top of page

SIRAS - Security Incident Response Automated Simulations

  • Writer: Santiago F
    Santiago F
  • Jun 20, 2024
  • 1 min read

Security Incident Response Automated Simulations (SIRAS) are internal/controlled actions that provide a structured opportunity to practice the incident response plan and procedures during a realistic scenarios. the main idea of SIRAS is create an detection-as-a-code testing scenarios to facilitate the blueteam/tabletops scenarios. All smokers of SIRAS make real actions into your AWS and then delete those actions in the same execution.


SIRAS is the incident response friend when you need to test your controls/alerts :)



Why SIRAS?


Currently, the incident detection and response team are developing differents mechanisms to prevent/detect several types of incidents, leaving aside the test stage. Although each alert/automation is tested before implementing it, and it is not constantly monitored. For this, SIRAS proposes an automated test model where it is expected to trigger alerts in a controlled manner to make security incidents simulation.


How to run it?


Using the official Docker image:

docker run --rm \
    -e AWS_ACCESS_KEY_ID \
    -e AWS_SECRET_ACCESS_KEY \
    -e AWS_SESSION_TOKEN \
    -e AWS_DEFAULT_REGION=us-east-1 \
    stuxend/siras:latest -s XXXX -B XXXX

Running Docker build:

  1. Build the Docker image.

docker build -t siras .

  1. Run the container by passing your aws credentials.

docker run --rm \
    -e AWS_ACCESS_KEY_ID \
    -e AWS_SECRET_ACCESS_KEY \
    -e AWS_SESSION_TOKEN \
    -e AWS_DEFAULT_REGION=us-east-1 \
    siras -s XXXX -B XXXX

Mandatory command options for running siras

You must use the -s option to run a Smoker.

-s

Description

all

Run all Smokers

test

Test SIRAS

sg

Create an open security group

pa

Multiple authentication failure in Palo Alto VPN portal. Must configure pano_url located in smoker/PanAuthSmoker.py

au

Create an administrator user

aca

Multiple authentication failure in AWS console. Must configure account_id located in smoker/awsConsoleAuthSmoker.py

ctr

Create a CloudTrail trail

s3p

Create a public S3 bucket

esb

Create a public EBS snapshot. Must configure a snapshot id in smoker/EBSPublicSmoker


Optional command options to run SIRAS

-b

Description

True

Store the results in an S3 bucket

False

This is the default option, it prints the output on the console

Requirements


  • Docker

  • AWS Credentials

  • Variable named 'BUCKETS3' to store records in S3.

Upcoming Smokers


  • Kubernetes

  • AWS VPC changes

  • AWS EC2

  • GuardDuty


bottom of page