Special Features
Discovering and auditing configuration's changes
To discover and audit changes in configurations:
In Discovery ➔ Settings ➔ Discovery, when creating or editing a discovery, in the search tab you can check Identify systems configuration.
We integrate with the following systems:
Active Directory
Microsoft Exchange
SQL Server
File Systems
NetApp
For this configuration, we will need the Windows or SSH plugin.
After the discovery is done, the result will be shown in Discovery ➔ Discovery ➔ Configurations.
To restore a configuration, you can search in Discovery ➔ Discovery ➔ Configurations, the action History will show all different configurations, and in the button Restore you can recover any previous configuration.
Discovering privilege accounts in other applications
The senhasegura has a series of plugins to automatically find accounts with high privilege in several applications. Besides having a flexible platform that allows the inclusion of new third party systems, improving the monitoring and identification possible offenders in your company.
This integration with third party applications also allows the synchronization of equipment with the main CMDB tools on the market, such as ServiceNow and BMC, synchronizing their device base, ensuring visibility and control of your entire equipment park. Through our support service we are able to expand the interaction with third party systems according to the needs of our customers.
To do so, follow the instructions in the previous sections and create a new Discovery of Application and fill in the necessary data for the correct discovery.
IIS application pool accounts
senhasegura also performs the search for local and domain credentials associated with an IIS application pool.
To perform a search for these credentials follow the instructions:
As explained in the dry antherors create an Application Discovery through the menu Discovery ➔ Settings ➔ Discovery
Uma vez no formulário, siga para a guia Buscas selecione a opção Identify accounts in application pools (IIS)
cautionOnly Windows plugins may be used on this Discovery
Save and carry out the search.
IIS Application Pool Report
At the end of the search it will be possible to analyze a report containing the information collected such as: name of the pool, username of the credential linked to the pool, untime version of the application pool and other data.
To do this, go to the menu: Discovery ➔ Discovery ➔ Devices.
Select the item in the report you want to check and click the action button Application pools IIS.
A report with the collected data will be displayed.
Secrets Discovery in Kubernetes
It is possible to perform the discovery of secrets in Kubernetes through the integration of the senhasegura with the orchestrator.
Before performing this type of discovery it is necessary to know:
The Kube API Server URL
On which port the Kubernetes is being executed. By default it is 6443.
Bearer token to access the Kubernetes API
Getting the bearer token
The token to be used in the senhasegura must have permission to list and search the secrets, so it must be generated according to our instructions.
Access the Kubernetes server and execute the following commands:
Command to create a service account on Kubernetes:
kubectl apply -f - <<EOF
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: senhasegura-discovery
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: senhasegura-discovery
rules:
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- list
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: senhasegura-discovery
subjects:
- kind: ServiceAccount
name: senhasegura-discovery
namespace: kube-system
roleRef:
kind: ClusterRole
name: senhasegura-discovery
apiGroup: rbac.authorization.k8s.io
EOFcautionDo not change any data in this command, this may influence the effectiveness of the token. If you wish, only the name field can be changed, but we do not recommend this action since the string
secure-discoverywill help in identifying the policy.Command to export the service account token to environment variable:
export K8S_TOKEN=$(kubectl get secrets/$(kubectl get serviceaccount/senhasegura-discovery -n kube-system -o jsonpath='{.secrets[0].name}') -n kube-system -o jsonpath='{.data.token}' | base64 -d)cautionIf the name field was changed in the previous command it must be changed in this one too.
Command to print the token on the screen:
echo $K8S_TOKEN
Registering the credential
After executing the commands and with the token in hand it is necessary to associate it with an access credential to the Kubernetes server.
Go to PAM Core ➔ Credentials ➔ All click on the action button in the report to create a new credential.
Enter your credential username
Define the Password type
In the field Device select or Kubernetes server
Select the Set current password field and in the Password field enter the token obtained
Click Save
Performing the discovery
With the bearer token already registered in the senhasegura you will be able to perform the discovery. To do so, access the menu Discovery ➔ Settings ➔ Discovery and create a new discovery of Devices or Containers:
Containers Discovery
Please refer to the Create Discovery section of this chapter to understand how to complete the form.
This type of discovery will search for containers on a host. In the Container host field select the host where the search should be done.
In the tab Search select the option Find DevOps artifacts
When selecting the option a new tab called DevOps will be displayed, access the tab and go to the section Kubernetes' settings
Select the options:
Enable Kubernetes service: Enables the to search for Kubernetes services
Search secrets: Performs the search for secrets
Bearer token: Uses as a means of API Kubernetes authentication employing a bearer token
In the field Credential access Kubernetes select the credential where the bearer token was registered
Then select which port you want Kubernetes to search on.
infoThe default port of Kubernetes is 6443, or enter the number configured for your Kubernetes server.
To finish click Save to finish.
infoConsult Credentials Administration to understand how to complete the credentials registration form.
Device Discovery
Please refer to the Create Discovery section of this chapter to understand how to complete the form.
This kind of discovery will search for devices. In the Initial IP field enter the IP's range where the search should be done.
In the tab Search select the option Find DevOps artifacts
When selecting the option a new tab called DevOps will be displayed, access the tab and go to the section Kubernetes' settings
Select the options:
Enable Kubernetes service: Enables the to search for Kubernetes services
Search secrets: Performs the search for secrets
Bearer token: Uses as a means of API Kubernetes authentication employing a bearer token
In the field Credential access Kubernetes select the credential where the bearer token was registered
Then select which port you want Kubernetes to search on.
infoThe default port of Kubernetes is 6443, or enter the number configured for your Kubernetes server.
To finish click Save to finish.
infoConsult Credentials Administration to understand how to complete the credentials registration form.
Discovery Certificates with NetScaler
Only application certificates managed by NetScaler will be scanned, imported, and managed by senhasegura.
To Discovery Certificates the fields (Name, Initial IP, Final IP, Site, and Active) are fields that, after being filled in, returned the devices that are in this IP range, you can also filter by the site and if devices are discovered will be active or inactive.
- Select the module Discovery ➔ Settings ➔ Discovery.
- Choose the New option in the actions menu.
- Choose the Discovery Devices type.
- Select the Certificates tab.
- Check the type of search (types of plugins).
- Fill in the other information with your API Key Extras settings for NetScaler search.
Discovered and imported certificates can be viewed in the Discovery ➔ Discovery ➔ Certificates ➔ Certificates module Certificates not imported will be in the module Discovery ➔ Discovery ➔ Certificates ➔ Certificates not imported.
Viewing the secrets found
Access the menu Discovery ➔ DevOps ➔ Kubernetes ➔ Secrets. This screen will display the list of Secrets found during the search.
Click on the action button to have more information about Secret.