Open-source alternatives to Aaia

Identify all permitted data paths originating from the Internet to Network Interfaces within AWS Accounts across the entire AWS Organization.

1. The ADTimeline PowerShell script 1. Description 2. Prerequisites 3. Usage 4. Files generated 5. Custom groups 2. The ADTimeline App for Splunk 1. Description 2. Sourcetypes 3. AD General information dashboards 4. AD threat hunting dashboards 5. Enhance your traditional event logs threat…

Least privilege AWS IAM Terraformer

Sparrow.ps1 was created by CISA's Cloud Forensics team to help detect possible compromised accounts and applications in the Azure/m365 environment.

aws-security-architecture

Cloud Custodian is an open-source rules engine that uses declarative YAML policies to query, filter, and take automated actions on cloud resources for governance and compliance. It functions as a stateless policy execution engine, where each policy evaluation runs as an independent, idempotent operation without maintaining internal state between runs. Policies are defined using a YAML-based domain-specific language that structures rules as a query-filter-action pipeline. The engine supports dry-run validation, allowing users to simulate policy actions against live resources without applying c

This project is a multi-cloud security auditor and configuration audit tool designed to identify misconfigurations and vulnerabilities across various cloud service provider environments. It functions as a cloud security posture management tool and a vulnerability remediation engine, allowing users to scan resources against security best practices and industry compliance standards. The system distinguishes itself by combining detection with a remediation engine that executes corrective actions to fix discovered security gaps. It employs a plugin-based audit engine and a provider-agnostic abstr

SkyArk helps to discover, assess and secure the most privileged entities in Azure and AWS

'Continuous' AWS perimeter monitoring: Periodically scan internet facing AWS resources to detect misconfigured services.

SkyWrapper helps to discover suspicious creation forms and uses of temporary tokens in AWS

Multi-threaded AWS inventory collection tool with a focus on security-relevant resources and metadata.

AWS Auditing & Hardening Tool

This command line tool counts the number of resources in different categories across Amazon regions.

CloudTracker helps you find over-privileged IAM users and roles by comparing CloudTrail logs with current IAM policies.

Access Undenied parses AWS AccessDenied CloudTrail events, explains the reasons for them, and offers actionable remediation steps. Open-sourced by Ermetic.

A command-line tool to get valuable information out of AWS CloudTrail

A graph-based tool for visualizing effective access and resource relationships in AWS environments.

MetaHub is an automated contextual security findings enrichment and impact evaluation tool for vulnerability management.

Open source demos, concept and guidance related to the AWS CIS Foundation framework.