<commit_before>AWS IR
======

Python installable command line utility for mitigation of instance and key compromises.

Documentation
-------------

Read the full documentation on `read the docs <https://aws_ir.readthedocs.io/en/latest/>`__.

Quickstart
----------

For more information see the `user guide <https://aws_ir.readthedocs.io/en/latest/user_guide.html>`__.

Installation
************

``pip install aws_ir``

Or see `installing <https://aws_ir.readthedocs.io/en/latest/installing.html>`__.

AWS Credentials
***************

Ensure aws credentials are configured under the user running aws_ir as documented `by amazon <https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html>`__.

Check back soon for an IAM policy featuring the minimum set of required permissions

Optional Arguments
******************

.. code-block:: bash

   $ aws_ir -h
   usage: aws_ir [-h] [--case-number CASE_NUMBER]
                 [--examiner-cidr-range EXAMINER_CIDR_RANGE]
                 [--bucket-name BUCKET_NAME] [--dry-run]
                 {instance-compromise,key-compromise} ...
   
   Incident Response command line for Amazon Web Services. This command line
   interface is designed to process instance and key based incursions without delay
   or error.
   
   positional arguments:
     {instance-compromise,key-compromise}
       instance-compromise
       key-compromise
   
   optional arguments:
     -h, --help            show this help message and exit
   
     --case-number CASE_NUMBER
                           The case number to use., usually of the form
                           "cr-16-053018-2d2d"
     --examiner-cidr-range EXAMINER_CIDR_RANGE
                           The IP/CIDR for the examiner and/or the tool. This
                           will be added as the only allowed range in the
                           isolated security group.
     --bucket-name BUCKET_NAME
                           Optional. The id of the s3 bucket to use. This must
                           already exist
     --dry-run             Dry run. Pass dry run parameter to perform API calls
                           but will not modify any resources.

Key Compromise
**************

The ``aws_ir`` subcommand ``key-compromise`` disables access keys in the case of a key compromise.
It's single argument is the access key id, he compromised key is disabled via the AWS api.

.. code-block:: bash

   $ aws_ir key-compromise -h
   usage: aws_ir key-compromise [-h] --access-key-id ACCESS_KEY_ID
   
   optional arguments:
     -h, --help            show this help message and exit
     --access-key-id ACCESS_KEY_ID

Below is the output of running the ``key-compromise`` subcommand.

.. code-block:: bash

   $ aws_ir key-compromise --access-key-id <KEY>
   2016-07-29 16:53:35,458 - aws_ir.cli - INFO - Initial connection to AmazonWebServices made.
   2016-07-29 16:53:42,772 - aws_ir.cli - INFO - Inventory AWS Regions Complete 11 found.
   2016-07-29 16:53:42,772 - aws_ir.cli - INFO - Inventory Availability Zones Complete 27 found.
   2016-07-29 16:53:42,773 - aws_ir.cli - INFO - Beginning inventory of instances world wide.  This might take a minute...
   2016-07-29 16:53:49,527 - aws_ir.cli - INFO - Inventory complete.  Proceeding to resource identification.
   2016-07-29 16:53:54,839 - aws_ir.cli - INFO - Set satus of access key AKIAJGOVL2FIYOG6YFIA to Inactive
   Processing complete

Instance Compromise
*******************

The ``aws_ir`` subcommand ``instance-compromise`` preserves forensic artifacts from a compromised instance after isolating the instance.
Once all artifacts are collected and tagged the compromised instance is powered off.
The ``instance-compromise`` subcommand takes three arguments, the ``instance-ip`` of the compromised instance, a ``user`` with ssh access to the target instance, and the ``ssh-key`` used for authentication.<commit_msg>fix typo in readme closes #31<commit_after>AWS IR
======

Python installable command line utility for mitigation of instance and key compromises.

Documentation
-------------

Read the full documentation on `read the docs <https://aws_ir.readthedocs.io/en/latest/>`__.

Quickstart
----------

For more information see the `user guide <https://aws_ir.readthedocs.io/en/latest/user_guide.html>`__.

Installation
************

``pip install aws_ir``

Or see `installing <https://aws_ir.readthedocs.io/en/latest/installing.html>`__.

AWS Credentials
***************

Ensure aws credentials are configured under the user running aws_ir as documented `by amazon <https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html>`__.

Check back soon for an IAM policy featuring the minimum set of required permissions

Optional Arguments
******************

.. code-block:: bash

   $ aws_ir -h
   usage: aws_ir [-h] [--case-number CASE_NUMBER]
                 [--examiner-cidr-range EXAMINER_CIDR_RANGE]
                 [--bucket-name BUCKET_NAME] [--dry-run]
                 {instance-compromise,key-compromise} ...
   
   Incident Response command line for Amazon Web Services. This command line
   interface is designed to process instance and key based incursions without delay
   or error.
   
   positional arguments:
     {instance-compromise,key-compromise}
       instance-compromise
       key-compromise
   
   optional arguments:
     -h, --help            show this help message and exit
   
     --case-number CASE_NUMBER
                           The case number to use., usually of the form
                           "cr-16-053018-2d2d"
     --examiner-cidr-range EXAMINER_CIDR_RANGE
                           The IP/CIDR for the examiner and/or the tool. This
                           will be added as the only allowed range in the
                           isolated security group.
     --bucket-name BUCKET_NAME
                           Optional. The id of the s3 bucket to use. This must
                           already exist
     --dry-run             Dry run. Pass dry run parameter to perform API calls
                           but will not modify any resources.

Key Compromise
**************

The ``aws_ir`` subcommand ``key-compromise`` disables access keys in the case of a key compromise.
It's single argument is the access key id, he compromised key is disabled via the AWS api.

.. code-block:: bash

   $ aws_ir key-compromise -h
   usage: aws_ir key-compromise [-h] --access-key-id ACCESS_KEY_ID
   
   optional arguments:
     -h, --help            show this help message and exit
     --access-key-id ACCESS_KEY_ID

Below is the output of running the ``key-compromise`` subcommand.

.. code-block:: bash

   $ aws_ir key-compromise --access-key-id <KEY>
   2016-07-29 16:53:35,458 - aws_ir.cli - INFO - Initial connection to AmazonWebServices made.
   2016-07-29 16:53:42,772 - aws_ir.cli - INFO - Inventory AWS Regions Complete 11 found.
   2016-07-29 16:53:42,772 - aws_ir.cli - INFO - Inventory Availability Zones Complete 27 found.
   2016-07-29 16:53:42,773 - aws_ir.cli - INFO - Beginning inventory of instances world wide.  This might take a minute...
   2016-07-29 16:53:49,527 - aws_ir.cli - INFO - Inventory complete.  Proceeding to resource identification.
   2016-07-29 16:53:54,839 - aws_ir.cli - INFO - Set status of access key AKIAJGOVL2FIYOG6YFIA to Inactive
   Processing complete

Instance Compromise
*******************

The ``aws_ir`` subcommand ``instance-compromise`` preserves forensic artifacts from a compromised instance after isolating the instance.
Once all artifacts are collected and tagged the compromised instance is powered off.
The ``instance-compromise`` subcommand takes three arguments, the ``instance-ip`` of the compromised instance, a ``user`` with ssh access to the target instance, and the ``ssh-key`` used for authentication.
{'fraction_non_alphanumeric': 0.10552507336991196, 'fraction_numerical': 0.0306239632512441, 'mean_word_length': 2.60865561694291, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 13, 'https://': 8, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2785798', 'n_tokens_mistral': 2405, 'n_tokens_neox': 2246, 'n_words': 790}