├── .gitattributes ├── .github └── ISSUE_TEMPLATE │ ├── bug_report.md │ └── feature_request.md ├── LICENSE ├── README.md ├── appendix-a-ipinsights ├── README.md ├── SyntheticSun_TRAINING_GROUNDS_CFN.yml ├── cloudtrail-training │ ├── Dockerfile │ ├── cloudtrail-ipinsights.py │ └── requirements.txt ├── taskmaster.py └── waf-training │ ├── Dockerfile │ ├── requirements.txt │ └── waf-ipinsights.py ├── img ├── fuggg.jpeg ├── ipinsights-training-architecture.jpg ├── kibana-configuremonitor.JPG ├── kibana-createdetector.JPG ├── kibana-dashboard.JPG ├── kibana-importobjects.JPG ├── kibana-intervaldetector.JPG ├── kibana-monitor-architecture.jpg ├── kibana-monitordest.JPG ├── syntheticsun-automation-diagram.jpg ├── syntheticsun-buildautomation-diagram.jpg ├── syntheticsun-misp-addtag.JPG ├── syntheticsun-misp-automationkey.JPG ├── syntheticsun-misp-edituser.JPG ├── syntheticsun-misp-enablefeeds.JPG ├── syntheticsun-misp-fetchevents.JPG ├── syntheticsun-misp-publishevents.JPG ├── syntheticsun-misp-scheduledtasks.JPG └── syntheticsun-telemetry-diagram.jpg ├── readme-stage1 ├── README.md ├── SyntheticSun_SETUP_CFN.yaml ├── artifacts │ ├── anomaly-threatlist.txt │ ├── ct-model.tar.gz │ ├── cti-threatlist.txt │ ├── suricata.yaml │ ├── syntheticsun-alblog-function.zip │ ├── syntheticsun-apigw-function.zip │ ├── syntheticsun-cloudtrail-function.zip │ ├── syntheticsun-codecommit.zip │ ├── syntheticsun-vpcflow-function.zip │ ├── syntheticsun-waf-function.zip │ └── waf-model.tar.gz ├── gewalthaufen.py ├── lambda-layer │ └── aws4auth-layer.zip └── requirements.txt ├── readme-stage2 ├── README.md └── SyntheticSun_BUILD_AUTOMATION_CFN.yml └── readme-stage3 ├── README.md ├── SyntheticSun_CORE_CFN.yaml ├── es-policy.py ├── ipinsights-uri.py ├── kibana-objects.ndjson ├── monitors.py └── tercio.py /.gitattributes: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/.gitattributes -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug_report.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/.github/ISSUE_TEMPLATE/bug_report.md -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/.github/ISSUE_TEMPLATE/feature_request.md -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/LICENSE -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/README.md -------------------------------------------------------------------------------- /appendix-a-ipinsights/README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/appendix-a-ipinsights/README.md -------------------------------------------------------------------------------- /appendix-a-ipinsights/SyntheticSun_TRAINING_GROUNDS_CFN.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/appendix-a-ipinsights/SyntheticSun_TRAINING_GROUNDS_CFN.yml -------------------------------------------------------------------------------- /appendix-a-ipinsights/cloudtrail-training/Dockerfile: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/appendix-a-ipinsights/cloudtrail-training/Dockerfile -------------------------------------------------------------------------------- /appendix-a-ipinsights/cloudtrail-training/cloudtrail-ipinsights.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/appendix-a-ipinsights/cloudtrail-training/cloudtrail-ipinsights.py -------------------------------------------------------------------------------- /appendix-a-ipinsights/cloudtrail-training/requirements.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/appendix-a-ipinsights/cloudtrail-training/requirements.txt -------------------------------------------------------------------------------- /appendix-a-ipinsights/taskmaster.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/appendix-a-ipinsights/taskmaster.py -------------------------------------------------------------------------------- /appendix-a-ipinsights/waf-training/Dockerfile: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/appendix-a-ipinsights/waf-training/Dockerfile -------------------------------------------------------------------------------- /appendix-a-ipinsights/waf-training/requirements.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/appendix-a-ipinsights/waf-training/requirements.txt -------------------------------------------------------------------------------- /appendix-a-ipinsights/waf-training/waf-ipinsights.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/appendix-a-ipinsights/waf-training/waf-ipinsights.py -------------------------------------------------------------------------------- /img/fuggg.jpeg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/fuggg.jpeg -------------------------------------------------------------------------------- /img/ipinsights-training-architecture.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/ipinsights-training-architecture.jpg -------------------------------------------------------------------------------- /img/kibana-configuremonitor.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/kibana-configuremonitor.JPG -------------------------------------------------------------------------------- /img/kibana-createdetector.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/kibana-createdetector.JPG -------------------------------------------------------------------------------- /img/kibana-dashboard.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/kibana-dashboard.JPG -------------------------------------------------------------------------------- /img/kibana-importobjects.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/kibana-importobjects.JPG -------------------------------------------------------------------------------- /img/kibana-intervaldetector.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/kibana-intervaldetector.JPG -------------------------------------------------------------------------------- /img/kibana-monitor-architecture.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/kibana-monitor-architecture.jpg -------------------------------------------------------------------------------- /img/kibana-monitordest.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/kibana-monitordest.JPG -------------------------------------------------------------------------------- /img/syntheticsun-automation-diagram.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/syntheticsun-automation-diagram.jpg -------------------------------------------------------------------------------- /img/syntheticsun-buildautomation-diagram.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/syntheticsun-buildautomation-diagram.jpg -------------------------------------------------------------------------------- /img/syntheticsun-misp-addtag.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/syntheticsun-misp-addtag.JPG -------------------------------------------------------------------------------- /img/syntheticsun-misp-automationkey.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/syntheticsun-misp-automationkey.JPG -------------------------------------------------------------------------------- /img/syntheticsun-misp-edituser.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/syntheticsun-misp-edituser.JPG -------------------------------------------------------------------------------- /img/syntheticsun-misp-enablefeeds.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/syntheticsun-misp-enablefeeds.JPG -------------------------------------------------------------------------------- /img/syntheticsun-misp-fetchevents.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/syntheticsun-misp-fetchevents.JPG -------------------------------------------------------------------------------- /img/syntheticsun-misp-publishevents.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/syntheticsun-misp-publishevents.JPG -------------------------------------------------------------------------------- /img/syntheticsun-misp-scheduledtasks.JPG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/syntheticsun-misp-scheduledtasks.JPG -------------------------------------------------------------------------------- /img/syntheticsun-telemetry-diagram.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/img/syntheticsun-telemetry-diagram.jpg -------------------------------------------------------------------------------- /readme-stage1/README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/README.md -------------------------------------------------------------------------------- /readme-stage1/SyntheticSun_SETUP_CFN.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/SyntheticSun_SETUP_CFN.yaml -------------------------------------------------------------------------------- /readme-stage1/artifacts/anomaly-threatlist.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/artifacts/anomaly-threatlist.txt -------------------------------------------------------------------------------- /readme-stage1/artifacts/ct-model.tar.gz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/artifacts/ct-model.tar.gz -------------------------------------------------------------------------------- /readme-stage1/artifacts/cti-threatlist.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/artifacts/cti-threatlist.txt -------------------------------------------------------------------------------- /readme-stage1/artifacts/suricata.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/artifacts/suricata.yaml -------------------------------------------------------------------------------- /readme-stage1/artifacts/syntheticsun-alblog-function.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/artifacts/syntheticsun-alblog-function.zip -------------------------------------------------------------------------------- /readme-stage1/artifacts/syntheticsun-apigw-function.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/artifacts/syntheticsun-apigw-function.zip -------------------------------------------------------------------------------- /readme-stage1/artifacts/syntheticsun-cloudtrail-function.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/artifacts/syntheticsun-cloudtrail-function.zip -------------------------------------------------------------------------------- /readme-stage1/artifacts/syntheticsun-codecommit.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/artifacts/syntheticsun-codecommit.zip -------------------------------------------------------------------------------- /readme-stage1/artifacts/syntheticsun-vpcflow-function.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/artifacts/syntheticsun-vpcflow-function.zip -------------------------------------------------------------------------------- /readme-stage1/artifacts/syntheticsun-waf-function.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/artifacts/syntheticsun-waf-function.zip -------------------------------------------------------------------------------- /readme-stage1/artifacts/waf-model.tar.gz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/artifacts/waf-model.tar.gz -------------------------------------------------------------------------------- /readme-stage1/gewalthaufen.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/gewalthaufen.py -------------------------------------------------------------------------------- /readme-stage1/lambda-layer/aws4auth-layer.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/lambda-layer/aws4auth-layer.zip -------------------------------------------------------------------------------- /readme-stage1/requirements.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage1/requirements.txt -------------------------------------------------------------------------------- /readme-stage2/README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage2/README.md -------------------------------------------------------------------------------- /readme-stage2/SyntheticSun_BUILD_AUTOMATION_CFN.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage2/SyntheticSun_BUILD_AUTOMATION_CFN.yml -------------------------------------------------------------------------------- /readme-stage3/README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage3/README.md -------------------------------------------------------------------------------- /readme-stage3/SyntheticSun_CORE_CFN.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage3/SyntheticSun_CORE_CFN.yaml -------------------------------------------------------------------------------- /readme-stage3/es-policy.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage3/es-policy.py -------------------------------------------------------------------------------- /readme-stage3/ipinsights-uri.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage3/ipinsights-uri.py -------------------------------------------------------------------------------- /readme-stage3/kibana-objects.ndjson: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage3/kibana-objects.ndjson -------------------------------------------------------------------------------- /readme-stage3/monitors.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage3/monitors.py -------------------------------------------------------------------------------- /readme-stage3/tercio.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jonrau1/SyntheticSun/HEAD/readme-stage3/tercio.py --------------------------------------------------------------------------------