Description
🖼️
Background 👴🏼
In today's fast-paced society, most people are unaware of the potential consequences of cyberattacks on their organizations. Furthermore, they do not invest in cybersecurity solutions due to the costs of setup, licensing, and maintenance.
Vision
📜
MutableSecurity
Despite the current lack of complex functionalities, we have a vision in mind that we hope to achieve in the near future. As we must begin somewhere, the first step in our progress is this command line interface for automatic management of cybersecurity solutions.
Come join the MutableSecurity journey!
Concepts
💬
MutableSecurity implements and operates on a few concepts:
- Target host (or target machine): A computer where the actions will be performed. Can be the local machine or remote one.
- Solution: A cybersecurity solution that needs to be set up on a target machine.
- Operation: A manipulation of a solution that is installed or needs to be installed. Could vary from effective installation to testing.
- Solution's lifecycle: States in which a solution exists. MutableSecurity implements a set of operations for each state.
- Configuration: A set of parameters (in pairs of aspect and value) specific to the solution. Can be initial, if it is used in the deployment process, or production, if it accompanies the solution on the target host and stores its current configuration.
- Logs: Logging messages generated by the solution, relevant to understand its functioning.
- Stats: Metrics offered by the installed solution, relevant to measure the protection provided to the machine.
Solutions' Lifecycle. Operations
⭕
| Stage | Operation | Description |
|---|---|---|
| Deployment | Initial Configuration Setting | Sets an aspect of the initial configuration used during the installation process. |
| Install | Installs the solution in the target host. | |
| Test | Tests the proper functioning of the newly installed solution. | |
| Production* | Production Configuration Retrieval | Retrieves the production configuration of the running solution |
| Production Configuration Setting | Sets an aspect of the production configuration. | |
| Logs Retrieval | Retrieves the logs generated by the solution. | |
| Stats Retrieval | Retrieves the stats generated by the solution. | |
| Test | Tests the proper functioning of the running solution. | |
| Update | Updates the solution to its latest version. | |
| Disconnection | Uninstall | Uninstalls the solution from the target host. |
* All the operations listed in the production stage are optional and can be executed in any order.
Functionalities
🚀
- Local or remote (via password-based SSH) deployment
- One solution supported so far (and more under development)
- Intuitive command line interface
Supported Cybersecurity Solutions
📦
| Supported Solution | Short Description | Supported Operating Systems |
|---|---|---|
 |
Open source network intrusion detection and prevention system | Ubuntu 20.04 LTS and 22.04 LTS |
| More coming soon... | ||
Installation
🥡
The easiest way to install MutableSecurity is from PyPI. Just run pip install mutablesecurity and you'll have everything set!
Requirements
🥢
The only requirements are Python 3.9 and pip.
To avoid warnings when using pip to install Python scripts, add /home/<username>/.local/bin (where <username> identifies the current user) to your $PATH variable.
Usage and Demos
🪜
0️⃣
Get help.
Syntax
mutablesecurity --help or mutablesecurity --solution <solution> --help
Example
➜ mutablesecurity --help
_ _ _ __ _ _
/\/\ _ _| |_ __ _| |__ | | ___/ _\ ___ ___ _ _ _ __(_| |_ _ _
/ \| | | | __/ _` | '_ \| |/ _ \ \ / _ \/ __| | | | '__| | __| | | |
/ /\/\ | |_| | || (_| | |_) | | ___\ | __| (__| |_| | | | | |_| |_| |
\/ \/\__,_|\__\__,_|_.__/|_|\___\__/\___|\___|\__,_|_| |_|\__|\__, |
Seamless deployment and management of cybersecurity solutions |___/
Usage: mutablesecurity [OPTIONS]
Options:
-r, --remote TEXT Connect to remote in the
USERNAME@HOSTNAME:PORT format. If ommited,
the operations are executed locally.
-s, --solution [SURICATA] Solution to manage
-o, --operation [GET_CONFIGURATION|GET_LOGS|GET_STATS|INSTALL|SET_CONFIGURATION|TEST|UNINSTALL|UPDATE]
Operation to perform
-a, --aspect TEXT Configuration's aspect to modify. Available
only with a value (--value)
-v, --value TEXT New value of the configuration's aspect.
Available only with an aspect (--aspect).
--verbose Increase in the logging volume
-h, --help Useful information for using MutableSecurity
or about a solution
➜ mutablesecurity --solution SURICATA --help
_ _ _ __ _ _
/\/\ _ _| |_ __ _| |__ | | ___/ _\ ___ ___ _ _ _ __(_| |_ _ _
/ \| | | | __/ _` | '_ \| |/ _ \ \ / _ \/ __| | | | '__| | __| | | |
/ /\/\ | |_| | || (_| | |_) | | ___\ | __| (__| |_| | | | | |_| |_| |
\/ \/\__,_|\__\__,_|_.__/|_|\___\__/\___|\___|\__,_|_| |_|\__|\__, |
Seamless deployment and management of cybersecurity solutions |___/
Full name: Suricata Intrusion Detection and Prevention System
Description:
Suricata is the leading independent open source threat detection engine. By combining intrusion detection (IDS), intrusion prevention (IPS), network
security monitoring (NSM) and PCAP processing, Suricata can quickly identify, stop, and assess even the most sophisticated attacks.
References:
- https://suricata.io
- https://github.com/OISF/suricata
Configuration:
┏━━━━━━━━━━━━━━━━━━━┳━━━━━━┳━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Aspect ┃ Type ┃ Possible Values ┃ Description ┃
┡━━━━━━━━━━━━━━━━━━━╇━━━━━━╇━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ interface │ str │ * │ Interface on which Suricata listens │
│ automatic_updates │ str │ ENABLED, DISABLED │ State of the automatic daily updates │
└───────────────────┴──────┴───────────────────┴──────────────────────────────────────┘
1️⃣
Install a solution.
Syntax
mutablesecurity --solution <solution> --operation INSTALL
Example
➜ mutablesecurity --solution SURICATA --operation INSTALL
🔐 Password for localhost:
✅ Suricata is now installed on this machine.
Optional: To connect to a remote host via a privileged user, just add the --remote flag.
➜ mutablesecurity --remote [email protected]:22 --solution SURICATA --operation INSTALL
🔐 Password for [email protected]:22:
✅ Suricata is now installed on this machine.
2️⃣
Test the solution.
Syntax
mutablesecurity --solution <solution> --operation TEST
Example
➜ mutablesecurity --solution SURICATA --operation TEST
🔐 Password for localhost:
✅ Suricata works as expected.
3️⃣
Get the production configuration.
Syntax
mutablesecurity --solution <solution> --operation GET_CONFIGURATION
Example
➜ mutablesecurity --solution SURICATA --operation GET_CONFIGURATION
🔐 Password for localhost:
✅ The configuration of Suricata was retrieved.
┏━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━┓
┃ Attribute ┃ Value ┃
┡━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━┩
│ automatic_updates │ DISABLED │
│ interface │ enp0s3 │
└───────────────────┴──────────┘
4️⃣
Modify the production configuration.
Syntax
mutablesecurity --solution <solution> --operation SET_CONFIGURATION --aspect <aspect> --value <value>
Example
➜ mutablesecurity --solution SURICATA --operation SET_CONFIGURATION --aspect automatic_updates --value ENABLED
🔐 Password for localhost:
✅ The configuration of Suricata was set.
Optional: To test the modifications, run the configuration retrieval and testing operations.
➜ mutablesecurity --solution SURICATA --operation GET_CONFIGURATION
🔐 Password for localhost:
✅ The configuration of Suricata was retrieved.
┏━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━┓
┃ Attribute ┃ Value ┃
┡━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━┩
│ automatic_updates │ ENABLED │
│ interface │ enp0s3 │
└───────────────────┴─────────┘
➜ mutablesecurity --solution SURICATA --operation TEST
🔐 Password for localhost:
✅ Suricata works as expected.
5️⃣
Retrieve the solution logs.
Syntax
mutablesecurity --solution <solution> --operation GET_LOGS
Example
➜ mutablesecurity --solution SURICATA --operation GET_LOGS
🔐 Password for localhost:
✅ The logs of Suricata were retrieved.
[...]
04/18/2022-10:55:31.134760 [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2]
{TCP} 54.192.235.64:80 -> 10.0.2.15:50690
[...]
6️⃣
Retrieve the solution statistics.
Syntax
mutablesecurity --solution <solution> --operation GET_STATS
Example
➜ mutablesecurity --solution SURICATA --operation GET_STATS
🔐 Password for localhost:
✅ The stats of Suricata were retrieved.
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Attribute ┃ Value ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ Total number of alerts │ 5 │
│ Total number of alerts generated today │ 5 │
│ Uptime │ 1 minute and 23 seconds │
│ Current installed version │ 6.0.4 RELEASE │
└────────────────────────────────────────┴─────────────────────────┘
7️⃣
Updates the solution.
Syntax
mutablesecurity --solution <solution> --operation UPDATE
Example
➜ mutablesecurity --solution SURICATA --operation UPDATE
🔐 Password for localhost:
✅ Suricata was updated to its latest version.
8️⃣
Uninstall the solution.
Syntax
mutablesecurity --solution <solution> --operation UNINSTALL
Example
➜ mutablesecurity --solution SURICATA --operation UNINSTALL
🔐 Password for localhost:
✅ Suricata is no longer installed on this machine.
Support
🆘
If you have any type of suggestion (for example, proposals for new functionalities or support for other security solutions), please open an issue or drop us a line at [email protected].
Contributing
🤝
To find out how you can contribute to this project, check out our contribution guide.
27 Dec 6, 2022
2 Jul 26, 2022
7 Jul 1, 2022
48 Aug 28, 2022
14 Oct 15, 2022
1 Feb 14, 2022
53 Nov 1, 2022
84 Dec 23, 2022
329 Jan 1, 2023
861 Feb 18, 2021
22.1k Jan 2, 2023
368 Jan 4, 2023
100 Dec 23, 2022
6 Feb 2, 2022
41 Dec 30, 2022
96 Dec 20, 2022
3 Feb 22, 2022
3 Sep 3, 2022
34 Nov 21, 2022