FireMon Asset Manager
Page tree

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Next »

Lumeta now offers a DisruptOps/AWS integration, which replaces the Lumeta CloudVisibility engine.  

DisruptOps is a cloud security operations platform to monitor, alert and respond to security risk across your public cloud infrastructure. 


Prerequisite

To use the feature, you must have the DisruptOps platform deployed in your AWS environment.  For guidance, pen a Support ticket (lumetasupport@firemon.com) and request Disrupt:Ops. FireMon Support will respond by providing you with implementation steps and login credentials. They will also help you deploy the necessary "cloudformation stack."

Configuration

  1. To configure this new integration, browse to Settings > Integrations > Disrupt:Ops and click Configure.
  2. Complete the form, supplying your Disrupt:Ops credentials as the Username and Password (not your AWS credentials).
  3. As seen in screenshot firewall ACL rules must be open for Lumeta to access these URLs over 443
    1. https://api.prod.disruptops.com/auth/login
    2. https://graph.prod.disruptops.com/graphql
    3. https://graph-v3.prod.disruptops.com/graphql


Lumeta considers the following factors in calculating the Security Group violation:

  1. Instances that have been deployed from images in either a white list or black list.
    • You have an image that was not in the white list.
    • You have an image that was in the black list.
  2. Ports and protocols that are either in a white list or black list.
    • You have a port / protocol that was not in the white list.
    • You have a port / protocol that was in the black list.
  3. IPv4 / IPv6 that are either in a white list or black list. On this, bear in mind that IP address blocks are not sliced. If a /8 is specified in blacklist, and a /24 out of that /8 in white list, an IP address that is in that /24 will still appear as a blacklist risk.
    • You have a IPv4 / IPv6 that was not in the white list.
    • You have a IPv4 / IPv6 that was in the black list.
  4. Wildcard in a Security Group.
  5. IPv4 mask is too large for a Security Group.
  6. Src/Dest checks disabled on an instance
  7. Inbound/outbound path to the public internet (direct and indirect)
  • No labels