Netflix/security_monkeyArchived
Security Monkey
Security Monkey 是一个云安全态势管理工具和配置审计器。它作为一个监控平台，跟踪云资产并记录状态变更，以识别安全策略何时被篡改或引入了不安全的配置。
该系统维护多云资产清单，跟踪 AWS、GCP、OpenStack 和 GitHub 组织中的资源。它提供了一个集中式界面，用于搜索和浏览跨多个云服务商和区域的资产。
该平台通过比较资源的历史状态来检测配置漂移，从而涵盖云安全审计和基础设施变更跟踪。它利用基于服务商的发现和统一资源索引来持续监控资产和策略。
Features
- Cloud Security Monitoring - Audits and monitors cloud infrastructure configurations and permissions to detect insecure settings over time.
- Cloud Asset Discoverers - Queries cloud provider APIs to identify, list, and track infrastructure resources across multiple environments.
- State Snapshots - Detects configuration drift by comparing current resource states against stored historical snapshots.
- Cloud Asset Inventory Managers - Maintains a global inventory of assets by consolidating resource lists from AWS, GCP, OpenStack, and GitHub.
- Infrastructure Change Tracking - Records and compares historical states of cloud resources to identify precisely how configurations were modified.
- Cloud Resource Inventory - Catalogs and tracks deployed cloud infrastructure components across multiple providers in a centralized inventory.
- Unified Resource Models - Normalizes disparate data formats from multiple cloud providers into a consistent model for cross-platform security auditing.
- Cloud Infrastructure Security Auditors - Analyzes multi-cloud resource configurations against security rules to identify when policies are altered.
- Cloud Security Posture Management - Tracks and visualizes the security state of cloud accounts to detect insecure configurations and prioritize risk.
- Cloud Asset Discovery Plugins - Utilizes provider-specific connector plugins to discover assets and fetch configurations from cloud and version control APIs.
- Administrative Change Auditing - Maintains a verifiable history of administrative configuration changes to track when security policies were altered.
- Configuration Delta Monitoring - Monitors assets and policy changes over time to detect insecure configurations and compliance drift.
- Cloud Resource Search - Provides a unified interface to search and browse cloud resources across different providers, regions, and accounts.
- Detector-Based Plugin Architectures - Implements a modular architecture where individual security vulnerability checks are developed as independent detector plugins.
- Resource Change Monitors - Schedules periodic scans to monitor and alert on configuration changes and resource drift across cloud accounts.
- Infrastructure Services - Monitors cloud infrastructure for security and configuration changes.
- Systems And Services - Listed in the “Systems And Services” section of the The Book Of Secret Knowledge awesome list.
