forked from rpetrich/deciduous
-
Notifications
You must be signed in to change notification settings - Fork 0
/
missing-logs.yaml
98 lines (92 loc) · 2.08 KB
/
missing-logs.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
title: Adverse Scenario - Missing Logs
facts:
- same_hostname: giving all your hosts the same hostname
from:
- reality: '#yolo'
- misconfigured: misconfigured log daemon
from:
- reality: '#yolo'
- block_egress: blocking network egress; logs can't be shipped
from:
- reality: '#yolo'
- forgetting_daemon: forgetting to install the log daemon
from:
- reality: '#yolo'
attacks:
- expired_certs: expired TLS certificates
from:
- misconfigured
- wrong_path: configuring the wrong path to gather logs
from:
- misconfigured
- no_start: forgetting to start the log daemon
from:
- reality: '#yolo'
- base_daemon
- fill_disk: filling the disk so no logs produced
from:
- start_daemon
- log_jam: produce logs faster than you can ship them
from:
- start_daemon
- wrong_time: wrong log times
from:
- start_daemon
- host_clock: incorrect host clock
from:
- wrong_time
- wrong_parsing: incorrect parsing of log timestamps
from:
- wrong_time
mitigations:
- standardize_path: standardize log paths; all prod services write to same path
from:
- wrong_path
- base_daemon: include daemon in base image
from:
- forgetting_daemon
- smoke_test: smoke tests to verify working logs
from:
- no_start
- wrong_path
- block_egress
- monitor_daemon: monitor the log daemon
from:
- no_start
- unique_names: generate unique hostnames for hosts
from:
- same_hostname
- monitor_disk: monitor and alert on disk usage
from:
- fill_disk
- monitor_cert: monitor the root certificate store
from:
- expired_certs
- start_daemon: start the log daemon
from:
- no_start
- log_less: reconfigure app workload to log less
from:
- log_jam
- integration_test: integration test that checks for log level
from:
- log_jam
- run_ntp: run an NTP daemon
from:
- host_clock
- standard_lib: use standard logging library
from:
- wrong_parsing
goals:
- missing_logs: Missing logs (good luck with incident response)
from:
- forgetting_daemon
- no_start
- same_hostname
- misconfigured
- wrong_path
- fill_disk
- block_egress
- expired_certs
- log_jam
- wrong_time