&n(6854),n(6726)(`./prism-${e}`)})),delete globalThis.Prism}(r.p1)},3899:(e,t,n)=>{"use strict";n.d(t,{Z:()=>c});n(7294);var r=n(6905),o=n(7325),a=n(107),i=n(3699);const s={anchorWithStickyNavbar:"anchorWithStickyNavbar_LWe7",anchorWithHideOnScrollNavbar:"anchorWithHideOnScrollNavbar_WYt5"};var l=n(5893);function c(e){let{as:t,id:n,...c}=e;const{navbar:{hideOnScroll:u}}=(0,a.L)();if("h1"===t||!n)return(0,l.jsx)(t,{...c,id:void 0});const d=(0,o.I)({id:"theme.common.headingLinkTitle",message:"Direct link to {heading}",description:"Title for link to heading"},{heading:"string"==typeof c.children?c.children:n});return(0,l.jsxs)(t,{...c,className:(0,r.Z)("anchor",u?s.anchorWithHideOnScrollNavbar:s.anchorWithStickyNavbar,c.className),id:n,children:[c.children,(0,l.jsx)(i.Z,{className:"hash-link",to:`#${n}`,"aria-label":d,title:d,children:"\u200b"})]})}},4082:(e,t,n)=>{"use strict";n.d(t,{Z:()=>a});n(7294);const r={iconExternalLink:"iconExternalLink_nPIU"};var o=n(5893);function a(e){let{width:t=13.5,height:n=13.5}=e;return(0,o.jsx)("svg",{width:t,height:n,"aria-hidden":"true",viewBox:"0 0 24 24",className:r.iconExternalLink,children:(0,o.jsx)("path",{fill:"currentColor",d:"M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"})})}},8030:(e,t,n)=>{"use strict";n.d(t,{Z:()=>ci});var r=n(7294),o=n(6905),a=n(3256),i=n(5463),s=n(6550),l=n(7325),c=n(3266),u=n(5893);const d="__docusaurus_skipToContent_fallback";function p(e){e.setAttribute("tabindex","-1"),e.focus(),e.removeAttribute("tabindex")}function f(){const e=(0,r.useRef)(null),{action:t}=(0,s.k6)(),n=(0,r.useCallback)((e=>{e.preventDefault();const t=document.querySelector("main:first-of-type")??document.getElementById(d);t&&p(t)}),[]);return(0,c.S)((n=>{let{location:r}=n;e.current&&!r.hash&&"PUSH"===t&&p(e.current)})),{containerRef:e,onClick:n}}const m=(0,l.I)({id:"theme.common.skipToMainContent",description:"The skip to content label used for accessibility, allowing to rapidly navigate to main content with keyboard tab/enter navigation",message:"Skip to main content"});function h(e){const t=e.children??m,{containerRef:n,onClick:r}=f();return(0,u.jsx)("div",{ref:n,role:"region","aria-label":m,children:(0,u.jsx)("a",{...e,href:`#${d}`,onClick:r,children:t})})}var g=n(3702),y=n(8181);const b={skipToContent:"skipToContent_fXgn"};function v(){return(0,u.jsx)(h,{className:b.skipToContent})}var w=n(107),S=n(5830);function k(e){let{width:t=21,height:n=21,color:r="currentColor",strokeWidth:o=1.2,className:a,...i}=e;return(0,u.jsx)("svg",{viewBox:"0 0 15 15",width:t,height:n,...i,children:(0,u.jsx)("g",{stroke:r,strokeWidth:o,children:(0,u.jsx)("path",{d:"M.75.75l13.5 13.5M14.25.75L.75 14.25"})})})}const x={closeButton:"closeButton_CVFx"};function _(e){return(0,u.jsx)("button",{type:"button","aria-label":(0,l.I)({id:"theme.AnnouncementBar.closeButtonAriaLabel",message:"Close",description:"The ARIA label for close button of announcement bar"}),...e,className:(0,o.Z)("clean-btn close",x.closeButton,e.className),children:(0,u.jsx)(k,{width:14,height:14,strokeWidth:3.1})})}const E={content:"content_knG7"};function O(e){const{announcementBar:t}=(0,w.L)(),{content:n}=t;return(0,u.jsx)("div",{...e,className:(0,o.Z)(E.content,e.className),dangerouslySetInnerHTML:{__html:n}})}const j={announcementBar:"announcementBar_mb4j",announcementBarPlaceholder:"announcementBarPlaceholder_vyr4",announcementBarClose:"announcementBarClose_gvF7",announcementBarContent:"announcementBarContent_xLdY"};function C(){const{announcementBar:e}=(0,w.L)(),{isActive:t,close:n}=(0,S.nT)();if(!t)return null;const{backgroundColor:r,textColor:o,isCloseable:a}=e;return(0,u.jsxs)("div",{className:j.announcementBar,style:{backgroundColor:r,color:o},role:"banner",children:[a&&(0,u.jsx)("div",{className:j.announcementBarPlaceholder}),(0,u.jsx)(O,{className:j.announcementBarContent}),a&&(0,u.jsx)(_,{onClick:n,className:j.announcementBarClose})]})}var P=n(2600),T=n(2957);var I=n(3768),A=n(3086);const N=r.createContext(null);function L(e){let{children:t}=e;const n=function(){const e=(0,P.e)(),t=(0,A.HY)(),[n,o]=(0,r.useState)(!1),a=null!==t.component,i=(0,I.D9)(a);return(0,r.useEffect)((()=>{a&&!i&&o(!0)}),[a,i]),(0,r.useEffect)((()=>{a?e.shown||o(!0):o(!1)}),[e.shown,a]),(0,r.useMemo)((()=>[n,o]),[n])}();return(0,u.jsx)(N.Provider,{value:n,children:t})}function R(e){if(e.component){const t=e.component;return(0,u.jsx)(t,{...e.props})}}function D(){const e=(0,r.useContext)(N);if(!e)throw new I.i6("NavbarSecondaryMenuDisplayProvider");const[t,n]=e,o=(0,r.useCallback)((()=>n(!1)),[n]),a=(0,A.HY)();return(0,r.useMemo)((()=>({shown:t,hide:o,content:R(a)})),[o,a,t])}function F(e){let{header:t,primaryMenu:n,secondaryMenu:r}=e;const{shown:a}=D();return(0,u.jsxs)("div",{className:"navbar-sidebar",children:[t,(0,u.jsxs)("div",{className:(0,o.Z)("navbar-sidebar__items",{"navbar-sidebar__items--show-secondary":a}),children:[(0,u.jsx)("div",{className:"navbar-sidebar__item menu",children:n}),(0,u.jsx)("div",{className:"navbar-sidebar__item menu",children:r})]})]})}var M=n(9200),z=n(1048);function B(e){return(0,u.jsx)("svg",{viewBox:"0 0 24 24",width:24,height:24,...e,children:(0,u.jsx)("path",{fill:"currentColor",d:"M12,9c1.65,0,3,1.35,3,3s-1.35,3-3,3s-3-1.35-3-3S10.35,9,12,9 M12,7c-2.76,0-5,2.24-5,5s2.24,5,5,5s5-2.24,5-5 S14.76,7,12,7L12,7z M2,13l2,0c0.55,0,1-0.45,1-1s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S1.45,13,2,13z M20,13l2,0c0.55,0,1-0.45,1-1 s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S19.45,13,20,13z M11,2v2c0,0.55,0.45,1,1,1s1-0.45,1-1V2c0-0.55-0.45-1-1-1S11,1.45,11,2z M11,20v2c0,0.55,0.45,1,1,1s1-0.45,1-1v-2c0-0.55-0.45-1-1-1C11.45,19,11,19.45,11,20z M5.99,4.58c-0.39-0.39-1.03-0.39-1.41,0 c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0s0.39-1.03,0-1.41L5.99,4.58z M18.36,16.95 c-0.39-0.39-1.03-0.39-1.41,0c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0c0.39-0.39,0.39-1.03,0-1.41 L18.36,16.95z M19.42,5.99c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06c-0.39,0.39-0.39,1.03,0,1.41 s1.03,0.39,1.41,0L19.42,5.99z M7.05,18.36c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06 c-0.39,0.39-0.39,1.03,0,1.41s1.03,0.39,1.41,0L7.05,18.36z"})})}function U(e){return(0,u.jsx)("svg",{viewBox:"0 0 24 24",width:24,height:24,...e,children:(0,u.jsx)("path",{fill:"currentColor",d:"M9.37,5.51C9.19,6.15,9.1,6.82,9.1,7.5c0,4.08,3.32,7.4,7.4,7.4c0.68,0,1.35-0.09,1.99-0.27C17.45,17.19,14.93,19,12,19 c-3.86,0-7-3.14-7-7C5,9.07,6.81,6.55,9.37,5.51z M12,3c-4.97,0-9,4.03-9,9s4.03,9,9,9s9-4.03,9-9c0-0.46-0.04-0.92-0.1-1.36 c-0.98,1.37-2.58,2.26-4.4,2.26c-2.98,0-5.4-2.42-5.4-5.4c0-1.81,0.89-3.42,2.26-4.4C12.92,3.04,12.46,3,12,3L12,3z"})})}const $={toggle:"toggle_vylO",toggleButton:"toggleButton_gllP",darkToggleIcon:"darkToggleIcon_wfgR",lightToggleIcon:"lightToggleIcon_pyhR",toggleButtonDisabled:"toggleButtonDisabled_aARS"};function q(e){let{className:t,buttonClassName:n,value:r,onChange:a}=e;const i=(0,z.Z)(),s=(0,l.I)({message:"Switch between dark and light mode (currently {mode})",id:"theme.colorToggle.ariaLabel",description:"The ARIA label for the navbar color mode toggle"},{mode:"dark"===r?(0,l.I)({message:"dark mode",id:"theme.colorToggle.ariaLabel.mode.dark",description:"The name for the dark color mode"}):(0,l.I)({message:"light mode",id:"theme.colorToggle.ariaLabel.mode.light",description:"The name for the light color mode"})});return(0,u.jsx)("div",{className:(0,o.Z)($.toggle,t),children:(0,u.jsxs)("button",{className:(0,o.Z)("clean-btn",$.toggleButton,!i&&$.toggleButtonDisabled,n),type:"button",onClick:()=>a("dark"===r?"light":"dark"),disabled:!i,title:s,"aria-label":s,"aria-live":"polite",children:[(0,u.jsx)(B,{className:(0,o.Z)($.toggleIcon,$.lightToggleIcon)}),(0,u.jsx)(U,{className:(0,o.Z)($.toggleIcon,$.darkToggleIcon)})]})})}const H=r.memo(q),Q={darkNavbarColorModeToggle:"darkNavbarColorModeToggle_X3D1"};function V(e){let{className:t}=e;const n=(0,w.L)().navbar.style,r=(0,w.L)().colorMode.disableSwitch,{colorMode:o,setColorMode:a}=(0,M.I)();return r?null:(0,u.jsx)(H,{className:t,buttonClassName:"dark"===n?Q.darkNavbarColorModeToggle:void 0,value:o,onChange:a})}var W=n(6811);function Z(){return(0,u.jsx)(W.Z,{className:"navbar__brand",imageClassName:"navbar__logo",titleClassName:"navbar__title text--truncate"})}function G(){const e=(0,P.e)();return(0,u.jsx)("button",{type:"button","aria-label":(0,l.I)({id:"theme.docs.sidebar.closeSidebarButtonAriaLabel",message:"Close navigation bar",description:"The ARIA label for close button of mobile sidebar"}),className:"clean-btn navbar-sidebar__close",onClick:()=>e.toggle(),children:(0,u.jsx)(k,{color:"var(--ifm-color-emphasis-600)"})})}function K(){return(0,u.jsxs)("div",{className:"navbar-sidebar__brand",children:[(0,u.jsx)(Z,{}),(0,u.jsx)(V,{className:"margin-right--md"}),(0,u.jsx)(G,{})]})}var Y=n(3699),J=n(9524),X=n(2735);function ee(e,t){return void 0!==e&&void 0!==t&&new RegExp(e,"gi").test(t)}var te=n(4082);function ne(e){let{activeBasePath:t,activeBaseRegex:n,to:r,href:o,label:a,html:i,isDropdownLink:s,prependBaseUrlToHref:l,...c}=e;const d=(0,J.Z)(r),p=(0,J.Z)(t),f=(0,J.Z)(o,{forcePrependBaseUrl:!0}),m=a&&o&&!(0,X.Z)(o),h=i?{dangerouslySetInnerHTML:{__html:i}}:{children:(0,u.jsxs)(u.Fragment,{children:[a,m&&(0,u.jsx)(te.Z,{...s&&{width:12,height:12}})]})};return o?(0,u.jsx)(Y.Z,{href:l?f:o,...c,...h}):(0,u.jsx)(Y.Z,{to:d,isNavLink:!0,...(t||n)&&{isActive:(e,t)=>n?ee(n,t.pathname):t.pathname.startsWith(p)},...c,...h})}function re(e){let{className:t,isDropdownItem:n=!1,...r}=e;const a=(0,u.jsx)(ne,{className:(0,o.Z)(n?"dropdown__link":"navbar__item navbar__link",t),isDropdownLink:n,...r});return n?(0,u.jsx)("li",{children:a}):a}function oe(e){let{className:t,isDropdownItem:n,...r}=e;return(0,u.jsx)("li",{className:"menu__list-item",children:(0,u.jsx)(ne,{className:(0,o.Z)("menu__link",t),...r})})}function ae(e){let{mobile:t=!1,position:n,...r}=e;const o=t?oe:re;return(0,u.jsx)(o,{...r,activeClassName:r.activeClassName??(t?"menu__link--active":"navbar__link--active")})}var ie=n(4639),se=n(9003),le=n(9962);const ce={dropdownNavbarItemMobile:"dropdownNavbarItemMobile_S0Fm"};function ue(e,t){return e.some((e=>function(e,t){return!!(0,se.Mg)(e.to,t)||!!ee(e.activeBaseRegex,t)||!(!e.activeBasePath||!t.startsWith(e.activeBasePath))}(e,t)))}function de(e){let{items:t,position:n,className:a,onClick:i,...s}=e;const l=(0,r.useRef)(null),[c,d]=(0,r.useState)(!1);return(0,r.useEffect)((()=>{const e=e=>{l.current&&!l.current.contains(e.target)&&d(!1)};return document.addEventListener("mousedown",e),document.addEventListener("touchstart",e),document.addEventListener("focusin",e),()=>{document.removeEventListener("mousedown",e),document.removeEventListener("touchstart",e),document.removeEventListener("focusin",e)}}),[l]),(0,u.jsxs)("div",{ref:l,className:(0,o.Z)("navbar__item","dropdown","dropdown--hoverable",{"dropdown--right":"right"===n,"dropdown--show":c}),children:[(0,u.jsx)(ne,{"aria-haspopup":"true","aria-expanded":c,role:"button",href:s.to?void 0:"#",className:(0,o.Z)("navbar__link",a),...s,onClick:s.to?void 0:e=>e.preventDefault(),onKeyDown:e=>{"Enter"===e.key&&(e.preventDefault(),d(!c))},children:s.children??s.label}),(0,u.jsx)("ul",{className:"dropdown__menu",children:t.map(((e,t)=>(0,r.createElement)(Sa,{isDropdownItem:!0,activeClassName:"dropdown__link--active",...e,key:t})))})]})}function pe(e){let{items:t,className:n,position:a,onClick:i,...l}=e;const c=function(){const{siteConfig:{baseUrl:e}}=(0,le.Z)(),{pathname:t}=(0,s.TH)();return t.replace(e,"/")}(),d=ue(t,c),{collapsed:p,toggleCollapsed:f,setCollapsed:m}=(0,ie.u)({initialState:()=>!d});return(0,r.useEffect)((()=>{d&&m(!d)}),[c,d,m]),(0,u.jsxs)("li",{className:(0,o.Z)("menu__list-item",{"menu__list-item--collapsed":p}),children:[(0,u.jsx)(ne,{role:"button",className:(0,o.Z)(ce.dropdownNavbarItemMobile,"menu__link menu__link--sublist menu__link--sublist-caret",n),...l,onClick:e=>{e.preventDefault(),f()},children:l.children??l.label}),(0,u.jsx)(ie.z,{lazy:!0,as:"ul",className:"menu__list",collapsed:p,children:t.map(((e,t)=>(0,r.createElement)(Sa,{mobile:!0,isDropdownItem:!0,onClick:i,activeClassName:"menu__link--active",...e,key:t})))})]})}function fe(e){let{mobile:t=!1,...n}=e;const r=t?pe:de;return(0,u.jsx)(r,{...n})}var me=n(626);function he(e){let{width:t=20,height:n=20,...r}=e;return(0,u.jsx)("svg",{viewBox:"0 0 24 24",width:t,height:n,"aria-hidden":!0,...r,children:(0,u.jsx)("path",{fill:"currentColor",d:"M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"})})}const ge="iconLanguage_nlXk";var ye=n(3935);function be(e,t){var n=void 0;return function(){for(var r=arguments.length,o=new Array(r),a=0;ae.length)&&(t=e.length);for(var n=0,r=new Array(t);ne.length)&&(t=e.length);for(var n=0,r=new Array(t);n=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function Ae(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Ne(e){for(var t=1;t=3||2===n&&r>=4||1===n&&r>=10}(e);function n(n,r,o){if(t&&void 0!==o){var a=o[0].__autocomplete_algoliaCredentials,i={"X-Algolia-Application-Id":a.appId,"X-Algolia-API-Key":a.apiKey};e.apply(void 0,[n].concat(Pe(r),[{headers:i}]))}else e.apply(void 0,[n].concat(Pe(r)))}return{init:function(t,n){e("init",{appId:t,apiKey:n})},setUserToken:function(t){e("setUserToken",t)},clickedObjectIDsAfterSearch:function(){for(var e=arguments.length,t=new Array(e),r=0;r0&&n("clickedObjectIDsAfterSearch",Re(t),t[0].items)},clickedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),r=0;r0&&n("clickedObjectIDs",Re(t),t[0].items)},clickedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r0&&e.apply(void 0,["clickedFilters"].concat(n))},convertedObjectIDsAfterSearch:function(){for(var e=arguments.length,t=new Array(e),r=0;r0&&n("convertedObjectIDsAfterSearch",Re(t),t[0].items)},convertedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),r=0;r0&&n("convertedObjectIDs",Re(t),t[0].items)},convertedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r0&&e.apply(void 0,["convertedFilters"].concat(n))},viewedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),r=0;r0&&t.reduce((function(e,t){var n=t.items,r=Ie(t,je);return[].concat(Pe(e),Pe(function(e){for(var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:20,n=[],r=0;r0&&e.apply(void 0,["viewedFilters"].concat(n))}}}function Fe(e){var t=e.items.reduce((function(e,t){var n;return e[t.__autocomplete_indexName]=(null!==(n=e[t.__autocomplete_indexName])&&void 0!==n?n:[]).concat(t),e}),{});return Object.keys(t).map((function(e){return{index:e,items:t[e],algoliaSource:["autocomplete"]}}))}function Me(e){return e.objectID&&e.__autocomplete_indexName&&e.__autocomplete_queryID}function ze(e){return ze="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},ze(e)}function Be(e){return function(e){if(Array.isArray(e))return Ue(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return Ue(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return Ue(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Ue(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n0&&We({onItemsChange:r,items:n,insights:l,state:t}))}}),0);return{name:"aa.algoliaInsightsPlugin",subscribe:function(e){var t=e.setContext,n=e.onSelect,r=e.onActive;function c(e){t({algoliaInsightsPlugin:{__algoliaSearchParameters:qe(qe({},i?{clickAnalytics:!0}:{}),e?{userToken:Ke(e)}:{}),insights:l}})}s("addAlgoliaAgent","insights-plugin"),c(),s("onUserTokenChange",c),s("getUserToken",null,(function(e,t){c(t)})),n((function(e){var t=e.item,n=e.state,r=e.event,a=e.source;Me(t)&&o({state:n,event:r,insights:l,item:t,insightsEvents:[qe({eventName:"Item Selected"},xe({item:t,items:a.getItems().filter(Me)}))]})})),r((function(e){var t=e.item,n=e.source,r=e.state,o=e.event;Me(t)&&a({state:r,event:o,insights:l,item:t,insightsEvents:[qe({eventName:"Item Active"},xe({item:t,items:n.getItems().filter(Me)}))]})}))},onStateChange:function(e){var t=e.state;u({state:t})},__autocomplete_pluginOptions:e}}function Ge(){var e,t=arguments.length>1?arguments[1]:void 0;return[].concat(Be(arguments.length>0&&void 0!==arguments[0]?arguments[0]:[]),["autocomplete-internal"],Be(null!==(e=t.algoliaInsightsPlugin)&&void 0!==e&&e.__automaticInsights?["autocomplete-automatic"]:[]))}function Ke(e){return"number"==typeof e?e.toString():e}function Ye(e){return Ye="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Ye(e)}function Je(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Xe(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Ye(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Ye(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Ye(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function et(e,t,n){var r,o=t.initialState;return{getState:function(){return o},dispatch:function(r,a){var i=function(e){for(var t=1;te.length)&&(t=e.length);for(var n=0,r=new Array(t);n0},reshape:function(e){return e.sources}},e),{},{id:null!==(n=e.id)&&void 0!==n?n:lt(),plugins:o,initialState:yt({activeItemId:null,query:"",completion:null,collections:[],isOpen:!1,status:"idle",context:{}},e.initialState),onStateChange:function(t){var n;null===(n=e.onStateChange)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onStateChange)||void 0===n?void 0:n.call(e,t)}))},onSubmit:function(t){var n;null===(n=e.onSubmit)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onSubmit)||void 0===n?void 0:n.call(e,t)}))},onReset:function(t){var n;null===(n=e.onReset)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onReset)||void 0===n?void 0:n.call(e,t)}))},getSources:function(n){return Promise.all([].concat(mt(o.map((function(e){return e.getSources}))),[e.getSources]).filter(Boolean).map((function(e){return function(e,t){var n=[];return Promise.resolve(e(t)).then((function(e){return Array.isArray(e),Promise.all(e.filter((function(e){return Boolean(e)})).map((function(e){if(e.sourceId,n.includes(e.sourceId))throw new Error("[Autocomplete] The `sourceId` ".concat(JSON.stringify(e.sourceId)," is not unique."));n.push(e.sourceId);var t={getItemInputValue:function(e){return e.state.query},getItemUrl:function(){},onSelect:function(e){(0,e.setIsOpen)(!1)},onActive:ke,onResolve:ke};Object.keys(t).forEach((function(e){t[e].__default=!0}));var r=ut(ut({},t),e);return Promise.resolve(r)})))}))}(e,n)}))).then((function(e){return tt(e)})).then((function(e){return e.map((function(e){return yt(yt({},e),{},{onSelect:function(n){e.onSelect(n),t.forEach((function(e){var t;return null===(t=e.onSelect)||void 0===t?void 0:t.call(e,n)}))},onActive:function(n){e.onActive(n),t.forEach((function(e){var t;return null===(t=e.onActive)||void 0===t?void 0:t.call(e,n)}))},onResolve:function(n){e.onResolve(n),t.forEach((function(e){var t;return null===(t=e.onResolve)||void 0===t?void 0:t.call(e,n)}))}})}))}))},navigator:yt({navigate:function(e){var t=e.itemUrl;r.location.assign(t)},navigateNewTab:function(e){var t=e.itemUrl,n=r.open(t,"_blank","noopener");null==n||n.focus()},navigateNewWindow:function(e){var t=e.itemUrl;r.open(t,"_blank","noopener")}},e.navigator)})}function wt(e){return wt="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},wt(e)}function St(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function kt(e){for(var t=1;te.length)&&(t=e.length);for(var n=0,r=new Array(t);n=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var Qt,Vt,Wt,Zt=null,Gt=(Qt=-1,Vt=-1,Wt=void 0,function(e){var t=++Qt;return Promise.resolve(e).then((function(e){return Wt&&t=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var on=/((gt|sm)-|galaxy nexus)|samsung[- ]|samsungbrowser/i;function an(e){return an="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},an(e)}var sn=["props","refresh","store"],ln=["inputElement","formElement","panelElement"],cn=["inputElement"],un=["inputElement","maxLength"],dn=["source"],pn=["item","source"];function fn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function mn(e){for(var t=1;t=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function yn(e){var t=e.props,n=e.refresh,r=e.store,o=gn(e,sn);return{getEnvironmentProps:function(e){var n=e.inputElement,o=e.formElement,a=e.panelElement;function i(e){!r.getState().isOpen&&r.pendingRequests.isEmpty()||e.target===n||!1===[o,a].some((function(t){return n=t,r=e.target,n===r||n.contains(r);var n,r}))&&(r.dispatch("blur",null),t.debug||r.pendingRequests.cancelAll())}return mn({onTouchStart:i,onMouseDown:i,onTouchMove:function(e){!1!==r.getState().isOpen&&n===t.environment.document.activeElement&&e.target!==n&&n.blur()}},gn(e,ln))},getRootProps:function(e){return mn({role:"combobox","aria-expanded":r.getState().isOpen,"aria-haspopup":"listbox","aria-owns":r.getState().isOpen?r.getState().collections.map((function(e){var n=e.source;return Yt(t.id,"list",n)})).join(" "):void 0,"aria-labelledby":Yt(t.id,"label")},e)},getFormProps:function(e){e.inputElement;return mn({action:"",noValidate:!0,role:"search",onSubmit:function(a){var i;a.preventDefault(),t.onSubmit(mn({event:a,refresh:n,state:r.getState()},o)),r.dispatch("submit",null),null===(i=e.inputElement)||void 0===i||i.blur()},onReset:function(a){var i;a.preventDefault(),t.onReset(mn({event:a,refresh:n,state:r.getState()},o)),r.dispatch("reset",null),null===(i=e.inputElement)||void 0===i||i.focus()}},gn(e,cn))},getLabelProps:function(e){return mn({htmlFor:Yt(t.id,"input"),id:Yt(t.id,"label")},e)},getInputProps:function(e){var a;function i(e){(t.openOnFocus||Boolean(r.getState().query))&&Kt(mn({event:e,props:t,query:r.getState().completion||r.getState().query,refresh:n,store:r},o)),r.dispatch("focus",null)}var s=e||{},l=(s.inputElement,s.maxLength),c=void 0===l?512:l,u=gn(s,un),d=Mt(r.getState()),p=function(e){return Boolean(e&&e.match(on))}((null===(a=t.environment.navigator)||void 0===a?void 0:a.userAgent)||""),f=t.enterKeyHint||(null!=d&&d.itemUrl&&!p?"go":"search");return mn({"aria-autocomplete":"both","aria-activedescendant":r.getState().isOpen&&null!==r.getState().activeItemId?Yt(t.id,"item-".concat(r.getState().activeItemId),null==d?void 0:d.source):void 0,"aria-controls":r.getState().isOpen?r.getState().collections.map((function(e){var n=e.source;return Yt(t.id,"list",n)})).join(" "):void 0,"aria-labelledby":Yt(t.id,"label"),value:r.getState().completion||r.getState().query,id:Yt(t.id,"input"),autoComplete:"off",autoCorrect:"off",autoCapitalize:"off",enterKeyHint:f,spellCheck:"false",autoFocus:t.autoFocus,placeholder:t.placeholder,maxLength:c,type:"search",onChange:function(e){Kt(mn({event:e,props:t,query:e.currentTarget.value.slice(0,c),refresh:n,store:r},o))},onKeyDown:function(e){!function(e){var t=e.event,n=e.props,r=e.refresh,o=e.store,a=rn(e,Xt);if("ArrowUp"===t.key||"ArrowDown"===t.key){var i=function(){var e=Mt(o.getState()),t=n.environment.document.getElementById(Yt(n.id,"item-".concat(o.getState().activeItemId),null==e?void 0:e.source));t&&(t.scrollIntoViewIfNeeded?t.scrollIntoViewIfNeeded(!1):t.scrollIntoView(!1))},s=function(){var e=Mt(o.getState());if(null!==o.getState().activeItemId&&e){var n=e.item,i=e.itemInputValue,s=e.itemUrl,l=e.source;l.onActive(tn({event:t,item:n,itemInputValue:i,itemUrl:s,refresh:r,source:l,state:o.getState()},a))}};t.preventDefault(),!1===o.getState().isOpen&&(n.openOnFocus||Boolean(o.getState().query))?Kt(tn({event:t,props:n,query:o.getState().query,refresh:r,store:o},a)).then((function(){o.dispatch(t.key,{nextActiveItemId:n.defaultActiveItemId}),s(),setTimeout(i,0)})):(o.dispatch(t.key,{}),s(),i())}else if("Escape"===t.key)t.preventDefault(),o.dispatch(t.key,null),o.pendingRequests.cancelAll();else if("Tab"===t.key)o.dispatch("blur",null),o.pendingRequests.cancelAll();else if("Enter"===t.key){if(null===o.getState().activeItemId||o.getState().collections.every((function(e){return 0===e.items.length})))return void(n.debug||o.pendingRequests.cancelAll());t.preventDefault();var l=Mt(o.getState()),c=l.item,u=l.itemInputValue,d=l.itemUrl,p=l.source;if(t.metaKey||t.ctrlKey)void 0!==d&&(p.onSelect(tn({event:t,item:c,itemInputValue:u,itemUrl:d,refresh:r,source:p,state:o.getState()},a)),n.navigator.navigateNewTab({itemUrl:d,item:c,state:o.getState()}));else if(t.shiftKey)void 0!==d&&(p.onSelect(tn({event:t,item:c,itemInputValue:u,itemUrl:d,refresh:r,source:p,state:o.getState()},a)),n.navigator.navigateNewWindow({itemUrl:d,item:c,state:o.getState()}));else if(t.altKey);else{if(void 0!==d)return p.onSelect(tn({event:t,item:c,itemInputValue:u,itemUrl:d,refresh:r,source:p,state:o.getState()},a)),void n.navigator.navigate({itemUrl:d,item:c,state:o.getState()});Kt(tn({event:t,nextState:{isOpen:!1},props:n,query:u,refresh:r,store:o},a)).then((function(){p.onSelect(tn({event:t,item:c,itemInputValue:u,itemUrl:d,refresh:r,source:p,state:o.getState()},a))}))}}}(mn({event:e,props:t,refresh:n,store:r},o))},onFocus:i,onBlur:ke,onClick:function(n){e.inputElement!==t.environment.document.activeElement||r.getState().isOpen||i(n)}},u)},getPanelProps:function(e){return mn({onMouseDown:function(e){e.preventDefault()},onMouseLeave:function(){r.dispatch("mouseleave",null)}},e)},getListProps:function(e){var n=e||{},r=n.source,o=gn(n,dn);return mn({role:"listbox","aria-labelledby":Yt(t.id,"label"),id:Yt(t.id,"list",r)},o)},getItemProps:function(e){var a=e.item,i=e.source,s=gn(e,pn);return mn({id:Yt(t.id,"item-".concat(a.__autocomplete_id),i),role:"option","aria-selected":r.getState().activeItemId===a.__autocomplete_id,onMouseMove:function(e){if(a.__autocomplete_id!==r.getState().activeItemId){r.dispatch("mousemove",a.__autocomplete_id);var t=Mt(r.getState());if(null!==r.getState().activeItemId&&t){var i=t.item,s=t.itemInputValue,l=t.itemUrl,c=t.source;c.onActive(mn({event:e,item:i,itemInputValue:s,itemUrl:l,refresh:n,source:c,state:r.getState()},o))}}},onMouseDown:function(e){e.preventDefault()},onClick:function(e){var s=i.getItemInputValue({item:a,state:r.getState()}),l=i.getItemUrl({item:a,state:r.getState()});(l?Promise.resolve():Kt(mn({event:e,nextState:{isOpen:!1},props:t,query:s,refresh:n,store:r},o))).then((function(){i.onSelect(mn({event:e,item:a,itemInputValue:s,itemUrl:l,refresh:n,source:i,state:r.getState()},o))}))}},s)}}}var bn="1.13.0",vn=[{segment:"autocomplete-core",version:bn}];function wn(e){return wn="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},wn(e)}function Sn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function kn(e){for(var t=1;t=n?null===r?null:0:o}function jn(e){return jn="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},jn(e)}function Cn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Pn(e){for(var t=1;t=5&&((o||!e&&5===r)&&(i.push(r,0,o,n),r=6),e&&(i.push(r,e,0,n),r=6)),o=""},l=0;l"===t?(r=1,o=""):o=t+o[0]:a?t===a?a="":o+=t:'"'===t||"'"===t?a=t:">"===t?(s(),r=1):r&&("="===t?(r=5,n=o,o=""):"/"===t&&(r<5||">"===e[l][c+1])?(s(),3===r&&(i=i[0]),r=i,(i=i[0]).push(2,0,r),r=0):" "===t||"\t"===t||"\n"===t||"\r"===t?(s(),r=2):o+=t),3===r&&"!--"===o&&(r=4,i=i[0])}return s(),i}(e)),t),arguments,[])).length>1?t:t[0]}var Bn=function(e){var t=e.environment,n=t.document.createElementNS("http://www.w3.org/2000/svg","svg");n.setAttribute("class","aa-SubmitIcon"),n.setAttribute("viewBox","0 0 24 24"),n.setAttribute("width","20"),n.setAttribute("height","20"),n.setAttribute("fill","currentColor");var r=t.document.createElementNS("http://www.w3.org/2000/svg","path");return r.setAttribute("d","M16.041 15.856c-0.034 0.026-0.067 0.055-0.099 0.087s-0.060 0.064-0.087 0.099c-1.258 1.213-2.969 1.958-4.855 1.958-1.933 0-3.682-0.782-4.95-2.050s-2.050-3.017-2.050-4.95 0.782-3.682 2.050-4.95 3.017-2.050 4.95-2.050 3.682 0.782 4.95 2.050 2.050 3.017 2.050 4.95c0 1.886-0.745 3.597-1.959 4.856zM21.707 20.293l-3.675-3.675c1.231-1.54 1.968-3.493 1.968-5.618 0-2.485-1.008-4.736-2.636-6.364s-3.879-2.636-6.364-2.636-4.736 1.008-6.364 2.636-2.636 3.879-2.636 6.364 1.008 4.736 2.636 6.364 3.879 2.636 6.364 2.636c2.125 0 4.078-0.737 5.618-1.968l3.675 3.675c0.391 0.391 1.024 0.391 1.414 0s0.391-1.024 0-1.414z"),n.appendChild(r),n},Un=function(e){var t=e.environment,n=t.document.createElementNS("http://www.w3.org/2000/svg","svg");n.setAttribute("class","aa-ClearIcon"),n.setAttribute("viewBox","0 0 24 24"),n.setAttribute("width","18"),n.setAttribute("height","18"),n.setAttribute("fill","currentColor");var r=t.document.createElementNS("http://www.w3.org/2000/svg","path");return r.setAttribute("d","M5.293 6.707l5.293 5.293-5.293 5.293c-0.391 0.391-0.391 1.024 0 1.414s1.024 0.391 1.414 0l5.293-5.293 5.293 5.293c0.391 0.391 1.024 0.391 1.414 0s0.391-1.024 0-1.414l-5.293-5.293 5.293-5.293c0.391-0.391 0.391-1.024 0-1.414s-1.024-0.391-1.414 0l-5.293 5.293-5.293-5.293c-0.391-0.391-1.024-0.391-1.414 0s-0.391 1.024 0 1.414z"),n.appendChild(r),n},$n=function(e){var t=e.environment.document.createElementNS("http://www.w3.org/2000/svg","svg");return t.setAttribute("class","aa-LoadingIcon"),t.setAttribute("viewBox","0 0 100 100"),t.setAttribute("width","20"),t.setAttribute("height","20"),t.innerHTML='\n \n',t},qn=["ontouchstart","ontouchend","ontouchmove","ontouchcancel"];function Hn(e,t,n){e[t]=null===n?"":"number"!=typeof n?n:n+"px"}function Qn(e){this._listeners[e.type](e)}function Vn(e,t,n){var r,o,a=e[t];if("style"===t)if("string"==typeof n)e.style=n;else if(null===n)e.style="";else for(t in n)a&&n[t]===a[t]||Hn(e.style,t,n[t]);else"o"===t[0]&&"n"===t[1]?(r=t!==(t=t.replace(/Capture$/,"")),((o=t.toLowerCase())in e||qn.includes(o))&&(t=o),t=t.slice(2),e._listeners||(e._listeners={}),e._listeners[t]=n,n?a||e.addEventListener(t,Qn,r):e.removeEventListener(t,Qn,r)):"list"!==t&&"tagName"!==t&&"form"!==t&&"type"!==t&&"size"!==t&&"download"!==t&&"href"!==t&&t in e?e[t]=null==n?"":n:"function"!=typeof n&&"dangerouslySetInnerHTML"!==t&&(null==n||!1===n&&!/^ar/.test(t)?e.removeAttribute(t):e.setAttribute(t,n))}function Wn(e){return"onChange"===e?"onInput":e}function Zn(e,t){for(var n in t)Vn(e,Wn(n),t[n])}function Gn(e,t){for(var n in t)"o"===n[0]&&"n"===n[1]||Vn(e,Wn(n),t[n])}var Kn=["children"];function Yn(e){return function(e){if(Array.isArray(e))return Jn(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return Jn(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return Jn(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Jn(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function er(e){return function(t,n){var r=n.children,o=void 0===r?[]:r,a=Xn(n,Kn),i=e.document.createElement(t);return Zn(i,a),i.append.apply(i,Yn(o)),i}}function tr(e){return tr="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},tr(e)}var nr=["autocompleteScopeApi","environment","classNames","getInputProps","getInputPropsCore","isDetached","state"];function rr(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function or(e){for(var t=1;t=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var sr=function(e){var t=e.autocompleteScopeApi,n=e.environment,r=(e.classNames,e.getInputProps),o=e.getInputPropsCore,a=e.isDetached,i=e.state,s=ir(e,nr),l=er(n)("input",s),c=r(or({state:i,props:o({inputElement:l}),inputElement:l},t));return Zn(l,or(or({},c),{},{onKeyDown:function(e){a&&"Tab"===e.key||c.onKeyDown(e)}})),l};function lr(e){return lr="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},lr(e)}function cr(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function ur(e){for(var t=1;t2&&(i.children=arguments.length>3?pr.call(arguments,2):n),"function"==typeof e&&null!=e.defaultProps)for(a in e.defaultProps)void 0===i[a]&&(i[a]=e.defaultProps[a]);return Or(e,i,r,o,null)}function Or(e,t,n,r,o){var a={type:e,props:t,key:n,ref:r,__k:null,__:null,__b:0,__e:null,__d:void 0,__c:null,constructor:void 0,__v:null==o?++mr:o,__i:-1,__u:0};return null==o&&null!=fr.vnode&&fr.vnode(a),a}function jr(e){return e.children}function Cr(e,t){this.props=e,this.context=t}function Pr(e,t){if(null==t)return e.__?Pr(e.__,e.__i+1):null;for(var n;tt&&hr.sort(br));Ar.__r=0}function Nr(e,t,n,r,o,a,i,s,l,c,u){var d,p,f,m,h,g=r&&r.__k||wr,y=t.length;for(n.__d=l,Lr(n,t,g),l=n.__d,d=0;d0?Or(o.type,o.props,o.key,o.ref?o.ref:null,o.__v):o)?(o.__=e,o.__b=e.__b+1,s=Dr(o,n,i=r+d,u),o.__i=s,a=null,-1!==s&&(u--,(a=n[s])&&(a.__u|=131072)),null==a||null===a.__v?(-1==s&&d--,"function"!=typeof o.type&&(o.__u|=65536)):s!==i&&(s===i+1?d++:s>i?u>l-i?d+=s-i:d--:d=s(null!=l&&0==(131072&l.__u)?1:0))for(;i>=0||s=0){if((l=t[i])&&0==(131072&l.__u)&&o==l.key&&a===l.type)return i;i--}if(s0&&void 0!==arguments[0]?arguments[0]:[];return{get:function(){return e},add:function(t){var n=e[e.length-1];(null==n?void 0:n.isHighlighted)===t.isHighlighted?e[e.length-1]={value:n.value+t.value,isHighlighted:n.isHighlighted}:e.push(t)}}}(n?[{value:n,isHighlighted:!1}]:[]);return t.forEach((function(e){var t=e.split(Kr);r.add({value:t[0],isHighlighted:!0}),""!==t[1]&&r.add({value:t[1],isHighlighted:!1})})),r.get()}function Jr(e){return function(e){if(Array.isArray(e))return Xr(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return Xr(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return Xr(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Xr(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n",""":'"',"'":"'"},ro=new RegExp(/\w/i),oo=/&(amp|quot|lt|gt|#39);/g,ao=RegExp(oo.source);function io(e,t){var n,r,o,a=e[t],i=(null===(n=e[t+1])||void 0===n?void 0:n.isHighlighted)||!0,s=(null===(r=e[t-1])||void 0===r?void 0:r.isHighlighted)||!0;return ro.test((o=a.value)&&ao.test(o)?o.replace(oo,(function(e){return no[e]})):o)||s!==i?a.isHighlighted:s}function so(e){return so="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},so(e)}function lo(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function co(e){for(var t=1;te.length)&&(t=e.length);for(var n=0,r=new Array(t);n=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var jo={clearButton:"aa-ClearButton",detachedCancelButton:"aa-DetachedCancelButton",detachedContainer:"aa-DetachedContainer",detachedFormContainer:"aa-DetachedFormContainer",detachedOverlay:"aa-DetachedOverlay",detachedSearchButton:"aa-DetachedSearchButton",detachedSearchButtonIcon:"aa-DetachedSearchButtonIcon",detachedSearchButtonPlaceholder:"aa-DetachedSearchButtonPlaceholder",detachedSearchButtonQuery:"aa-DetachedSearchButtonQuery",form:"aa-Form",input:"aa-Input",inputWrapper:"aa-InputWrapper",inputWrapperPrefix:"aa-InputWrapperPrefix",inputWrapperSuffix:"aa-InputWrapperSuffix",item:"aa-Item",label:"aa-Label",list:"aa-List",loadingIndicator:"aa-LoadingIndicator",panel:"aa-Panel",panelLayout:"aa-PanelLayout aa-Panel--scrollable",root:"aa-Autocomplete",source:"aa-Source",sourceFooter:"aa-SourceFooter",sourceHeader:"aa-SourceHeader",sourceNoResults:"aa-SourceNoResults",submitButton:"aa-SubmitButton"},Co=function(e,t){var n=e.children;(0,e.render)(n,t)},Po={createElement:Er,Fragment:jr,render:Wr};function To(e){var t=e.panelPlacement,n=e.container,r=e.form,o=e.environment,a=n.getBoundingClientRect(),i=(o.pageYOffset||o.document.documentElement.scrollTop||o.document.body.scrollTop||0)+a.top+a.height;switch(t){case"start":return{top:i,left:a.left};case"end":return{top:i,right:o.document.documentElement.clientWidth-(a.left+a.width)};case"full-width":return{top:i,left:0,right:0,width:"unset",maxWidth:"unset"};case"input-wrapper-width":var s=r.getBoundingClientRect();return{top:i,left:s.left,right:o.document.documentElement.clientWidth-(s.left+s.width),width:"unset",maxWidth:"unset"};default:throw new Error("[Autocomplete] The `panelPlacement` value ".concat(JSON.stringify(t)," is not valid."))}}function Io(e){return Io="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Io(e)}function Ao(){return Ao=Object.assign?Object.assign.bind():function(e){for(var t=1;te.length)&&(t=e.length);for(var n=0,r=new Array(t);ne.length)&&(t=e.length);for(var n=0,r=new Array(t);n=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);for(r=0;r=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function Yo(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Jo(e){for(var t=1;t0;if(!p.value.core.openOnFocus&&!t.query)return n;var r=Boolean(c.current||p.value.renderer.renderNoResults);return!n&&r||n},__autocomplete_metadata:{userAgents:Do,options:e}}))})),h=ve(Jo({collections:[],completion:null,context:{},isOpen:!1,query:"",activeItemId:null,status:"idle"},p.value.core.initialState)),g={getEnvironmentProps:p.value.renderer.getEnvironmentProps,getFormProps:p.value.renderer.getFormProps,getInputProps:p.value.renderer.getInputProps,getItemProps:p.value.renderer.getItemProps,getLabelProps:p.value.renderer.getLabelProps,getListProps:p.value.renderer.getListProps,getPanelProps:p.value.renderer.getPanelProps,getRootProps:p.value.renderer.getRootProps},y={setActiveItemId:m.value.setActiveItemId,setQuery:m.value.setQuery,setCollections:m.value.setCollections,setIsOpen:m.value.setIsOpen,setStatus:m.value.setStatus,setContext:m.value.setContext,refresh:m.value.refresh,navigator:m.value.navigator},b=s((function(){return zn.bind(p.value.renderer.renderer.createElement)})),v=s((function(){return function(e){var t=e.autocomplete,n=e.autocompleteScopeApi,r=e.classNames,o=e.environment,a=e.isDetached,i=e.placeholder,s=void 0===i?"Search":i,l=e.propGetters,c=e.setIsModalOpen,u=e.state,d=e.translations,p=er(o),f=l.getRootProps(ur({state:u,props:t.getRootProps({})},n)),m=p("div",ur({class:r.root},f)),h=p("div",{class:r.detachedContainer,onMouseDown:function(e){e.stopPropagation()}}),g=p("div",{class:r.detachedOverlay,children:[h],onMouseDown:function(){c(!1),t.setIsOpen(!1)}}),y=l.getLabelProps(ur({state:u,props:t.getLabelProps({})},n)),b=p("button",{class:r.submitButton,type:"submit",title:d.submitButtonTitle,children:[Bn({environment:o})]}),v=p("label",ur({class:r.label,children:[b]},y)),w=p("button",{class:r.clearButton,type:"reset",title:d.clearButtonTitle,children:[Un({environment:o})]}),S=p("div",{class:r.loadingIndicator,children:[$n({environment:o})]}),k=sr({class:r.input,environment:o,state:u,getInputProps:l.getInputProps,getInputPropsCore:t.getInputProps,autocompleteScopeApi:n,isDetached:a}),x=p("div",{class:r.inputWrapperPrefix,children:[v,S]}),_=p("div",{class:r.inputWrapperSuffix,children:[w]}),E=p("div",{class:r.inputWrapper,children:[k]}),O=l.getFormProps(ur({state:u,props:t.getFormProps({inputElement:k})},n)),j=p("form",ur({class:r.form,children:[x,E,_]},O)),C=l.getPanelProps(ur({state:u,props:t.getPanelProps({})},n)),P=p("div",ur({class:r.panel},C)),T=p("div",{class:r.detachedSearchButtonQuery,textContent:u.query}),I=p("div",{class:r.detachedSearchButtonPlaceholder,hidden:Boolean(u.query),textContent:s});if(a){var A=p("div",{class:r.detachedSearchButtonIcon,children:[Bn({environment:o})]}),N=p("button",{type:"button",class:r.detachedSearchButton,onClick:function(){c(!0)},children:[A,I,T]}),L=p("button",{type:"button",class:r.detachedCancelButton,textContent:d.detachedCancelButtonText,onTouchStart:function(e){e.stopPropagation()},onClick:function(){t.setIsOpen(!1),c(!1)}}),R=p("div",{class:r.detachedFormContainer,children:[j,L]});h.appendChild(R),m.appendChild(N)}else m.appendChild(j);return{detachedContainer:h,detachedOverlay:g,detachedSearchButtonQuery:T,detachedSearchButtonPlaceholder:I,inputWrapper:E,input:k,root:m,form:j,label:v,submitButton:b,clearButton:w,loadingIndicator:S,panel:P}}({autocomplete:m.value,autocompleteScopeApi:y,classNames:p.value.renderer.classNames,environment:p.value.core.environment,isDetached:f.value,placeholder:p.value.core.placeholder,propGetters:g,setIsModalOpen:x,state:h.current,translations:p.value.renderer.translations})}));function w(){Zn(v.value.panel,{style:f.value?{}:To({panelPlacement:p.value.renderer.panelPlacement,container:v.value.root,form:v.value.form,environment:p.value.core.environment})})}function S(e){h.current=e;var t={autocomplete:m.value,autocompleteScopeApi:y,classNames:p.value.renderer.classNames,components:p.value.renderer.components,container:p.value.renderer.container,html:b.value,dom:v.value,panelContainer:f.value?v.value.detachedContainer:p.value.renderer.panelContainer,propGetters:g,state:h.current,renderer:p.value.renderer.renderer},n=!it(e)&&!c.current&&p.value.renderer.renderNoResults||p.value.renderer.render;!function(e){var t=e.autocomplete,n=e.autocompleteScopeApi,r=e.dom,o=e.propGetters,a=e.state;Gn(r.root,o.getRootProps(Lo({state:a,props:t.getRootProps({})},n))),Gn(r.input,o.getInputProps(Lo({state:a,props:t.getInputProps({inputElement:r.input}),inputElement:r.input},n))),Zn(r.label,{hidden:"stalled"===a.status}),Zn(r.loadingIndicator,{hidden:"stalled"!==a.status}),Zn(r.clearButton,{hidden:!a.query}),Zn(r.detachedSearchButtonQuery,{textContent:a.query}),Zn(r.detachedSearchButtonPlaceholder,{hidden:Boolean(a.query)})}(t),function(e,t){var n=t.autocomplete,r=t.autocompleteScopeApi,o=t.classNames,a=t.html,i=t.dom,s=t.panelContainer,l=t.propGetters,c=t.state,u=t.components,d=t.renderer;if(c.isOpen){s.contains(i.panel)||"loading"===c.status||s.appendChild(i.panel),i.panel.classList.toggle("aa-Panel--stalled","stalled"===c.status);var p=c.collections.filter((function(e){var t=e.source,n=e.items;return t.templates.noResults||n.length>0})).map((function(e,t){var i=e.source,s=e.items;return d.createElement("section",{key:t,className:o.source,"data-autocomplete-source-id":i.sourceId},i.templates.header&&d.createElement("div",{className:o.sourceHeader},i.templates.header({components:u,createElement:d.createElement,Fragment:d.Fragment,items:s,source:i,state:c,html:a})),i.templates.noResults&&0===s.length?d.createElement("div",{className:o.sourceNoResults},i.templates.noResults({components:u,createElement:d.createElement,Fragment:d.Fragment,source:i,state:c,html:a})):d.createElement("ul",Ao({className:o.list},l.getListProps(Lo({state:c,props:n.getListProps({source:i})},r))),s.map((function(e){var t=n.getItemProps({item:e,source:i});return d.createElement("li",Ao({key:t.id,className:o.item},l.getItemProps(Lo({state:c,props:t},r))),i.templates.item({components:u,createElement:d.createElement,Fragment:d.Fragment,item:e,state:c,html:a}))}))),i.templates.footer&&d.createElement("div",{className:o.sourceFooter},i.templates.footer({components:u,createElement:d.createElement,Fragment:d.Fragment,items:s,source:i,state:c,html:a})))})),f=d.createElement(d.Fragment,null,d.createElement("div",{className:o.panelLayout},p),d.createElement("div",{className:"aa-GradientBottom"})),m=p.reduce((function(e,t){return e[t.props["data-autocomplete-source-id"]]=t,e}),{});e(Lo(Lo({children:f,state:c,sections:p,elements:m},d),{},{components:u,html:a},r),i.panel)}else s.contains(i.panel)&&s.removeChild(i.panel)}(n,t)}function k(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{};o();var t,n,r=p.value.renderer,i=r.components,s=Ko(r,Zo);u.current=Uo(s,p.value.core,{components:(t=i,n=function(e){return!e.value.hasOwnProperty("__autocomplete_componentName")},Object.entries(t).reduce((function(e,t){var r=Vo(t,2),o=r[0],a=r[1];return n({key:o,value:a})?Ho(Ho({},e),{},Qo({},o,a)):e}),{})),initialState:h.current},e),l(),a(),m.value.refresh().then((function(){S(h.current)}))}function x(e){requestAnimationFrame((function(){var t=p.value.core.environment.document.body.contains(v.value.detachedOverlay);e!==t&&(e?(p.value.core.environment.document.body.appendChild(v.value.detachedOverlay),p.value.core.environment.document.body.classList.add("aa-Detached"),v.value.input.focus()):(p.value.core.environment.document.body.removeChild(v.value.detachedOverlay),p.value.core.environment.document.body.classList.remove("aa-Detached")))}))}return r((function(){var e=m.value.getEnvironmentProps({formElement:v.value.form,panelElement:v.value.panel,inputElement:v.value.input});return Zn(p.value.core.environment,e),function(){Zn(p.value.core.environment,Object.keys(e).reduce((function(e,t){return Jo(Jo({},e),{},Xo({},t,void 0))}),{}))}})),r((function(){var e=f.value?p.value.core.environment.document.body:p.value.renderer.panelContainer,t=f.value?v.value.detachedOverlay:v.value.panel;return f.value&&h.current.isOpen&&x(!0),S(h.current),function(){e.contains(t)&&e.removeChild(t)}})),r((function(){var e=p.value.renderer.container;return e.appendChild(v.value.root),function(){e.removeChild(v.value.root)}})),r((function(){var e=be((function(e){S(e.state)}),0);return d.current=function(t){var n=t.state,r=t.prevState;(f.value&&r.isOpen!==n.isOpen&&x(n.isOpen),f.value||!n.isOpen||r.isOpen||w(),n.query!==r.query)&&p.value.core.environment.document.querySelectorAll(".aa-Panel--scrollable").forEach((function(e){0!==e.scrollTop&&(e.scrollTop=0)}));e({state:n})},function(){d.current=void 0}})),r((function(){var e=be((function(){var e=f.value;f.value=p.value.core.environment.matchMedia(p.value.renderer.detachedMediaQuery).matches,e!==f.value?k({}):requestAnimationFrame(w)}),20);return p.value.core.environment.addEventListener("resize",e),function(){p.value.core.environment.removeEventListener("resize",e)}})),r((function(){if(!f.value)return function(){};function e(e){v.value.detachedContainer.classList.toggle("aa-DetachedContainer--modal",e)}function t(t){e(t.matches)}var n=p.value.core.environment.matchMedia(getComputedStyle(p.value.core.environment.document.documentElement).getPropertyValue("--aa-detached-modal-media-query"));e(n.matches);var r=Boolean(n.addEventListener);return r?n.addEventListener("change",t):n.addListener(t),function(){r?n.removeEventListener("change",t):n.removeListener(t)}})),r((function(){return requestAnimationFrame(w),function(){}})),Jo(Jo({},y),{},{update:k,destroy:function(){o()}})}var ta=n(1514);const na=n(5351),ra=na;var oa=n(813),aa=n.n(oa);function ia(){const e=(0,s.TH)(),t=(0,s.k6)(),{siteConfig:{baseUrl:n}}=(0,le.Z)(),[o,a]=(0,r.useState)({terms:[],isDocsOrBlog:!1});return(0,r.useEffect)((()=>{if(!e.state?.cmfcmfhighlight||0===e.state.cmfcmfhighlight.terms.length)return;a(e.state.cmfcmfhighlight);const{cmfcmfhighlight:n,...r}=e.state;t.replace({...e,state:r})}),[e.state?.cmfcmfhighlight,t,e]),(0,r.useEffect)((()=>{if(0===o.terms.length)return;const e=o.isDocsOrBlog?document.getElementsByTagName("article")[0]:document.getElementsByTagName("main")[0];if(!e)return;const t=new(aa())(e),n={ignoreJoiners:!0};return t.mark(o.terms,n),()=>t.unmark(n)}),[o,n]),null}var sa=n(1610),la=n(246);function ca(e){let{document:t}=e;const[n,r]=t.sectionRoute.split("#");let o=n;return r&&(o+="#"+r),o}const ua={documents:[],index:ra((function(){this.ref("id"),this.field("title"),this.field("content")}))};const da=()=>{const e=(0,z.Z)(),[t,n]=(0,r.useState)((()=>!!e&&"dark"===document.documentElement.getAttribute("data-theme")));(0,r.useEffect)((()=>{const e=new MutationObserver((()=>{n("dark"===document.documentElement.getAttribute("data-theme"))}));return e.observe(document.documentElement,{attributes:!0,attributeFilter:["data-theme"]}),()=>e.disconnect()}),[]);const{siteConfig:{baseUrl:o}}=(0,le.Z)(),{titleBoost:a,contentBoost:i,tagsBoost:c,parentCategoriesBoost:u,indexDocSidebarParentCategories:d,maxSearchResults:p}=(0,sa.eZ)("@cmfcmf/docusaurus-search-local"),f=(0,s.k6)(),{tags:m}=(0,la._q)(),h=(0,r.useRef)(m);(0,r.useEffect)((()=>{h.current=m}),[m]);const g=(0,r.useRef)({}),y=async e=>{const t=g.current[e];switch(t?.state){case"ready":return t;case void 0:{const t=[];g.current[e]={state:"loading",callbacks:t};const n=await async function(e,t){{let r;try{const n=await fetch(`${e}search-index-${t}.json`);if(!n.ok)return ua;r=await n.json()}catch(n){return ua}return{documents:r.documents,index:ra.Index.load(r.index)}}}(o,e);return t.forEach((e=>e(n))),g.current[e]={state:"ready",...n}}case"loading":return new Promise((e=>{t.callbacks.push(e)}))}},b=(0,l.I)({message:"cmfcmf/d-s-l.searchBar.placeholder",description:"Placeholder shown in the searchbar"}),v=(0,r.useRef)(null),w=(0,r.useRef)(null);return(0,r.useEffect)((()=>{if(v.current)return w.current=ea({container:v.current,placeholder:b,renderer:{createElement:r.createElement,Fragment:r.Fragment,render:ye.render},navigator:{navigate(e){let{item:t,itemUrl:n}=e;f.push(n,{cmfcmfhighlight:{terms:t.terms,isDocsOrBlog:"docs"===t.document.type||"blog"===t.document.type}})}},detachedMediaQuery:"",defaultActiveItemId:0,translations:{clearButtonTitle:(0,l.I)({message:"cmfcmf/d-s-l.searchBar.clearButtonTitle",description:"Title of the button to clear the current search input"}),detachedCancelButtonText:(0,l.I)({message:"cmfcmf/d-s-l.searchBar.detachedCancelButtonText",description:"Text of the button to close the detached search window"}),submitButtonTitle:(0,l.I)({message:"cmfcmf/d-s-l.searchBar.submitButtonTitle",description:"Title of the button to submit a new search"})},getSources(e){let{query:t}=e;return[{sourceId:"search-results",templates:{item(e){let{item:t}=e;const n=ca(t);return r.createElement("a",{href:n,className:"aa-ItemLink",onClick:e=>{e.preventDefault(),f.push(n,{cmfcmfhighlight:{terms:t.terms,isDocsOrBlog:"docs"===t.document.type||"blog"===t.document.type}})}},r.createElement("div",{className:"aa-ItemContent"},r.createElement("div",{className:"aa-ItemContentBody"},r.createElement("div",{className:"aa-ItemContentTitle"},t.document.sectionTitle),t.document.pageTitle!==t.document.sectionTitle&&r.createElement("div",{className:"aa-ItemContentDescription"},t.document.pageTitle))),r.createElement("div",{className:"aa-ItemActions"},r.createElement("button",{className:"aa-ItemActionButton aa-DesktopOnly aa-ActiveOnly",type:"button",title:"Select"},r.createElement("svg",{viewBox:"0 0 24 24",width:"20",height:"20",fill:"currentColor"},r.createElement("path",{d:"M18.984 6.984h2.016v6h-15.188l3.609 3.609-1.406 1.406-6-6 6-6 1.406 1.406-3.609 3.609h13.172v-4.031z"})))))},noResults:()=>r.createElement("div",{className:"aa-ItemContent"},r.createElement("div",{className:"aa-ItemContentBody"},(0,l.I)({message:"cmfcmf/d-s-l.searchBar.noResults",description:"message shown if no results are found"})))},getItemUrl(e){let{item:t}=e;return ca(t)},async getItems(){const e=h.current,n=await Promise.all(e.map((e=>y(e)))),r=(e=>na.tokenizer(e).map((e=>e.str)))(t);return n.flatMap((e=>{let{index:t,documents:n}=e;return t.query((e=>{e.term(r,{fields:["title"],boost:a}),e.term(r,{fields:["title"],boost:a,wildcard:ra.Query.wildcard.TRAILING}),e.term(r,{fields:["content"],boost:i}),e.term(r,{fields:["content"],boost:i,wildcard:ra.Query.wildcard.TRAILING}),e.term(r,{fields:["tags"],boost:c}),e.term(r,{fields:["tags"],boost:c,wildcard:ra.Query.wildcard.TRAILING}),d&&(e.term(r,{fields:["sidebarParentCategories"],boost:u}),e.term(r,{fields:["sidebarParentCategories"],boost:u,wildcard:ra.Query.wildcard.TRAILING}))})).slice(0,p).map((e=>({document:n.find((t=>t.id.toString()===e.ref)),score:e.score,terms:r})))})).sort(((e,t)=>t.score-e.score)).slice(0,p)}}]}}),()=>w.current?.destroy()}),[p]),r.createElement(r.Fragment,null,r.createElement(ta.Z,null,r.createElement("body",{"data-theme":t?"dark":"light"})),r.createElement(ia,null),r.createElement("div",{className:"dsla-search-wrapper"},r.createElement("div",{className:"dsla-search-field",ref:v,"data-tags":m.join(",")})))};function pa(e){return(0,u.jsx)(u.Fragment,{children:(0,u.jsx)(da,{...e})})}const fa={navbarSearchContainer:"navbarSearchContainer_Bca1"};function ma(e){let{children:t,className:n}=e;return(0,u.jsx)("div",{className:(0,o.Z)(n,fa.navbarSearchContainer),children:t})}var ha=n(868),ga=n(3734);var ya=n(6409);const ba=e=>e.docs.find((t=>t.id===e.mainDocId));const va={default:ae,localeDropdown:function(e){let{mobile:t,dropdownItemsBefore:n,dropdownItemsAfter:r,queryString:o="",...a}=e;const{i18n:{currentLocale:i,locales:c,localeConfigs:d}}=(0,le.Z)(),p=(0,me.l)(),{search:f,hash:m}=(0,s.TH)(),h=[...n,...c.map((e=>{const n=`${`pathname://${p.createUrl({locale:e,fullyQualified:!1})}`}${f}${m}${o}`;return{label:d[e].label,lang:d[e].htmlLang,to:n,target:"_self",autoAddBaseUrl:!1,className:e===i?t?"menu__link--active":"dropdown__link--active":""}})),...r],g=t?(0,l.I)({message:"Languages",id:"theme.navbar.mobileLanguageDropdown.label",description:"The label for the mobile language switcher dropdown"}):d[i].label;return(0,u.jsx)(fe,{...a,mobile:t,label:(0,u.jsxs)(u.Fragment,{children:[(0,u.jsx)(he,{className:ge}),g]}),items:h})},search:function(e){let{mobile:t,className:n}=e;return t?null:(0,u.jsx)(ma,{className:n,children:(0,u.jsx)(pa,{})})},dropdown:fe,html:function(e){let{value:t,className:n,mobile:r=!1,isDropdownItem:a=!1}=e;const i=a?"li":"div";return(0,u.jsx)(i,{className:(0,o.Z)({navbar__item:!r&&!a,"menu__list-item":r},n),dangerouslySetInnerHTML:{__html:t}})},doc:function(e){let{docId:t,label:n,docsPluginId:r,...o}=e;const{activeDoc:a}=(0,ha.Iw)(r),i=(0,ga.vY)(t,r),s=a?.path===i?.path;return null===i||i.unlisted&&!s?null:(0,u.jsx)(ae,{exact:!0,...o,isActive:()=>s||!!a?.sidebar&&a.sidebar===i.sidebar,label:n??i.id,to:i.path})},docSidebar:function(e){let{sidebarId:t,label:n,docsPluginId:r,...o}=e;const{activeDoc:a}=(0,ha.Iw)(r),i=(0,ga.oz)(t,r).link;if(!i)throw new Error(`DocSidebarNavbarItem: Sidebar with ID "${t}" doesn't have anything to be linked to.`);return(0,u.jsx)(ae,{exact:!0,...o,isActive:()=>a?.sidebar===t,label:n??i.label,to:i.path})},docsVersion:function(e){let{label:t,to:n,docsPluginId:r,...o}=e;const a=(0,ga.lO)(r)[0],i=t??a.label,s=n??(e=>e.docs.find((t=>t.id===e.mainDocId)))(a).path;return(0,u.jsx)(ae,{...o,label:i,to:s})},docsVersionDropdown:function(e){let{mobile:t,docsPluginId:n,dropdownActiveClassDisabled:r,dropdownItemsBefore:o,dropdownItemsAfter:a,...i}=e;const{search:c,hash:d}=(0,s.TH)(),p=(0,ha.Iw)(n),f=(0,ha.gB)(n),{savePreferredVersionName:m}=(0,ya.J)(n),h=f.map((e=>{const t=p.alternateDocVersions[e.name]??ba(e);return{label:e.label,to:`${t.path}${c}${d}`,isActive:()=>e===p.activeVersion,onClick:()=>m(e.name)}})),g=[...o,...h,...a],y=(0,ga.lO)(n)[0],b=t&&g.length>1?(0,l.I)({id:"theme.navbar.mobileVersionsDropdown.label",message:"Versions",description:"The label for the navbar versions dropdown on mobile view"}):y.label,v=t&&g.length>1?void 0:ba(y).path;return g.length<=1?(0,u.jsx)(ae,{...i,mobile:t,label:b,to:v,isActive:r?()=>!1:void 0}):(0,u.jsx)(fe,{...i,mobile:t,label:b,to:v,items:g,isActive:r?()=>!1:void 0})}},wa=va;function Sa(e){let{type:t,...n}=e;const r=function(e,t){return e&&"default"!==e?e:"items"in t?"dropdown":"default"}(t,n),o=wa[r];if(!o)throw new Error(`No NavbarItem component found for type "${t}".`);return(0,u.jsx)(o,{...n})}function ka(){const e=(0,P.e)(),t=(0,w.L)().navbar.items;return(0,u.jsx)("ul",{className:"menu__list",children:t.map(((t,n)=>(0,r.createElement)(Sa,{mobile:!0,...t,onClick:()=>e.toggle(),key:n})))})}function xa(e){return(0,u.jsx)("button",{...e,type:"button",className:"clean-btn navbar-sidebar__back",children:(0,u.jsx)(l.Z,{id:"theme.navbar.mobileSidebarSecondaryMenu.backButtonLabel",description:"The label of the back button to return to main menu, inside the mobile navbar sidebar secondary menu (notably used to display the docs sidebar)",children:"\u2190 Back to main menu"})})}function _a(){const e=0===(0,w.L)().navbar.items.length,t=D();return(0,u.jsxs)(u.Fragment,{children:[!e&&(0,u.jsx)(xa,{onClick:()=>t.hide()}),t.content]})}function Ea(){const e=(0,P.e)();var t;return void 0===(t=e.shown)&&(t=!0),(0,r.useEffect)((()=>(document.body.style.overflow=t?"hidden":"visible",()=>{document.body.style.overflow="visible"})),[t]),e.shouldRender?(0,u.jsx)(F,{header:(0,u.jsx)(K,{}),primaryMenu:(0,u.jsx)(ka,{}),secondaryMenu:(0,u.jsx)(_a,{})}):null}const Oa={navbarHideable:"navbarHideable_m1mJ",navbarHidden:"navbarHidden_jGov"};function ja(e){return(0,u.jsx)("div",{role:"presentation",...e,className:(0,o.Z)("navbar-sidebar__backdrop",e.className)})}function Ca(e){let{children:t}=e;const{navbar:{hideOnScroll:n,style:a}}=(0,w.L)(),i=(0,P.e)(),{navbarRef:s,isNavbarVisible:d}=function(e){const[t,n]=(0,r.useState)(e),o=(0,r.useRef)(!1),a=(0,r.useRef)(0),i=(0,r.useCallback)((e=>{null!==e&&(a.current=e.getBoundingClientRect().height)}),[]);return(0,T.RF)(((t,r)=>{let{scrollY:i}=t;if(!e)return;if(i=s?n(!1):i+c{if(!e)return;const r=t.location.hash;if(r?document.getElementById(r.substring(1)):void 0)return o.current=!0,void n(!1);n(!0)})),{navbarRef:i,isNavbarVisible:t}}(n);return(0,u.jsxs)("nav",{ref:s,"aria-label":(0,l.I)({id:"theme.NavBar.navAriaLabel",message:"Main",description:"The ARIA label for the main navigation"}),className:(0,o.Z)("navbar","navbar--fixed-top",n&&[Oa.navbarHideable,!d&&Oa.navbarHidden],{"navbar--dark":"dark"===a,"navbar--primary":"primary"===a,"navbar-sidebar--show":i.shown}),children:[t,(0,u.jsx)(ja,{onClick:i.toggle}),(0,u.jsx)(Ea,{})]})}var Pa=n(3905);const Ta={errorBoundaryError:"errorBoundaryError_a6uf",errorBoundaryFallback:"errorBoundaryFallback_VBag"};function Ia(e){return(0,u.jsx)("button",{type:"button",...e,children:(0,u.jsx)(l.Z,{id:"theme.ErrorPageContent.tryAgain",description:"The label of the button to try again rendering when the React error boundary captures an error",children:"Try again"})})}function Aa(e){let{error:t}=e;const n=(0,Pa.getErrorCausalChain)(t).map((e=>e.message)).join("\n\nCause:\n");return(0,u.jsx)("p",{className:Ta.errorBoundaryError,children:n})}class Na extends r.Component{componentDidCatch(e,t){throw this.props.onError(e,t)}render(){return this.props.children}}const La="right";function Ra(e){let{width:t=30,height:n=30,className:r,...o}=e;return(0,u.jsx)("svg",{className:r,width:t,height:n,viewBox:"0 0 30 30","aria-hidden":"true",...o,children:(0,u.jsx)("path",{stroke:"currentColor",strokeLinecap:"round",strokeMiterlimit:"10",strokeWidth:"2",d:"M4 7h22M4 15h22M4 23h22"})})}function Da(){const{toggle:e,shown:t}=(0,P.e)();return(0,u.jsx)("button",{onClick:e,"aria-label":(0,l.I)({id:"theme.docs.sidebar.toggleSidebarButtonAriaLabel",message:"Toggle navigation bar",description:"The ARIA label for hamburger menu button of mobile navigation"}),"aria-expanded":t,className:"navbar__toggle clean-btn",type:"button",children:(0,u.jsx)(Ra,{})})}const Fa={colorModeToggle:"colorModeToggle_DEke"};function Ma(e){let{items:t}=e;return(0,u.jsx)(u.Fragment,{children:t.map(((e,t)=>(0,u.jsx)(Na,{onError:t=>new Error(`A theme navbar item failed to render.\nPlease double-check the following navbar item (themeConfig.navbar.items) of your Docusaurus config:\n${JSON.stringify(e,null,2)}`,{cause:t}),children:(0,u.jsx)(Sa,{...e})},t)))})}function za(e){let{left:t,right:n}=e;return(0,u.jsxs)("div",{className:"navbar__inner",children:[(0,u.jsx)("div",{className:"navbar__items",children:t}),(0,u.jsx)("div",{className:"navbar__items navbar__items--right",children:n})]})}function Ba(){const e=(0,P.e)(),t=(0,w.L)().navbar.items,[n,r]=function(e){function t(e){return"left"===(e.position??La)}return[e.filter(t),e.filter((e=>!t(e)))]}(t),o=t.find((e=>"search"===e.type));return(0,u.jsx)(za,{left:(0,u.jsxs)(u.Fragment,{children:[!e.disabled&&(0,u.jsx)(Da,{}),(0,u.jsx)(Z,{}),(0,u.jsx)(Ma,{items:n})]}),right:(0,u.jsxs)(u.Fragment,{children:[(0,u.jsx)(Ma,{items:r}),(0,u.jsx)(V,{className:Fa.colorModeToggle}),!o&&(0,u.jsx)(ma,{children:(0,u.jsx)(pa,{})})]})})}function Ua(){return(0,u.jsx)(Ca,{children:(0,u.jsx)(Ba,{})})}function $a(e){let{item:t}=e;const{to:n,href:r,label:o,prependBaseUrlToHref:a,...i}=t,s=(0,J.Z)(n),l=(0,J.Z)(r,{forcePrependBaseUrl:!0});return(0,u.jsxs)(Y.Z,{className:"footer__link-item",...r?{href:a?l:r}:{to:s},...i,children:[o,r&&!(0,X.Z)(r)&&(0,u.jsx)(te.Z,{})]})}function qa(e){let{item:t}=e;return t.html?(0,u.jsx)("li",{className:"footer__item",dangerouslySetInnerHTML:{__html:t.html}}):(0,u.jsx)("li",{className:"footer__item",children:(0,u.jsx)($a,{item:t})},t.href??t.to)}function Ha(e){let{column:t}=e;return(0,u.jsxs)("div",{className:"col footer__col",children:[(0,u.jsx)("div",{className:"footer__title",children:t.title}),(0,u.jsx)("ul",{className:"footer__items clean-list",children:t.items.map(((e,t)=>(0,u.jsx)(qa,{item:e},t)))})]})}function Qa(e){let{columns:t}=e;return(0,u.jsx)("div",{className:"row footer__links",children:t.map(((e,t)=>(0,u.jsx)(Ha,{column:e},t)))})}function Va(){return(0,u.jsx)("span",{className:"footer__link-separator",children:"\xb7"})}function Wa(e){let{item:t}=e;return t.html?(0,u.jsx)("span",{className:"footer__link-item",dangerouslySetInnerHTML:{__html:t.html}}):(0,u.jsx)($a,{item:t})}function Za(e){let{links:t}=e;return(0,u.jsx)("div",{className:"footer__links text--center",children:(0,u.jsx)("div",{className:"footer__links",children:t.map(((e,n)=>(0,u.jsxs)(r.Fragment,{children:[(0,u.jsx)(Wa,{item:e}),t.length!==n+1&&(0,u.jsx)(Va,{})]},n)))})})}function Ga(e){let{links:t}=e;return function(e){return"title"in e[0]}(t)?(0,u.jsx)(Qa,{columns:t}):(0,u.jsx)(Za,{links:t})}var Ka=n(4277);const Ya={footerLogoLink:"footerLogoLink_BH7S"};function Ja(e){let{logo:t}=e;const{withBaseUrl:n}=(0,J.C)(),r={light:n(t.src),dark:n(t.srcDark??t.src)};return(0,u.jsx)(Ka.Z,{className:(0,o.Z)("footer__logo",t.className),alt:t.alt,sources:r,width:t.width,height:t.height,style:t.style})}function Xa(e){let{logo:t}=e;return t.href?(0,u.jsx)(Y.Z,{href:t.href,className:Ya.footerLogoLink,target:t.target,children:(0,u.jsx)(Ja,{logo:t})}):(0,u.jsx)(Ja,{logo:t})}function ei(e){let{copyright:t}=e;return(0,u.jsx)("div",{className:"footer__copyright",dangerouslySetInnerHTML:{__html:t}})}function ti(e){let{style:t,links:n,logo:r,copyright:a}=e;return(0,u.jsx)("footer",{className:(0,o.Z)("footer",{"footer--dark":"dark"===t}),children:(0,u.jsxs)("div",{className:"container container-fluid",children:[n,(r||a)&&(0,u.jsxs)("div",{className:"footer__bottom text--center",children:[r&&(0,u.jsx)("div",{className:"margin-bottom--sm",children:r}),a]})]})})}function ni(){const{footer:e}=(0,w.L)();if(!e)return null;const{copyright:t,links:n,logo:r,style:o}=e;return(0,u.jsx)(ti,{style:o,links:n&&n.length>0&&(0,u.jsx)(Ga,{links:n}),logo:r&&(0,u.jsx)(Xa,{logo:r}),copyright:t&&(0,u.jsx)(ei,{copyright:t})})}const ri=r.memo(ni),oi=(0,I.Qc)([M.S,S.pl,T.OC,ya.L5,i.VC,function(e){let{children:t}=e;return(0,u.jsx)(A.n2,{children:(0,u.jsx)(P.M,{children:(0,u.jsx)(L,{children:t})})})}]);function ai(e){let{children:t}=e;return(0,u.jsx)(oi,{children:t})}var ii=n(3899);function si(e){let{error:t,tryAgain:n}=e;return(0,u.jsx)("main",{className:"container margin-vert--xl",children:(0,u.jsx)("div",{className:"row",children:(0,u.jsxs)("div",{className:"col col--6 col--offset-3",children:[(0,u.jsx)(ii.Z,{as:"h1",className:"hero__title",children:(0,u.jsx)(l.Z,{id:"theme.ErrorPageContent.title",description:"The title of the fallback page when the page crashed",children:"This page crashed."})}),(0,u.jsx)("div",{className:"margin-vert--lg",children:(0,u.jsx)(Ia,{onClick:n,className:"button button--primary shadow--lw"})}),(0,u.jsx)("hr",{}),(0,u.jsx)("div",{className:"margin-vert--md",children:(0,u.jsx)(Aa,{error:t})})]})})})}const li={mainWrapper:"mainWrapper_z2l0"};function ci(e){const{children:t,noFooter:n,wrapperClassName:r,title:s,description:l}=e;return(0,y.t)(),(0,u.jsxs)(ai,{children:[(0,u.jsx)(i.d,{title:s,description:l}),(0,u.jsx)(v,{}),(0,u.jsx)(C,{}),(0,u.jsx)(Ua,{}),(0,u.jsx)("div",{id:d,className:(0,o.Z)(g.k.wrapper.main,li.mainWrapper,r),children:(0,u.jsx)(a.Z,{fallback:e=>(0,u.jsx)(si,{...e}),children:t})}),!n&&(0,u.jsx)(ri,{})]})}},6811:(e,t,n)=>{"use strict";n.d(t,{Z:()=>u});n(7294);var r=n(3699),o=n(9524),a=n(9962),i=n(107),s=n(4277),l=n(5893);function c(e){let{logo:t,alt:n,imageClassName:r}=e;const a={light:(0,o.Z)(t.src),dark:(0,o.Z)(t.srcDark||t.src)},i=(0,l.jsx)(s.Z,{className:t.className,sources:a,height:t.height,width:t.width,alt:n,style:t.style});return r?(0,l.jsx)("div",{className:r,children:i}):i}function u(e){const{siteConfig:{title:t}}=(0,a.Z)(),{navbar:{title:n,logo:s}}=(0,i.L)(),{imageClassName:u,titleClassName:d,...p}=e,f=(0,o.Z)(s?.href||"/"),m=n?"":t,h=s?.alt??m;return(0,l.jsxs)(r.Z,{to:f,...p,...s?.target&&{target:s.target},children:[s&&(0,l.jsx)(c,{logo:s,alt:h,imageClassName:u}),null!=n&&(0,l.jsx)("b",{className:d,children:n})]})}},3647:(e,t,n)=>{"use strict";n.d(t,{Z:()=>a});n(7294);var r=n(1514),o=n(5893);function a(e){let{locale:t,version:n,tag:a}=e;const i=t;return(0,o.jsxs)(r.Z,{children:[t&&(0,o.jsx)("meta",{name:"docusaurus_locale",content:t}),n&&(0,o.jsx)("meta",{name:"docusaurus_version",content:n}),a&&(0,o.jsx)("meta",{name:"docusaurus_tag",content:a}),i&&(0,o.jsx)("meta",{name:"docsearch:language",content:i}),n&&(0,o.jsx)("meta",{name:"docsearch:version",content:n}),a&&(0,o.jsx)("meta",{name:"docsearch:docusaurus_tag",content:a})]})}},4277:(e,t,n)=>{"use strict";n.d(t,{Z:()=>u});var r=n(7294),o=n(788),a=n(1048),i=n(9200);const s={themedComponent:"themedComponent_mlkZ","themedComponent--light":"themedComponent--light_NVdE","themedComponent--dark":"themedComponent--dark_xIcU"};var l=n(5893);function c(e){let{className:t,children:n}=e;const c=(0,a.Z)(),{colorMode:u}=(0,i.I)();return(0,l.jsx)(l.Fragment,{children:(c?"dark"===u?["dark"]:["light"]:["light","dark"]).map((e=>{const a=n({theme:e,className:(0,o.Z)(t,s.themedComponent,s[`themedComponent--${e}`])});return(0,l.jsx)(r.Fragment,{children:a},e)}))})}function u(e){const{sources:t,className:n,alt:r,...o}=e;return(0,l.jsx)(c,{className:n,children:e=>{let{theme:n,className:a}=e;return(0,l.jsx)("img",{src:t[n],alt:r,className:a,...o})}})}},4639:(e,t,n)=>{"use strict";n.d(t,{u:()=>c,z:()=>y});var r=n(7294),o=n(6136),a=n(1270),i=n(8986),s=n(5893);const l="ease-in-out";function c(e){let{initialState:t}=e;const[n,o]=(0,r.useState)(t??!1),a=(0,r.useCallback)((()=>{o((e=>!e))}),[]);return{collapsed:n,setCollapsed:o,toggleCollapsed:a}}const u={display:"none",overflow:"hidden",height:"0px"},d={display:"block",overflow:"visible",height:"auto"};function p(e,t){const n=t?u:d;e.style.display=n.display,e.style.overflow=n.overflow,e.style.height=n.height}function f(e){let{collapsibleRef:t,collapsed:n,animation:o}=e;const a=(0,r.useRef)(!1);(0,r.useEffect)((()=>{const e=t.current;function r(){const t=e.scrollHeight,n=o?.duration??function(e){if((0,i.n)())return 1;const t=e/36;return Math.round(10*(4+15*t**.25+t/5))}(t);return{transition:`height ${n}ms ${o?.easing??l}`,height:`${t}px`}}function s(){const t=r();e.style.transition=t.transition,e.style.height=t.height}if(!a.current)return p(e,n),void(a.current=!0);return e.style.willChange="height",function(){const t=requestAnimationFrame((()=>{n?(s(),requestAnimationFrame((()=>{e.style.height=u.height,e.style.overflow=u.overflow}))):(e.style.display="block",requestAnimationFrame((()=>{s()})))}));return()=>cancelAnimationFrame(t)}()}),[t,n,o])}function m(e){if(!o.Z.canUseDOM)return e?u:d}function h(e){let{as:t="div",collapsed:n,children:o,animation:a,onCollapseTransitionEnd:i,className:l,disableSSRStyle:c}=e;const u=(0,r.useRef)(null);return f({collapsibleRef:u,collapsed:n,animation:a}),(0,s.jsx)(t,{ref:u,style:c?void 0:m(n),onTransitionEnd:e=>{"height"===e.propertyName&&(p(u.current,n),i?.(n))},className:l,children:o})}function g(e){let{collapsed:t,...n}=e;const[o,i]=(0,r.useState)(!t),[l,c]=(0,r.useState)(t);return(0,a.Z)((()=>{t||i(!0)}),[t]),(0,a.Z)((()=>{o&&c(t)}),[o,t]),o?(0,s.jsx)(h,{...n,collapsed:l}):null}function y(e){let{lazy:t,...n}=e;const r=t?g:h;return(0,s.jsx)(r,{...n})}},5830:(e,t,n)=>{"use strict";n.d(t,{nT:()=>h,pl:()=>m});var r=n(7294),o=n(1048),a=n(2560),i=n(3768),s=n(107),l=n(5893);const c=(0,a.WA)("docusaurus.announcement.dismiss"),u=(0,a.WA)("docusaurus.announcement.id"),d=()=>"true"===c.get(),p=e=>c.set(String(e)),f=r.createContext(null);function m(e){let{children:t}=e;const n=function(){const{announcementBar:e}=(0,s.L)(),t=(0,o.Z)(),[n,a]=(0,r.useState)((()=>!!t&&d()));(0,r.useEffect)((()=>{a(d())}),[]);const i=(0,r.useCallback)((()=>{p(!0),a(!0)}),[]);return(0,r.useEffect)((()=>{if(!e)return;const{id:t}=e;let n=u.get();"annoucement-bar"===n&&(n="announcement-bar");const r=t!==n;u.set(t),r&&p(!1),!r&&d()||a(!1)}),[e]),(0,r.useMemo)((()=>({isActive:!!e&&!n,close:i})),[e,n,i])}();return(0,l.jsx)(f.Provider,{value:n,children:t})}function h(){const e=(0,r.useContext)(f);if(!e)throw new i.i6("AnnouncementBarProvider");return e}},9200:(e,t,n)=>{"use strict";n.d(t,{I:()=>y,S:()=>g});var r=n(7294),o=n(6136),a=n(3768),i=n(2560),s=n(107),l=n(5893);const c=r.createContext(void 0),u="theme",d=(0,i.WA)(u),p={light:"light",dark:"dark"},f=e=>e===p.dark?p.dark:p.light,m=e=>o.Z.canUseDOM?f(document.documentElement.getAttribute("data-theme")):f(e),h=e=>{d.set(f(e))};function g(e){let{children:t}=e;const n=function(){const{colorMode:{defaultMode:e,disableSwitch:t,respectPrefersColorScheme:n}}=(0,s.L)(),[o,a]=(0,r.useState)(m(e));(0,r.useEffect)((()=>{t&&d.del()}),[t]);const i=(0,r.useCallback)((function(t,r){void 0===r&&(r={});const{persist:o=!0}=r;t?(a(t),o&&h(t)):(a(n?window.matchMedia("(prefers-color-scheme: dark)").matches?p.dark:p.light:e),d.del())}),[n,e]);(0,r.useEffect)((()=>{document.documentElement.setAttribute("data-theme",f(o))}),[o]),(0,r.useEffect)((()=>{if(t)return;const e=e=>{if(e.key!==u)return;const t=d.get();null!==t&&i(f(t))};return window.addEventListener("storage",e),()=>window.removeEventListener("storage",e)}),[t,i]);const l=(0,r.useRef)(!1);return(0,r.useEffect)((()=>{if(t&&!n)return;const e=window.matchMedia("(prefers-color-scheme: dark)"),r=()=>{window.matchMedia("print").matches||l.current?l.current=window.matchMedia("print").matches:i(null)};return e.addListener(r),()=>e.removeListener(r)}),[i,t,n]),(0,r.useMemo)((()=>({colorMode:o,setColorMode:i,get isDarkTheme(){return o===p.dark},setLightTheme(){i(p.light)},setDarkTheme(){i(p.dark)}})),[o,i])}();return(0,l.jsx)(c.Provider,{value:n,children:t})}function y(){const e=(0,r.useContext)(c);if(null==e)throw new a.i6("ColorModeProvider","Please see https://docusaurus.io/docs/api/themes/configuration#use-color-mode.");return e}},6409:(e,t,n)=>{"use strict";n.d(t,{J:()=>v,L5:()=>y,Oh:()=>w});var r=n(7294),o=n(868),a=n(6875),i=n(107),s=n(3734),l=n(3768),c=n(2560),u=n(5893);const d=e=>`docs-preferred-version-${e}`,p={save:(e,t,n)=>{(0,c.WA)(d(e),{persistence:t}).set(n)},read:(e,t)=>(0,c.WA)(d(e),{persistence:t}).get(),clear:(e,t)=>{(0,c.WA)(d(e),{persistence:t}).del()}},f=e=>Object.fromEntries(e.map((e=>[e,{preferredVersionName:null}])));const m=r.createContext(null);function h(){const e=(0,o._r)(),t=(0,i.L)().docs.versionPersistence,n=(0,r.useMemo)((()=>Object.keys(e)),[e]),[a,s]=(0,r.useState)((()=>f(n)));(0,r.useEffect)((()=>{s(function(e){let{pluginIds:t,versionPersistence:n,allDocsData:r}=e;function o(e){const t=p.read(e,n);return r[e].versions.some((e=>e.name===t))?{preferredVersionName:t}:(p.clear(e,n),{preferredVersionName:null})}return Object.fromEntries(t.map((e=>[e,o(e)])))}({allDocsData:e,versionPersistence:t,pluginIds:n}))}),[e,t,n]);return[a,(0,r.useMemo)((()=>({savePreferredVersion:function(e,n){p.save(e,t,n),s((t=>({...t,[e]:{preferredVersionName:n}})))}})),[t])]}function g(e){let{children:t}=e;const n=h();return(0,u.jsx)(m.Provider,{value:n,children:t})}function y(e){let{children:t}=e;return s.cE?(0,u.jsx)(g,{children:t}):(0,u.jsx)(u.Fragment,{children:t})}function b(){const e=(0,r.useContext)(m);if(!e)throw new l.i6("DocsPreferredVersionContextProvider");return e}function v(e){void 0===e&&(e=a.m);const t=(0,o.zh)(e),[n,i]=b(),{preferredVersionName:s}=n[e];return{preferredVersion:t.versions.find((e=>e.name===s))??null,savePreferredVersionName:(0,r.useCallback)((t=>{i.savePreferredVersion(e,t)}),[i,e])}}function w(){const e=(0,o._r)(),[t]=b();function n(n){const r=e[n],{preferredVersionName:o}=t[n];return r.versions.find((e=>e.name===o))??null}const r=Object.keys(e);return Object.fromEntries(r.map((e=>[e,n(e)])))}},4432:(e,t,n)=>{"use strict";n.d(t,{V:()=>c,b:()=>l});var r=n(7294),o=n(3768),a=n(5893);const i=Symbol("EmptyContext"),s=r.createContext(i);function l(e){let{children:t,name:n,items:o}=e;const i=(0,r.useMemo)((()=>n&&o?{name:n,items:o}:null),[n,o]);return(0,a.jsx)(s.Provider,{value:i,children:t})}function c(){const e=(0,r.useContext)(s);if(e===i)throw new o.i6("DocsSidebarProvider");return e}},8801:(e,t,n)=>{"use strict";n.d(t,{E:()=>l,q:()=>s});var r=n(7294),o=n(3768),a=n(5893);const i=r.createContext(null);function s(e){let{children:t,version:n}=e;return(0,a.jsx)(i.Provider,{value:n,children:t})}function l(){const e=(0,r.useContext)(i);if(null===e)throw new o.i6("DocsVersionProvider");return e}},2600:(e,t,n)=>{"use strict";n.d(t,{M:()=>f,e:()=>m});var r=n(7294),o=n(3086),a=n(3488),i=n(6550),s=n(3768);function l(e){!function(e){const t=(0,i.k6)(),n=(0,s.zX)(e);(0,r.useEffect)((()=>t.block(((e,t)=>n(e,t)))),[t,n])}(((t,n)=>{if("POP"===n)return e(t,n)}))}var c=n(107),u=n(5893);const d=r.createContext(void 0);function p(){const e=function(){const e=(0,o.HY)(),{items:t}=(0,c.L)().navbar;return 0===t.length&&!e.component}(),t=(0,a.i)(),n=!e&&"mobile"===t,[i,s]=(0,r.useState)(!1);l((()=>{if(i)return s(!1),!1}));const u=(0,r.useCallback)((()=>{s((e=>!e))}),[]);return(0,r.useEffect)((()=>{"desktop"===t&&s(!1)}),[t]),(0,r.useMemo)((()=>({disabled:e,shouldRender:n,toggle:u,shown:i})),[e,n,u,i])}function f(e){let{children:t}=e;const n=p();return(0,u.jsx)(d.Provider,{value:n,children:t})}function m(){const e=r.useContext(d);if(void 0===e)throw new s.i6("NavbarMobileSidebarProvider");return e}},3086:(e,t,n)=>{"use strict";n.d(t,{HY:()=>l,Zo:()=>c,n2:()=>s});var r=n(7294),o=n(3768),a=n(5893);const i=r.createContext(null);function s(e){let{children:t}=e;const n=(0,r.useState)({component:null,props:null});return(0,a.jsx)(i.Provider,{value:n,children:t})}function l(){const e=(0,r.useContext)(i);if(!e)throw new o.i6("NavbarSecondaryMenuContentProvider");return e[0]}function c(e){let{component:t,props:n}=e;const a=(0,r.useContext)(i);if(!a)throw new o.i6("NavbarSecondaryMenuContentProvider");const[,s]=a,l=(0,o.Ql)(n);return(0,r.useEffect)((()=>{s({component:t,props:l})}),[s,t,l]),(0,r.useEffect)((()=>()=>s({component:null,props:null})),[s]),null}},8181:(e,t,n)=>{"use strict";n.d(t,{h:()=>o,t:()=>a});var r=n(7294);const o="navigation-with-keyboard";function a(){(0,r.useEffect)((()=>{function e(e){"keydown"===e.type&&"Tab"===e.key&&document.body.classList.add(o),"mousedown"===e.type&&document.body.classList.remove(o)}return document.addEventListener("keydown",e),document.addEventListener("mousedown",e),()=>{document.body.classList.remove(o),document.removeEventListener("keydown",e),document.removeEventListener("mousedown",e)}}),[])}},3488:(e,t,n)=>{"use strict";n.d(t,{i:()=>s});var r=n(7294),o=n(6136);const a={desktop:"desktop",mobile:"mobile",ssr:"ssr"},i=996;function s(){const[e,t]=(0,r.useState)((()=>"ssr"));return(0,r.useEffect)((()=>{function e(){t(function(){if(!o.Z.canUseDOM)throw new Error("getWindowSize() should only be called after React hydration");return window.innerWidth>i?a.desktop:a.mobile}())}return e(),window.addEventListener("resize",e),()=>{window.removeEventListener("resize",e)}}),[]),e}},3702:(e,t,n)=>{"use strict";n.d(t,{k:()=>r});const r={page:{blogListPage:"blog-list-page",blogPostPage:"blog-post-page",blogTagsListPage:"blog-tags-list-page",blogTagPostListPage:"blog-tags-post-list-page",docsDocPage:"docs-doc-page",docsTagsListPage:"docs-tags-list-page",docsTagDocListPage:"docs-tags-doc-list-page",mdxPage:"mdx-page"},wrapper:{main:"main-wrapper",blogPages:"blog-wrapper",docsPages:"docs-wrapper",mdxPages:"mdx-wrapper"},common:{editThisPage:"theme-edit-this-page",lastUpdated:"theme-last-updated",backToTopButton:"theme-back-to-top-button",codeBlock:"theme-code-block",admonition:"theme-admonition",unlistedBanner:"theme-unlisted-banner",admonitionType:e=>`theme-admonition-${e}`},layout:{},docs:{docVersionBanner:"theme-doc-version-banner",docVersionBadge:"theme-doc-version-badge",docBreadcrumbs:"theme-doc-breadcrumbs",docMarkdown:"theme-doc-markdown",docTocMobile:"theme-doc-toc-mobile",docTocDesktop:"theme-doc-toc-desktop",docFooter:"theme-doc-footer",docFooterTagsRow:"theme-doc-footer-tags-row",docFooterEditMetaRow:"theme-doc-footer-edit-meta-row",docSidebarContainer:"theme-doc-sidebar-container",docSidebarMenu:"theme-doc-sidebar-menu",docSidebarItemCategory:"theme-doc-sidebar-item-category",docSidebarItemLink:"theme-doc-sidebar-item-link",docSidebarItemCategoryLevel:e=>`theme-doc-sidebar-item-category-level-${e}`,docSidebarItemLinkLevel:e=>`theme-doc-sidebar-item-link-level-${e}`},blog:{}}},8986:(e,t,n)=>{"use strict";function r(){return window.matchMedia("(prefers-reduced-motion: reduce)").matches}n.d(t,{n:()=>r})},3734:(e,t,n)=>{"use strict";n.d(t,{LM:()=>f,_F:()=>g,cE:()=>p,SN:()=>_,lO:()=>S,vY:()=>x,oz:()=>k,s1:()=>w,f:()=>b});var r=n(7294),o=n(6550),a=n(8790),i=n(868),s=n(6409),l=n(8801),c=n(4432);function u(e){return Array.from(new Set(e))}var d=n(9003);const p=!!i._r;function f(e){return"link"!==e.type||e.unlisted?"category"===e.type?function(e){if(e.href&&!e.linkUnlisted)return e.href;for(const t of e.items){const e=f(t);if(e)return e}}(e):void 0:e.href}const m=(e,t)=>void 0!==e&&(0,d.Mg)(e,t),h=(e,t)=>e.some((e=>g(e,t)));function g(e,t){return"link"===e.type?m(e.href,t):"category"===e.type&&(m(e.href,t)||h(e.items,t))}function y(e,t){switch(e.type){case"category":return g(e,t)||e.items.some((e=>y(e,t)));case"link":return!e.unlisted||g(e,t);default:return!0}}function b(e,t){return(0,r.useMemo)((()=>e.filter((e=>y(e,t)))),[e,t])}function v(e){let{sidebarItems:t,pathname:n,onlyCategories:r=!1}=e;const o=[];return function e(t){for(const a of t)if("category"===a.type&&((0,d.Mg)(a.href,n)||e(a.items))||"link"===a.type&&(0,d.Mg)(a.href,n)){return r&&"category"!==a.type||o.unshift(a),!0}return!1}(t),o}function w(){const e=(0,c.V)(),{pathname:t}=(0,o.TH)(),n=(0,i.gA)()?.pluginData.breadcrumbs;return!1!==n&&e?v({sidebarItems:e.items,pathname:t}):null}function S(e){const{activeVersion:t}=(0,i.Iw)(e),{preferredVersion:n}=(0,s.J)(e),o=(0,i.yW)(e);return(0,r.useMemo)((()=>u([t,n,o].filter(Boolean))),[t,n,o])}function k(e,t){const n=S(t);return(0,r.useMemo)((()=>{const t=n.flatMap((e=>e.sidebars?Object.entries(e.sidebars):[])),r=t.find((t=>t[0]===e));if(!r)throw new Error(`Can't find any sidebar with id "${e}" in version${n.length>1?"s":""} ${n.map((e=>e.name)).join(", ")}".\nAvailable sidebar ids are:\n- ${t.map((e=>e[0])).join("\n- ")}`);return r[1]}),[e,n])}function x(e,t){const n=S(t);return(0,r.useMemo)((()=>{const t=n.flatMap((e=>e.docs)),r=t.find((t=>t.id===e));if(!r){if(n.flatMap((e=>e.draftIds)).includes(e))return null;throw new Error(`Couldn't find any doc with id "${e}" in version${n.length>1?"s":""} "${n.map((e=>e.name)).join(", ")}".\nAvailable doc ids are:\n- ${u(t.map((e=>e.id))).join("\n- ")}`)}return r}),[e,n])}function _(e){let{route:t}=e;const n=(0,o.TH)(),r=(0,l.E)(),i=t.routes,s=i.find((e=>(0,o.LX)(n.pathname,e)));if(!s)return null;const c=s.sidebar,u=c?r.docsSidebars[c]:void 0;return{docElement:(0,a.H)(i),sidebarName:c,sidebarItems:u}}},5463:(e,t,n)=>{"use strict";n.d(t,{FG:()=>f,d:()=>d,VC:()=>m});var r=n(7294),o=n(788),a=n(1514),i=n(9656);function s(){const e=r.useContext(i._);if(!e)throw new Error("Unexpected: no Docusaurus route context found");return e}var l=n(9524),c=n(9962);var u=n(5893);function d(e){let{title:t,description:n,keywords:r,image:o,children:i}=e;const s=function(e){const{siteConfig:t}=(0,c.Z)(),{title:n,titleDelimiter:r}=t;return e?.trim().length?`${e.trim()} ${r} ${n}`:n}(t),{withBaseUrl:d}=(0,l.C)(),p=o?d(o,{absolute:!0}):void 0;return(0,u.jsxs)(a.Z,{children:[t&&(0,u.jsx)("title",{children:s}),t&&(0,u.jsx)("meta",{property:"og:title",content:s}),n&&(0,u.jsx)("meta",{name:"description",content:n}),n&&(0,u.jsx)("meta",{property:"og:description",content:n}),r&&(0,u.jsx)("meta",{name:"keywords",content:Array.isArray(r)?r.join(","):r}),p&&(0,u.jsx)("meta",{property:"og:image",content:p}),p&&(0,u.jsx)("meta",{name:"twitter:image",content:p}),i]})}const p=r.createContext(void 0);function f(e){let{className:t,children:n}=e;const i=r.useContext(p),s=(0,o.Z)(i,t);return(0,u.jsxs)(p.Provider,{value:s,children:[(0,u.jsx)(a.Z,{children:(0,u.jsx)("html",{className:s})}),n]})}function m(e){let{children:t}=e;const n=s(),r=`plugin-${n.plugin.name.replace(/docusaurus-(?:plugin|theme)-(?:content-)?/gi,"")}`;const a=`plugin-id-${n.plugin.id}`;return(0,u.jsx)(f,{className:(0,o.Z)(r,a),children:t})}},3768:(e,t,n)=>{"use strict";n.d(t,{D9:()=>s,Qc:()=>u,Ql:()=>c,i6:()=>l,zX:()=>i});var r=n(7294),o=n(1270),a=n(5893);function i(e){const t=(0,r.useRef)(e);return(0,o.Z)((()=>{t.current=e}),[e]),(0,r.useCallback)((function(){return t.current(...arguments)}),[])}function s(e){const t=(0,r.useRef)();return(0,o.Z)((()=>{t.current=e})),t.current}class l extends Error{constructor(e,t){super(),this.name="ReactContextError",this.message=`Hook ${this.stack?.split("\n")[1]?.match(/at (?:\w+\.)?(?\w+)/)?.groups.name??""} is called outside the <${e}>. ${t??""}`}}function c(e){const t=Object.entries(e);return t.sort(((e,t)=>e[0].localeCompare(t[0]))),(0,r.useMemo)((()=>e),t.flat())}function u(e){return t=>{let{children:n}=t;return(0,a.jsx)(a.Fragment,{children:e.reduceRight(((e,t)=>(0,a.jsx)(t,{children:e})),n)})}}},9003:(e,t,n)=>{"use strict";n.d(t,{Mg:()=>i,Ns:()=>s});var r=n(7294),o=n(997),a=n(9962);function i(e,t){const n=e=>(!e||e.endsWith("/")?e:`${e}/`)?.toLowerCase();return n(e)===n(t)}function s(){const{baseUrl:e}=(0,a.Z)().siteConfig;return(0,r.useMemo)((()=>function(e){let{baseUrl:t,routes:n}=e;function r(e){return e.path===t&&!0===e.exact}function o(e){return e.path===t&&!e.exact}return function e(t){if(0===t.length)return;return t.find(r)||e(t.filter(o).flatMap((e=>e.routes??[])))}(n)}({routes:o.Z,baseUrl:e})),[e])}},2957:(e,t,n)=>{"use strict";n.d(t,{Ct:()=>f,OC:()=>c,RF:()=>p});var r=n(7294),o=n(6136),a=n(1048),i=(n(1270),n(3768)),s=n(5893);const l=r.createContext(void 0);function c(e){let{children:t}=e;const n=function(){const e=(0,r.useRef)(!0);return(0,r.useMemo)((()=>({scrollEventsEnabledRef:e,enableScrollEvents:()=>{e.current=!0},disableScrollEvents:()=>{e.current=!1}})),[])}();return(0,s.jsx)(l.Provider,{value:n,children:t})}function u(){const e=(0,r.useContext)(l);if(null==e)throw new i.i6("ScrollControllerProvider");return e}const d=()=>o.Z.canUseDOM?{scrollX:window.pageXOffset,scrollY:window.pageYOffset}:null;function p(e,t){void 0===t&&(t=[]);const{scrollEventsEnabledRef:n}=u(),o=(0,r.useRef)(d()),a=(0,i.zX)(e);(0,r.useEffect)((()=>{const e=()=>{if(!n.current)return;const e=d();a(e,o.current),o.current=e},t={passive:!0};return e(),window.addEventListener("scroll",e,t),()=>window.removeEventListener("scroll",e,t)}),[a,n,...t])}function f(){const e=(0,r.useRef)(null),t=(0,a.Z)()&&"smooth"===getComputedStyle(document.documentElement).scrollBehavior;return{startScroll:n=>{e.current=t?function(e){return window.scrollTo({top:e,behavior:"smooth"}),()=>{}}(n):function(e){let t=null;const n=document.documentElement.scrollTop>e;return function r(){const o=document.documentElement.scrollTop;(n&&o>e||!n&&ot&&cancelAnimationFrame(t)}(n)},cancelScroll:()=>e.current?.()}}},246:(e,t,n)=>{"use strict";n.d(t,{HX:()=>i,_q:()=>l,os:()=>s});var r=n(868),o=n(9962),a=n(6409);const i="default";function s(e,t){return`docs-${e}-${t}`}function l(){const{i18n:e}=(0,o.Z)(),t=(0,r._r)(),n=(0,r.WS)(),l=(0,a.Oh)();const c=[i,...Object.keys(t).map((function(e){const r=n?.activePlugin.pluginId===e?n.activeVersion:void 0,o=l[e],a=t[e].versions.find((e=>e.isLast));return s(e,(r??o??a).name)}))];return{locale:e.currentLocale,tags:c}}},2560:(e,t,n)=>{"use strict";n.d(t,{WA:()=>l});n(7294);const r="localStorage";function o(e){let{key:t,oldValue:n,newValue:r,storage:o}=e;if(n===r)return;const a=document.createEvent("StorageEvent");a.initStorageEvent("storage",!1,!1,t,n,r,window.location.href,o),window.dispatchEvent(a)}function a(e){if(void 0===e&&(e=r),"undefined"==typeof window)throw new Error("Browser storage is not available on Node.js/Docusaurus SSR process.");if("none"===e)return null;try{return window[e]}catch(n){return t=n,i||(console.warn("Docusaurus browser storage is not available.\nPossible reasons: running Docusaurus in an iframe, in an incognito browser session, or using too strict browser privacy settings.",t),i=!0),null}var t}let i=!1;const s={get:()=>null,set:()=>{},del:()=>{},listen:()=>()=>{}};function l(e,t){if("undefined"==typeof window)return function(e){function t(){throw new Error(`Illegal storage API usage for storage key "${e}".\nDocusaurus storage APIs are not supposed to be called on the server-rendering process.\nPlease only call storage APIs in effects and event handlers.`)}return{get:t,set:t,del:t,listen:t}}(e);const n=a(t?.persistence);return null===n?s:{get:()=>{try{return n.getItem(e)}catch(t){return console.error(`Docusaurus storage error, can't get key=${e}`,t),null}},set:t=>{try{const r=n.getItem(e);n.setItem(e,t),o({key:e,oldValue:r,newValue:t,storage:n})}catch(r){console.error(`Docusaurus storage error, can't set ${e}=${t}`,r)}},del:()=>{try{const t=n.getItem(e);n.removeItem(e),o({key:e,oldValue:t,newValue:null,storage:n})}catch(t){console.error(`Docusaurus storage error, can't delete key=${e}`,t)}},listen:t=>{try{const r=r=>{r.storageArea===n&&r.key===e&&t(r)};return window.addEventListener("storage",r),()=>window.removeEventListener("storage",r)}catch(r){return console.error(`Docusaurus storage error, can't listen for changes of key=${e}`,r),()=>{}}}}}},626:(e,t,n)=>{"use strict";n.d(t,{l:()=>i});var r=n(9962),o=n(6550),a=n(3905);function i(){const{siteConfig:{baseUrl:e,url:t,trailingSlash:n},i18n:{defaultLocale:i,currentLocale:s}}=(0,r.Z)(),{pathname:l}=(0,o.TH)(),c=(0,a.applyTrailingSlash)(l,{trailingSlash:n,baseUrl:e}),u=s===i?e:e.replace(`/${s}/`,"/"),d=c.replace(e,"");return{createUrl:function(e){let{locale:n,fullyQualified:r}=e;return`${r?t:""}${function(e){return e===i?`${u}`:`${u}${e}/`}(n)}${d}`}}}},3266:(e,t,n)=>{"use strict";n.d(t,{S:()=>i});var r=n(7294),o=n(6550),a=n(3768);function i(e){const t=(0,o.TH)(),n=(0,a.D9)(t),i=(0,a.zX)(e);(0,r.useEffect)((()=>{n&&t!==n&&i({location:t,previousLocation:n})}),[i,t,n])}},107:(e,t,n)=>{"use strict";n.d(t,{L:()=>o});var r=n(9962);function o(){return(0,r.Z)().siteConfig.themeConfig}},4136:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e,t){const{trailingSlash:n,baseUrl:r}=t;if(e.startsWith("#"))return e;if(void 0===n)return e;const[o]=e.split(/[#?]/),a="/"===o||o===r?o:(i=o,n?function(e){return e.endsWith("/")?e:`${e}/`}(i):function(e){return e.endsWith("/")?e.slice(0,-1):e}(i));var i;return e.replace(o,a)}},5806:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.getErrorCausalChain=void 0,t.getErrorCausalChain=function e(t){return t.cause?[t,...e(t.cause)]:[t]}},3905:function(e,t,n){"use strict";var r=this&&this.__importDefault||function(e){return e&&e.__esModule?e:{default:e}};Object.defineProperty(t,"__esModule",{value:!0}),t.getErrorCausalChain=t.applyTrailingSlash=t.blogPostContainerID=void 0,t.blogPostContainerID="__blog-post-container";var o=n(4136);Object.defineProperty(t,"applyTrailingSlash",{enumerable:!0,get:function(){return r(o).default}});var a=n(5806);Object.defineProperty(t,"getErrorCausalChain",{enumerable:!0,get:function(){return a.getErrorCausalChain}})},2358:(e,t,n)=>{"use strict";n.d(t,{lX:()=>x,q_:()=>P,ob:()=>h,PP:()=>I,Ep:()=>m,Hp:()=>g});var r=n(7462);function o(e){return"/"===e.charAt(0)}function a(e,t){for(var n=t,r=n+1,o=e.length;r=0;p--){var f=i[p];"."===f?a(i,p):".."===f?(a(i,p),d++):d&&(a(i,p),d--)}if(!c)for(;d--;d)i.unshift("..");!c||""===i[0]||i[0]&&o(i[0])||i.unshift("");var m=i.join("/");return n&&"/"!==m.substr(-1)&&(m+="/"),m};function s(e){return e.valueOf?e.valueOf():Object.prototype.valueOf.call(e)}const l=function e(t,n){if(t===n)return!0;if(null==t||null==n)return!1;if(Array.isArray(t))return Array.isArray(n)&&t.length===n.length&&t.every((function(t,r){return e(t,n[r])}));if("object"==typeof t||"object"==typeof n){var r=s(t),o=s(n);return r!==t||o!==n?e(r,o):Object.keys(Object.assign({},t,n)).every((function(r){return e(t[r],n[r])}))}return!1};var c=n(2177);function u(e){return"/"===e.charAt(0)?e:"/"+e}function d(e){return"/"===e.charAt(0)?e.substr(1):e}function p(e,t){return function(e,t){return 0===e.toLowerCase().indexOf(t.toLowerCase())&&-1!=="/?#".indexOf(e.charAt(t.length))}(e,t)?e.substr(t.length):e}function f(e){return"/"===e.charAt(e.length-1)?e.slice(0,-1):e}function m(e){var t=e.pathname,n=e.search,r=e.hash,o=t||"/";return n&&"?"!==n&&(o+="?"===n.charAt(0)?n:"?"+n),r&&"#"!==r&&(o+="#"===r.charAt(0)?r:"#"+r),o}function h(e,t,n,o){var a;"string"==typeof e?(a=function(e){var t=e||"/",n="",r="",o=t.indexOf("#");-1!==o&&(r=t.substr(o),t=t.substr(0,o));var a=t.indexOf("?");return-1!==a&&(n=t.substr(a),t=t.substr(0,a)),{pathname:t,search:"?"===n?"":n,hash:"#"===r?"":r}}(e),a.state=t):(void 0===(a=(0,r.Z)({},e)).pathname&&(a.pathname=""),a.search?"?"!==a.search.charAt(0)&&(a.search="?"+a.search):a.search="",a.hash?"#"!==a.hash.charAt(0)&&(a.hash="#"+a.hash):a.hash="",void 0!==t&&void 0===a.state&&(a.state=t));try{a.pathname=decodeURI(a.pathname)}catch(s){throw s instanceof URIError?new URIError('Pathname "'+a.pathname+'" could not be decoded. This is likely caused by an invalid percent-encoding.'):s}return n&&(a.key=n),o?a.pathname?"/"!==a.pathname.charAt(0)&&(a.pathname=i(a.pathname,o.pathname)):a.pathname=o.pathname:a.pathname||(a.pathname="/"),a}function g(e,t){return e.pathname===t.pathname&&e.search===t.search&&e.hash===t.hash&&e.key===t.key&&l(e.state,t.state)}function y(){var e=null;var t=[];return{setPrompt:function(t){return e=t,function(){e===t&&(e=null)}},confirmTransitionTo:function(t,n,r,o){if(null!=e){var a="function"==typeof e?e(t,n):e;"string"==typeof a?"function"==typeof r?r(a,o):o(!0):o(!1!==a)}else o(!0)},appendListener:function(e){var n=!0;function r(){n&&e.apply(void 0,arguments)}return t.push(r),function(){n=!1,t=t.filter((function(e){return e!==r}))}},notifyListeners:function(){for(var e=arguments.length,n=new Array(e),r=0;rt?n.splice(t,n.length-t,o):n.push(o),d({action:r,location:o,index:t,entries:n})}}))},replace:function(e,t){var r="REPLACE",o=h(e,t,p(),w.location);u.confirmTransitionTo(o,r,n,(function(e){e&&(w.entries[w.index]=o,d({action:r,location:o}))}))},go:v,goBack:function(){v(-1)},goForward:function(){v(1)},canGo:function(e){var t=w.index+e;return t>=0&&t{"use strict";var r=n(9864),o={childContextTypes:!0,contextType:!0,contextTypes:!0,defaultProps:!0,displayName:!0,getDefaultProps:!0,getDerivedStateFromError:!0,getDerivedStateFromProps:!0,mixins:!0,propTypes:!0,type:!0},a={name:!0,length:!0,prototype:!0,caller:!0,callee:!0,arguments:!0,arity:!0},i={$$typeof:!0,compare:!0,defaultProps:!0,displayName:!0,propTypes:!0,type:!0},s={};function l(e){return r.isMemo(e)?i:s[e.$$typeof]||o}s[r.ForwardRef]={$$typeof:!0,render:!0,defaultProps:!0,displayName:!0,propTypes:!0},s[r.Memo]=i;var c=Object.defineProperty,u=Object.getOwnPropertyNames,d=Object.getOwnPropertySymbols,p=Object.getOwnPropertyDescriptor,f=Object.getPrototypeOf,m=Object.prototype;e.exports=function e(t,n,r){if("string"!=typeof n){if(m){var o=f(n);o&&o!==m&&e(t,o,r)}var i=u(n);d&&(i=i.concat(d(n)));for(var s=l(t),h=l(n),g=0;g{"use strict";e.exports=function(e,t,n,r,o,a,i,s){if(!e){var l;if(void 0===t)l=new Error("Minified exception occurred; use the non-minified dev environment for the full error message and additional helpful warnings.");else{var c=[n,r,o,a,i,s],u=0;(l=new Error(t.replace(/%s/g,(function(){return c[u++]})))).name="Invariant Violation"}throw l.framesToPop=1,l}}},5826:e=>{e.exports=Array.isArray||function(e){return"[object Array]"==Object.prototype.toString.call(e)}},813:function(e){e.exports=function(){"use strict";var e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},t=function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")},n=function(){function e(e,t){for(var n=0;n1&&void 0!==arguments[1])||arguments[1],o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:[],a=arguments.length>3&&void 0!==arguments[3]?arguments[3]:5e3;t(this,e),this.ctx=n,this.iframes=r,this.exclude=o,this.iframesTimeout=a}return n(e,[{key:"getContexts",value:function(){var e=[];return(void 0!==this.ctx&&this.ctx?NodeList.prototype.isPrototypeOf(this.ctx)?Array.prototype.slice.call(this.ctx):Array.isArray(this.ctx)?this.ctx:"string"==typeof this.ctx?Array.prototype.slice.call(document.querySelectorAll(this.ctx)):[this.ctx]:[]).forEach((function(t){var n=e.filter((function(e){return e.contains(t)})).length>0;-1!==e.indexOf(t)||n||e.push(t)})),e}},{key:"getIframeContents",value:function(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:function(){},r=void 0;try{var o=e.contentWindow;if(r=o.document,!o||!r)throw new Error("iframe inaccessible")}catch(a){n()}r&&t(r)}},{key:"isIframeBlank",value:function(e){var t="about:blank",n=e.getAttribute("src").trim();return e.contentWindow.location.href===t&&n!==t&&n}},{key:"observeIframeLoad",value:function(e,t,n){var r=this,o=!1,a=null,i=function i(){if(!o){o=!0,clearTimeout(a);try{r.isIframeBlank(e)||(e.removeEventListener("load",i),r.getIframeContents(e,t,n))}catch(s){n()}}};e.addEventListener("load",i),a=setTimeout(i,this.iframesTimeout)}},{key:"onIframeReady",value:function(e,t,n){try{"complete"===e.contentWindow.document.readyState?this.isIframeBlank(e)?this.observeIframeLoad(e,t,n):this.getIframeContents(e,t,n):this.observeIframeLoad(e,t,n)}catch(r){n()}}},{key:"waitForIframes",value:function(e,t){var n=this,r=0;this.forEachIframe(e,(function(){return!0}),(function(e){r++,n.waitForIframes(e.querySelector("html"),(function(){--r||t()}))}),(function(e){e||t()}))}},{key:"forEachIframe",value:function(t,n,r){var o=this,a=arguments.length>3&&void 0!==arguments[3]?arguments[3]:function(){},i=t.querySelectorAll("iframe"),s=i.length,l=0;i=Array.prototype.slice.call(i);var c=function(){--s<=0&&a(l)};s||c(),i.forEach((function(t){e.matches(t,o.exclude)?c():o.onIframeReady(t,(function(e){n(t)&&(l++,r(e)),c()}),c)}))}},{key:"createIterator",value:function(e,t,n){return document.createNodeIterator(e,t,n,!1)}},{key:"createInstanceOnIframe",value:function(t){return new e(t.querySelector("html"),this.iframes)}},{key:"compareNodeIframe",value:function(e,t,n){if(e.compareDocumentPosition(n)&Node.DOCUMENT_POSITION_PRECEDING){if(null===t)return!0;if(t.compareDocumentPosition(n)&Node.DOCUMENT_POSITION_FOLLOWING)return!0}return!1}},{key:"getIteratorNode",value:function(e){var t=e.previousNode();return{prevNode:t,node:(null===t||e.nextNode())&&e.nextNode()}}},{key:"checkIframeFilter",value:function(e,t,n,r){var o=!1,a=!1;return r.forEach((function(e,t){e.val===n&&(o=t,a=e.handled)})),this.compareNodeIframe(e,t,n)?(!1!==o||a?!1===o||a||(r[o].handled=!0):r.push({val:n,handled:!0}),!0):(!1===o&&r.push({val:n,handled:!1}),!1)}},{key:"handleOpenIframes",value:function(e,t,n,r){var o=this;e.forEach((function(e){e.handled||o.getIframeContents(e.val,(function(e){o.createInstanceOnIframe(e).forEachNode(t,n,r)}))}))}},{key:"iterateThroughNodes",value:function(e,t,n,r,o){for(var a=this,i=this.createIterator(t,e,r),s=[],l=[],c=void 0,u=void 0,d=function(){var e=a.getIteratorNode(i);return u=e.prevNode,c=e.node};d();)this.iframes&&this.forEachIframe(t,(function(e){return a.checkIframeFilter(c,u,e,s)}),(function(t){a.createInstanceOnIframe(t).forEachNode(e,(function(e){return l.push(e)}),r)})),l.push(c);l.forEach((function(e){n(e)})),this.iframes&&this.handleOpenIframes(s,e,n,r),o()}},{key:"forEachNode",value:function(e,t,n){var r=this,o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:function(){},a=this.getContexts(),i=a.length;i||o(),a.forEach((function(a){var s=function(){r.iterateThroughNodes(e,a,t,n,(function(){--i<=0&&o()}))};r.iframes?r.waitForIframes(a,s):s()}))}}],[{key:"matches",value:function(e,t){var n="string"==typeof t?[t]:t,r=e.matches||e.matchesSelector||e.msMatchesSelector||e.mozMatchesSelector||e.oMatchesSelector||e.webkitMatchesSelector;if(r){var o=!1;return n.every((function(t){return!r.call(e,t)||(o=!0,!1)})),o}return!1}}]),e}(),a=function(){function a(e){t(this,a),this.ctx=e,this.ie=!1;var n=window.navigator.userAgent;(n.indexOf("MSIE")>-1||n.indexOf("Trident")>-1)&&(this.ie=!0)}return n(a,[{key:"log",value:function(t){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"debug",r=this.opt.log;this.opt.debug&&"object"===(void 0===r?"undefined":e(r))&&"function"==typeof r[n]&&r[n]("mark.js: "+t)}},{key:"escapeStr",value:function(e){return e.replace(/[\-\[\]\/\{\}\(\)\*\+\?\.\\\^\$\|]/g,"\\$&")}},{key:"createRegExp",value:function(e){return"disabled"!==this.opt.wildcards&&(e=this.setupWildcardsRegExp(e)),e=this.escapeStr(e),Object.keys(this.opt.synonyms).length&&(e=this.createSynonymsRegExp(e)),(this.opt.ignoreJoiners||this.opt.ignorePunctuation.length)&&(e=this.setupIgnoreJoinersRegExp(e)),this.opt.diacritics&&(e=this.createDiacriticsRegExp(e)),e=this.createMergedBlanksRegExp(e),(this.opt.ignoreJoiners||this.opt.ignorePunctuation.length)&&(e=this.createJoinersRegExp(e)),"disabled"!==this.opt.wildcards&&(e=this.createWildcardsRegExp(e)),e=this.createAccuracyRegExp(e)}},{key:"createSynonymsRegExp",value:function(e){var t=this.opt.synonyms,n=this.opt.caseSensitive?"":"i",r=this.opt.ignoreJoiners||this.opt.ignorePunctuation.length?"\0":"";for(var o in t)if(t.hasOwnProperty(o)){var a=t[o],i="disabled"!==this.opt.wildcards?this.setupWildcardsRegExp(o):this.escapeStr(o),s="disabled"!==this.opt.wildcards?this.setupWildcardsRegExp(a):this.escapeStr(a);""!==i&&""!==s&&(e=e.replace(new RegExp("("+this.escapeStr(i)+"|"+this.escapeStr(s)+")","gm"+n),r+"("+this.processSynomyms(i)+"|"+this.processSynomyms(s)+")"+r))}return e}},{key:"processSynomyms",value:function(e){return(this.opt.ignoreJoiners||this.opt.ignorePunctuation.length)&&(e=this.setupIgnoreJoinersRegExp(e)),e}},{key:"setupWildcardsRegExp",value:function(e){return(e=e.replace(/(?:\\)*\?/g,(function(e){return"\\"===e.charAt(0)?"?":"\x01"}))).replace(/(?:\\)*\*/g,(function(e){return"\\"===e.charAt(0)?"*":"\x02"}))}},{key:"createWildcardsRegExp",value:function(e){var t="withSpaces"===this.opt.wildcards;return e.replace(/\u0001/g,t?"[\\S\\s]?":"\\S?").replace(/\u0002/g,t?"[\\S\\s]*?":"\\S*")}},{key:"setupIgnoreJoinersRegExp",value:function(e){return e.replace(/[^(|)\\]/g,(function(e,t,n){var r=n.charAt(t+1);return/[(|)\\]/.test(r)||""===r?e:e+"\0"}))}},{key:"createJoinersRegExp",value:function(e){var t=[],n=this.opt.ignorePunctuation;return Array.isArray(n)&&n.length&&t.push(this.escapeStr(n.join(""))),this.opt.ignoreJoiners&&t.push("\\u00ad\\u200b\\u200c\\u200d"),t.length?e.split(/\u0000+/).join("["+t.join("")+"]*"):e}},{key:"createDiacriticsRegExp",value:function(e){var t=this.opt.caseSensitive?"":"i",n=this.opt.caseSensitive?["a\xe0\xe1\u1ea3\xe3\u1ea1\u0103\u1eb1\u1eaf\u1eb3\u1eb5\u1eb7\xe2\u1ea7\u1ea5\u1ea9\u1eab\u1ead\xe4\xe5\u0101\u0105","A\xc0\xc1\u1ea2\xc3\u1ea0\u0102\u1eb0\u1eae\u1eb2\u1eb4\u1eb6\xc2\u1ea6\u1ea4\u1ea8\u1eaa\u1eac\xc4\xc5\u0100\u0104","c\xe7\u0107\u010d","C\xc7\u0106\u010c","d\u0111\u010f","D\u0110\u010e","e\xe8\xe9\u1ebb\u1ebd\u1eb9\xea\u1ec1\u1ebf\u1ec3\u1ec5\u1ec7\xeb\u011b\u0113\u0119","E\xc8\xc9\u1eba\u1ebc\u1eb8\xca\u1ec0\u1ebe\u1ec2\u1ec4\u1ec6\xcb\u011a\u0112\u0118","i\xec\xed\u1ec9\u0129\u1ecb\xee\xef\u012b","I\xcc\xcd\u1ec8\u0128\u1eca\xce\xcf\u012a","l\u0142","L\u0141","n\xf1\u0148\u0144","N\xd1\u0147\u0143","o\xf2\xf3\u1ecf\xf5\u1ecd\xf4\u1ed3\u1ed1\u1ed5\u1ed7\u1ed9\u01a1\u1edf\u1ee1\u1edb\u1edd\u1ee3\xf6\xf8\u014d","O\xd2\xd3\u1ece\xd5\u1ecc\xd4\u1ed2\u1ed0\u1ed4\u1ed6\u1ed8\u01a0\u1ede\u1ee0\u1eda\u1edc\u1ee2\xd6\xd8\u014c","r\u0159","R\u0158","s\u0161\u015b\u0219\u015f","S\u0160\u015a\u0218\u015e","t\u0165\u021b\u0163","T\u0164\u021a\u0162","u\xf9\xfa\u1ee7\u0169\u1ee5\u01b0\u1eeb\u1ee9\u1eed\u1eef\u1ef1\xfb\xfc\u016f\u016b","U\xd9\xda\u1ee6\u0168\u1ee4\u01af\u1eea\u1ee8\u1eec\u1eee\u1ef0\xdb\xdc\u016e\u016a","y\xfd\u1ef3\u1ef7\u1ef9\u1ef5\xff","Y\xdd\u1ef2\u1ef6\u1ef8\u1ef4\u0178","z\u017e\u017c\u017a","Z\u017d\u017b\u0179"]:["a\xe0\xe1\u1ea3\xe3\u1ea1\u0103\u1eb1\u1eaf\u1eb3\u1eb5\u1eb7\xe2\u1ea7\u1ea5\u1ea9\u1eab\u1ead\xe4\xe5\u0101\u0105A\xc0\xc1\u1ea2\xc3\u1ea0\u0102\u1eb0\u1eae\u1eb2\u1eb4\u1eb6\xc2\u1ea6\u1ea4\u1ea8\u1eaa\u1eac\xc4\xc5\u0100\u0104","c\xe7\u0107\u010dC\xc7\u0106\u010c","d\u0111\u010fD\u0110\u010e","e\xe8\xe9\u1ebb\u1ebd\u1eb9\xea\u1ec1\u1ebf\u1ec3\u1ec5\u1ec7\xeb\u011b\u0113\u0119E\xc8\xc9\u1eba\u1ebc\u1eb8\xca\u1ec0\u1ebe\u1ec2\u1ec4\u1ec6\xcb\u011a\u0112\u0118","i\xec\xed\u1ec9\u0129\u1ecb\xee\xef\u012bI\xcc\xcd\u1ec8\u0128\u1eca\xce\xcf\u012a","l\u0142L\u0141","n\xf1\u0148\u0144N\xd1\u0147\u0143","o\xf2\xf3\u1ecf\xf5\u1ecd\xf4\u1ed3\u1ed1\u1ed5\u1ed7\u1ed9\u01a1\u1edf\u1ee1\u1edb\u1edd\u1ee3\xf6\xf8\u014dO\xd2\xd3\u1ece\xd5\u1ecc\xd4\u1ed2\u1ed0\u1ed4\u1ed6\u1ed8\u01a0\u1ede\u1ee0\u1eda\u1edc\u1ee2\xd6\xd8\u014c","r\u0159R\u0158","s\u0161\u015b\u0219\u015fS\u0160\u015a\u0218\u015e","t\u0165\u021b\u0163T\u0164\u021a\u0162","u\xf9\xfa\u1ee7\u0169\u1ee5\u01b0\u1eeb\u1ee9\u1eed\u1eef\u1ef1\xfb\xfc\u016f\u016bU\xd9\xda\u1ee6\u0168\u1ee4\u01af\u1eea\u1ee8\u1eec\u1eee\u1ef0\xdb\xdc\u016e\u016a","y\xfd\u1ef3\u1ef7\u1ef9\u1ef5\xffY\xdd\u1ef2\u1ef6\u1ef8\u1ef4\u0178","z\u017e\u017c\u017aZ\u017d\u017b\u0179"],r=[];return e.split("").forEach((function(o){n.every((function(n){if(-1!==n.indexOf(o)){if(r.indexOf(n)>-1)return!1;e=e.replace(new RegExp("["+n+"]","gm"+t),"["+n+"]"),r.push(n)}return!0}))})),e}},{key:"createMergedBlanksRegExp",value:function(e){return e.replace(/[\s]+/gim,"[\\s]+")}},{key:"createAccuracyRegExp",value:function(e){var t=this,n="!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~\xa1\xbf",r=this.opt.accuracy,o="string"==typeof r?r:r.value,a="string"==typeof r?[]:r.limiters,i="";switch(a.forEach((function(e){i+="|"+t.escapeStr(e)})),o){case"partially":default:return"()("+e+")";case"complementary":return"()([^"+(i="\\s"+(i||this.escapeStr(n)))+"]*"+e+"[^"+i+"]*)";case"exactly":return"(^|\\s"+i+")("+e+")(?=$|\\s"+i+")"}}},{key:"getSeparatedKeywords",value:function(e){var t=this,n=[];return e.forEach((function(e){t.opt.separateWordSearch?e.split(" ").forEach((function(e){e.trim()&&-1===n.indexOf(e)&&n.push(e)})):e.trim()&&-1===n.indexOf(e)&&n.push(e)})),{keywords:n.sort((function(e,t){return t.length-e.length})),length:n.length}}},{key:"isNumeric",value:function(e){return Number(parseFloat(e))==e}},{key:"checkRanges",value:function(e){var t=this;if(!Array.isArray(e)||"[object Object]"!==Object.prototype.toString.call(e[0]))return this.log("markRanges() will only accept an array of objects"),this.opt.noMatch(e),[];var n=[],r=0;return e.sort((function(e,t){return e.start-t.start})).forEach((function(e){var o=t.callNoMatchOnInvalidRanges(e,r),a=o.start,i=o.end;o.valid&&(e.start=a,e.length=i-a,n.push(e),r=i)})),n}},{key:"callNoMatchOnInvalidRanges",value:function(e,t){var n=void 0,r=void 0,o=!1;return e&&void 0!==e.start?(r=(n=parseInt(e.start,10))+parseInt(e.length,10),this.isNumeric(e.start)&&this.isNumeric(e.length)&&r-t>0&&r-n>0?o=!0:(this.log("Ignoring invalid or overlapping range: "+JSON.stringify(e)),this.opt.noMatch(e))):(this.log("Ignoring invalid range: "+JSON.stringify(e)),this.opt.noMatch(e)),{start:n,end:r,valid:o}}},{key:"checkWhitespaceRanges",value:function(e,t,n){var r=void 0,o=!0,a=n.length,i=t-a,s=parseInt(e.start,10)-i;return(r=(s=s>a?a:s)+parseInt(e.length,10))>a&&(r=a,this.log("End range automatically set to the max value of "+a)),s<0||r-s<0||s>a||r>a?(o=!1,this.log("Invalid range: "+JSON.stringify(e)),this.opt.noMatch(e)):""===n.substring(s,r).replace(/\s+/g,"")&&(o=!1,this.log("Skipping whitespace only range: "+JSON.stringify(e)),this.opt.noMatch(e)),{start:s,end:r,valid:o}}},{key:"getTextNodes",value:function(e){var t=this,n="",r=[];this.iterator.forEachNode(NodeFilter.SHOW_TEXT,(function(e){r.push({start:n.length,end:(n+=e.textContent).length,node:e})}),(function(e){return t.matchesExclude(e.parentNode)?NodeFilter.FILTER_REJECT:NodeFilter.FILTER_ACCEPT}),(function(){e({value:n,nodes:r})}))}},{key:"matchesExclude",value:function(e){return o.matches(e,this.opt.exclude.concat(["script","style","title","head","html"]))}},{key:"wrapRangeInTextNode",value:function(e,t,n){var r=this.opt.element?this.opt.element:"mark",o=e.splitText(t),a=o.splitText(n-t),i=document.createElement(r);return i.setAttribute("data-markjs","true"),this.opt.className&&i.setAttribute("class",this.opt.className),i.textContent=o.textContent,o.parentNode.replaceChild(i,o),a}},{key:"wrapRangeInMappedTextNode",value:function(e,t,n,r,o){var a=this;e.nodes.every((function(i,s){var l=e.nodes[s+1];if(void 0===l||l.start>t){if(!r(i.node))return!1;var c=t-i.start,u=(n>i.end?i.end:n)-i.start,d=e.value.substr(0,i.start),p=e.value.substr(u+i.start);if(i.node=a.wrapRangeInTextNode(i.node,c,u),e.value=d+p,e.nodes.forEach((function(t,n){n>=s&&(e.nodes[n].start>0&&n!==s&&(e.nodes[n].start-=u),e.nodes[n].end-=u)})),n-=u,o(i.node.previousSibling,i.start),!(n>i.end))return!1;t=i.end}return!0}))}},{key:"wrapMatches",value:function(e,t,n,r,o){var a=this,i=0===t?0:t+1;this.getTextNodes((function(t){t.nodes.forEach((function(t){t=t.node;for(var o=void 0;null!==(o=e.exec(t.textContent))&&""!==o[i];)if(n(o[i],t)){var s=o.index;if(0!==i)for(var l=1;l{"use strict";n.r(t)},6930:(e,t,n)=>{"use strict";n.r(t)},4865:function(e,t,n){var r,o;r=function(){var e,t,n={version:"0.2.0"},r=n.settings={minimum:.08,easing:"ease",positionUsing:"",speed:200,trickle:!0,trickleRate:.02,trickleSpeed:800,showSpinner:!0,barSelector:'[role="bar"]',spinnerSelector:'[role="spinner"]',parent:"body",template:'
'};function o(e,t,n){return en?n:e}function a(e){return 100*(-1+e)}function i(e,t,n){var o;return(o="translate3d"===r.positionUsing?{transform:"translate3d("+a(e)+"%,0,0)"}:"translate"===r.positionUsing?{transform:"translate("+a(e)+"%,0)"}:{"margin-left":a(e)+"%"}).transition="all "+t+"ms "+n,o}n.configure=function(e){var t,n;for(t in e)void 0!==(n=e[t])&&e.hasOwnProperty(t)&&(r[t]=n);return this},n.status=null,n.set=function(e){var t=n.isStarted();e=o(e,r.minimum,1),n.status=1===e?null:e;var a=n.render(!t),c=a.querySelector(r.barSelector),u=r.speed,d=r.easing;return a.offsetWidth,s((function(t){""===r.positionUsing&&(r.positionUsing=n.getPositioningCSS()),l(c,i(e,u,d)),1===e?(l(a,{transition:"none",opacity:1}),a.offsetWidth,setTimeout((function(){l(a,{transition:"all "+u+"ms linear",opacity:0}),setTimeout((function(){n.remove(),t()}),u)}),u)):setTimeout(t,u)})),this},n.isStarted=function(){return"number"==typeof n.status},n.start=function(){n.status||n.set(0);var e=function(){setTimeout((function(){n.status&&(n.trickle(),e())}),r.trickleSpeed)};return r.trickle&&e(),this},n.done=function(e){return e||n.status?n.inc(.3+.5*Math.random()).set(1):this},n.inc=function(e){var t=n.status;return t?("number"!=typeof e&&(e=(1-t)*o(Math.random()*t,.1,.95)),t=o(t+e,0,.994),n.set(t)):n.start()},n.trickle=function(){return n.inc(Math.random()*r.trickleRate)},e=0,t=0,n.promise=function(r){return r&&"resolved"!==r.state()?(0===t&&n.start(),e++,t++,r.always((function(){0==--t?(e=0,n.done()):n.set((e-t)/e)})),this):this},n.render=function(e){if(n.isRendered())return document.getElementById("nprogress");u(document.documentElement,"nprogress-busy");var t=document.createElement("div");t.id="nprogress",t.innerHTML=r.template;var o,i=t.querySelector(r.barSelector),s=e?"-100":a(n.status||0),c=document.querySelector(r.parent);return l(i,{transition:"all 0 linear",transform:"translate3d("+s+"%,0,0)"}),r.showSpinner||(o=t.querySelector(r.spinnerSelector))&&f(o),c!=document.body&&u(c,"nprogress-custom-parent"),c.appendChild(t),t},n.remove=function(){d(document.documentElement,"nprogress-busy"),d(document.querySelector(r.parent),"nprogress-custom-parent");var e=document.getElementById("nprogress");e&&f(e)},n.isRendered=function(){return!!document.getElementById("nprogress")},n.getPositioningCSS=function(){var e=document.body.style,t="WebkitTransform"in e?"Webkit":"MozTransform"in e?"Moz":"msTransform"in e?"ms":"OTransform"in e?"O":"";return t+"Perspective"in e?"translate3d":t+"Transform"in e?"translate":"margin"};var s=function(){var e=[];function t(){var n=e.shift();n&&n(t)}return function(n){e.push(n),1==e.length&&t()}}(),l=function(){var e=["Webkit","O","Moz","ms"],t={};function n(e){return e.replace(/^-ms-/,"ms-").replace(/-([\da-z])/gi,(function(e,t){return t.toUpperCase()}))}function r(t){var n=document.body.style;if(t in n)return t;for(var r,o=e.length,a=t.charAt(0).toUpperCase()+t.slice(1);o--;)if((r=e[o]+a)in n)return r;return t}function o(e){return e=n(e),t[e]||(t[e]=r(e))}function a(e,t,n){t=o(t),e.style[t]=n}return function(e,t){var n,r,o=arguments;if(2==o.length)for(n in t)void 0!==(r=t[n])&&t.hasOwnProperty(n)&&a(e,n,r);else a(e,o[1],o[2])}}();function c(e,t){return("string"==typeof e?e:p(e)).indexOf(" "+t+" ")>=0}function u(e,t){var n=p(e),r=n+t;c(n,t)||(e.className=r.substring(1))}function d(e,t){var n,r=p(e);c(e,t)&&(n=r.replace(" "+t+" "," "),e.className=n.substring(1,n.length-1))}function p(e){return(" "+(e.className||"")+" ").replace(/\s+/gi," ")}function f(e){e&&e.parentNode&&e.parentNode.removeChild(e)}return n},void 0===(o="function"==typeof r?r.call(t,n,t,e):r)||(e.exports=o)},9901:e=>{e.exports&&(e.exports={core:{meta:{path:"components/prism-core.js",option:"mandatory"},core:"Core"},themes:{meta:{path:"themes/{id}.css",link:"index.html?theme={id}",exclusive:!0},prism:{title:"Default",option:"default"},"prism-dark":"Dark","prism-funky":"Funky","prism-okaidia":{title:"Okaidia",owner:"ocodia"},"prism-twilight":{title:"Twilight",owner:"remybach"},"prism-coy":{title:"Coy",owner:"tshedor"},"prism-solarizedlight":{title:"Solarized Light",owner:"hectormatos2011 "},"prism-tomorrow":{title:"Tomorrow Night",owner:"Rosey"}},languages:{meta:{path:"components/prism-{id}",noCSS:!0,examplesPath:"examples/prism-{id}",addCheckAll:!0},markup:{title:"Markup",alias:["html","xml","svg","mathml","ssml","atom","rss"],aliasTitles:{html:"HTML",xml:"XML",svg:"SVG",mathml:"MathML",ssml:"SSML",atom:"Atom",rss:"RSS"},option:"default"},css:{title:"CSS",option:"default",modify:"markup"},clike:{title:"C-like",option:"default"},javascript:{title:"JavaScript",require:"clike",modify:"markup",optional:"regex",alias:"js",option:"default"},abap:{title:"ABAP",owner:"dellagustin"},abnf:{title:"ABNF",owner:"RunDevelopment"},actionscript:{title:"ActionScript",require:"javascript",modify:"markup",owner:"Golmote"},ada:{title:"Ada",owner:"Lucretia"},agda:{title:"Agda",owner:"xy-ren"},al:{title:"AL",owner:"RunDevelopment"},antlr4:{title:"ANTLR4",alias:"g4",owner:"RunDevelopment"},apacheconf:{title:"Apache Configuration",owner:"GuiTeK"},apex:{title:"Apex",require:["clike","sql"],owner:"RunDevelopment"},apl:{title:"APL",owner:"ngn"},applescript:{title:"AppleScript",owner:"Golmote"},aql:{title:"AQL",owner:"RunDevelopment"},arduino:{title:"Arduino",require:"cpp",alias:"ino",owner:"dkern"},arff:{title:"ARFF",owner:"Golmote"},armasm:{title:"ARM Assembly",alias:"arm-asm",owner:"RunDevelopment"},arturo:{title:"Arturo",alias:"art",optional:["bash","css","javascript","markup","markdown","sql"],owner:"drkameleon"},asciidoc:{alias:"adoc",title:"AsciiDoc",owner:"Golmote"},aspnet:{title:"ASP.NET (C#)",require:["markup","csharp"],owner:"nauzilus"},asm6502:{title:"6502 Assembly",owner:"kzurawel"},asmatmel:{title:"Atmel AVR Assembly",owner:"cerkit"},autohotkey:{title:"AutoHotkey",owner:"aviaryan"},autoit:{title:"AutoIt",owner:"Golmote"},avisynth:{title:"AviSynth",alias:"avs",owner:"Zinfidel"},"avro-idl":{title:"Avro IDL",alias:"avdl",owner:"RunDevelopment"},awk:{title:"AWK",alias:"gawk",aliasTitles:{gawk:"GAWK"},owner:"RunDevelopment"},bash:{title:"Bash",alias:["sh","shell"],aliasTitles:{sh:"Shell",shell:"Shell"},owner:"zeitgeist87"},basic:{title:"BASIC",owner:"Golmote"},batch:{title:"Batch",owner:"Golmote"},bbcode:{title:"BBcode",alias:"shortcode",aliasTitles:{shortcode:"Shortcode"},owner:"RunDevelopment"},bbj:{title:"BBj",owner:"hyyan"},bicep:{title:"Bicep",owner:"johnnyreilly"},birb:{title:"Birb",require:"clike",owner:"Calamity210"},bison:{title:"Bison",require:"c",owner:"Golmote"},bnf:{title:"BNF",alias:"rbnf",aliasTitles:{rbnf:"RBNF"},owner:"RunDevelopment"},bqn:{title:"BQN",owner:"yewscion"},brainfuck:{title:"Brainfuck",owner:"Golmote"},brightscript:{title:"BrightScript",owner:"RunDevelopment"},bro:{title:"Bro",owner:"wayward710"},bsl:{title:"BSL (1C:Enterprise)",alias:"oscript",aliasTitles:{oscript:"OneScript"},owner:"Diversus23"},c:{title:"C",require:"clike",owner:"zeitgeist87"},csharp:{title:"C#",require:"clike",alias:["cs","dotnet"],owner:"mvalipour"},cpp:{title:"C++",require:"c",owner:"zeitgeist87"},cfscript:{title:"CFScript",require:"clike",alias:"cfc",owner:"mjclemente"},chaiscript:{title:"ChaiScript",require:["clike","cpp"],owner:"RunDevelopment"},cil:{title:"CIL",owner:"sbrl"},cilkc:{title:"Cilk/C",require:"c",alias:"cilk-c",owner:"OpenCilk"},cilkcpp:{title:"Cilk/C++",require:"cpp",alias:["cilk-cpp","cilk"],owner:"OpenCilk"},clojure:{title:"Clojure",owner:"troglotit"},cmake:{title:"CMake",owner:"mjrogozinski"},cobol:{title:"COBOL",owner:"RunDevelopment"},coffeescript:{title:"CoffeeScript",require:"javascript",alias:"coffee",owner:"R-osey"},concurnas:{title:"Concurnas",alias:"conc",owner:"jasontatton"},csp:{title:"Content-Security-Policy",owner:"ScottHelme"},cooklang:{title:"Cooklang",owner:"ahue"},coq:{title:"Coq",owner:"RunDevelopment"},crystal:{title:"Crystal",require:"ruby",owner:"MakeNowJust"},"css-extras":{title:"CSS Extras",require:"css",modify:"css",owner:"milesj"},csv:{title:"CSV",owner:"RunDevelopment"},cue:{title:"CUE",owner:"RunDevelopment"},cypher:{title:"Cypher",owner:"RunDevelopment"},d:{title:"D",require:"clike",owner:"Golmote"},dart:{title:"Dart",require:"clike",owner:"Golmote"},dataweave:{title:"DataWeave",owner:"machaval"},dax:{title:"DAX",owner:"peterbud"},dhall:{title:"Dhall",owner:"RunDevelopment"},diff:{title:"Diff",owner:"uranusjr"},django:{title:"Django/Jinja2",require:"markup-templating",alias:"jinja2",owner:"romanvm"},"dns-zone-file":{title:"DNS zone file",owner:"RunDevelopment",alias:"dns-zone"},docker:{title:"Docker",alias:"dockerfile",owner:"JustinBeckwith"},dot:{title:"DOT (Graphviz)",alias:"gv",optional:"markup",owner:"RunDevelopment"},ebnf:{title:"EBNF",owner:"RunDevelopment"},editorconfig:{title:"EditorConfig",owner:"osipxd"},eiffel:{title:"Eiffel",owner:"Conaclos"},ejs:{title:"EJS",require:["javascript","markup-templating"],owner:"RunDevelopment",alias:"eta",aliasTitles:{eta:"Eta"}},elixir:{title:"Elixir",owner:"Golmote"},elm:{title:"Elm",owner:"zwilias"},etlua:{title:"Embedded Lua templating",require:["lua","markup-templating"],owner:"RunDevelopment"},erb:{title:"ERB",require:["ruby","markup-templating"],owner:"Golmote"},erlang:{title:"Erlang",owner:"Golmote"},"excel-formula":{title:"Excel Formula",alias:["xlsx","xls"],owner:"RunDevelopment"},fsharp:{title:"F#",require:"clike",owner:"simonreynolds7"},factor:{title:"Factor",owner:"catb0t"},false:{title:"False",owner:"edukisto"},"firestore-security-rules":{title:"Firestore security rules",require:"clike",owner:"RunDevelopment"},flow:{title:"Flow",require:"javascript",owner:"Golmote"},fortran:{title:"Fortran",owner:"Golmote"},ftl:{title:"FreeMarker Template Language",require:"markup-templating",owner:"RunDevelopment"},gml:{title:"GameMaker Language",alias:"gamemakerlanguage",require:"clike",owner:"LiarOnce"},gap:{title:"GAP (CAS)",owner:"RunDevelopment"},gcode:{title:"G-code",owner:"RunDevelopment"},gdscript:{title:"GDScript",owner:"RunDevelopment"},gedcom:{title:"GEDCOM",owner:"Golmote"},gettext:{title:"gettext",alias:"po",owner:"RunDevelopment"},gherkin:{title:"Gherkin",owner:"hason"},git:{title:"Git",owner:"lgiraudel"},glsl:{title:"GLSL",require:"c",owner:"Golmote"},gn:{title:"GN",alias:"gni",owner:"RunDevelopment"},"linker-script":{title:"GNU Linker Script",alias:"ld",owner:"RunDevelopment"},go:{title:"Go",require:"clike",owner:"arnehormann"},"go-module":{title:"Go module",alias:"go-mod",owner:"RunDevelopment"},gradle:{title:"Gradle",require:"clike",owner:"zeabdelkhalek-badido18"},graphql:{title:"GraphQL",optional:"markdown",owner:"Golmote"},groovy:{title:"Groovy",require:"clike",owner:"robfletcher"},haml:{title:"Haml",require:"ruby",optional:["css","css-extras","coffeescript","erb","javascript","less","markdown","scss","textile"],owner:"Golmote"},handlebars:{title:"Handlebars",require:"markup-templating",alias:["hbs","mustache"],aliasTitles:{mustache:"Mustache"},owner:"Golmote"},haskell:{title:"Haskell",alias:"hs",owner:"bholst"},haxe:{title:"Haxe",require:"clike",optional:"regex",owner:"Golmote"},hcl:{title:"HCL",owner:"outsideris"},hlsl:{title:"HLSL",require:"c",owner:"RunDevelopment"},hoon:{title:"Hoon",owner:"matildepark"},http:{title:"HTTP",optional:["csp","css","hpkp","hsts","javascript","json","markup","uri"],owner:"danielgtaylor"},hpkp:{title:"HTTP Public-Key-Pins",owner:"ScottHelme"},hsts:{title:"HTTP Strict-Transport-Security",owner:"ScottHelme"},ichigojam:{title:"IchigoJam",owner:"BlueCocoa"},icon:{title:"Icon",owner:"Golmote"},"icu-message-format":{title:"ICU Message Format",owner:"RunDevelopment"},idris:{title:"Idris",alias:"idr",owner:"KeenS",require:"haskell"},ignore:{title:".ignore",owner:"osipxd",alias:["gitignore","hgignore","npmignore"],aliasTitles:{gitignore:".gitignore",hgignore:".hgignore",npmignore:".npmignore"}},inform7:{title:"Inform 7",owner:"Golmote"},ini:{title:"Ini",owner:"aviaryan"},io:{title:"Io",owner:"AlesTsurko"},j:{title:"J",owner:"Golmote"},java:{title:"Java",require:"clike",owner:"sherblot"},javadoc:{title:"JavaDoc",require:["markup","java","javadoclike"],modify:"java",optional:"scala",owner:"RunDevelopment"},javadoclike:{title:"JavaDoc-like",modify:["java","javascript","php"],owner:"RunDevelopment"},javastacktrace:{title:"Java stack trace",owner:"RunDevelopment"},jexl:{title:"Jexl",owner:"czosel"},jolie:{title:"Jolie",require:"clike",owner:"thesave"},jq:{title:"JQ",owner:"RunDevelopment"},jsdoc:{title:"JSDoc",require:["javascript","javadoclike","typescript"],modify:"javascript",optional:["actionscript","coffeescript"],owner:"RunDevelopment"},"js-extras":{title:"JS Extras",require:"javascript",modify:"javascript",optional:["actionscript","coffeescript","flow","n4js","typescript"],owner:"RunDevelopment"},json:{title:"JSON",alias:"webmanifest",aliasTitles:{webmanifest:"Web App Manifest"},owner:"CupOfTea696"},json5:{title:"JSON5",require:"json",owner:"RunDevelopment"},jsonp:{title:"JSONP",require:"json",owner:"RunDevelopment"},jsstacktrace:{title:"JS stack trace",owner:"sbrl"},"js-templates":{title:"JS Templates",require:"javascript",modify:"javascript",optional:["css","css-extras","graphql","markdown","markup","sql"],owner:"RunDevelopment"},julia:{title:"Julia",owner:"cdagnino"},keepalived:{title:"Keepalived Configure",owner:"dev-itsheng"},keyman:{title:"Keyman",owner:"mcdurdin"},kotlin:{title:"Kotlin",alias:["kt","kts"],aliasTitles:{kts:"Kotlin Script"},require:"clike",owner:"Golmote"},kumir:{title:"KuMir (\u041a\u0443\u041c\u0438\u0440)",alias:"kum",owner:"edukisto"},kusto:{title:"Kusto",owner:"RunDevelopment"},latex:{title:"LaTeX",alias:["tex","context"],aliasTitles:{tex:"TeX",context:"ConTeXt"},owner:"japborst"},latte:{title:"Latte",require:["clike","markup-templating","php"],owner:"nette"},less:{title:"Less",require:"css",optional:"css-extras",owner:"Golmote"},lilypond:{title:"LilyPond",require:"scheme",alias:"ly",owner:"RunDevelopment"},liquid:{title:"Liquid",require:"markup-templating",owner:"cinhtau"},lisp:{title:"Lisp",alias:["emacs","elisp","emacs-lisp"],owner:"JuanCaicedo"},livescript:{title:"LiveScript",owner:"Golmote"},llvm:{title:"LLVM IR",owner:"porglezomp"},log:{title:"Log file",optional:"javastacktrace",owner:"RunDevelopment"},lolcode:{title:"LOLCODE",owner:"Golmote"},lua:{title:"Lua",owner:"Golmote"},magma:{title:"Magma (CAS)",owner:"RunDevelopment"},makefile:{title:"Makefile",owner:"Golmote"},markdown:{title:"Markdown",require:"markup",optional:"yaml",alias:"md",owner:"Golmote"},"markup-templating":{title:"Markup templating",require:"markup",owner:"Golmote"},mata:{title:"Mata",owner:"RunDevelopment"},matlab:{title:"MATLAB",owner:"Golmote"},maxscript:{title:"MAXScript",owner:"RunDevelopment"},mel:{title:"MEL",owner:"Golmote"},mermaid:{title:"Mermaid",owner:"RunDevelopment"},metafont:{title:"METAFONT",owner:"LaeriExNihilo"},mizar:{title:"Mizar",owner:"Golmote"},mongodb:{title:"MongoDB",owner:"airs0urce",require:"javascript"},monkey:{title:"Monkey",owner:"Golmote"},moonscript:{title:"MoonScript",alias:"moon",owner:"RunDevelopment"},n1ql:{title:"N1QL",owner:"TMWilds"},n4js:{title:"N4JS",require:"javascript",optional:"jsdoc",alias:"n4jsd",owner:"bsmith-n4"},"nand2tetris-hdl":{title:"Nand To Tetris HDL",owner:"stephanmax"},naniscript:{title:"Naninovel Script",owner:"Elringus",alias:"nani"},nasm:{title:"NASM",owner:"rbmj"},neon:{title:"NEON",owner:"nette"},nevod:{title:"Nevod",owner:"nezaboodka"},nginx:{title:"nginx",owner:"volado"},nim:{title:"Nim",owner:"Golmote"},nix:{title:"Nix",owner:"Golmote"},nsis:{title:"NSIS",owner:"idleberg"},objectivec:{title:"Objective-C",require:"c",alias:"objc",owner:"uranusjr"},ocaml:{title:"OCaml",owner:"Golmote"},odin:{title:"Odin",owner:"edukisto"},opencl:{title:"OpenCL",require:"c",modify:["c","cpp"],owner:"Milania1"},openqasm:{title:"OpenQasm",alias:"qasm",owner:"RunDevelopment"},oz:{title:"Oz",owner:"Golmote"},parigp:{title:"PARI/GP",owner:"Golmote"},parser:{title:"Parser",require:"markup",owner:"Golmote"},pascal:{title:"Pascal",alias:"objectpascal",aliasTitles:{objectpascal:"Object Pascal"},owner:"Golmote"},pascaligo:{title:"Pascaligo",owner:"DefinitelyNotAGoat"},psl:{title:"PATROL Scripting Language",owner:"bertysentry"},pcaxis:{title:"PC-Axis",alias:"px",owner:"RunDevelopment"},peoplecode:{title:"PeopleCode",alias:"pcode",owner:"RunDevelopment"},perl:{title:"Perl",owner:"Golmote"},php:{title:"PHP",require:"markup-templating",owner:"milesj"},phpdoc:{title:"PHPDoc",require:["php","javadoclike"],modify:"php",owner:"RunDevelopment"},"php-extras":{title:"PHP Extras",require:"php",modify:"php",owner:"milesj"},"plant-uml":{title:"PlantUML",alias:"plantuml",owner:"RunDevelopment"},plsql:{title:"PL/SQL",require:"sql",owner:"Golmote"},powerquery:{title:"PowerQuery",alias:["pq","mscript"],owner:"peterbud"},powershell:{title:"PowerShell",owner:"nauzilus"},processing:{title:"Processing",require:"clike",owner:"Golmote"},prolog:{title:"Prolog",owner:"Golmote"},promql:{title:"PromQL",owner:"arendjr"},properties:{title:".properties",owner:"Golmote"},protobuf:{title:"Protocol Buffers",require:"clike",owner:"just-boris"},pug:{title:"Pug",require:["markup","javascript"],optional:["coffeescript","ejs","handlebars","less","livescript","markdown","scss","stylus","twig"],owner:"Golmote"},puppet:{title:"Puppet",owner:"Golmote"},pure:{title:"Pure",optional:["c","cpp","fortran"],owner:"Golmote"},purebasic:{title:"PureBasic",require:"clike",alias:"pbfasm",owner:"HeX0R101"},purescript:{title:"PureScript",require:"haskell",alias:"purs",owner:"sriharshachilakapati"},python:{title:"Python",alias:"py",owner:"multipetros"},qsharp:{title:"Q#",require:"clike",alias:"qs",owner:"fedonman"},q:{title:"Q (kdb+ database)",owner:"Golmote"},qml:{title:"QML",require:"javascript",owner:"RunDevelopment"},qore:{title:"Qore",require:"clike",owner:"temnroegg"},r:{title:"R",owner:"Golmote"},racket:{title:"Racket",require:"scheme",alias:"rkt",owner:"RunDevelopment"},cshtml:{title:"Razor C#",alias:"razor",require:["markup","csharp"],optional:["css","css-extras","javascript","js-extras"],owner:"RunDevelopment"},jsx:{title:"React JSX",require:["markup","javascript"],optional:["jsdoc","js-extras","js-templates"],owner:"vkbansal"},tsx:{title:"React TSX",require:["jsx","typescript"]},reason:{title:"Reason",require:"clike",owner:"Golmote"},regex:{title:"Regex",owner:"RunDevelopment"},rego:{title:"Rego",owner:"JordanSh"},renpy:{title:"Ren'py",alias:"rpy",owner:"HyuchiaDiego"},rescript:{title:"ReScript",alias:"res",owner:"vmarcosp"},rest:{title:"reST (reStructuredText)",owner:"Golmote"},rip:{title:"Rip",owner:"ravinggenius"},roboconf:{title:"Roboconf",owner:"Golmote"},robotframework:{title:"Robot Framework",alias:"robot",owner:"RunDevelopment"},ruby:{title:"Ruby",require:"clike",alias:"rb",owner:"samflores"},rust:{title:"Rust",owner:"Golmote"},sas:{title:"SAS",optional:["groovy","lua","sql"],owner:"Golmote"},sass:{title:"Sass (Sass)",require:"css",optional:"css-extras",owner:"Golmote"},scss:{title:"Sass (SCSS)",require:"css",optional:"css-extras",owner:"MoOx"},scala:{title:"Scala",require:"java",owner:"jozic"},scheme:{title:"Scheme",owner:"bacchus123"},"shell-session":{title:"Shell session",require:"bash",alias:["sh-session","shellsession"],owner:"RunDevelopment"},smali:{title:"Smali",owner:"RunDevelopment"},smalltalk:{title:"Smalltalk",owner:"Golmote"},smarty:{title:"Smarty",require:"markup-templating",optional:"php",owner:"Golmote"},sml:{title:"SML",alias:"smlnj",aliasTitles:{smlnj:"SML/NJ"},owner:"RunDevelopment"},solidity:{title:"Solidity (Ethereum)",alias:"sol",require:"clike",owner:"glachaud"},"solution-file":{title:"Solution file",alias:"sln",owner:"RunDevelopment"},soy:{title:"Soy (Closure Template)",require:"markup-templating",owner:"Golmote"},sparql:{title:"SPARQL",require:"turtle",owner:"Triply-Dev",alias:"rq"},"splunk-spl":{title:"Splunk SPL",owner:"RunDevelopment"},sqf:{title:"SQF: Status Quo Function (Arma 3)",require:"clike",owner:"RunDevelopment"},sql:{title:"SQL",owner:"multipetros"},squirrel:{title:"Squirrel",require:"clike",owner:"RunDevelopment"},stan:{title:"Stan",owner:"RunDevelopment"},stata:{title:"Stata Ado",require:["mata","java","python"],owner:"RunDevelopment"},iecst:{title:"Structured Text (IEC 61131-3)",owner:"serhioromano"},stylus:{title:"Stylus",owner:"vkbansal"},supercollider:{title:"SuperCollider",alias:"sclang",owner:"RunDevelopment"},swift:{title:"Swift",owner:"chrischares"},systemd:{title:"Systemd configuration file",owner:"RunDevelopment"},"t4-templating":{title:"T4 templating",owner:"RunDevelopment"},"t4-cs":{title:"T4 Text Templates (C#)",require:["t4-templating","csharp"],alias:"t4",owner:"RunDevelopment"},"t4-vb":{title:"T4 Text Templates (VB)",require:["t4-templating","vbnet"],owner:"RunDevelopment"},tap:{title:"TAP",owner:"isaacs",require:"yaml"},tcl:{title:"Tcl",owner:"PeterChaplin"},tt2:{title:"Template Toolkit 2",require:["clike","markup-templating"],owner:"gflohr"},textile:{title:"Textile",require:"markup",optional:"css",owner:"Golmote"},toml:{title:"TOML",owner:"RunDevelopment"},tremor:{title:"Tremor",alias:["trickle","troy"],owner:"darach",aliasTitles:{trickle:"trickle",troy:"troy"}},turtle:{title:"Turtle",alias:"trig",aliasTitles:{trig:"TriG"},owner:"jakubklimek"},twig:{title:"Twig",require:"markup-templating",owner:"brandonkelly"},typescript:{title:"TypeScript",require:"javascript",optional:"js-templates",alias:"ts",owner:"vkbansal"},typoscript:{title:"TypoScript",alias:"tsconfig",aliasTitles:{tsconfig:"TSConfig"},owner:"dkern"},unrealscript:{title:"UnrealScript",alias:["uscript","uc"],owner:"RunDevelopment"},uorazor:{title:"UO Razor Script",owner:"jaseowns"},uri:{title:"URI",alias:"url",aliasTitles:{url:"URL"},owner:"RunDevelopment"},v:{title:"V",require:"clike",owner:"taggon"},vala:{title:"Vala",require:"clike",optional:"regex",owner:"TemplarVolk"},vbnet:{title:"VB.Net",require:"basic",owner:"Bigsby"},velocity:{title:"Velocity",require:"markup",owner:"Golmote"},verilog:{title:"Verilog",owner:"a-rey"},vhdl:{title:"VHDL",owner:"a-rey"},vim:{title:"vim",owner:"westonganger"},"visual-basic":{title:"Visual Basic",alias:["vb","vba"],aliasTitles:{vba:"VBA"},owner:"Golmote"},warpscript:{title:"WarpScript",owner:"RunDevelopment"},wasm:{title:"WebAssembly",owner:"Golmote"},"web-idl":{title:"Web IDL",alias:"webidl",owner:"RunDevelopment"},wgsl:{title:"WGSL",owner:"Dr4gonthree"},wiki:{title:"Wiki markup",require:"markup",owner:"Golmote"},wolfram:{title:"Wolfram language",alias:["mathematica","nb","wl"],aliasTitles:{mathematica:"Mathematica",nb:"Mathematica Notebook"},owner:"msollami"},wren:{title:"Wren",owner:"clsource"},xeora:{title:"Xeora",require:"markup",alias:"xeoracube",aliasTitles:{xeoracube:"XeoraCube"},owner:"freakmaxi"},"xml-doc":{title:"XML doc (.net)",require:"markup",modify:["csharp","fsharp","vbnet"],owner:"RunDevelopment"},xojo:{title:"Xojo (REALbasic)",owner:"Golmote"},xquery:{title:"XQuery",require:"markup",owner:"Golmote"},yaml:{title:"YAML",alias:"yml",owner:"hason"},yang:{title:"YANG",owner:"RunDevelopment"},zig:{title:"Zig",owner:"RunDevelopment"}},plugins:{meta:{path:"plugins/{id}/prism-{id}",link:"plugins/{id}/"},"line-highlight":{title:"Line Highlight",description:"Highlights specific lines and/or line ranges."},"line-numbers":{title:"Line Numbers",description:"Line number at the beginning of code lines.",owner:"kuba-kubula"},"show-invisibles":{title:"Show Invisibles",description:"Show hidden characters such as tabs and line breaks.",optional:["autolinker","data-uri-highlight"]},autolinker:{title:"Autolinker",description:"Converts URLs and emails in code to clickable links. Parses Markdown links in comments."},wpd:{title:"WebPlatform Docs",description:'Makes tokens link to WebPlatform.org documentation. The links open in a new tab.'},"custom-class":{title:"Custom Class",description:"This plugin allows you to prefix Prism's default classes (.comment can become .namespace--comment) or replace them with your defined ones (like .editor__comment). You can even add new classes.",owner:"dvkndn",noCSS:!0},"file-highlight":{title:"File Highlight",description:"Fetch external files and highlight them with Prism. Used on the Prism website itself.",noCSS:!0},"show-language":{title:"Show Language",description:"Display the highlighted language in code blocks (inline code does not show the label).",owner:"nauzilus",noCSS:!0,require:"toolbar"},"jsonp-highlight":{title:"JSONP Highlight",description:"Fetch content with JSONP and highlight some interesting content (e.g. GitHub/Gists or Bitbucket API).",noCSS:!0,owner:"nauzilus"},"highlight-keywords":{title:"Highlight Keywords",description:"Adds special CSS classes for each keyword for fine-grained highlighting.",owner:"vkbansal",noCSS:!0},"remove-initial-line-feed":{title:"Remove initial line feed",description:"Removes the initial line feed in code blocks.",owner:"Golmote",noCSS:!0},"inline-color":{title:"Inline color",description:"Adds a small inline preview for colors in style sheets.",require:"css-extras",owner:"RunDevelopment"},previewers:{title:"Previewers",description:"Previewers for angles, colors, gradients, easing and time.",require:"css-extras",owner:"Golmote"},autoloader:{title:"Autoloader",description:"Automatically loads the needed languages to highlight the code blocks.",owner:"Golmote",noCSS:!0},"keep-markup":{title:"Keep Markup",description:"Prevents custom markup from being dropped out during highlighting.",owner:"Golmote",optional:"normalize-whitespace",noCSS:!0},"command-line":{title:"Command Line",description:"Display a command line with a prompt and, optionally, the output/response from the commands.",owner:"chriswells0"},"unescaped-markup":{title:"Unescaped Markup",description:"Write markup without having to escape anything."},"normalize-whitespace":{title:"Normalize Whitespace",description:"Supports multiple operations to normalize whitespace in code blocks.",owner:"zeitgeist87",optional:"unescaped-markup",noCSS:!0},"data-uri-highlight":{title:"Data-URI Highlight",description:"Highlights data-URI contents.",owner:"Golmote",noCSS:!0},toolbar:{title:"Toolbar",description:"Attach a toolbar for plugins to easily register buttons on the top of a code block.",owner:"mAAdhaTTah"},"copy-to-clipboard":{title:"Copy to Clipboard Button",description:"Add a button that copies the code block to the clipboard when clicked.",owner:"mAAdhaTTah",require:"toolbar",noCSS:!0},"download-button":{title:"Download Button",description:"A button in the toolbar of a code block adding a convenient way to download a code file.",owner:"Golmote",require:"toolbar",noCSS:!0},"match-braces":{title:"Match braces",description:"Highlights matching braces.",owner:"RunDevelopment"},"diff-highlight":{title:"Diff Highlight",description:"Highlights the code inside diff blocks.",owner:"RunDevelopment",require:"diff"},"filter-highlight-all":{title:"Filter highlightAll",description:"Filters the elements the highlightAll and highlightAllUnder methods actually highlight.",owner:"RunDevelopment",noCSS:!0},treeview:{title:"Treeview",description:"A language with special styles to highlight file system tree structures.",owner:"Golmote"}}})},2885:(e,t,n)=>{const r=n(9901),o=n(9642),a=new Set;function i(e){void 0===e?e=Object.keys(r.languages).filter((e=>"meta"!=e)):Array.isArray(e)||(e=[e]);const t=[...a,...Object.keys(Prism.languages)];o(r,e,t).load((e=>{if(!(e in r.languages))return void(i.silent||console.warn("Language does not exist: "+e));const t="./prism-"+e;delete n.c[n(6500).resolve(t)],delete Prism.languages[e],n(6500)(t),a.add(e)}))}i.silent=!1,e.exports=i},6854:()=>{!function(e){function t(e,t){return"___"+e.toUpperCase()+t+"___"}Object.defineProperties(e.languages["markup-templating"]={},{buildPlaceholders:{value:function(n,r,o,a){if(n.language===r){var i=n.tokenStack=[];n.code=n.code.replace(o,(function(e){if("function"==typeof a&&!a(e))return e;for(var o,s=i.length;-1!==n.code.indexOf(o=t(r,s));)++s;return i[s]=e,o})),n.grammar=e.languages.markup}}},tokenizePlaceholders:{value:function(n,r){if(n.language===r&&n.tokenStack){n.grammar=e.languages[r];var o=0,a=Object.keys(n.tokenStack);!function i(s){for(var l=0;l=a.length);l++){var c=s[l];if("string"==typeof c||c.content&&"string"==typeof c.content){var u=a[o],d=n.tokenStack[u],p="string"==typeof c?c:c.content,f=t(r,u),m=p.indexOf(f);if(m>-1){++o;var h=p.substring(0,m),g=new e.Token(r,e.tokenize(d,n.grammar),"language-"+r,d),y=p.substring(m+f.length),b=[];h&&b.push.apply(b,i([h])),b.push(g),y&&b.push.apply(b,i([y])),"string"==typeof c?s.splice.apply(s,[l,1].concat(b)):c.content=b}}else c.content&&i(c.content)}return s}(n.tokens)}}}})}(Prism)},6726:(e,t,n)=>{var r={"./":2885};function o(e){var t=a(e);return n(t)}function a(e){if(!n.o(r,e)){var t=new Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}o.keys=function(){return Object.keys(r)},o.resolve=a,e.exports=o,o.id=6726},6500:(e,t,n)=>{var r={"./":2885};function o(e){var t=a(e);return n(t)}function a(e){if(!n.o(r,e)){var t=new Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}o.keys=function(){return Object.keys(r)},o.resolve=a,e.exports=o,o.id=6500},9642:e=>{"use strict";var t=function(){var e=function(){};function t(e,t){Array.isArray(e)?e.forEach(t):null!=e&&t(e,0)}function n(e){for(var t={},n=0,r=e.length;n "));var s={},l=e[r];if(l){function c(t){if(!(t in e))throw new Error(r+" depends on an unknown component "+t);if(!(t in s))for(var i in o(t,a),s[t]=!0,n[t])s[i]=!0}t(l.require,c),t(l.optional,c),t(l.modify,c)}n[r]=s,a.pop()}}return function(e){var t=n[e];return t||(o(e,r),t=n[e]),t}}function o(e){for(var t in e)return!0;return!1}return function(a,i,s){var l=function(e){var t={};for(var n in e){var r=e[n];for(var o in r)if("meta"!=o){var a=r[o];t[o]="string"==typeof a?{title:a}:a}}return t}(a),c=function(e){var n;return function(r){if(r in e)return r;if(!n)for(var o in n={},e){var a=e[o];t(a&&a.alias,(function(t){if(t in n)throw new Error(t+" cannot be alias for both "+o+" and "+n[t]);if(t in e)throw new Error(t+" cannot be alias of "+o+" because it is a component.");n[t]=o}))}return n[r]||r}}(l);i=i.map(c),s=(s||[]).map(c);var u=n(i),d=n(s);i.forEach((function e(n){var r=l[n];t(r&&r.require,(function(t){t in d||(u[t]=!0,e(t))}))}));for(var p,f=r(l),m=u;o(m);){for(var h in p={},m){var g=l[h];t(g&&g.modify,(function(e){e in d&&(p[e]=!0)}))}for(var y in d)if(!(y in u))for(var b in f(y))if(b in u){p[y]=!0;break}for(var v in m=p)u[v]=!0}var w={getIds:function(){var e=[];return w.load((function(t){e.push(t)})),e},load:function(t,n){return function(t,n,r,o){var a=o?o.series:void 0,i=o?o.parallel:e,s={},l={};function c(e){if(e in s)return s[e];l[e]=!0;var o,u=[];for(var d in t(e))d in n&&u.push(d);if(0===u.length)o=r(e);else{var p=i(u.map((function(e){var t=c(e);return delete l[e],t})));a?o=a(p,(function(){return r(e)})):r(e)}return s[e]=o}for(var u in n)c(u);var d=[];for(var p in l)d.push(s[p]);return i(d)}(f,u,t,n)}};return w}}();e.exports=t},2703:(e,t,n)=>{"use strict";var r=n(414);function o(){}function a(){}a.resetWarningCache=o,e.exports=function(){function e(e,t,n,o,a,i){if(i!==r){var s=new Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw s.name="Invariant Violation",s}}function t(){return e}e.isRequired=e;var n={array:e,bigint:e,bool:e,func:e,number:e,object:e,string:e,symbol:e,any:e,arrayOf:t,element:e,elementType:e,instanceOf:t,node:e,objectOf:t,oneOf:t,oneOfType:t,shape:t,exact:t,checkPropTypes:a,resetWarningCache:o};return n.PropTypes=n,n}},5697:(e,t,n)=>{e.exports=n(2703)()},414:e=>{"use strict";e.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED"},4448:(e,t,n)=>{"use strict";var r=n(7294),o=n(3840);function a(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n