diff --git a/.orgids b/.orgids index 64a0d099..d9fc8296 100644 --- a/.orgids +++ b/.orgids @@ -1,2 +1,2 @@ -(("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/iroh_team_meeting_notes.org" "72772426-cd53-4f61-b584-7807d274c0ad") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/rigid_vs_flexible.org" "a397da72-7731-4a69-9460-38f4a76fbfc1") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/deploy_new_environment_staging.org" "7b35763c-84af-41fa-bad5-b407b33ff020") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/chien_d_assistance.org" "c26339f6-e0bc-40e3-8fe3-94e4b41b61b0") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/elegance.org" "f3e7b5bf-81a1-4592-89fa-f2094a8136d5") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/gaia_2023_10_14_charge_rose.org" "7a256b49-ca75-4c7a-96fe-85c151f2b6ae") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/radiation_chien_espoir_handicap.org" "882b81e7-14e1-40e7-b818-67320f760c59") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/iroh_offsite_2023_notes.org" "437300b8-0f8e-4923-b6d2-d8c7a2db4b6d") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_staging_environment_kick_off.org" "aa8ba7b5-d4e5-48c0-9e7a-2a5adb504d38") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_custom_roles.org" "13070c29-3c00-43f2-a73d-dedc056fb503") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/personal_retrospective_template.org" "f70bf00d-8bc8-445e-a65d-2b960b46f419") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cookie_clicker_save.org" "3d75e1da-3fc4-414d-90f8-c3266eed3ddc") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/chien_espoir_handicap_ag.org" "7a934ca5-31c0-4cf8-8a86-1efa89904b31") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/capt_website.org" "54f15fc7-8c85-4bde-a15a-ea9fe94e7c2f") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/rbac_for_clients.org" "8f30dbd3-8c24-4fd6-b784-2753130453ec") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/maintenance_questions.org" "b55abfad-ea21-4e81-8017-e99b8af33f9c") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/brut_css.org" "cfd05ee0-488d-4b28-ab97-5fe6fe4a5cae") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/one_one_v2.org" "9699f986-29ad-429f-9ca9-1080062ae11c") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/duo.org" "e9d79b8d-3779-45b7-9360-7bb5558ffbeb") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/amstrad.org" "a9971a5b-6565-4835-9c49-c968011bbc21") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/positive_attitude.org" "8deaa4e4-a96c-4d3c-96df-8f23e0d90f1e") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/weekly_platform.org" "1194cbe4-b31c-4b17-9e0a-f0ee8422292c") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/weekly_iroh_auth_notes.org" "8ddf9276-6888-4502-9dd9-943769726ca1") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/vigiglobe.org" "07412c20-49d3-4616-957f-5ddd246ed080") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/presentation_leads.org" "22d031b5-ff8e-46df-a306-0ca30ab7358b") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/characteristics_of_pseudoscience.org" "509cbe3e-cf95-4bcd-9f61-9cc74aa35a8c") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/impots_2021.org" "8daf6185-ad0e-40c2-af79-0bb885505303") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/deep_merge_exploration.org" "c1dbe471-a470-4d44-a91c-0bfda0d47d21") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_securex_ips.org" "c9e0342f-f082-4c9b-9dcd-f1629124ac71") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/new_iroh_auth_apis.org" "2c317dbe-4fca-444b-b0bc-f9174522e106") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/remove_securex_tg_login_button.org" "3290e028-b7a6-4be3-a5d2-45bf89ff2f0d") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/interview_shafiq.org" "094630db-95cf-416f-a147-ca5fdeddd902") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/factorio_maps.org" "e5c17702-09d5-4d7d-97ff-95a8de353ea0") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/artificial_life_game_approach.org" "8a37b5d3-8ee5-45cd-8c32-021b8d42210f") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/customer_manager.org" "99fd9444-ae5d-4d51-a295-a936fc01928a") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_team_history.org" "e3296579-2f2e-4f23-92e2-1ce9fef6fe04") ("../../../Applications/y/her.esy.fun/src/posts/0013-how-to-choose-your-tools/index.org" "c2e61938-8493-434a-9ffa-9fd4698d9863") ("../../../Applications/y/her.esy.fun/src/posts/0019-utopia-tv-show/index.org" "88e25182-ee54-4d2e-b373-b4e06fc292c8") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/interview_certification.org" "93027c33-dcf8-4bda-8aee-60f507e0ff4a") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/how_to_speak.org" "4ad5f64e-c330-4f36-8f8a-d82a1ae993a0") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_ft_securex_registration.org" "1208f09c-d37d-4e6b-9110-151f3c6b7d34") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/simplex_chat.org" "5a711803-6a92-40e3-817d-40f564ac5cf8") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/security.org" "2351f4cb-85a3-45ca-9bb5-f13a559afcfe") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/chat.org" "fb32a68e-b32c-4ce5-9c6a-cc141a122708") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/encryption.org" "80630a59-70f2-435b-967b-abb162324be8") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/redirect_to_new_page_with_useridentity_jwt.org" "f46a4a9e-6a06-4b9e-8764-30cd8c501d7e") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/one_one_meetings.org" "cd101af9-2dd7-41b7-85d6-4de5c0c594df") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/management.org" "719fabee-1094-4596-b26e-55fe7a512113") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/high_iq_captcha.org" "b6402aa6-3315-4317-82a5-367af38f0ead") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_user_data.org" "e6db475b-9ccc-43b2-bcfe-057215ddc1d1") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/iroh_auth_ui_enhancements.org" "fe9118f2-3cf1-4a9c-b97d-d5d58f9d0769") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco.org" "ce893df9-32a4-44e0-9eb5-b9817141ee6a") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_org_level_entities.org" "b30f9e63-e655-40e6-9a58-5a390a7921bb") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/lgtm.org" "cc2e9340-1340-4d28-8f54-47080a569c7e") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/one_hacker_way_by_erik_meijer_goto_2015.org" "02bd2e1e-cd10-4b29-bd03-611edf0c7eab") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/hacker_culture.org" "0caa54f7-bbac-486c-855c-f299943f4226") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/browserless_software_project_management_with_git.org" "13c23225-379a-45a8-bed1-24fb6a054454") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/template_information_chien_d_assistance.org" "b0b0b46f-a11e-4c4b-8d1f-0d444847aeae") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/either_in_clojure.org" "b413e4db-1367-4936-8a46-cd5b86178e29") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/html_css_web_techs.org" "7431e4a3-4359-4dcb-89e6-c1c700cd4355") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/custom_routes.org" "0dceeeca-7c23-41a8-b9dc-4642a09618db") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/what_i_forsee_about_the_future_of_developers.org" "16bbfe28-ea40-437f-861d-1eacb408d34f") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/composable_shell_nix.org" "8c33ebae-bccf-4e73-837b-f52fa4c5e4c6") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/permission_outside_scopes.org" "8c6d80b5-dc83-40ee-b187-4b0427c77f78") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_qdd.org" "32684342-7935-41c3-b855-4a748662b15d") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/maison_martigues.org" "bac1c907-5733-4837-83bb-747e189432b5") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/full_integration_development_doc.org" "b073b659-19e2-4402-b3ef-087ee67aa201") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/programming_langage_ideas.org" "31da574a-3a97-41e7-9513-764b55830ff1") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/iroh_new_env_init.org" "4d0d86f1-1aba-4166-a61f-8b6199c02e57") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_staging_environment_doc.org" "c33df84f-9b64-47a8-b716-fcadc0ec4f8c") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/archives/TODO.archive.org" "8163f2ed-7106-4b4a-93b0-7009fe316172" "797ba971-6ae3-49a1-9499-928572760d09" "B72E4288-E96B-4099-8684-37DDF3395C50" "96343FD2-E7A9-4AAA-A40A-8D048DA340E9") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/events_circular_service_dependency_handlers_service.org" "d494276b-97a5-4415-be58-20e908a84f19") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/dynamic_service_architecture_for_big_software.org" "cdf1dfad-99f0-42d6-9eda-7a04dd275c20")) +(("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/secure_client_and_orbital_sx_eol.org" "26867184-57cf-472d-b5db-d6349665184e") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/protection_juridique.org" "a6cd5474-53e9-465e-8f49-f544199ccb40") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/scc_integration_piam_option_1.org" "e32045d1-4f6b-491d-b83a-6fa1511e2229") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/on_software_programming_evolution.org" "3acde895-6fb6-433a-a46c-3ebd0dedcdbe") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/iroh_team_meeting_notes.org" "72772426-cd53-4f61-b584-7807d274c0ad") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/rigid_vs_flexible.org" "a397da72-7731-4a69-9460-38f4a76fbfc1") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/deploy_new_environment_staging.org" "7b35763c-84af-41fa-bad5-b407b33ff020") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/chien_d_assistance.org" "c26339f6-e0bc-40e3-8fe3-94e4b41b61b0") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/elegance.org" "f3e7b5bf-81a1-4592-89fa-f2094a8136d5") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/gaia_2023_10_14_charge_rose.org" "7a256b49-ca75-4c7a-96fe-85c151f2b6ae") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/radiation_chien_espoir_handicap.org" "882b81e7-14e1-40e7-b818-67320f760c59") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/iroh_offsite_2023_notes.org" "437300b8-0f8e-4923-b6d2-d8c7a2db4b6d") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_staging_environment_kick_off.org" "aa8ba7b5-d4e5-48c0-9e7a-2a5adb504d38") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_custom_roles.org" "13070c29-3c00-43f2-a73d-dedc056fb503") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/personal_retrospective_template.org" "f70bf00d-8bc8-445e-a65d-2b960b46f419") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cookie_clicker_save.org" "3d75e1da-3fc4-414d-90f8-c3266eed3ddc") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/chien_espoir_handicap_ag.org" "7a934ca5-31c0-4cf8-8a86-1efa89904b31") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/capt_website.org" "54f15fc7-8c85-4bde-a15a-ea9fe94e7c2f") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/rbac_for_clients.org" "8f30dbd3-8c24-4fd6-b784-2753130453ec") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/maintenance_questions.org" "b55abfad-ea21-4e81-8017-e99b8af33f9c") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/brut_css.org" "cfd05ee0-488d-4b28-ab97-5fe6fe4a5cae") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/one_one_v2.org" "9699f986-29ad-429f-9ca9-1080062ae11c") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/duo.org" "e9d79b8d-3779-45b7-9360-7bb5558ffbeb") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/amstrad.org" "a9971a5b-6565-4835-9c49-c968011bbc21") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/positive_attitude.org" "8deaa4e4-a96c-4d3c-96df-8f23e0d90f1e") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/weekly_platform.org" "1194cbe4-b31c-4b17-9e0a-f0ee8422292c") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/weekly_iroh_auth_notes.org" "8ddf9276-6888-4502-9dd9-943769726ca1") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/vigiglobe.org" "07412c20-49d3-4616-957f-5ddd246ed080") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/presentation_leads.org" "22d031b5-ff8e-46df-a306-0ca30ab7358b") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/characteristics_of_pseudoscience.org" "509cbe3e-cf95-4bcd-9f61-9cc74aa35a8c") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/impots_2021.org" "8daf6185-ad0e-40c2-af79-0bb885505303") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/deep_merge_exploration.org" "c1dbe471-a470-4d44-a91c-0bfda0d47d21") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_securex_ips.org" "c9e0342f-f082-4c9b-9dcd-f1629124ac71") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/new_iroh_auth_apis.org" "2c317dbe-4fca-444b-b0bc-f9174522e106") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/remove_securex_tg_login_button.org" "3290e028-b7a6-4be3-a5d2-45bf89ff2f0d") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/interview_shafiq.org" "094630db-95cf-416f-a147-ca5fdeddd902") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/factorio_maps.org" "e5c17702-09d5-4d7d-97ff-95a8de353ea0") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/artificial_life_game_approach.org" "8a37b5d3-8ee5-45cd-8c32-021b8d42210f") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/customer_manager.org" "99fd9444-ae5d-4d51-a295-a936fc01928a") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_team_history.org" "e3296579-2f2e-4f23-92e2-1ce9fef6fe04") ("../../../Applications/y/her.esy.fun/src/posts/0013-how-to-choose-your-tools/index.org" "c2e61938-8493-434a-9ffa-9fd4698d9863") ("../../../Applications/y/her.esy.fun/src/posts/0019-utopia-tv-show/index.org" "88e25182-ee54-4d2e-b373-b4e06fc292c8") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/interview_certification.org" "93027c33-dcf8-4bda-8aee-60f507e0ff4a") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/how_to_speak.org" "4ad5f64e-c330-4f36-8f8a-d82a1ae993a0") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_ft_securex_registration.org" "1208f09c-d37d-4e6b-9110-151f3c6b7d34") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/simplex_chat.org" "5a711803-6a92-40e3-817d-40f564ac5cf8") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/security.org" "2351f4cb-85a3-45ca-9bb5-f13a559afcfe") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/chat.org" "fb32a68e-b32c-4ce5-9c6a-cc141a122708") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/encryption.org" "80630a59-70f2-435b-967b-abb162324be8") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/redirect_to_new_page_with_useridentity_jwt.org" "f46a4a9e-6a06-4b9e-8764-30cd8c501d7e") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/one_one_meetings.org" "cd101af9-2dd7-41b7-85d6-4de5c0c594df") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/management.org" "719fabee-1094-4596-b26e-55fe7a512113") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/high_iq_captcha.org" "b6402aa6-3315-4317-82a5-367af38f0ead") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_user_data.org" "e6db475b-9ccc-43b2-bcfe-057215ddc1d1") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/iroh_auth_ui_enhancements.org" "fe9118f2-3cf1-4a9c-b97d-d5d58f9d0769") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco.org" "ce893df9-32a4-44e0-9eb5-b9817141ee6a") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_org_level_entities.org" "b30f9e63-e655-40e6-9a58-5a390a7921bb") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/lgtm.org" "cc2e9340-1340-4d28-8f54-47080a569c7e") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/one_hacker_way_by_erik_meijer_goto_2015.org" "02bd2e1e-cd10-4b29-bd03-611edf0c7eab") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/hacker_culture.org" "0caa54f7-bbac-486c-855c-f299943f4226") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/browserless_software_project_management_with_git.org" "13c23225-379a-45a8-bed1-24fb6a054454") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/template_information_chien_d_assistance.org" "b0b0b46f-a11e-4c4b-8d1f-0d444847aeae") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/either_in_clojure.org" "b413e4db-1367-4936-8a46-cd5b86178e29") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/html_css_web_techs.org" "7431e4a3-4359-4dcb-89e6-c1c700cd4355") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/custom_routes.org" "0dceeeca-7c23-41a8-b9dc-4642a09618db") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/what_i_forsee_about_the_future_of_developers.org" "16bbfe28-ea40-437f-861d-1eacb408d34f") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/composable_shell_nix.org" "8c33ebae-bccf-4e73-837b-f52fa4c5e4c6") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/permission_outside_scopes.org" "8c6d80b5-dc83-40ee-b187-4b0427c77f78") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_qdd.org" "32684342-7935-41c3-b855-4a748662b15d") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/maison_martigues.org" "bac1c907-5733-4837-83bb-747e189432b5") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/full_integration_development_doc.org" "b073b659-19e2-4402-b3ef-087ee67aa201") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/programming_langage_ideas.org" "31da574a-3a97-41e7-9513-764b55830ff1") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/iroh_new_env_init.org" "4d0d86f1-1aba-4166-a61f-8b6199c02e57") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_staging_environment_doc.org" "c33df84f-9b64-47a8-b716-fcadc0ec4f8c") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/events_circular_service_dependency_handlers_service.org" "d494276b-97a5-4415-be58-20e908a84f19") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/dynamic_service_architecture_for_big_software.org" "cdf1dfad-99f0-42d6-9eda-7a04dd275c20") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/retrieve_tokens_for_ai_assistant.org" "7d934841-a145-4833-8389-18ba449a6de7") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/sx_eol_phase_1.org" "c60e01f9-9513-46f7-85f8-994f90989b2f") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/sx_eol_phase_1_presentation.org" "7ddbbc9f-a3a9-4ef3-b751-3f12be315482") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/ai_and_death_of_the_web_as_we_know_it.org" "1f142832-05f9-4280-a8ca-aa6f35209f91") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/budget_famille.org" "6899703d-51cb-49e6-a16b-30ae460ed055") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/impots_2023.org" "9952b8ac-59df-442c-b3aa-64e78e47d9b1") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/notes/cisco_iroh_client_data_retention.org" "b129bbc2-43c7-4ba6-bcba-23fcc45add4f") ("../Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/archives/TODO.archive.org" "8163f2ed-7106-4b4a-93b0-7009fe316172" "797ba971-6ae3-49a1-9499-928572760d09" "B72E4288-E96B-4099-8684-37DDF3395C50" "96343FD2-E7A9-4AAA-A40A-8D048DA340E9")) diff --git a/Cisco.org.gpg b/Cisco.org.gpg index 3bbc1ce9..46370266 100644 Binary files a/Cisco.org.gpg and b/Cisco.org.gpg differ diff --git a/SE_Orbital_provisioning.png b/SE_Orbital_provisioning.png new file mode 100644 index 00000000..2b8dcfba Binary files /dev/null and b/SE_Orbital_provisioning.png differ diff --git a/archives/Cisco.archive.org.gpg b/archives/Cisco.archive.org.gpg index 4d43fd03..807837de 100644 Binary files a/archives/Cisco.archive.org.gpg and b/archives/Cisco.archive.org.gpg differ diff --git a/archives/TODO.archive.org b/archives/TODO.archive.org index 2b07776e..1916b421 100644 --- a/archives/TODO.archive.org +++ b/archives/TODO.archive.org @@ -12746,3 +12746,459 @@ SCHEDULED: <2024-01-31 Wed 10:07> :ARCHIVE_TODO: DONE :END: [2024-01-31 Wed 07:07] + +* DONE answer webexteams://im?space=06fcf5e0-9dca-11ee-baad-23b6ab543fdf&message=da31b7f0-c12b-11ee-ac23-e7bfffb2503c +SCHEDULED: <2024-02-02 Fri 10:51> +:PROPERTIES: +:ARCHIVE_TIME: 2024-02-15 Thu 10:00 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-02-01 Thu 20:50] + +* DONE Appeler assurance Toyota +SCHEDULED: <2024-02-14 Wed 10:23> +:PROPERTIES: +:ARCHIVE_TIME: 2024-02-15 Thu 10:00 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-02-13 Tue 19:23] + +* DONE [#B] Payer Farina +DEADLINE: <2024-02-01 Thu 10:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-02-15 Thu 10:01 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-01-31 Wed 21:03] + +* DONE Carrosserie +SCHEDULED: <2024-01-18 Thu 10:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-02-15 Thu 10:01 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-01-17 Wed 17:14] + +* DONE Decision crédit Toyota 17k +SCHEDULED: <2024-01-14 Sun 14:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-02-15 Thu 10:01 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-01-12 Fri 09:54] + +* DONE Lire le wiki vos-finances [[https://www.reddit.com/r/vosfinances/wiki/index][wiki]] +SCHEDULED: <2024-02-03 Sat 19:10> +:PROPERTIES: +:ARCHIVE_TIME: 2024-02-15 Thu 10:01 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2023-10-29 Sun 15:35] + +* DONE Réessayer [[https://www.mamedev.org/?p=530][MAME]] +SCHEDULED: <2024-01-27 Sat 11:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-02-15 Thu 10:01 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2023-10-25 Wed 08:03] + +* DONE AI Assistant Token @Prerna :work: +SCHEDULED: <2024-02-02 Fri 11:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-02-15 Thu 10:01 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-02-01 Thu 23:04] + +* DONE SCA re-onboard +SCHEDULED: <2024-02-29 Thu 10:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-03-10 Sun 18:24 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-02-28 Wed 20:03] + +* DONE Check [[https://github.com/juspay/services-flake][flake compose service]] +SCHEDULED: <2024-02-19 Mon 10:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-03-10 Sun 18:24 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-02-17 Sat 23:37] + +* CANCELED Compléter dossier MDPH best practices +SCHEDULED: <2024-02-09 Fri 15:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-03-10 Sun 18:24 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: CANCELED +:END: +:LOGBOOK: +- State "CANCELED" from "TODO" [2024-02-22 Thu 17:58] +:END: +[2024-01-21 Sun 11:38] + +* DONE Check lettre Matthieu à Val +:PROPERTIES: +:ARCHIVE_TIME: 2024-03-10 Sun 18:25 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2023-10-03 Tue 19:16] + +Raison de la radiation: +- manque de suivi + +* DONE Envoyer un message a Joannie +SCHEDULED: <2024-03-22 Fri 10:33> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-15 Mon 12:47 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-02-23 Fri 22:32] + +* DONE [[https://fr.m.wikipedia.org/wiki/Ma_Loute][Ma Loute — Wikipédia]] +SCHEDULED: <2024-03-16 Sat> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-15 Mon 12:47 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-03-16 Sat 13:42] + +* DONE Update Meraki clients webexteams://im?space=b5844a30-2e19-11ee-b0bb-8575ace105f3&message=26fed6b0-eaf0-11ee-a113-5fa39a3c7afe +SCHEDULED: <2024-03-26 Tue 11:42> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-15 Mon 12:47 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-03-26 Tue 07:42] + +* DONE Telecharger FROM +SCHEDULED: <2024-04-01 Mon 19:31> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-15 Mon 12:47 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-04-01 Mon 13:31] + +* DONE Payer 60€ Psy Krystelle +SCHEDULED: <2024-03-28 Thu 09:39> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-15 Mon 12:47 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-03-28 Thu 07:39] + +* DONE télécharger la guerre des mondes +SCHEDULED: <2024-04-08 Mon 10:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-15 Mon 12:47 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-04-06 Sat 19:53] + +* DONE Commander gateaux aux perles de l'étang +SCHEDULED: <2024-04-25 Thu 14:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:34 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-04-25 Thu 12:13] + +* DONE Appeler la MDPH! +SCHEDULED: <2024-04-22 Mon 14:30> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:34 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-04-18 Thu 17:59] + +Madame Lagarde Sandrine pour la demande de compensation. + +Num Dossier: 500992 +Num Individu: 3362710 +NIR: 2040313056049 97 + +Mercredi 15 au matin, vers 10h30. + +* DONE Faire un virment de 3900+2600 vers Banque Pop +SCHEDULED: <2024-04-18 Thu 18:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:34 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-04-05 Fri 10:06] + +* DONE Mettre les rideaux +SCHEDULED: <2024-03-28 Thu 14:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:34 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-03-28 Thu 12:15] + +* DONE Commander les brises vues +SCHEDULED: <2024-03-26 Tue 10:30> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:34 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-03-25 Mon 17:10] + +- Route du haut: 1m x 23 +- Voisins: 180x500 x1 + 150x300 x1 +- Terrasse: 90x300 x3 + 90x500 x1 + +* DONE Appeler Farina +SCHEDULED: <2024-03-26 Tue 10:20> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:34 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-03-25 Mon 17:09] + +* CANCELED Appeler Diagonale Carrelage +SCHEDULED: <2024-03-26 Tue 10:10> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:34 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: CANCELED +:END: +:LOGBOOK: +- State "CANCELED" from "TODO" [2024-03-26 Tue 15:50] \\ + Il nous ont contactés en premier +:END: +[2024-03-25 Mon 17:09] + +* DONE Appeler Violet 06.19.84.29.28 +SCHEDULED: <2024-03-26 Tue 10:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:34 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-03-25 Mon 17:09] + +* DONE Envoyer email escaliers +SCHEDULED: <2024-03-20 Wed 10:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:34 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-03-19 Tue 22:21] + +* DONE Envoyer documents +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:34 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-03-19 Tue 14:23] + +gestion@toyota-assurances.fr + +- photocopie du permis de conduire recto/verso +- manda SEPA +- photocopie de la carte grise du véhicule +- signature des conditions +- chèque du premier paiement 62.24€ + +* DONE Systeme pour voir un des 32 conseils de temps en temps (mothership?) +SCHEDULED: <2024-03-18 Mon 14:30> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:34 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-03-18 Mon 12:55] + +* CANCELED Use Caddy to fix Let's encrypt with nginx +SCHEDULED: <2024-03-21 Thu 10:00> DEADLINE: <2024-07-01 Mon> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:34 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: CANCELED +:END: +:LOGBOOK: +- State "CANCELED" from "TODO" [2024-03-26 Tue 19:03] \\ + Maybe not necessary +:END: +[2024-03-15 Fri 16:18] + +* DONE Appeler Toyota +SCHEDULED: <2024-03-11 Mon 15:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:35 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-03-11 Mon 10:52] + +* DONE Appeler Diagonale Carrelage +SCHEDULED: <2024-03-11 Mon 10:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:35 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-03-10 Sun 18:23] + +* DONE Appeler Devis Isolation +SCHEDULED: <2024-03-11 Mon 10:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:35 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-03-10 Sun 18:23] + +* DONE Appeler Farina +SCHEDULED: <2024-03-11 Mon 10:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:35 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-03-10 Sun 18:22] + +* DONE Appeler Hydropolis +SCHEDULED: <2024-03-11 Mon 10:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:35 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: + +Tel: 04 83 88 16 70 +Pas de contrat depuis 1 an. + +[2024-03-10 Sun 18:14] + +* DONE Aller chercher du vin et champagne pour demain +SCHEDULED: <2024-04-26 Fri 14:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:35 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-04-25 Thu 12:16] + +* DONE Update Meraki clients [[webexteams://im?space=b5844a30-2e19-11ee-b0bb-8575ace105f3&message=885f3ba0-0334-11ef-9d9b-4309461a14ff][msg]] +SCHEDULED: <2024-04-26 Fri 10:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:35 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-04-26 Fri 09:02] + +* DONE Add a mitre flag to an EU org +SCHEDULED: <2024-04-26 Fri 10:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:35 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_OLPATH: Inbox +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-04-26 Fri 09:03] + +* DONE Appeler carte grise Antibe urgent ! +SCHEDULED: <2024-04-17 Wed 10:00> +:PROPERTIES: +:ARCHIVE_TIME: 2024-04-29 Mon 10:37 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org +:ARCHIVE_CATEGORY: inbox +:ARCHIVE_TODO: DONE +:END: +[2024-04-08 Mon 18:26] diff --git a/inbox.org b/inbox.org index 40386cc6..1e29aed1 100644 --- a/inbox.org +++ b/inbox.org @@ -10,49 +10,87 @@ SPC y o c => DISPLAY org columns #+end_comment * Inbox -** DONE [#B] Payer Farina -DEADLINE: <2024-02-01 Thu 10:00> -[2024-01-31 Wed 21:03] -** TODO Compléter dossier MDPH best practices -SCHEDULED: <2024-01-30 Tue 10:00> -[2024-01-21 Sun 11:38] -** DONE Carrosserie -SCHEDULED: <2024-01-18 Thu 10:00> -[2024-01-17 Wed 17:14] -** DONE Decision crédit Toyota 17k -SCHEDULED: <2024-01-14 Sun 14:00> -[2024-01-12 Fri 09:54] -** TODO Lire le wiki vos-finances [[https://www.reddit.com/r/vosfinances/wiki/index][wiki]] -SCHEDULED: <2024-02-03 Sat 19:10> -[2023-10-29 Sun 15:35] -** DONE Réessayer [[https://www.mamedev.org/?p=530][MAME]] -SCHEDULED: <2024-01-27 Sat 11:00> -[2023-10-25 Wed 08:03] -** TODO Check lettre Matthieu à Val -[2023-10-03 Tue 19:16] +** DONE Appeler carte grise Aygo +SCHEDULED: <2024-04-29 Mon 14:40> +[2024-04-09 Tue 22:13] +** TODO Mail banque populaire interdiction copy/paste de l'identifiant sur iOS +[2024-04-05 Fri 09:55] +** DONE [#A] Documents Appartement Impots +SCHEDULED: <2024-05-30 Thu 10:00> +[2024-04-04 Thu 18:56] +** TODO Commander le matelas 140x190x16cm +SCHEDULED: <2024-06-28 Fri 19:00> +[2024-04-02 Tue 17:34] +** TODO https://github.com//incident-manager/issues/2408 +[2024-03-11 Mon 16:41] +** TODO Envoyer documents hydropolis +[2024-03-11 Mon 15:52] -Raison de la radiation: -- manque de suivi +Numero de contrat: 152002674 + +- [ ] document de vente +- [ ] nouvelle addresse ** TODO [#B] [[file:death.org.gpg][Post Mortem]] pour la famille :family: -SCHEDULED: <2024-03-05 Tue 11:00 +1m> +SCHEDULED: <2024-07-07 Sun 11:00 +1m> +:PROPERTIES: +:LAST_REPEAT: [2024-06-10 Mon 12:07] +:END: +:LOGBOOK: +- State "DONE" from "TODO" [2024-06-10 Mon 12:07] +- State "DONE" from "TODO" [2024-04-18 Thu 14:43] +:END: [2023-04-30 Sun 09:06] 1. Fermer mes serveurs 2. Trouver mes comptes 3. Récupérer mes access (mots de passe, keychain, etc…) -** TODO Voitures (addresses, Crit'Air) -SCHEDULED: <2024-01-29 Mon 11:00> -*** TODO Acheter vignette Crit'air Aygo -**** TODO Changer l'addresse du Aygo -***** TODO Joindre Toyota (Aygo) -*** TODO Acheter vignette Crit'air CHR -**** TODO Changer l'addresse du CHR -***** TODO Joindre Toyota (CHR) -*** TODO Décider choix Voiture CHR -**** TODO Continuer nouvelle LOA -***** TODO Aller chez le [[https://www.carrosserie-rca.fr/contact.php][carrossier]] 0481684549 -***** TODO Changer les pneus -**** TODO Rachat + Crédit +** DONE Voitures (addresses, Crit'Air) +SCHEDULED: <2024-03-20 Wed 11:00> +*** DONE Acheter vignette Crit'air Aygo +**** DONE Changer l'addresse du Aygo +***** DONE Joindre Toyota (Aygo) +*** DONE Acheter vignette Crit'air CHR +**** CANCELED Changer l'addresse du CHR +:LOGBOOK: +- State "CANCELED" from "TODO" [2024-02-08 Thu 08:38] +:END: +***** CANCELED Joindre Toyota (CHR) +:LOGBOOK: +- State "CANCELED" from "TODO" [2024-02-08 Thu 08:38] +:END: +*** DONE Décider choix Voiture CHR +**** DONE Continuer nouvelle LOA +***** DONE Aller chez le [[https://www.carrosserie-rca.fr/contact.php][carrossier]] 0481684549 +***** DONE Changer les pneus +**** DONE Rachat + Crédit +** DONE Acheter croquettes Oslo +SCHEDULED: <2024-04-29 Mon 10:00> +[2024-04-29 Mon 13:57] +** DONE Check de la durée de l'abonnement Pô +SCHEDULED: <2024-04-29 Mon 10:00> +[2024-04-29 Mon 13:58] +** DONE Faire les impots +SCHEDULED: <2024-05-18 Sat 10:00> +[2024-05-18 Sat 08:53] +** DONE Appeler et annuler l'assurance Toyota +SCHEDULED: <2024-05-23 Thu 10:00> +[2024-05-18 Sat 09:29] +** DONE [#A] Envoyer le certificat de cession du CHR FX-123-BS +SCHEDULED: <2024-05-30 Thu 10:00> +[2024-05-24 Fri 17:45] +** DONE [#A] Envoyer courrier recommandé à Toyota Antibes +SCHEDULED: <2024-05-29 Wed 10:00> +[2024-05-29 Wed 10:25] +** TODO Movie: The One I Love (2014) +SCHEDULED: <2024-06-27 Thu 10:00> +[2024-06-13 Thu 21:56] +** CANCELED Film "The Humt" +SCHEDULED: <2024-06-24 Mon 19:00> +:LOGBOOK: +- State "CANCELED" from "TODO" [2024-06-25 Tue 10:06] \\ + Cannot find "The Hunt" +:END: +[2024-06-21 Fri 23:59] * Perso :perso: ** Habits :habit: ** Maybe :maybe: @@ -64,11 +102,32 @@ explcit constraints. doc type system, tests * Famille :family: ** Daily :daily: *** TODO Attention gentille -SCHEDULED: <2024-01-30 Tue .+1d> +SCHEDULED: <2024-06-25 Tue .+1d> :PROPERTIES: -:LAST_REPEAT: [2024-01-29 Mon 09:20] +:LAST_REPEAT: [2024-06-24 Mon 09:16] :END: :LOGBOOK: +- State "DONE" from "TODO" [2024-06-24 Mon 09:16] +- State "DONE" from "TODO" [2024-06-18 Tue 08:35] +- State "DONE" from "TODO" [2024-06-17 Mon 07:36] +- State "DONE" from "TODO" [2024-06-10 Mon 12:05] +- State "DONE" from "TODO" [2024-05-22 Wed 18:43] +- State "DONE" from "TODO" [2024-05-18 Sat 08:52] +- State "DONE" from "TODO" [2024-04-28 Sun 20:48] +- State "DONE" from "TODO" [2024-04-28 Sun 20:48] +- State "DONE" from "TODO" [2024-04-25 Thu 14:50] +- State "DONE" from "TODO" [2024-04-24 Wed 18:16] +- State "DONE" from "TODO" [2024-04-23 Tue 09:06] +- State "DONE" from "TODO" [2024-04-19 Fri 09:50] +- State "DONE" from "TODO" [2024-03-29 Fri 08:47] +- State "DONE" from "TODO" [2024-03-26 Tue 19:03] +- State "DONE" from "TODO" [2024-03-20 Wed 10:26] +- State "DONE" from "TODO" [2024-03-15 Fri 18:20] +- State "DONE" from "TODO" [2024-03-13 Wed 18:38] +- State "CANCELED" from "TODO" [2024-02-22 Thu 17:58] +- State "DONE" from "TODO" [2024-02-15 Thu 09:58] +- State "DONE" from "TODO" [2024-02-14 Wed 16:34] +- State "DONE" from "TODO" [2024-02-09 Fri 09:13] - State "DONE" from "TODO" [2024-01-29 Mon 09:20] - State "DONE" from "TODO" [2024-01-22 Mon 17:40] - State "DONE" from "TODO" [2024-01-20 Sat 10:51] @@ -87,12 +146,16 @@ SCHEDULED: <2024-01-30 Tue .+1d> :END: ** Weekly :weekly: *** TODO Appeler Papa -SCHEDULED: <2023-12-05 Tue 12:30 .+1w> +SCHEDULED: <2024-06-25 Tue 12:30 .+1w> :PROPERTIES: :STYLE: habit -:LAST_REPEAT: [2023-11-28 Tue 09:56] +:LAST_REPEAT: [2024-06-18 Tue 08:35] :END: :LOGBOOK: +- State "DONE" from "TODO" [2024-06-18 Tue 08:35] +- State "DONE" from "TODO" [2024-05-18 Sat 08:52] +- State "DONE" from "TODO" [2024-04-08 Mon 15:38] +- State "DONE" from "TODO" [2024-02-14 Wed 16:34] - State "DONE" from "TODO" [2023-11-28 Tue 09:56] - State "DONE" from "TODO" [2023-11-05 Sun 19:19] - State "DONE" from "TODO" [2023-10-29 Sun 19:22] @@ -106,12 +169,17 @@ SCHEDULED: <2023-12-05 Tue 12:30 .+1w> - State "DONE" from "TODO" [2022-12-02 Fri 19:10] :END: *** TODO Appeler Maman -SCHEDULED: <2024-02-05 Mon 12:00 .+1w> +SCHEDULED: <2024-07-01 Mon 12:00 .+1w> :PROPERTIES: :STYLE: habit -:LAST_REPEAT: [2024-01-29 Mon 09:20] +:LAST_REPEAT: [2024-06-24 Mon 09:18] :END: :LOGBOOK: +- State "DONE" from "TODO" [2024-06-24 Mon 09:18] +- State "DONE" from "TODO" [2024-05-18 Sat 08:52] +- State "DONE" from "TODO" [2024-04-23 Tue 09:06] +- State "DONE" from "TODO" [2024-02-14 Wed 16:34] +- State "DONE" from "TODO" [2024-02-05 Mon 11:38] - State "DONE" from "TODO" [2024-01-29 Mon 09:20] - State "DONE" from "TODO" [2024-01-22 Mon 17:40] - State "DONE" from "TODO" [2024-01-08 Mon 15:43] @@ -166,11 +234,12 @@ SCHEDULED: <2024-11-18 Mon 10:30 +1y> :END: [2020-05-23 Sat 10:32] *** TODO [#A] Cadeau Rencontre Krystelle (1995) :yearly: -DEADLINE: <2024-04-08 Mon +1y -2w> +DEADLINE: <2025-04-08 Tue +1y -2w> :PROPERTIES: -:LAST_REPEAT: [2023-04-04 Tue 22:57] +:LAST_REPEAT: [2024-04-08 Mon 15:38] :END: :LOGBOOK: +- State "DONE" from "TODO" [2024-04-08 Mon 15:38] - State "DONE" from "TODO" [2023-04-04 Tue 22:57] - State "DONE" from "TODO" [2022-04-07 Thu 11:56] :END: @@ -186,11 +255,12 @@ DEADLINE: <2024-08-12 Mon +1y -2w> - State "DONE" from "TODO" [2020-08-10 Mon 12:19] :END: *** TODO [#A] Cadeau Anniversaire Krystelle :yearly: -DEADLINE: <2024-04-26 Fri +1y -2w> +DEADLINE: <2025-04-26 Sat +1y -2w> :PROPERTIES: -:LAST_REPEAT: [2023-04-20 Thu 15:42] +:LAST_REPEAT: [2024-04-26 Fri 09:03] :END: :LOGBOOK: +- State "DONE" from "TODO" [2024-04-26 Fri 09:03] - State "DONE" from "TODO" [2023-04-20 Thu 15:42] - State "DONE" from "TODO" [2022-04-26 Tue 18:53] :END: @@ -211,22 +281,30 @@ DEADLINE: <2025-01-04 Sat +1y> ** Krystelle :krystelle: ** Anna :anna: *** TODO Trouver un établissement – DAEU -SCHEDULED: <2024-02-24 Sat 12:00> +SCHEDULED: <2024-07-02 Tue 12:00> [2023-08-02 Wed 12:39] https://www.daeu.fr/sinscrire-au-daeu/trouver-un-etablissement/ ** Bastien :bastien: ** Monthly :monthly: *** TODO Nettoyer la fontaine des animaux -SCHEDULED: <2024-02-19 Mon 12:00 .+3w> +SCHEDULED: <2024-07-08 Mon 12:00 .+3w> :PROPERTIES: -:LAST_REPEAT: [2024-01-29 Mon 09:20] +:LAST_REPEAT: [2024-06-17 Mon 07:36] :END: :LOGBOOK: +- State "DONE" from "TODO" [2024-06-17 Mon 07:36] +- State "DONE" from "TODO" [2024-05-22 Wed 18:43] +- State "DONE" from "TODO" [2024-04-23 Tue 09:04] +- State "DONE" from "TODO" [2024-03-29 Fri 08:46] +- State "CANCELED" from "TODO" [2024-02-29 Thu 18:53] - State "DONE" from "TODO" [2024-01-29 Mon 09:20] - State "DONE" from "TODO" [2024-01-08 Mon 15:42] - State "DONE" from "TODO" [2023-12-04 Mon 15:04] :END: [2023-10-05 Thu 21:09] +** DONE [#A] Payer Farina :work: +SCHEDULED: <2024-04-16 Tue 10:00> +[2024-04-15 Mon 21:02] * Memory ** TODO client TG dans le config.edn :spaced:cisco: :LOGBOOK: @@ -235,22 +313,22 @@ SCHEDULED: <2024-02-19 Mon 12:00 .+3w> :END: Ne pas oublier le client de TG est dans le config.edn ** TODO Search within org notes :spaced:org: -SCHEDULED: <2024-02-05 Mon> +SCHEDULED: <2024-10-05 Sat> :PROPERTIES: -:SPACED_REPETITION: 4 +:SPACED_REPETITION: 5 :END: =helm-org-rifle= (~SPC y o s~) ** TODO update ~[/]~ and ~[%]~ in org mode ~SPC m #~ :spaced:org: -SCHEDULED: <2024-02-05 Mon> +SCHEDULED: <2024-07-05 Fri> :PROPERTIES: -:SPACED_REPETITION: 4 +:SPACED_REPETITION: 3 :END: use (~org-update-statistics-cookies~) -** TODO projectile toggle from implementation to test file =SPC p y= :spaced: -SCHEDULED: <2024-02-06 Tue> +** DONE projectile toggle from implementation to test file =SPC p y= :spaced: +SCHEDULED: <2024-06-06 Thu> :PROPERTIES: -:SPACED_REPETITION: 4 +:SPACED_REPETITION: 5 :END: :LOGBOOK: - State "DELEGATED" from "HOLD" [2023-10-23 Mon 11:40] @@ -260,16 +338,16 @@ SCHEDULED: <2024-02-06 Tue> |----------+------+-----+----------+----------------------| | front | 2.65 | 7 | 287.31 | 2021-11-08T21:22:55Z | :END: -** TODO Create inactive Timestamp: ~SPC m d T~ :spaced:org:doom: -SCHEDULED: <2024-02-05 Mon> +** DONE Create inactive Timestamp: ~SPC m d T~ :spaced:org:doom: +SCHEDULED: <2024-06-05 Wed> :PROPERTIES: -:SPACED_REPETITION: 4 +:SPACED_REPETITION: 5 :END: [2020-09-01 Tue 12:13] -** TODO Clone sub tree with time shift :spaced: -SCHEDULED: <2024-02-04 Sun> +** DONE Clone sub tree with time shift :spaced: +SCHEDULED: <2024-06-04 Tue> :PROPERTIES: -:SPACED_REPETITION: 4 +:SPACED_REPETITION: 5 :END: =org-clone-subtree-with-time-shift= * Work :work: @@ -279,3 +357,262 @@ SCHEDULED: <2024-02-04 Sun> - =SPC m s c= =- org-clone-subtree-with-time-shift= #+end_comment +** W11 +*** Friday +**** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-03-15 Fri 09:00> +** W12 +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-03-18 Mon 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-03-19 Tue 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-03-20 Wed 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-03-21 Thu 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-03-22 Fri 09:00> +** W13 +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-03-25 Mon 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-03-26 Tue 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-03-27 Wed 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-03-28 Thu 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-03-29 Fri 09:00> +** W14 +*** CANCELED Morning Tour write down tasks for the day +SCHEDULED: <2024-04-01 Mon 09:00> +:LOGBOOK: +- State "CANCELED" from "TODO" [2024-04-02 Tue 15:16] +:END: +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-02 Tue 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-03 Wed 09:00> +*** CANCELED Morning Tour write down tasks for the day +SCHEDULED: <2024-04-04 Thu 09:00> +:LOGBOOK: +- State "CANCELED" from "TODO" [2024-04-04 Thu 18:28] +:END: +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-05 Fri 09:00> +** W15 +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-08 Mon 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-09 Tue 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-10 Wed 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-11 Thu 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-12 Fri 09:00> +** W16 +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-15 Mon 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-16 Tue 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-17 Wed 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-18 Thu 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-19 Fri 09:00> +** W17 +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-22 Mon 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-23 Tue 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-24 Wed 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-25 Thu 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-26 Fri 09:00> +** W18 +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-29 Mon 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-04-30 Tue 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-05-01 Wed 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-05-02 Thu 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-05-03 Fri 09:00> +** W20 +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-05-13 Mon 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-05-14 Tue 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-05-15 Wed 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-05-16 Thu 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-05-17 Fri 09:00> +** W21 +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-05-22 Wed 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-05-23 Thu 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-05-24 Fri 09:00> +** W22 +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-05-27 Mon 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-05-28 Tue 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-05-29 Wed 09:00> +*** CANCELED Morning Tour write down tasks for the day +SCHEDULED: <2024-05-30 Thu 09:00> +:LOGBOOK: +- State "CANCELED" from "TODO" [2024-05-31 Fri 10:07] +:END: +*** CANCELED Morning Tour write down tasks for the day +SCHEDULED: <2024-05-31 Fri 09:00> +:LOGBOOK: +- State "CANCELED" from "TODO" [2024-05-31 Fri 10:07] +:END: +** W23 +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-03 Mon 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-04 Tue 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-05 Wed 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-06 Thu 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-07 Fri 09:00> +** W24 +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-10 Mon 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-11 Tue 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-12 Wed 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-13 Thu 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-14 Fri 09:00> +** W25 +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-17 Mon 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-18 Tue 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-19 Wed 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-20 Thu 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-21 Fri 09:00> +** W26 +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-24 Mon 09:00> +*** DONE Morning Tour write down tasks for the day +SCHEDULED: <2024-06-25 Tue 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-06-26 Wed 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-06-27 Thu 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-06-28 Fri 09:00> +** W27 +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-01 Mon 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-02 Tue 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-03 Wed 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-04 Thu 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-05 Fri 09:00> +** W28 +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-08 Mon 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-09 Tue 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-10 Wed 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-11 Thu 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-12 Fri 09:00> +** W29 +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-15 Mon 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-16 Tue 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-17 Wed 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-18 Thu 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-19 Fri 09:00> +** W30 +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-22 Mon 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-23 Tue 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-24 Wed 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-25 Thu 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-26 Fri 09:00> +** W31 +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-29 Mon 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-30 Tue 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-07-31 Wed 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-08-01 Thu 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-08-02 Fri 09:00> +** W32 +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-08-05 Mon 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-08-06 Tue 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-08-07 Wed 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-08-08 Thu 09:00> +*** TODO Morning Tour write down tasks for the day +SCHEDULED: <2024-08-09 Fri 09:00> +* TODO [#A] Annuler contrat Roole +SCHEDULED: <2025-01-16 Thu 10:28> DEADLINE: <2025-02-14 Fri 10:27> +[2024-02-16 Fri 15:27] +* TODO Acheter bois +SCHEDULED: <2024-06-27 Thu 10:00> +[2024-04-07 Sun 19:55] +* DONE Histoire de fantômes chinois +SCHEDULED: <2024-05-09 Thu 09:51> +[2024-05-08 Wed 22:50] +* DONE Appeler les poubelles +SCHEDULED: <2024-05-13 Mon 09:30> +[2024-05-11 Sat 20:06] +* DONE Chris Duane JWT +SCHEDULED: <2024-05-14 Tue 10:01> +[2024-05-13 Mon 23:01] +* DONE anime blood c +SCHEDULED: <2024-06-17 Mon 10:13> +[2024-06-16 Sun 13:13] +* [[https://nlnetlabs.nl/projects/unbound/support/][NLnet Labs - Unbound - Support]] +SCHEDULED: <2024-06-27 Thu 10:00> +[2024-06-16 Sun 19:22] +* TODO Élastique de piscine +SCHEDULED: <2024-06-25 Tue 11:27> +[2024-06-21 Fri 11:27] +* DONE Msg Abhiram +SCHEDULED: <2024-06-24 Mon 10:00> +[2024-06-24 Mon 08:42] diff --git a/notes.org.gpg b/notes.org.gpg index aae0eee5..5e82527f 100644 Binary files a/notes.org.gpg and b/notes.org.gpg differ diff --git a/notes/72yo_life_advices.org b/notes/72yo_life_advices.org new file mode 100644 index 00000000..9de2710b --- /dev/null +++ b/notes/72yo_life_advices.org @@ -0,0 +1,53 @@ +:PROPERTIES: +:ID: 5ba2342c-b65c-49e4-b362-5cc3a28f0d14 +:END: +#+Title: 72yo life advices +#+Author: Yann Esposito +#+Date: [2024-03-18] + +- tags :: +- source :: https://old.reddit.com/r/lifehacks/comments/1bgw44k/i_turned_72_today/ + +Here’s 32 things I’ve learned that I hope help you in your journey: + +- It’s usually better to be nice than right. +- Nothing worthwhile comes easy. +- Work on a passion project, even just 30 minutes a day. It compounds. +- Become a lifelong learner (best tip). +- Working from 7am to 7pm isn’t productivity. It’s guilt. +- To be really successful become useful. +- Like houses in need of repair, problems usually don’t fix themselves. +- Envy is like drinking poison expecting the other person to die. +- Don’t hold onto your “great idea” until it’s too late. +- People aren’t thinking about you as much as you think. +- Being grateful is a cheat sheet for happiness. (Especially today.) +- Write your life plan with a pencil that has an eraser. +- Choose your own path or someone will choose it for you. +- Never say, I’ll never… +- Not all advice is created equal. +- Be the first one to smile. +- The expense of something special is forgotten quickly. The experience lasts a lifetime. Do it. +- Don’t say something to yourself that you wouldn’t say to someone else. +- It’s not how much money you make. It’s how much you take home. +- Feeling good is better than that “third” slice of pizza. +- Who you become is more important than what you accomplish. +- Nobody gets to their death bed and says, I’m sorry for trying so many things. +- There are always going to be obstacles in your life. Especially if you go after big things. +- The emptiest head rattles the loudest. +- If you don’t let some things go, they eat you alive. +- Try to spend 12 minutes a day in quiet reflection, meditation, or prayer. +- Try new things. If it doesn’t work out, stop. At least you tried. +- NEVER criticize, blame, or complain. +- You can’t control everything. Focus on what you can control. +- If you think you have it tough, look around. +- It's only over when you say it is. +- One hand washes the other and together they get clean. Help someone else. + +If you're lucky enough to get up to my age, the view becomes more clear. +It may seem like nothing good is happening to you, or just the opposite. +Both will probably change over time. +I'm still working (fractionally), and posting here, because business and people +are my mojo. +I hope you find yours. +Onward! +Louie diff --git a/notes/ai_and_death_of_the_web_as_we_know_it.org b/notes/ai_and_death_of_the_web_as_we_know_it.org new file mode 100644 index 00000000..056ad2a5 --- /dev/null +++ b/notes/ai_and_death_of_the_web_as_we_know_it.org @@ -0,0 +1,107 @@ +:PROPERTIES: +:ID: 1f142832-05f9-4280-a8ca-aa6f35209f91 +:END: +#+title: AI and Death of the web as we know it +#+Author: Yann Esposito +#+Date: [2024-05-16] + +- tags :: +- source :: + +* Constat + +First, since a few years now, we are experiencing a huge acceleration of the +"enshitification" of the web. +Most of us relied on services and soon, most of these servies will be worse or +completely will not provide the same benefits as before. + +A typical example, as a software engineer we often searched technical knowledge +using google. Quite often we ended up on Stack Overflow, or reddit, or twitter, etc… +Now with the promise of infinite AI Generated +Spam+ SEO content. Most search will +point to a terrible website full of ads, with the additional cost that the +content could not be trusted as it was not just copied from a reliable source, +no, worse, it will be invented by the AI that has a tendency to hallucinate its +answer and pretty often return wrong and even potentially dangerous ones. +Typically, imagine generated recipes, people made some experimentation and the +generated recipe are good to put you to the Hospital if you follow these advises. + +So now, that's it. We are loosing our ability to more or less, trust random +content from the web. +Is this the end? + +Perhaps. + +Is there something we could do about it? + +I think so yes :) +And this problem already is mostly solved using the notion of "Web of Trust". + +Web of Trust is a decentralized system that help you trust resources. +But you have you word to say. For example, if you trust someone for a while and +they change, they start to put horrible ads, AI generated content on their +content. You simply "downvote" or "block" them. All your direct connection of +the network of trust will be impacted by your decision, and if enough people +like you start to dislike the new content. The content of this user will +disappear forever. + +This is a bit like Reddit karma, but instead of the mechanism being centralized +and controlled by a single source. This is distributed on the customers. Some +might enjoy a user, for them that user will have a big note, for other it will +be not enjoyable and his note will be very low. So low, you will almost never be +exposed to the content produced by this user. + +That will probably solve a first issue. Remove from our collective sight all the +SEO spam website/content, etc… + +Now, what about discoverability? Being able to search for content using this new knowledge? +Here we have different multiple solutions: + +1. Still rely on classical search engines but use a browser plugin to filter the + results with only website with a trust value that is high enough +2. Use the "Web of Trust" to the rescue. We could have servers taking care of + downloading the website from the most trusted websites (starting from a few + trusted people) and open source the algorithm so people could spawn that + system on their local computer or host it and provide their server to their friends. + And we will have a very small web at first, but with a quality value that + should be very high as compared to the "Big Web". + +* BONUS + +I think one issue with the "Web of Trust" is the ability for attacker to "steal +an identity" of a trusted producer and produce in its name. +In particular, if the "Web of Trust" simply uses domain names, these are know to +rot easily, and could be taken. + +For this, one simple but efficient mechanism will simply be to cryptographically +sign your content. +So instead of having a "web of trust" that is using domain name, we could +additionally add GPG signatures. This could be added in the header of the HTML +pages, this way a browser that will be "Web of Trust"-friendly could display a +green mark saying "Hey this content was really produced by this user with this +value of trust". + +This would probably change how we use the web, because it will forces us to +"vote" time to time. Probably with more and more subtleties. For example with +different level of like/dislike in order to be able to completely block some +sources, and not just make them less prominent. + +* Last but not least some wise words from Socrates + +Don't forget what Socrates has to say about the invention of writing: + +"For this invention will produce forgetfulness in the minds of those who learn +to use it, because they will not practice their memory. +Their trust in writing, produced by external characters which are no part of +themselves, will discourage the use of their own memory within them. +You have invented an elixir not of memory, but of reminding; and you offer your +pupils the appearance of wisdom, not true wisdom, for they will read many things +without instruction and will therefore seem [275b] to know many things, when +they are for the most part ignorant and hard to get along with, since they are +not wise, but only appear wise." + +We put our confidence in a shared memory, it was great knowledge sharing. +And with the recent changes it appears we will need to regress and use our +memory, read books, read man pages, go to official documentation website at +best. + +I feel the potentially single way to solve this issue is perhaps with a "Web of Trust" that will drastically reduce the size of our shared memory. diff --git a/notes/assets/Déclaration/2020-05-30_10-32-18_2020-05-19_13-37-48_cisco_systems_france__-_pre__sentation_rsu-so_-_v.13.05.19.pdf b/notes/assets/Déclaration/2020-05-30_10-32-18_2020-05-19_13-37-48_cisco_systems_france__-_pre__sentation_rsu-so_-_v.13.05.19.pdf deleted file mode 100644 index d9473d0b..00000000 Binary files a/notes/assets/Déclaration/2020-05-30_10-32-18_2020-05-19_13-37-48_cisco_systems_france__-_pre__sentation_rsu-so_-_v.13.05.19.pdf and /dev/null differ diff --git a/notes/assets/Déclaration/2020-05-30_10-32-44_2020-05-19_13-37-48_cisco_systems_france__-_pre__sentation_rsu-so_-_v.13.05.19.pdf b/notes/assets/Déclaration/2020-05-30_10-32-44_2020-05-19_13-37-48_cisco_systems_france__-_pre__sentation_rsu-so_-_v.13.05.19.pdf deleted file mode 100644 index d9473d0b..00000000 Binary files a/notes/assets/Déclaration/2020-05-30_10-32-44_2020-05-19_13-37-48_cisco_systems_france__-_pre__sentation_rsu-so_-_v.13.05.19.pdf and /dev/null differ diff --git a/notes/assets/Déclaration/2020-06-01_15-57-56_article-83-PreRetraite.pdf b/notes/assets/Déclaration/2020-06-01_15-57-56_article-83-PreRetraite.pdf deleted file mode 100644 index 599b7ea3..00000000 Binary files a/notes/assets/Déclaration/2020-06-01_15-57-56_article-83-PreRetraite.pdf and /dev/null differ diff --git a/notes/blog.org b/notes/blog.org new file mode 100644 index 00000000..015f103f --- /dev/null +++ b/notes/blog.org @@ -0,0 +1,10 @@ +:PROPERTIES: +:ID: a5be1daf-1010-428f-a30f-8faf95c1a42f +:END: +#+title: blog +#+Author: Yann Esposito +#+Date: [2024-06-27] + +- tags :: +- source :: + diff --git a/notes/budget_famille.org b/notes/budget_famille.org new file mode 100644 index 00000000..61c0b799 --- /dev/null +++ b/notes/budget_famille.org @@ -0,0 +1,22 @@ +:PROPERTIES: +:ID: 6899703d-51cb-49e6-a16b-30ae460ed055 +:END: +#+title: Budget Famille +#+Author: Yann Esposito +#+Date: [2024-05-18] + +- tags :: +- source :: + +* 2024-05-18 + +Courant: LCL 200 + BP 920 +Epargne: LA: 5780 + PEL: 9310 + LA: f420 +RSU/ESPP: Dispo; 6020 (136 x 48$) + A venir: 75k + +Credits: maison 429k + appart 110k diff --git a/notes/chien_espoir_handicap_ag.org b/notes/chien_espoir_handicap_ag.org index 3602c578..04a5f6cf 100644 --- a/notes/chien_espoir_handicap_ag.org +++ b/notes/chien_espoir_handicap_ag.org @@ -1,24 +1,30 @@ :PROPERTIES: :ID: 7a934ca5-31c0-4cf8-8a86-1efa89904b31 :END: -#+title: Chien Espoir Handicap AG +#+title: Chien Espoir Handicap AG/Reunions #+Author: Yann Esposito -#+Date: [2023-06-13] +#+Lang: fr - tags :: [[id:c26339f6-e0bc-40e3-8fe3-94e4b41b61b0][chien d'assistance]] - source :: * Contacts +:PROPERTIES: +:EXPORT_FILE_NAME: Contacts +:END: -| Nom | email | telephone | addresse | -|-----------------------------+---------------------------------+------------+--------------------------------------------| -| Matthieu Delpeuch | chien.espoir.handicap@gmail.com | 0‭651597922‬ | Antibes | -| Mélodie Durand | melody.durandbernard@gmail.com | 0664335877 | 138 impasse Camatte 06410 Biot | -| Claire Mainguené Costa-Foru | claire.mainguene@wanadoo.fr | 0661092711 | 11 route du Mont Agel, 06320, La Turbie | -| Lionel Rebière | lrebi@yahoo.com | 0686263291 | 13320, Bouc-bel-Air | -| Joëlle Rebière | | 0637629720 | | -| Krystelle Esposito | krystelle.esposito@gmail.com | 0662203951 | 12, allée du Fer à Cheval, 13500 Martigues | -| Yann Esposito | yann@esposito.host | 0650845271 | 12, allée du Fer à Cheval, 13500 Martigues | +| Nom | email | telephone | addresse | +|-----------------------------+---------------------------------+----------------+--------------------------------------------| +| Matthieu Delpeuch | chien.espoir.handicap@gmail.com | 0‭651597922‬ | Antibes | +| Mélodie Durand | melody.durandbernard@gmail.com | 0664335877 | 138 impasse Camatte 06410 Biot | +| Claire Mainguené Costa-Foru | claire.mainguene@wanadoo.fr | 0661092711 | 11 route du Mont Agel, 06320, La Turbie | +| Lionel Rebière | lrebi@yahoo.com | 0686263291 | 13320, Bouc-bel-Air | +| Joëlle Rebière | | 0637629720 | | +| Krystelle Esposito | krystelle.esposito@gmail.com | 0662203951 | 12, allée du Fer à Cheval, 13500 Martigues | +| Yann Esposito | yann@esposito.host | 0650845271 | 12, allée du Fer à Cheval, 13500 Martigues | +| Clara Toti | cynoschool06@outlook.fr | 0665636981 | 2 ruelle du soleil, 06830, Gilette | +| Milena Molesini | milenamolesini@gmail.com | | | +| Céline Dragon | celine.dragon@free.fr | 0622404831 | | | username | password | @@ -30,21 +36,25 @@ | joelle | anleika | | yann | annapo | | krystelle | annapo | +| clara | ceh2024 | #+begin_comment htpasswd -b -c htpasswd_chien.tmp.1 matthieu ginette htpasswd -b -c htpasswd_chien.tmp.2 melodie flondine htpasswd -b -c htpasswd_chien.tmp.3 claire lacie -htpasswd -b -c htpasswd_chien.tmp.4 lionel anleika -htpasswd -b -c htpasswd_chien.tmp.5 joelle anleika +htpasswd -b -c htpasswd_chien.tmp.4 lionel leika +htpasswd -b -c htpasswd_chien.tmp.5 joelle leika htpasswd -b -c htpasswd_chien.tmp.6 yann annapo htpasswd -b -c htpasswd_chien.tmp.7 krystelle annapo +htpasswd -b -c htpasswd_chien.tmp.8 clara ceh2024 cat htpasswd_chien.tmp.* > htpasswd_chien -rm +rm htpasswd_chien.tmp.* #+end_comment - * [2023-06-13 Tue] +:PROPERTIES: +:EXPORT_FILE_NAME: 2023-06-13 +:END: - Matt - Melo @@ -80,7 +90,9 @@ Prévoir entretient avec Melo. - jeune croisé labrador * [2023-10-03 Tue] - +:PROPERTIES: +:EXPORT_FILE_NAME: 2023-10-03 +:END: ** Lettre Val ** Nouveau Contrat @@ -100,6 +112,9 @@ Livret Captt. Ancienne médecin. Peut-être remplacer Melo. * [2023-11-23 Thu] +:PROPERTIES: +:EXPORT_FILE_NAME: 2023-11-23 +:END: - Présentation Médecin - Présentation de tous @@ -124,6 +139,9 @@ Ajouter des binômes: - Relire et check logo * [2024-01-12 Fri] +:PROPERTIES: +:EXPORT_FILE_NAME: 2024-01-12 +:END: ** Personnes presentent: - Matthieu - Clara @@ -275,3 +293,350 @@ Ajouter des binômes: - Changer les couleurs du site web. - Ajouter le périmetre d'accueil sur le site web. - Ajouter un lien pour faire un don. + +* [2024-02-16 Fri 19:05] +:PROPERTIES: +:EXPORT_FILE_NAME: 2024-02-16 +:END: +** Personnes présentes +- Matthieu Delpeuch +- Mélodie Durand +- Lionel Rebière +- Clara Toti +- Krystelle Esposito +** Compte Rendu + +Les points suivants ont été abordés: + +- État des comptes banquaires ; environ 4000€ +- Proposition de fournir un harnais de guidage avec dossard à chaque chien + d'assistance de l'association afin d'offrir une meilleure visibiblité à + l'association ainsi qu'une unité. + Nous allons demander des devis +- Information donnée au groupe de dons faits au bénéfice de l'association. + Un provenant d'un membre bénéficiaire, un autre d'un particulier. +- Matthieu et Clara ont fait un retour sur la 1ere rencontre en audioconférence + d'un éventuel bénéficiaire. Ce premier retour et plutôt positif ; la personne + a des attentes raisonnables et n'est pas novice dans l'univers du chien. + De plus elle est consciente des spécificités des animaux de refuges et y a + déjà adopté son actuel chien de compagnie. + L'entourage du demandeur semble aidant et impliqué. + Matthieu et Clara soulignent quand même que la personne a quelques notions + obsolètes de l'éducation canine mais qu'il semble assez ouvert et motivé pour + s'adapter aux nouvelles situations. + Lionel et Mélodie demandent si cette personne a les moyens d'entretenir et de + financer un nouveau chien. + Cette question sera abordée lors des prochains échanges si l'association + décide de poursuivre le processus d'intégration au programme de formation. + La décision a été prise à l'unanimité de poursuivre avec ce demandeur. +- Clara soulève le problème du premier questionnaire d'accueil qui est trop + orienté sur l'autisme. Certains points ne correspondent pas à tous les + handicaps. Après discussion il est décidé que Matthieu et Clara s'occuperont + des questions concernant les spécificité éducatives et environnementales des + chiens et Mélodie et Christelle se pencheront sur la partie plus générale du + questionnaire. +- Une discussion a eu lieu sur les moyens de trouver de nouveaux financements. + As-t-on vraiment besoin d'aller chercher plus an prenant en considérations que + celà demande beaucoup de temps et d'investissement aux membres et que de plus + la plupart des financement peuvent être soumis à des obligations de résultats. + La question reste ouverte pour les futures réunions. + +** Actions +- [ ] demander des devis pour les harnais et dossards + +* [2024-03-15 Fri] +:PROPERTIES: +:EXPORT_FILE_NAME: 2024-03-15 +:END: +** Personnes présentes +- Claire +- Clara +- Yann +- Krystelle +** Notes +@Claire: quelle est la pathologie douloureuse de l'éventuel bénéficiaire. +@Clara: nous verrons si on pourra allez revoir la personne et être accompagné +par Claire. +** Actions +Trouver une nouvelle date. +* [2024-04-12 Fri] +:PROPERTIES: +:EXPORT_FILE_NAME: _2024-04-12_Fri_ +:END: + +** Personnes présentes +Matthieu, Claire, Clara, Lionel, Krystelle, Yann. +** Points +*** Dossard +Homogénéiser le dossard. +Au niveau des financements, il faut être une association serieuse et carrée. +Une autre asso, pour rentrer il faut payer une somme pour prendre en charge le +matériel, le premier mois de croquettes, etc… + +Disons 500€: Chien, dossard, croquettes, quelques cours d'éducation. + +Peux-t-on recevoir de l'argent (pas avec une association a but non lucratif) + +*** Questionnaire + +Questionnaire plus général que sur les troubles autistiques. + +* [2024-05-16 Thu] +:PROPERTIES: +:EXPORT_FILE_NAME: 2024-05-16 +:END: + +** Personnes présentes +:PROPERTIES: +:EXPORT_FILE_NAME: Personnes_pr_sentes +:END: +- Céline +- Clara +- Krystelle +- Matt +- Milena +- Yann + +** TL;DR + +1. Modifier le harnais pour agrandir le logo, et changer la police +2. refus du Monsieur de la réunion d'hier pour devenir bénéficiaire +3. une rencontre demain avec Matthieu, Céline et le bénéficiaire potentiel +4. Création d'un Google drive pour partager les documents +5. Création de cartes à imprimer pour que les membres du bureaux puisse les + donner pour permettre aux personnes de faire des dons et de contacter + facilement l'association +6. Modifier légèrement la proposition 2 des cartes pour que le rendu à + l'impression soit plus lisible. + +** Dossard + +- Mettre tout le texte en capitale et agrandir le logo et le changer. + Changer la Police utiliser la police sans serif Helvetica. + +** Réunion hier + +@Matthieu: +Monsieur 50aine, ils habitent Nice, centre ville, pas de parc. +Il veut un chien de compagnie mais avec peu de demande technique. +Environnement; 9ème étage en appartement, 2 lapin + +Mauvais feeling avec elle. Ils font un peu débordés. +Le chien sera brut et il faudra travailler sur le chien. + +Lui très motivé. Ils ont pris un vieux chien en refuge. +Il est sorti 2x/j. +Il faut qu'un chien d'assistance sorte plus souvent. + +@Clara: pas de crainte de Matt. +J'ai pas envie de placer un chien dans cet environnement. +Zone d'immeubles, grande avenue, presque centre ville, que transport en commun. +Le parc le plus proche en fauteuil roulant 20min. +Compliqué en tant que besoin. +Les moyens financier et humain sont peut-être insuffisants. +L'appartement pas adapté au handicap du monsieur. +Pas d'aide pour avoir le fauteuil électrique, don. +Beaucoup d'animaux, pas super propre (chat, lapins). +Les enfants sont partis, si il est hospitalisé, personne pour s'occuper des +animaux. +Mais pas de système pour s'occuper des animaux en cas de problème. + +@Milena: coté humain, je pense que ça le fait. +Ils sont dans une forme d'écoute et de respect mutuel. +Je rejoins sur le fait qu'ils sont isolés. +Et sur le reste de l'environnement c'est vous qui savez. + +@Clara: Il faut mettre une femelle assez grande. Et pas trop jeune. Ce qui fait +trop de contrainte pour trouver le chien. + +@Matt: environnement exiguë. + +@Milena: la demande n'est pas claire. +Il veut continuer à avoir un chien avec les avantages de pouvoir rentrer dans un +magasin. Est-ce une demande pertinente. +Elle est légitime, mais pas forcément pertinente. + +@Clara: Le fait d'avoir un chien l'aide à sortir. +En terme de besoin, il n'y a pas de besoin technique. + +@Milena: Il servira à la motivation, mais ne favorise pas plus d'autonomie. + +@Clara: peut rassurer aussi la conjointe. + +@Matt: Avec toutes les contraintes, on est obligé d'aller vers une +certification. +Mais je ne pense pas que l'environnement et le profil humain s'y prêtent. + +@Milena: Légitime mais est-elle pertinente pour l'asso ? + +@Krystelle: ça me dérange de placer un chien dans un environnement pas forcément adapté. +Pour avoir accompagner pour les démarches, c'est beaucoup de temps sur les temps +de libre pour travailler. +Ce n'est pas qu'1h par semaine mais beaucoup plus. + +@Matt: On leur a dit, mais de ce que je ressens, j'ai la sensation le monsieur a +tellement envie qu'il a dit oui mais il a pas conscience du travail qui a à faire +sur le chien. +On vu le problème avec Zucco et quand il arrive le chien, mais le chien il a +gratté, il a mangé, il aboie, etc… +Mais ils ont tellement un amour des animaux ils sont aveuglé du travail qui a +derrière. +Le monsieur n'est plus maître chien depuis longtemps. +Je vais plus tendre vers le non. + +@Milena: pour la motivation, il n'y aura de surprise. +Mais je te rejoins au niveau de l'organisation. +J'émets un doute. + +@Clara: aussi l'entretient, le financier. Ils ont pas les moyens de faire mieux. + +@Matt: avec Céline on a un chien à voir pour un bénéficiaire, on va peut-être +répondre favorablement. +Moi j'ai une demande, à Fréjus, j'attendais qu'on voit le monsieur d'hier vu +qu'il avait la priorité. +Je prendrai RDV avec la jeune femme de Fréjus. + +@Krystelle: Faire rencontrer des personnes d'une famille qui a fait famille +d'accueil pour expliquer les réalités. Peut-être que ça peut être un petit peu +plus parlant. + +@Matt: au début, les 1er RDV avec Mélodie qui a un coté très humain qui fait. +Si vous pouvez être présent avec grand plaisir. + +@Krystelle: si c'est dans mes horaires je me libère. + +@Matt: Oui ça serait très bien. + +@Milena: Peut-être faire un visio séparée. + +@Krystelle: Celà permettrait d'expliquer des réalités pour avoir des une vision +réaliste de ce que représente être un bénéficiaire de l'association. + +@Matt: oui c'est une bonne idée. + +** Bénéficiaire 2 + +@Celine: de l'extérieur, les besoins du chien. +Le monsieur ne peut pas supporter d'être sans chien. +Cognitivement c'est compliqué mais il est volontaire. +Sa femme est très volontaire. +Je lui est même proposer en cas de refus de chien d'assistance d'au moins venir +pour l'aider à gérer le chien. +C'est un golden qui est très actif. + +@Matt: ils sont très anxieux. + +@Celine: ils avaient un Beagle. + +@Celine: il a besoin qu'il allume les lumières, qu'il marche au pied. + +@Clara: quel handicap? Il est en fauteuil et paralysé d'un coté. + +@Celine: ils partent régulièrement prendre l'avion avec lui. +Hémiplégie. Ils essayent de faire des choses. +Ce monsieur à une aide qui vient chez lui. +On pourrait une fois de temps en temps à domicile. +La personne peut l'amener en voiture. + +@Clara: ça semble un travail qui se fait avec de la motivation. + +@Matt: quel âge le chien? + +@Celine: 7 ou 9 mois. +Parfois ils ont pris de mauvaises habitudes, il faudra l'éduquer. +L'environnement est bon. + +@Milena: seule limite, passer au delà des anxiétés et changer ses habitudes. + +@Clara: ce sont des problématiques qu'on a dans le quotidien. Donc rien d'inhabituel. + +@Celine: le chien ne comprends pas tout, je pense que la dame sera là pour l'accompagner. + +@Milena: c'était difficile le jour du RDV pour le monsieur il revenait de l'hôpital. + +@Celine: on sent qu'il y a de la bonne volonté. + +@Clara: ils ont un système d'aide. + +@Krystelle: ils sont d'où ? + +@Celine: de Ventabren + + +** Actions +- Clara; va faire le Google drive +- Clara; nouvelles cartes, soit changer le vert, soit utiliser des fontes + blanches sur le vert. +- Clara; pour les dossards, renvoyer le logo pour agrandir et changer la police +- Clara: cartes de contact pour l'association +- Krystelle & Yann; s'occuper du harnais (changer la police et agrandir le log) +- Matt; mail de refus pour le rdv d'hier +- Celine & Matt; réunion demain 18h + + +** [2024-06-12 Wed] + +*** Personnes présentes + +- Matt +- Lionel +- Claire +- Clara +- Krystelle +- Yann +- Céline +- Milena + +*** Sujets + +@Matt +Un refus la semaine précédente + +@Matt +Rencontrer des gens avec Céline, ils ont déjà un chien, Céline s'en occupera. +Renvoyer un contrat. +Bénéficiaire Douglas, le chien s'appelle Douglas. + +@Matt +Addresse de l'asso est l'ancienne addresse perso. +Est-ce que je la domicilie chez mes parents ? + +Décision: oui chez les parents, reste dans le 06. + +@Matt +Valeine, 35 ans. +Visio avec une bénéficiaire de Fréjus, qui a été amputée. + +@Milena +Plutôt positif en terme d'environnement et profil pour moi. On était pas sûr de +jusqu'où va son handicap. Toute une partie paralysée. +Elle a déjà le chien. +Chien doit faire rapport d'objet. +Rapport au sol. +Peu d'attente sur les capacités du chien. +Peut-être que le chien n'ira pas. + +@Celine +Est-ce qu'il y a besoin de faire des comptes rendus. + +@Matt +Gamin sera certifié cet été. +Les derniers temps, on suit le chien 2x par mois. +Ralonger le temps entre les scéances pour autonomiser et pas avoir trop de frais +dans l'asso. +Il faudrait expliquer cela pour les bénéficiaires. + +@Lionel +Factures Educ, Psy. +@Matt 3656€, de hello asso. + +@Matt dossard validé fond vert clair, texte noir. + +@Krystelle: Dimensions du chien. + +*** Actions +- Matt: changer l'addresse de l'asso à celle de ses parents +- Yann: Changer l'addresse de l'asso sur le site; 28 Boulevard Pointcarré, 06160, Juan les Pins +- Céline: envoyer un message à Norbert pour demander les dimensions du chien. +- Tous: Checker le contrat et le valider +- Tous: Checker le compte rendu de Valeine, RDV si besoin diff --git a/notes/cisco_custom_roles.html b/notes/cisco_custom_roles.html deleted file mode 100644 index bc26adb2..00000000 --- a/notes/cisco_custom_roles.html +++ /dev/null @@ -1,437 +0,0 @@ - - - - - - - - Custom Roles - - - - - -
-

Custom Roles

-

XDR IROH

-

Yann Esposito

-

[2023-10-03 Tue 15:30]

-
-

Current state

-

Listing Roles (already by -org)

-

GET /iroh/profile/roles

-

Provide a data structure with describing all roles for an Org:

- -

⚠ Role ≠ Permissions

-

The role associated to a user do not necessarily matches the user -permission.

-

The role is only one of the component to use to determine a token or -even a user permissions. The permissions are represented by -scopes which are computed using:

- -

⚠ Role ≠ Permissions (Tokens)

- -

Current response for an -XDR-enabled org

-
GET /iroh/profile/roles
-{:admin {:english {:only-role-name "administrator",
-                   :adjective "an",
-                   :only-role-name-capitalized "Administrator",
-                   :english-role-name "an administrator"},
-         :role-name "Administrator",
-         :role-id "admin",
-         :role-description "An admin of users.",
-         :visibility "public"},
- :sat {:english {:only-role-name "security analyst",
-                 :adjective "a",
-                 :only-role-name-capitalized "Security Analyst",
-                 :english-role-name "a security analyst"},
-       :role-name "Security Analyst",
-       :role-id "sat",
-       :role-description
-       "No account admin. SXO read only + run existing workflows.",
-       :visibility "public"},
- :user {:english {:only-role-name "incident responder",
-                  :adjective "an",
-                  :only-role-name-capitalized "Incident Responder",
-                  :english-role-name "an incident responder"},
-        :role-name "Incident Responder",
-        :role-id "user",
-        :role-description
-        "This is the closest to current user role:- no account administration- cannot create/change modules- SXO read only, but can run and edit workflows",
-        :visibility "public"}}
-

Current response for an -SX-only org

-
GET /iroh/profile/roles
-{:admin {:english {:only-role-name "admin",
-                     :adjective "an",
-                     :only-role-name-capitalized "Admin",
-                     :english-role-name "an admin"},
-           :role-name "Admin",
-           :role-id "admin",
-           :role-description "An admin of users.",
-           :visibility "public"},
-   :user {:english {:only-role-name "user",
-                    :adjective "a",
-                    :only-role-name-capitalized "User",
-                    :english-role-name "a user"},
-          :role-name "User",
-          :role-id "user",
-          :role-description "A standard user.",
-          :visibility "public"}}
-

What the API already support

- -

What the API does not -support

- -

Expected Changes

-

New API: (exhaustive scopes -list)

-

Exhaustive list of scopes as a forest structure

-
[{:scope "global-intel"
-  (optional :description) ,,,
-  :accessors ["read"]
-  :sub-scopes [{:scope "global-intel/incident"
-                :accessors ["read"]}
-               {:scope "global-intel/sighting"
-                :accessors ["read"]}
-               ,,,]}
- {:scope "private-intel"
-  (optional :description) ,,,
-  :accessors ["rw","read","write"]
-  :sub-scopes [{,,,}]}]
-

New API (maybe?)

-

Expose only a subset of scopes aliases pre-negociated with UX/UI/Doc -team:

-
[{:scope-alias "threat-hunt"
-  :scopes ["enrich/observables/observe:read","inspect","investigation"]
-  :description ,,,,}
- {:scope-alias "incidents"
-  :scopes ["private-intel","global-intel:read"]
-  :description ,,,}
- ,,, ]
-

New API: CRUD+Search

-

API to manage new custom roles

-
(s/defschema NewRole
-  {:role-name        s/Str
-   :role-description s/Str
-   :provided-scopes  Scopes})
-
-(s/defschema Role
-  (st/merge NewRole
-            {:id s/Str
-             :created-at Date
-             :updated-at Date}))
-

Existing APIs

-

The GET /iroh/profile/roles will look -like today + added the new custom roles that will look like:

-
{:admin ...
- :sat ...
- :user ...
- :role-d394db9e-613f-11ee-aff9-325096b39f47
- {:role-name "My Company Custom Role"
-  :role-description "This is a role that is read only except for workflows"
-  :role-id :role-d394db9e-613f-11ee-aff9-325096b39f47
-  :visibility "org"
-  :associated-scopes #{"inspect:read" "ao" "insights:read" "profile:read"}}
-
- :role-8891b9f4-6140-11ee-8e1a-325096b39f47
- {:role-name "Manager"
-  :role-description "Only for Sam who manage this team but should not directly act"
-  :role-id :role-8891b9f4-6140-11ee-8e1a-325096b39f47
-  :visibility "org"
-  :associated-scopes #{"inspect:read" "ao:read" "insights:read" "profile:read" "users" "profile"}}}
- -

Introduce sub-accessors -(maybe?)

-

Today: read, write

-
inspect = inspect:rw
-        = inspect:read + inspect:write.
-
-

Tomorrow: introduce read:get, read:search, -write:create, write:update, -write:delete, write:execute.

-

Equivalence of new accessors

-
rw = read + write
-
-read  = read:get      # GET by id
-      + read:search   # GET/POST search entities
-write = write:create  # POST create new entity
-      + write:update  # PUT/PATCH
-      + write:delete  # DELETE
-      + write:execute # POST to trigger action
-

Most important points

- -

Multiple Roles

-

Expect the role to be a sorted comma separated role ids like; -admin,role-344,sat,user (which would be equivalent to -admin here) in the tokens and not a list to prevent -breaking changes. But it will probably be a list in the -/whoami response.

- - diff --git a/notes/cisco_custom_roles.tex b/notes/cisco_custom_roles.tex deleted file mode 100644 index 5e183569..00000000 --- a/notes/cisco_custom_roles.tex +++ /dev/null @@ -1,269 +0,0 @@ -% Created 2023-10-04 Wed 14:01 -% Intended LaTeX compiler: pdflatex -\documentclass[11pt]{article} -\usepackage[utf8]{inputenc} -\usepackage[T1]{fontenc} -\usepackage{graphicx} -\usepackage{longtable} -\usepackage{wrapfig} -\usepackage{rotating} -\usepackage[normalem]{ulem} -\usepackage{amsmath} -\usepackage{amssymb} -\usepackage{capt-of} -\usepackage{hyperref} -\author{Yann Esposito} -\date{\textit{[2023-10-03 Tue 15:30]}} -\title{Custom Roles\\\medskip -\large XDR IROH} -\hypersetup{ - pdfauthor={Yann Esposito}, - pdftitle={Custom Roles}, - pdfkeywords={}, - pdfsubject={}, - pdfcreator={Emacs 29.1 (Org mode 9.7)}, - pdflang={English}} -\begin{document} - -\maketitle -\section{Current state} -\label{sec:org5577c77} -\subsection{Listing Roles (already by org)} -\label{sec:org3475552} - -\texttt{GET /iroh/profile/roles} - -Provide a data structure with describing all roles for an Org: - -\begin{itemize} -\item 3 roles for XDR (admin, user, sat) -\item 2 roles for SX (admin, user) -\end{itemize} -\subsection{⚠ Role ≠ Permissions} -\label{sec:org45793d5} - -The role associated to a user do not necessarily matches the user permission. - -The role is only one of the component to use to determine a token or even a user permissions. -The permissions are represented by \emph{scopes} which are computed using: - -\begin{itemize} -\item the user role -\item the org properties (activated or not, XDR or not etc…) -\item entitlements (not in use but will probably be the case in the future) -\end{itemize} -\subsection{⚠ Role ≠ Permissions (Tokens)} -\label{sec:org0374daf} - -\begin{itemize} -\item the user scopes -\item as well as the client scopes -\item as well as the scopes requested during the OAuth2 authorization flow -\end{itemize} -\subsection{Current response for an XDR-enabled org} -\label{sec:orga98ced4} - -\begin{verbatim} -GET /iroh/profile/roles -{:admin {:english {:only-role-name "administrator", - :adjective "an", - :only-role-name-capitalized "Administrator", - :english-role-name "an administrator"}, - :role-name "Administrator", - :role-id "admin", - :role-description "An admin of users.", - :visibility "public"}, - :sat {:english {:only-role-name "security analyst", - :adjective "a", - :only-role-name-capitalized "Security Analyst", - :english-role-name "a security analyst"}, - :role-name "Security Analyst", - :role-id "sat", - :role-description - "No account admin. SXO read only + run existing workflows.", - :visibility "public"}, - :user {:english {:only-role-name "incident responder", - :adjective "an", - :only-role-name-capitalized "Incident Responder", - :english-role-name "an incident responder"}, - :role-name "Incident Responder", - :role-id "user", - :role-description - "This is the closest to current user role:- no account administration- cannot create/change modules- SXO read only, but can run and edit workflows", - :visibility "public"}} -\end{verbatim} -\subsection{Current response for an SX-only org} -\label{sec:org8122353} - -\begin{verbatim} -GET /iroh/profile/roles -{:admin {:english {:only-role-name "admin", - :adjective "an", - :only-role-name-capitalized "Admin", - :english-role-name "an admin"}, - :role-name "Admin", - :role-id "admin", - :role-description "An admin of users.", - :visibility "public"}, - :user {:english {:only-role-name "user", - :adjective "a", - :only-role-name-capitalized "User", - :english-role-name "a user"}, - :role-name "User", - :role-id "user", - :role-description "A standard user.", - :visibility "public"}} -\end{verbatim} -\subsection{What the API already support} -\label{sec:orgc601aac} - - -\begin{itemize} -\item list all roles for every Org -\item change the role of a user -\item support roles during invitation and Org access request -\item expose a permissions endpoint to check permission access independently of the role -\item read/write access restriction -\item fine grained \emph{resource} target in the scopes \texttt{enrich} → \texttt{enrich/observables/observe:write} -\end{itemize} -\subsection{What the API does not support} -\label{sec:orga19776c} - -\begin{itemize} -\item No support for create+update but not delete. -\item No support for multiple roles (not sure what it means yet) -\item No support for custom role creation (obviously) -\begin{itemize} -\item No scopes API for roles -\end{itemize} -\end{itemize} -\section{Expected Changes} -\label{sec:org591e358} -\subsection{New API: (exhaustive scopes list)} -\label{sec:orgad4cfdd} - -Exhaustive list of scopes as a forest structure - -\begin{verbatim} -[{:scope "global-intel" - (optional :description) ,,, - :accessors ["read"] - :sub-scopes [{:scope "global-intel/incident" - :accessors ["read"]} - {:scope "global-intel/sighting" - :accessors ["read"]} - ,,,]} - {:scope "private-intel" - (optional :description) ,,, - :accessors ["rw","read","write"] - :sub-scopes [{,,,}]}] -\end{verbatim} -\subsection{New API (maybe?)} -\label{sec:org7dbeae2} - -Expose only a subset of scopes aliases pre-negociated with UX/UI/Doc team: - -\begin{verbatim} -[{:scope-alias "threat-hunt" - :scopes ["enrich/observables/observe:read","inspect","investigation"] - :description ,,,,} - {:scope-alias "incidents" - :scopes ["private-intel","global-intel:read"] - :description ,,,} - ,,, ] -\end{verbatim} -\subsection{New API: CRUD+Search} -\label{sec:orgc22dbdb} - -API to manage new custom roles - -\begin{verbatim} -(s/defschema NewRole - {:role-name s/Str - :role-description s/Str - :provided-scopes Scopes}) - -(s/defschema Role - (st/merge NewRole - {:id s/Str - :created-at Date - :updated-at Date})) -\end{verbatim} -\subsection{Existing APIs} -\label{sec:org8b0636c} - -The \texttt{GET /iroh/profile/roles} will look like today + added the new custom roles -that will look like: - -\begin{verbatim} -{:admin ... - :sat ... - :user ... - :role-d394db9e-613f-11ee-aff9-325096b39f47 - {:role-name "My Company Custom Role" - :role-description "This is a role that is read only except for workflows" - :role-id :role-d394db9e-613f-11ee-aff9-325096b39f47 - :visibility "org" - :associated-scopes #{"inspect:read" "ao" "insights:read" "profile:read"}} - - :role-8891b9f4-6140-11ee-8e1a-325096b39f47 - {:role-name "Manager" - :role-description "Only for Sam who manage this team but should not directly act" - :role-id :role-8891b9f4-6140-11ee-8e1a-325096b39f47 - :visibility "org" - :associated-scopes #{"inspect:read" "ao:read" "insights:read" "profile:read" "users" "profile"}}} -\end{verbatim} -\begin{itemize} -\item \texttt{visibility}; \texttt{org} for custom, \texttt{public} for global. -\item \texttt{associated-scopes}; only for role management UI -\end{itemize} -\subsection{Introduce sub-accessors (maybe?)} -\label{sec:org6e45fe3} - -Today: \texttt{read}, \texttt{write} - -\begin{verbatim} -inspect = inspect:rw - = inspect:read + inspect:write. -\end{verbatim} - -Tomorrow: introduce \texttt{read:get}, \texttt{read:search}, \texttt{write:create}, \texttt{write:update}, -\texttt{write:delete}, \texttt{write:execute}. -\subsubsection{Equivalence of new accessors} -\label{sec:org312e35c} - -\begin{verbatim} -rw = read + write - -read = read:get # GET by id - + read:search # GET/POST search entities -write = write:create # POST create new entity - + write:update # PUT/PATCH - + write:delete # DELETE - + write:execute # POST to trigger action -\end{verbatim} -\section{Most important points} -\label{sec:org072056b} - -\begin{itemize} -\item Dynamic role \texttt{ids}. \textbf{Must use the API} -\begin{itemize} -\item when you call \texttt{/iroh/profile/whoami} -\item when you look into the JWT -\item \textbf{note}: potentially a list of roles! -\end{itemize} -\item \texttt{associated-scopes} field only useful for the Role Management UI. -\item Use \texttt{/iroh/profile/permissions} -\item can also use \texttt{scopes} claim if present -\end{itemize} -\subsection{Multiple Roles} -\label{sec:org27898f0} - -\begin{itemize} -\item if union of roles for the same user: -Expect the role to be a sorted comma separated role ids like; -\texttt{admin,role-344,sat,user} (which would be equivalent to \texttt{admin} here) -\item if one role per session, then we will use different \texttt{user-id} and thus the role -must appear in the UIs (Registration UI, Org switching, etc…) -\end{itemize} -\end{document} \ No newline at end of file diff --git a/notes/cisco_iroh_client_data_retention.org b/notes/cisco_iroh_client_data_retention.org new file mode 100644 index 00000000..c64b6218 --- /dev/null +++ b/notes/cisco_iroh_client_data_retention.org @@ -0,0 +1,47 @@ +:PROPERTIES: +:ID: b129bbc2-43c7-4ba6-bcba-23fcc45add4f +:END: +#+Title: Cisco IROH Client Data Retention +#+Author: Yann Esposito +#+Date: [2024-06-05] + +- tags :: +- source :: + +* Recommendation + +As a client of XDR API (IROH) you can retrieve the Data Retention policy using +multiple APIs. But the recommended API to use is ~/iroh/profile/whoami~ +(See link in TEST: https://visibility.test.iroh.site/iroh/profile/index.html#/Profile/get_iroh_profile_whoami) + +You should call this API using an IROH access token that you could retrieve +using the refresh token you should already have for your customer. + +Inside this HTTP call, the body of the request should looks like: + +#+begin_src javascript +{ + "user": {...}, + "org": { + ... + "entitlement-summary": { + "tier": {"title": "advantage", ...}, + "extra_data_retention": {...}, + "extra_ingest": {...}, + "techvals": { + "data-retention-in-days": 180, + "data-maximal-size-in-GB": 30, + ... + } + } + } +} +#+end_src + +The recommended method to retrieve the number of days is to use +~org["entitlement-summary"]["techvals"]["data-retention-in-days"]~ value. +Note for some org the entitlement summary will not be provided entirely as some +XDR org do not have any entitlements (beta orgs, test orgs, not yet sync with +PIAM, etc…) + +For these cases we do not provide any default number of day. diff --git a/notes/composable_shell_nix.html b/notes/composable_shell_nix.html deleted file mode 100644 index 0d792059..00000000 --- a/notes/composable_shell_nix.html +++ /dev/null @@ -1,536 +0,0 @@ - - - - - - - - Composable shell.nix - - - - -
-

Composable shell.nix

-

Yann Esposito

-

[2023-02-10 Fri]

-
-
-
tags
-
-nix -
-
-

So I work on a project for which we used Docker to locally run -integration tests. More precisely we used docker-compose to launch different services, -most of them being databases. The project is big enough that we need -many different databases and other services.

-

It's been a while that I am following nix, and in particular I use -nix on macOS to create local development environments. But I never used -NixOS, even if I plan to do so on my remote server. In fact, I use nix -on a very old Linux distro to run recent softwares.

-

Anyway, after Docker started to change its licensing on macOS I -wanted to get rid of it. In fact, even before the licensing issue, I -wanted to get rid of docker for Mac.

-

So I tried many time to replace docker-compose by nix. And even if I am interested in nix I never -really dug into it. So my knowledge about it is incomplete and -imprecise. But I know just enough to be able to start write script with -nix taking care of dependencies, and similarly, I can write quick and -dirty shell.nix for all my personal -projects. Recently I started to add flake.nix files around too.

-

So here is how to easily replace docker-compose with nix. Which -should also compose.

-

nix-shell-fu level 1 lesson

-

Let's start with a basic shell.nix -example:

-
{ pkgs ? import (fetchTarball https://github.com/NixOS/nixpkgs/archive/22.11.tar.gz) {} }:
-with pkgs: mkShell
-  { buildInputs = [ hello ];
-    shellHook = ''
-      echo "Using ${hello.name}."
-    '';
-  }
-

And this could be understood in plain English as:

-
-

In the packages of nix version 22.11, create a new shell into which -the package hello will be installed. At -the end of the install, run a script that will print the package name. -(Cf 4.1)

-
-

And indeed, if you copy/paste this nix block in a file and run -nix-shell here is the result:

-
> nix-shell
-nix-shell shell.nix
-these 53 paths will be fetched (84.69 MiB download, 524.77 MiB unpacked):
-  /nix/store/08pckaqznwh0s3822cjp5aji6y1lsm27-libcxx-11.1.0
-  ...
-  /nix/store/zqcs5xahjxij0c8vfw60lnfb6d979rn2-zlib-1.2.13
-copying path '/nix/store/49wn01k9yikhjlxc1ym5b6civ29zz3gv-bash-5.1-p16' from 'https://cache.nixos.org'...
-...
-copying path '/nix/store/4w2rv6s96fwsb4qyw8b9w394010gxriz-stdenv-darwin' from 'https://cache.nixos.org'...
-Using hello-2.12.1.
-
-[nix-shell:~/tmp/nixplayground]$
-
-

If you close the session and run it again, it will be much faster and -will only show this:

-
❯ nix-shell
-Using hello-2.12.1.
-
-[nix-shell:~/tmp/nixplayground]$
-
-

This is because all dependencies will be cached. OK so, this is level -1 of nix-shell-fu.

-

Now, let's start level 2.

-

nix-shell-fu level 2 lesson; scripting and -configuring

-

This time, we want to launch a full service, as a redis docker would -do. So here is a basic shell script which is similar to the previous one -but will request redis as a dependency -instead of hello and also as a launching -script. From there will add a little bit more features.

-
{ pkgs ? import (fetchTarball https://github.com/NixOS/nixpkgs/archive/22.11.tar.gz) {} }:
-  pkgs.mkShell {
-    # must contain buildInputs, nativeBuildInputs and shellHook
-    buildInputs = [ pkgs.redis ];
-
-    # Post Shell Hook
-    shellHook = ''
-    echo "Using ${pkgs.redis.name} on port: ${port}"
-    redis-server
-  '';
-  }
-

Again if you run nix-shell here is the result:

-
❯ nix-shell
-these 2 paths will be fetched (2.08 MiB download, 6.99 MiB unpacked):
-  /nix/store/6w4vnaxdx12ccq172i8j5l830mlp8jlg-redis-7.0.5
-  /nix/store/b47gmsx9qx0c9vh75wsg8bqq9qd0ad6f-openssl-3.0.7
-copying path '/nix/store/b47gmsx9qx0c9vh75wsg8bqq9qd0ad6f-openssl-3.0.7' from 'https://cache.nixos.org'...
-copying path '/nix/store/6w4vnaxdx12ccq172i8j5l830mlp8jlg-redis-7.0.5' from 'https://cache.nixos.org'...
-Using redis-7.0.5
-97814:C 10 Feb 2023 20:44:36.960 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
-97814:C 10 Feb 2023 20:44:36.960 # Redis version=7.0.5, bits=64, commit=00000000, modified=0, pid=97814, just started
-97814:C 10 Feb 2023 20:44:36.960 # Warning: no config file specified, using the default config. In order to specify a config file use redis-server /path/to/redis.conf
-97814:M 10 Feb 2023 20:44:36.961 * Increased maximum number of open files to 10032 (it was originally set to 256).
-97814:M 10 Feb 2023 20:44:36.961 * monotonic clock: POSIX clock_gettime
-                _._
-           _.-``__ ''-._
-      _.-``    `.  `_.  ''-._           Redis 7.0.5 (00000000/0) 64 bit
-  .-`` .-```.  ```\/    _.,_ ''-._
- (    '      ,       .-`  | `,    )     Running in standalone mode
- |`-._`-...-` __...-.``-._|'` _.-'|     Port: 6379
- |    `-._   `._    /     _.-'    |     PID: 97814
-  `-._    `-._  `-./  _.-'    _.-'
- |`-._`-._    `-.__.-'    _.-'_.-'|
- |    `-._`-._        _.-'_.-'    |           https://redis.io
-  `-._    `-._`-.__.-'_.-'    _.-'
- |`-._`-._    `-.__.-'    _.-'_.-'|
- |    `-._`-._        _.-'_.-'    |
-  `-._    `-._`-.__.-'_.-'    _.-'
-      `-._    `-.__.-'    _.-'
-          `-._        _.-'
-              `-.__.-'
-
-97814:M 10 Feb 2023 20:44:36.962 # WARNING: The TCP backlog setting of 511 cannot be enforced because kern.ipc.somaxconn is set to the lower value of 128.
-97814:M 10 Feb 2023 20:44:36.962 # Server initialized
-97814:M 10 Feb 2023 20:44:36.963 * Ready to accept connections
-
-

Woo! Redis is started and it works!

-

But if you have multiple projects you want to have more control. For -example, we will want to run redis on a specific port. Here is how you -do it:

-
{ pkgs ? import (fetchTarball https://github.com/NixOS/nixpkgs/archive/21.05.tar.gz) {} }:
-  let iport = 16380;
-      port = toString iport;
-  in pkgs.mkShell {
-    # must contain buildInputs, nativeBuildInputs and shellHook
-    buildInputs = [ pkgs.redis ];
-
-    # Post Shell Hook
-    shellHook = ''
-    echo "Using ${pkgs.redis.name} on port ${port}"
-    redis-server --port ${port}
-  '';
-  }
-

And here is the result:

-
> rm dump.rdb
-> nix-shell
-Using redis-6.2.3 on port 16380
-1785:C 10 Feb 2023 20:50:00.880 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
-1785:C 10 Feb 2023 20:50:00.880 # Redis version=6.2.3, bits=64, commit=00000000, modified=0, pid=1785, just started
-1785:C 10 Feb 2023 20:50:00.880 # Configuration loaded
-1785:M 10 Feb 2023 20:50:00.880 * Increased maximum number of open files to 10032 (it was originally set to 256).
-1785:M 10 Feb 2023 20:50:00.880 * monotonic clock: POSIX clock_gettime
-                _._
-           _.-``__ ''-._
-      _.-``    `.  `_.  ''-._           Redis 6.2.3 (00000000/0) 64 bit
-  .-`` .-```.  ```\/    _.,_ ''-._
- (    '      ,       .-`  | `,    )     Running in standalone mode
- |`-._`-...-` __...-.``-._|'` _.-'|     Port: 16380
- |    `-._   `._    /     _.-'    |     PID: 1785
-  `-._    `-._  `-./  _.-'    _.-'
- |`-._`-._    `-.__.-'    _.-'_.-'|
- |    `-._`-._        _.-'_.-'    |           https://redis.io
-  `-._    `-._`-.__.-'_.-'    _.-'
- |`-._`-._    `-.__.-'    _.-'_.-'|
- |    `-._`-._        _.-'_.-'    |
-  `-._    `-._`-.__.-'_.-'    _.-'
-      `-._    `-.__.-'    _.-'
-          `-._        _.-'
-              `-.__.-'
-
-1785:M 10 Feb 2023 20:50:00.881 # Server initialized
-1785:M 10 Feb 2023 20:50:00.881 * Ready to accept connections
-
-

Woo! Now we can control the port from the file. That's nice. But, -hmmm, has you might have noticed, when you quit the session it dumps the -DB as the file dump.rdb. What we would -like is to keep the state in a local file that would be easy to delete. -So here is how I did it, mainly, I just create a redis config file -locally, and run redis using this local config file. Also I do my best -to put all files created for running this local redis instance into a -local file into my project. The code is more complex this time, but I -just added a way to create a config file and declare a directory that -will contain all the state of the DB and of the nix configuration.

-
{ pkgs ? import (fetchTarball https://github.com/NixOS/nixpkgs/archive/21.05.tar.gz) {} }:
-let iport = 16380;
-    port = toString iport;
-in pkgs.mkShell (rec {
-  # ENV Variables the directory to put all the DATA
-  REDIS_DATA = "${toString ./.}/.redis";
-  # the config file, as we use REDIS_DATA variable we just declared in the
-  # same nix set, we need to use rec
-  redisConf = pkgs.writeText "redis.conf"
-                             ''
-                             port ${port}
-                             dbfilename redis.db
-                             dir ${REDIS_DATA}
-                             '';
-
-  buildInputs = [ pkgs.redis ];
-
-  # Post Shell Hook
-  shellHook = ''
-    echo "Using ${pkgs.redis.name} on port: ${port}"
-
-    [ ! -d $REDIS_DATA ] \
-      && mkdir -p $REDIS_DATA
-    cat "$redisConf" > $REDIS_DATA/redis.conf
-    alias redisstop="echo 'Stopping Redis'; redis-cli -p ${port} shutdown; rm -rf $REDIS_DATA"
-    nohup redis-server $REDIS_DATA/redis.conf > /dev/null 2>&1 &
-    echo "When finished just run redisstop && exit"
-  '';
-})
-

And here is a full session using this shell.nix:

-
 nix-shell
-Using redis-6.2.3 on port: 16380
-When finished just run redisstop && exit
-
-[nix-shell:~/tmp/nixplayground]$ redis-cli -p 16380
-127.0.0.1:16380> help
-redis-cli 6.2.3
-To get help about Redis commands type:
-      "help @<group>" to get a list of commands in <group>
-      "help <command>" for help on <command>
-      "help <tab>" to get a list of possible help topics
-      "quit" to exit
-
-To set redis-cli preferences:
-      ":set hints" enable online hints
-      ":set nohints" disable online hints
-Set your preferences in ~/.redisclirc
-127.0.0.1:16380>
-
-[nix-shell:~/tmp/nixplayground]$ ls -a
-.  ..  .redis  shell.nix
-
-[nix-shell:~/tmp/nixplayground]$ find .redis
-.redis
-.redis/redis.conf
-
-[nix-shell:~/tmp/nixplayground]$ redis-cli -p 16380 shutdown
-[1]+  Done                    nohup redis-server $REDIS_DATA/redis.conf > /dev/null 2>&1
-
-[nix-shell:~/tmp/nixplayground]$ find .redis
-.redis
-.redis/redis.db
-.redis/redis.conf
-
-[nix-shell:~/tmp/nixplayground]$ redisstop
-Stopping Redis
-Could not connect to Redis at 127.0.0.1:16380: Connection refused
-
-[nix-shell:~/tmp/nixplayground]$ ls -a
-.  ..  shell.nix
-
-[nix-shell:~/tmp/nixplayground]$
-
-

So with this version all data related to redis is saved into the -local .redis directory. And in the nix -shell we provide a command redisstop that -once invoked, shutdown redis, then purge all redis related data (as you -would like in a development environment). Also, as compared to previous -version, redis is launched in background so you could run commands in -your nix shell.

-

nix-shell-fu level 3 lesson; composability

-

So in order for this part to be easier to follow, we'll go back to -our first example with the shell.nix that just ran hello.

-

Appendice

-

Digression

-

In fact, this is a bit more complex than "just that". The reality is -a bit more complex. The nix language is "pure", meaning, if you run the -nix evaluation multiple times, it will always evaluate to the exact same -value. But here, this block represent a function. The function takes as -input a "nix set" (which you can see as an associative array, or a -hash-map or also a javascript object depending on your preference), and -this set is expected to contain a field named pkgs. If pkgs is -not provided, it will us the set from the stable version 22.11 of -nixpkgs by downloading them from github archive. The second part of the -function generate "something" that is returned by an internal function -of the standard library provided by nix -which is named mkShell. So mainly, mkShell is a helper function that will generate -what nix calls a derivation. -Mainly, we don't really care about exactly what is a -derivation. This is an internal to nix representation that -could be finally used by different nix tools for different things. -Typically, installing a package, running a local development environment -with nix-shell or nix develop, etc…

-

So the important detail to remember is that we can manipulate the -parameter we pass to the functions derivation, mkDerivation and mkShell, but we have no mechanism to manipulate -directly derivation. So in order to make -that composable, you need to call the derivation internal function at the very end -only.

-

The argument of all these functions are nix sets

- - diff --git a/notes/create_long_running_dashboard.html b/notes/create_long_running_dashboard.html deleted file mode 100644 index 4ed4c2db..00000000 --- a/notes/create_long_running_dashboard.html +++ /dev/null @@ -1,399 +0,0 @@ - - - - - - - -Create Long Running Dashboard - - - - - -
-

Create Long Running Dashboard

-
-

Table of Contents

-
- -
-
- -
-

1. Summary

-
-
    -
  1. Once the user is logged, use his session token to make the first call to /oauth2/custom/tokens.
    2. -
  2. You should get an access and refresh token. That refresh token expiration -date will be far away (a lot later than in 24h)
    3. -
  3. Use this new access token to display the dashboard.
    4. -
  4. When the access token expires, request a new one by using the refresh token -and calling /oauth/token.
    5. -
-
-
- -
-

2. Working Example on INT

-
-
-
"https://visibility.int.iroh.site"
-
-
- -
-
"cisco-internal-71c1b24be4210aac731cef41664f15e3"
-
-
- -
-
"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjJscmNidExVeUI3aFRVQ0JGTVpvWU9VeTZTWThIeWJVNzBXVkk2ZzdaYmsifQ.eyJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvZW1haWwiOiJ5YWVzcG9zaUBjaXNjby5jb20iLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvaWRwL2lkIjoic3hzbyIsImVtYWlsIjoieWFlc3Bvc2lAY2lzY28uY29tIiwiYXVkIjpbImlyb2gtdWkiLCJsb2dpbiJdLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvcm9sZSI6ImFkbWluIiwic3ViIjoiMDAwMTA5MjQtZTFiYy00YjAzLWI2MDAtODljNmNmNTI3NTdjIiwiaXNzIjoiSVJPSCBBdXRoIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vYXV0aC9yZWZyZXNoLXRva2VuLWp0aSI6InJlZnJlc2gtMjVlYjI1YTYtYzZjYS00ODdkLWI4M2YtMjA2ZWRjNjRjZTgwIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9zY29wZXMiOlsiaXJvaC1hZG1pbiIsImV2ZW50OnJlYWQiLCJpbnNpZ2h0cyIsInZhdWx0L2NvbmZpZ3M6cmVhZCIsImludGVncmF0aW9uIiwicHJpdmF0ZS1pbnRlbCIsImFkbWluIiwicHJvZmlsZSIsImluc3BlY3QiLCJhc3NldCIsImZlZWRiYWNrIiwiaXJvaC1tYXN0ZXIiLCJzc2UiLCJyZWdpc3RyeSIsInVzZXJzIiwiaW52ZXN0aWdhdGlvbiIsImNpc2NvIiwiaW52aXRlIiwicGxheWJvb2siLCJjYXNlYm9vayIsInZhdWx0L2NvbmZpZy9tZXRhZGF0YTpyZWFkIiwib3JiaXRhbCIsImVucmljaCIsIm9hdXRoIiwiY29sbGVjdCIsInJlc3BvbnNlIiwidWktc2V0dGluZ3MiLCJ0ZWxlbWV0cnk6d3JpdGUiLCJvcGVuaWQiLCJub3RpZmljYXRpb24iLCJnbG9iYWwtaW50ZWw6cmVhZCIsIndlYmhvb2siLCJ2YXVsdC9jb25maWcvcG9zdHVyZTpyZWFkIiwiYW8iXSwiZXhwIjoxNzAyNzM1MjM0LCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL29hdXRoL2NsaWVudC9uYW1lIjoiVGhyZWF0IFJlc3BvbnNlIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vYXV0aC91c2VyL2lkIjoiMDAwMTA5MjQtZTFiYy00YjAzLWI2MDAtODljNmNmNTI3NTdjIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vcmcvaWQiOiIwNDdhODliZi01ZDJlLTQzOTItYjc3MC1hZDQ4MjFhODJhY2YiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL29hdXRoL2dyYW50IjoibG9naW4iLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL29yZy9uYW1lIjoiWWFubiBBRE1JTiBPUkciLCJqdGkiOiJ0b2tlbi0xMGVjYjk4NC1jMjk5LTRkNzItYjVlMC01ODA0Mjg4Njc4YmUiLCJuYmYiOjE3MDI2NDg3NzQsImh0dHBzOi8vc2NoZW1hcy5jaXNjby5jb20vaXJvaC9pZGVudGl0eS9jbGFpbXMvdXNlci9uYW1lIjoiWWFubiAtIE1hc3RlciIsImh0dHBzOi8vc2NoZW1hcy5jaXNjby5jb20vaXJvaC9pZGVudGl0eS9jbGFpbXMvdXNlci9pZCI6IjAwMDEwOTI0LWUxYmMtNGIwMy1iNjAwLTg5YzZjZjUyNzU3YyIsImh0dHBzOi8vc2NoZW1hcy5jaXNjby5jb20vaXJvaC9pZGVudGl0eS9jbGFpbXMvb2F1dGgvY2xpZW50L2lkIjoiaXJvaC11aSIsImh0dHBzOi8vc2NoZW1hcy5jaXNjby5jb20vaXJvaC9pZGVudGl0eS9jbGFpbXMvdmVyc2lvbiI6InYyLjEwLWM2ZDljZmM4NTU3OTg2NTA1YjkxIiwiaWF0IjoxNzAyNjQ4ODM0LCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL29hdXRoL2tpbmQiOiJzZXNzaW9uLXRva2VuIn0.aUM6fPSkcEh7wlD5se328l6GGeaqLFuNZTR5XjP5dA79RXSwXxDuPHQbr5VveLUQRd7cl-5yAMlcEumjv5AuozafcBzLRdc2OBPtXBFzSxOinZKmbk4mNZ2FVHLdSRqEBzGfWpcw5ZoG2DbYy0Ygqh9s5kMvF789zrNz0DYituUMM7Wf37AQAJ1oFWfDHBGAND22FkhsHd7QrnJDQhtPkCTTWiMjHSfAXnrUuJ6kNZCPdAwa4HlTTmmlTBqI4TA6GGbwUDmBGeSEed9N01MLrOgbtJK3M8mdchxGb9lA2ZnkI8QfdXPEa_ppJ5CUUnYw1sOqFq-PeLoDEDDtkDPHg6115SPdfckbLYsOsxnBRcm2FwxP2hHunPXDEkJrT0osjU6t8MMi3FoDV-9ISdDdD6Ldhe9NM7WPNFofVp9XwYMyuqcejHX6V5AW8eb5GK6Xk_nwzLBTUxThvFi1FJSlDj5bdj7jnjMWv7wHtvUU1bMwSMOPkA0xSlM0pmD0CdfrSk3Os-RYHpcYLqrdXVvjau40beSCCoFlgjdebidux8RC6Ln4l6cauNepnyKxyLWqr-UfdAhiFe3U-F0gGPVwhUvqTfbpeujCd3go0037akaSOtUIXid08HPSCRHhEXANeR8GO1zT86XCz3h74uLyfqRSWEkR_tbvMAik942bQWY"
-
-
- -
-
POST ${envorigin}/iroh/oauth2/custom/tokens
-Accept: application/json
-Content-Type: application/json
-User-Agent: ob-http
-Authorization: Bearer ${userjwt}
-
-{"client_id":"${clientid}",
- "client_secret": "dashboard"}
-
-
- -
-
{
-  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjJscmNidExVeUI3aFRVQ0JGTVpvWU9VeTZTWThIeWJVNzBXVkk2ZzdaYmsifQ.eyJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvZW1haWwiOiJ5YWVzcG9zaUBjaXNjby5jb20iLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvaWRwL2lkIjoic3hzbyIsImVtYWlsIjoieWFlc3Bvc2lAY2lzY28uY29tIiwiYXVkIjpbImNpc2NvLWludGVybmFsLTcxYzFiMjRiZTQyMTBhYWM3MzFjZWY0MTY2NGYxNWUzIl0sImh0dHBzOi8vc2NoZW1hcy5jaXNjby5jb20vaXJvaC9pZGVudGl0eS9jbGFpbXMvdXNlci9yb2xlIjoiYWRtaW4iLCJzdWIiOiIwMDAxMDkyNC1lMWJjLTRiMDMtYjYwMC04OWM2Y2Y1Mjc1N2MiLCJpc3MiOiJJUk9IIEF1dGgiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL29hdXRoL3JlZnJlc2gtdG9rZW4tanRpIjoicmVmcmVzaC1kYTAwZjQ4ZC1iZWRiLTQ1MWEtYjg2Yi05YjM1N2JmMzc0OWEiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3Njb3BlcyI6WyJldmVudDpyZWFkIiwicHJpdmF0ZS1pbnRlbDpyZWFkIiwiZmVlZGJhY2s6cmVhZCIsIm9yYml0YWw6cmVhZCIsInZhdWx0L2NvbmZpZ3M6cmVhZCIsImNvbGxlY3Q6cmVhZCIsInVzZXJzOnJlYWQiLCJlbnJpY2g6cmVhZCIsImluc2lnaHRzOnJlYWQiLCJpbnZlc3RpZ2F0aW9uOnJlYWQiLCJpbnRlZ3JhdGlvbjpyZWFkIiwicmVnaXN0cnkiLCJhbzpyZWFkIiwidWktc2V0dGluZ3M6cmVhZCIsInZhdWx0L2NvbmZpZy9tZXRhZGF0YTpyZWFkIiwic3NlOnJlYWQiLCJhZG1pbjpyZWFkIiwiaW5zcGVjdDpyZWFkIiwiY2FzZWJvb2s6cmVhZCIsInRlbGVtZXRyeTp3cml0ZSIsImdsb2JhbC1pbnRlbDpyZWFkIiwicHJvZmlsZTpyZWFkIiwid2ViaG9vazpyZWFkIiwidmF1bHQvY29uZmlnL3Bvc3R1cmU6cmVhZCIsIm5vdGlmaWNhdGlvbjpyZWFkIiwiYXNzZXQ6cmVhZCIsInJlc3BvbnNlOnJlYWQiLCJwbGF5Ym9vazpyZWFkIl0sImV4cCI6MTcwMjY1MzM3NCwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vYXV0aC9jbGllbnQvbmFtZSI6IjEgTW9udGggRGFzaGJvYXJkIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vYXV0aC91c2VyL2lkIjoiMDAwMTA5MjQtZTFiYy00YjAzLWI2MDAtODljNmNmNTI3NTdjIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vcmcvaWQiOiIwNDdhODliZi01ZDJlLTQzOTItYjc3MC1hZDQ4MjFhODJhY2YiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL29hdXRoL2dyYW50IjoiYXV0aC1jb2RlIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vYXV0aC9jbGllbnQvb3duZXIvaWQiOiJjaXNjby1pbnRlcm5hbC11aS1kYXNoYm9hcmRzIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vcmcvbmFtZSI6Illhbm4gQURNSU4gT1JHIiwianRpIjoidG9rZW4tMzI3Njk3ZjUtMWRkYi00MjhiLTg3ODQtMjAzNGQ0ODJlNGYwIiwibmJmIjoxNzAyNjQ5NzE0LCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvbmFtZSI6Illhbm4gLSBNYXN0ZXIiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvaWQiOiIwMDAxMDkyNC1lMWJjLTRiMDMtYjYwMC04OWM2Y2Y1Mjc1N2MiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL29hdXRoL2NsaWVudC9pZCI6ImNpc2NvLWludGVybmFsLTcxYzFiMjRiZTQyMTBhYWM3MzFjZWY0MTY2NGYxNWUzIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy92ZXJzaW9uIjoidjIuMTAtYzZkOWNmYzg1NTc5ODY1MDViOTEiLCJpYXQiOjE3MDI2NDk3NzQsImh0dHBzOi8vc2NoZW1hcy5jaXNjby5jb20vaXJvaC9pZGVudGl0eS9jbGFpbXMvb2F1dGgva2luZCI6ImFjY2Vzcy10b2tlbiJ9.qw0hHP73wExZLvzlzv60Y7eAOCsO4TGASvCkEtmXogQ1LgReyh8YSqPQVZX5wP0OBfhjQ4-smEu54EcMC9Lf_wC9-vRrtRjq-NwoEL6wNsoruvWEtPoeHYWjrpGdV14Z_AOrlLwPANiN8boOFq452rBNgWj2RdfyDfR2uhT_fvJmrOyVJ8QL4ZLOMZZx2N3-Bh2ZLWJSCIa8Rxmvld5uI_ZDwAQ2XNC5Bs5BCZLAaROPZ-xq8Hslc4ZMgINYruSSQ6l7DVIklCZmyyRoLfKROej-tBYRrbRosfckd7o72LQLV1h7Jf-jDNVtujb5vjfxB9yWClt-gmgCPO7mb3xSbh_bzrsY-CWMg5C_XfLjmiE2Jm9asuZWX6nZkBmLSIXz5tIT0NyyZeW4PByjOxO9OPcYYHI2PjxYy36kxQqnViYSbaK6zAZGPkqOLcmJmK5G00MSZL23jw52au_rpH1vkKJHYcb61CH3Uzat6yplxpYQm6pW-8eKMnXUa21LHCkoOzdPx_SQ9_Z4bMsyAy7h7A1cjCBiiUU1X34te544zUH88s5Nr-j_vR8A1CqI3iTGVaqMg1mMui9H2gIycfLFNzCMgjE6RI9f7EvWxAvIbDZiHj7I4_NKhsjP96YIoXISQmxOXaPCgbL5EbItgcADf-dGQOYk2MeadfNq8mlj-Gs",
-  "scope": "admin:read ao:read asset:read casebook:read collect:read enrich:read event:read feedback:read global-intel:read insights:read inspect:read integration:read investigation:read notification:read orbital:read playbook:read private-intel:read profile:read registry response:read sse:read telemetry:write ui-settings:read users:read vault/config/metadata:read vault/config/posture:read vault/configs:read webhook:read",
-  "token_type": "bearer",
-  "expires_in": 3600,
-  "refresh_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjJscmNidExVeUI3aFRVQ0JGTVpvWU9VeTZTWThIeWJVNzBXVkk2ZzdaYmsifQ.eyJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvZW1haWwiOiJ5YWVzcG9zaUBjaXNjby5jb20iLCJlbWFpbCI6InlhZXNwb3NpQGNpc2NvLmNvbSIsImF1ZCI6WyJjaXNjby1pbnRlcm5hbC03MWMxYjI0YmU0MjEwYWFjNzMxY2VmNDE2NjRmMTVlMyJdLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvcm9sZSI6ImFkbWluIiwiaXNzIjoiSVJPSCBBdXRoIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9zY29wZXMiOlsiZXZlbnQ6cmVhZCIsInByaXZhdGUtaW50ZWw6cmVhZCIsImZlZWRiYWNrOnJlYWQiLCJvcmJpdGFsOnJlYWQiLCJ2YXVsdC9jb25maWdzOnJlYWQiLCJjb2xsZWN0OnJlYWQiLCJ1c2VyczpyZWFkIiwiZW5yaWNoOnJlYWQiLCJpbnNpZ2h0czpyZWFkIiwiaW52ZXN0aWdhdGlvbjpyZWFkIiwiaW50ZWdyYXRpb246cmVhZCIsInJlZ2lzdHJ5IiwiYW86cmVhZCIsInVpLXNldHRpbmdzOnJlYWQiLCJ2YXVsdC9jb25maWcvbWV0YWRhdGE6cmVhZCIsInNzZTpyZWFkIiwiYWRtaW46cmVhZCIsImluc3BlY3Q6cmVhZCIsImNhc2Vib29rOnJlYWQiLCJ0ZWxlbWV0cnk6d3JpdGUiLCJnbG9iYWwtaW50ZWw6cmVhZCIsInByb2ZpbGU6cmVhZCIsIndlYmhvb2s6cmVhZCIsInZhdWx0L2NvbmZpZy9wb3N0dXJlOnJlYWQiLCJub3RpZmljYXRpb246cmVhZCIsImFzc2V0OnJlYWQiLCJyZXNwb25zZTpyZWFkIiwicGxheWJvb2s6cmVhZCJdLCJleHAiOjE3MDUzMjgxNzMsImh0dHBzOi8vc2NoZW1hcy5jaXNjby5jb20vaXJvaC9pZGVudGl0eS9jbGFpbXMvb2F1dGgvdXNlci9pZCI6IjAwMDEwOTI0LWUxYmMtNGIwMy1iNjAwLTg5YzZjZjUyNzU3YyIsImh0dHBzOi8vc2NoZW1hcy5jaXNjby5jb20vaXJvaC9pZGVudGl0eS9jbGFpbXMvb3JnL2lkIjoiMDQ3YTg5YmYtNWQyZS00MzkyLWI3NzAtYWQ0ODIxYTgyYWNmIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vYXV0aC9ncmFudCI6ImF1dGgtY29kZSIsImp0aSI6InJlZnJlc2gtZGEwMGY0OGQtYmVkYi00NTFhLWI4NmItOWIzNTdiZjM3NDlhIiwibmJmIjoxNzAyNjQ5NzEzLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvbmFtZSI6Illhbm4gLSBNYXN0ZXIiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvaWQiOiIwMDAxMDkyNC1lMWJjLTRiMDMtYjYwMC04OWM2Y2Y1Mjc1N2MiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL29hdXRoL2NsaWVudC9pZCI6ImNpc2NvLWludGVybmFsLTcxYzFiMjRiZTQyMTBhYWM3MzFjZWY0MTY2NGYxNWUzIiwiaWF0IjoxNzAyNjQ5NzczLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL29hdXRoL2tpbmQiOiJyZWZyZXNoLXRva2VuIn0.SpwTOO_Ze2dLY1EVpq86RefnHz5OKL2HQS8pjK32Ei2nELAZdSoJaMhtUriXF05Y5G-s1wtBItR0kRXDrDDSFyon6wVxaqwtTBd6vUWgKLJOzM6tLBrdQDd3-XnOuH3v2Zvsd4h7ritTlkCj5cA6aiuvBrhkyEpZE4OhJ-YRTXvMsiepZnAAiRHMaB9gRAMovMuXrCHYN_-hdVXh0uOrDF5ARTwmh9GC9fhQpgzOSL2YbTyj0u0uF9tBOsmc8JmfdR_BxwBk6A7QiygUhzT5w23VkzPZ1W842UyPWVeOprHgWjpb_eUZKAnmL5s3-uT58bv_llHg1JVNPTUtp1yXaWPUGeKe83qlUf3ySdOPD04BLcjG1J1RZ4vMzVW0MboyqairgoCRl5fnA9aUVBM-28E2qDR6zjzAG6XLz3tYFgb2ltKYHi9sOgzdRxhn_879R3W09jjNRh_n-_vEouL1QUWTLDX5ZwPyvIEbaZMvDKocjTQ1VIsQeRhKNvqsoy019Y7aixfm4XvEWrfjArbB-i3O7iLwdJEDRsYpFvif2kltTApKgdIUt6_1JS3oqzInJc7G8itd_T_IE2UQo6zf6J2OuL-Y4nuUlAhtMfS2pHgIfWXbCRJL2xDD3Zu2ukUL7WzdKA974zc0qB30ZuSaN3QxsNu2m_pDRX4KjFXftuo"
-}
-
-
- -

-decoded refresh token -

- -
-
Token header
-------------
-{
-  "typ": "JWT",
-  "alg": "RS256",
-  "kid": "2lrcbtLUyB7hTUCBFMZoYOUy6SY8HybU70WVI6g7Zbk"
-}
-
-Token claims
-------------
-{
-  "aud": [
-    "cisco-internal-71c1b24be4210aac731cef41664f15e3"
-  ],
-  "email": "yaesposi@cisco.com",
-  "exp": 1705328173,
-  "https://schemas.cisco.com/iroh/identity/claims/oauth/client/id": "cisco-internal-71c1b24be4210aac731cef41664f15e3",
-  "https://schemas.cisco.com/iroh/identity/claims/oauth/grant": "auth-code",
-  "https://schemas.cisco.com/iroh/identity/claims/oauth/kind": "refresh-token",
-  "https://schemas.cisco.com/iroh/identity/claims/oauth/user/id": "00010924-e1bc-4b03-b600-89c6cf52757c",
-  "https://schemas.cisco.com/iroh/identity/claims/org/id": "047a89bf-5d2e-4392-b770-ad4821a82acf",
-  "https://schemas.cisco.com/iroh/identity/claims/scopes": [
-    "event:read",
-    "private-intel:read",
-    "feedback:read",
-    "orbital:read",
-    "vault/configs:read",
-    "collect:read",
-    "users:read",
-    "enrich:read",
-    "insights:read",
-    "investigation:read",
-    "integration:read",
-    "registry",
-    "ao:read",
-    "ui-settings:read",
-    "vault/config/metadata:read",
-    "sse:read",
-    "admin:read",
-    "inspect:read",
-    "casebook:read",
-    "telemetry:write",
-    "global-intel:read",
-    "profile:read",
-    "webhook:read",
-    "vault/config/posture:read",
-    "notification:read",
-    "asset:read",
-    "response:read",
-    "playbook:read"
-  ],
-  "https://schemas.cisco.com/iroh/identity/claims/user/email": "yaesposi@cisco.com",
-  "https://schemas.cisco.com/iroh/identity/claims/user/id": "00010924-e1bc-4b03-b600-89c6cf52757c",
-  "https://schemas.cisco.com/iroh/identity/claims/user/name": "Yann - Master",
-  "https://schemas.cisco.com/iroh/identity/claims/user/role": "admin",
-  "iat": 1702649773,
-  "iss": "IROH Auth",
-  "jti": "refresh-da00f48d-bedb-451a-b86b-9b357bf3749a",
-  "nbf": 1702649713
-}
-
-
- -

-Where we can see that exp - iat claims is -

- -
-
(- 1705328173 1702649773)
-
-
- -

-Which is -

- -
-
(/ 2678400 (* 60 60 24))
-
-
- -

-31 days. -

- -

-Note also the access token lifetime is 3600 seconds (instead of the default 300s). -After 1 hour, the access token will fail, from now on you could request another -access token with: -

- -
-
"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjJscmNidExVeUI3aFRVQ0JGTVpvWU9VeTZTWThIeWJVNzBXVkk2ZzdaYmsifQ.eyJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvZW1haWwiOiJ5YWVzcG9zaUBjaXNjby5jb20iLCJlbWFpbCI6InlhZXNwb3NpQGNpc2NvLmNvbSIsImF1ZCI6WyJjaXNjby1pbnRlcm5hbC03MWMxYjI0YmU0MjEwYWFjNzMxY2VmNDE2NjRmMTVlMyJdLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvcm9sZSI6ImFkbWluIiwiaXNzIjoiSVJPSCBBdXRoIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9zY29wZXMiOlsiZXZlbnQ6cmVhZCIsInByaXZhdGUtaW50ZWw6cmVhZCIsImZlZWRiYWNrOnJlYWQiLCJvcmJpdGFsOnJlYWQiLCJ2YXVsdC9jb25maWdzOnJlYWQiLCJjb2xsZWN0OnJlYWQiLCJ1c2VyczpyZWFkIiwiZW5yaWNoOnJlYWQiLCJpbnNpZ2h0czpyZWFkIiwiaW52ZXN0aWdhdGlvbjpyZWFkIiwiaW50ZWdyYXRpb246cmVhZCIsInJlZ2lzdHJ5IiwiYW86cmVhZCIsInVpLXNldHRpbmdzOnJlYWQiLCJ2YXVsdC9jb25maWcvbWV0YWRhdGE6cmVhZCIsInNzZTpyZWFkIiwiYWRtaW46cmVhZCIsImluc3BlY3Q6cmVhZCIsImNhc2Vib29rOnJlYWQiLCJ0ZWxlbWV0cnk6d3JpdGUiLCJnbG9iYWwtaW50ZWw6cmVhZCIsInByb2ZpbGU6cmVhZCIsIndlYmhvb2s6cmVhZCIsInZhdWx0L2NvbmZpZy9wb3N0dXJlOnJlYWQiLCJub3RpZmljYXRpb246cmVhZCIsImFzc2V0OnJlYWQiLCJyZXNwb25zZTpyZWFkIiwicGxheWJvb2s6cmVhZCJdLCJleHAiOjE3MDUzMjgxNzMsImh0dHBzOi8vc2NoZW1hcy5jaXNjby5jb20vaXJvaC9pZGVudGl0eS9jbGFpbXMvb2F1dGgvdXNlci9pZCI6IjAwMDEwOTI0LWUxYmMtNGIwMy1iNjAwLTg5YzZjZjUyNzU3YyIsImh0dHBzOi8vc2NoZW1hcy5jaXNjby5jb20vaXJvaC9pZGVudGl0eS9jbGFpbXMvb3JnL2lkIjoiMDQ3YTg5YmYtNWQyZS00MzkyLWI3NzAtYWQ0ODIxYTgyYWNmIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vYXV0aC9ncmFudCI6ImF1dGgtY29kZSIsImp0aSI6InJlZnJlc2gtZGEwMGY0OGQtYmVkYi00NTFhLWI4NmItOWIzNTdiZjM3NDlhIiwibmJmIjoxNzAyNjQ5NzEzLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvbmFtZSI6Illhbm4gLSBNYXN0ZXIiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvaWQiOiIwMDAxMDkyNC1lMWJjLTRiMDMtYjYwMC04OWM2Y2Y1Mjc1N2MiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL29hdXRoL2NsaWVudC9pZCI6ImNpc2NvLWludGVybmFsLTcxYzFiMjRiZTQyMTBhYWM3MzFjZWY0MTY2NGYxNWUzIiwiaWF0IjoxNzAyNjQ5NzczLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL29hdXRoL2tpbmQiOiJyZWZyZXNoLXRva2VuIn0.SpwTOO_Ze2dLY1EVpq86RefnHz5OKL2HQS8pjK32Ei2nELAZdSoJaMhtUriXF05Y5G-s1wtBItR0kRXDrDDSFyon6wVxaqwtTBd6vUWgKLJOzM6tLBrdQDd3-XnOuH3v2Zvsd4h7ritTlkCj5cA6aiuvBrhkyEpZE4OhJ-YRTXvMsiepZnAAiRHMaB9gRAMovMuXrCHYN_-hdVXh0uOrDF5ARTwmh9GC9fhQpgzOSL2YbTyj0u0uF9tBOsmc8JmfdR_BxwBk6A7QiygUhzT5w23VkzPZ1W842UyPWVeOprHgWjpb_eUZKAnmL5s3-uT58bv_llHg1JVNPTUtp1yXaWPUGeKe83qlUf3ySdOPD04BLcjG1J1RZ4vMzVW0MboyqairgoCRl5fnA9aUVBM-28E2qDR6zjzAG6XLz3tYFgb2ltKYHi9sOgzdRxhn_879R3W09jjNRh_n-_vEouL1QUWTLDX5ZwPyvIEbaZMvDKocjTQ1VIsQeRhKNvqsoy019Y7aixfm4XvEWrfjArbB-i3O7iLwdJEDRsYpFvif2kltTApKgdIUt6_1JS3oqzInJc7G8itd_T_IE2UQo6zf6J2OuL-Y4nuUlAhtMfS2pHgIfWXbCRJL2xDD3Zu2ukUL7WzdKA974zc0qB30ZuSaN3QxsNu2m_pDRX4KjFXftuo"
-
-
- -
-
POST ${envorigin}/iroh/oauth2/token
-Accept: application/json
-Content-Type: application/x-www-form-urlencoded
-User-Agent: ob-http
-
-client_id=${clientid}&client_secret=dashboard&grant_type=refresh_token&refresh_token=${refreshtoken}
-
-
- -
-
{
-  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjJscmNidExVeUI3aFRVQ0JGTVpvWU9VeTZTWThIeWJVNzBXVkk2ZzdaYmsifQ.eyJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvZW1haWwiOiJ5YWVzcG9zaUBjaXNjby5jb20iLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvaWRwL2lkIjoic3hzbyIsImVtYWlsIjoieWFlc3Bvc2lAY2lzY28uY29tIiwiYXVkIjpbImNpc2NvLWludGVybmFsLTcxYzFiMjRiZTQyMTBhYWM3MzFjZWY0MTY2NGYxNWUzIl0sImh0dHBzOi8vc2NoZW1hcy5jaXNjby5jb20vaXJvaC9pZGVudGl0eS9jbGFpbXMvdXNlci9yb2xlIjoiYWRtaW4iLCJzdWIiOiIwMDAxMDkyNC1lMWJjLTRiMDMtYjYwMC04OWM2Y2Y1Mjc1N2MiLCJpc3MiOiJJUk9IIEF1dGgiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL29hdXRoL3JlZnJlc2gtdG9rZW4tanRpIjoicmVmcmVzaC1kYTAwZjQ4ZC1iZWRiLTQ1MWEtYjg2Yi05YjM1N2JmMzc0OWEiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3Njb3BlcyI6WyJldmVudDpyZWFkIiwicHJpdmF0ZS1pbnRlbDpyZWFkIiwiZmVlZGJhY2s6cmVhZCIsIm9yYml0YWw6cmVhZCIsInZhdWx0L2NvbmZpZ3M6cmVhZCIsImNvbGxlY3Q6cmVhZCIsInVzZXJzOnJlYWQiLCJlbnJpY2g6cmVhZCIsImluc2lnaHRzOnJlYWQiLCJpbnZlc3RpZ2F0aW9uOnJlYWQiLCJpbnRlZ3JhdGlvbjpyZWFkIiwicmVnaXN0cnkiLCJhbzpyZWFkIiwidWktc2V0dGluZ3M6cmVhZCIsInZhdWx0L2NvbmZpZy9tZXRhZGF0YTpyZWFkIiwic3NlOnJlYWQiLCJhZG1pbjpyZWFkIiwiaW5zcGVjdDpyZWFkIiwiY2FzZWJvb2s6cmVhZCIsInRlbGVtZXRyeTp3cml0ZSIsImdsb2JhbC1pbnRlbDpyZWFkIiwicHJvZmlsZTpyZWFkIiwid2ViaG9vazpyZWFkIiwidmF1bHQvY29uZmlnL3Bvc3R1cmU6cmVhZCIsIm5vdGlmaWNhdGlvbjpyZWFkIiwiYXNzZXQ6cmVhZCIsInJlc3BvbnNlOnJlYWQiLCJwbGF5Ym9vazpyZWFkIl0sImV4cCI6MTcwMjY1NDQ2NiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vYXV0aC9jbGllbnQvbmFtZSI6IjEgTW9udGggRGFzaGJvYXJkIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vYXV0aC91c2VyL2lkIjoiMDAwMTA5MjQtZTFiYy00YjAzLWI2MDAtODljNmNmNTI3NTdjIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vcmcvaWQiOiIwNDdhODliZi01ZDJlLTQzOTItYjc3MC1hZDQ4MjFhODJhY2YiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL29hdXRoL2dyYW50IjoiYXV0aC1jb2RlIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vYXV0aC9jbGllbnQvb3duZXIvaWQiOiJjaXNjby1pbnRlcm5hbC11aS1kYXNoYm9hcmRzIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy9vcmcvbmFtZSI6Illhbm4gQURNSU4gT1JHIiwianRpIjoidG9rZW4tYzYwZjYzZmMtZWRiYi00YThjLTlkMDQtODE2ZjBjN2I4NzdmIiwibmJmIjoxNzAyNjUwODA2LCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvbmFtZSI6Illhbm4gLSBNYXN0ZXIiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL3VzZXIvaWQiOiIwMDAxMDkyNC1lMWJjLTRiMDMtYjYwMC04OWM2Y2Y1Mjc1N2MiLCJodHRwczovL3NjaGVtYXMuY2lzY28uY29tL2lyb2gvaWRlbnRpdHkvY2xhaW1zL29hdXRoL2NsaWVudC9pZCI6ImNpc2NvLWludGVybmFsLTcxYzFiMjRiZTQyMTBhYWM3MzFjZWY0MTY2NGYxNWUzIiwiaHR0cHM6Ly9zY2hlbWFzLmNpc2NvLmNvbS9pcm9oL2lkZW50aXR5L2NsYWltcy92ZXJzaW9uIjoidjIuMTAtYzZkOWNmYzg1NTc5ODY1MDViOTEiLCJpYXQiOjE3MDI2NTA4NjYsImh0dHBzOi8vc2NoZW1hcy5jaXNjby5jb20vaXJvaC9pZGVudGl0eS9jbGFpbXMvb2F1dGgva2luZCI6ImFjY2Vzcy10b2tlbiJ9.cem4Kt5uwVFv11YhlpOCesPxlo-AfeOcIl8agwe7RP8bBrWI0O7L2coETjZb8a8axXwbWTpsBe2fgut7TjE8byAfRJwhW9jiAD31svw8RMRdRy07d54dVSiCoCfiaFBf79gKSgx0QjMsE1SCd1VJ7vaicp9k-q6a63BDMvp-7hsC1sIXmrsHhHX1wDkOQCrX7EWnOU8LDNhmcjIAgQqCk3TCZK_B-tM_1VNYEpZ6kYQHO1qhwTB6rHE1gh_Vxz0EUTt2H_7f1lj8Rp2ov5LFFi1VIBj7AIOwuTZeifUhJzNmZeeJNzWO3Ejd-Mh4saOGGuJxQqAQ5koxiD6IWZ25K810ojDt0AO-uSadZdbFpfjyox5v0ii-BWs303QQcHpjIzPQXnSq0jDLP6HnOauofHEs2LFimb2omkkUvhppRjpdewbFV6IV7F2lpw4XsiYBfwHLSWLa34PJqgVZ09Oiy7opVQo-tu9jho17RdJkNQYbyv5xCfwV8NKKSjXSFLv3TItmGENvnD_iWBxwFK9kRvCE1n0JoStnRqdpTWf-pkbU70TV71C7DsTlkmaJtporaBhAvF4rgJEWYrxPhEVTRt-ZpQ_hNFDkTWJxPOkSmmEWBjUiXwDWlu2kw0OXXSnndzsa3xIVYvOCNMDClj5gMFASS7DbvHvBAqe8au_bE4I",
-  "scope": "admin:read ao:read asset:read casebook:read collect:read enrich:read event:read feedback:read global-intel:read insights:read inspect:read integration:read investigation:read notification:read orbital:read playbook:read private-intel:read profile:read registry response:read sse:read telemetry:write ui-settings:read users:read vault/config/metadata:read vault/config/posture:read vault/configs:read webhook:read",
-  "token_type": "bearer",
-  "expires_in": 3600
-}
-
-
- -

-Yipie! A new access token that only has read-only authorizations (exceptipon for -registry). -

-
-
-
-
-

Date: 2023-12-15 Fri 00:00

-

Author: Yann Esposito

-

Created: 2023-12-15 Fri 15:38

-
- - \ No newline at end of file diff --git a/notes/dossier_mdph_anna_2023.html b/notes/dossier_mdph_anna_2023.html deleted file mode 100644 index 713f7af7..00000000 --- a/notes/dossier_mdph_anna_2023.html +++ /dev/null @@ -1,257 +0,0 @@ - - - - - - - -dossier MDPH Anna 2023 - - - - - -
-

dossier MDPH Anna 2023

-
-

Table of Contents

-
- -
-
-
-

1. Documents

-
-

-Madame, Monsieur, -

- -

-Veuillez trouver ci-joint le dossier de demande à la MDPH de notre fille Anna Esposito–Basso. -Celui-ci comprend les documents suivants : -

- -
    -
  • [ ] Dossier MDPH rempli (20 pages)
    • -
  • [ ] Certificat médical de moins de 6 mois pour demandes MDPH (8 pages)
    • -
  • [ ] Bilan Auditif (3 pages)
    • -
  • [ ] Certificat médical auditif - Dr Oddon (1 page)
    • -
  • [ ] Photocopie de la Carte d’identité d’Anna Esposito–Basso (1 page)
    • -
  • [ ] Justificatif de domicile; Photocopie de facture d’électricité EDF (1 page) ainsi -qu’une attestation sur l’honneur d’hébergement. (1 page)
    • -
  • [ ] Justificatif aide animalière ; certificat chien d’assistance (1 page)
    • -
  • [ ] Contrat de travail de l’aidant familial (9 pages) + Fiche de salaire de -l’aidant familial prouvant un temps partiel (80%)
    • -
  • [ ] Devis Ergothérapeute - Mme Pradura (1 page)
    • -
  • [ ] Factures et devis Coach de vie - Mme Arboucalot (3 pages)
    • -
  • [ ] Feuille remboursement Mutuelle Audio prothèses (reste à charge 740€, 380€ -par prothèse)
    • -
  • [ ] Projet de vie (2 pages)
    • -
  • [ ] Bilan Neuropsychologique
    • -
  • [ ] Comptes rendu bilan Ergothérapeute
    • -
  • [ ] Bilan du CRA des Alpes Maritimes
    • -
  • [ ] Facture Psychiatre - Dr Guidi (1 page)
    • -
- -

-En vous en souhaitant bonne réception. -

- -

-Krystelle & Yann Esposito

-
-
-
-
-

Date: 2023-06-19 Mon 00:00

-

Author: Yann Esposito

-

Created: 2023-11-13 Mon 23:01

-
- - \ No newline at end of file diff --git a/notes/impots2023/fiche-fiscale-cisco-2023.pdf b/notes/impots2023/fiche-fiscale-cisco-2023.pdf new file mode 100644 index 00000000..56edc3a0 Binary files /dev/null and b/notes/impots2023/fiche-fiscale-cisco-2023.pdf differ diff --git a/notes/impots2023/morgan-stanley-statement.pdf b/notes/impots2023/morgan-stanley-statement.pdf new file mode 100644 index 00000000..e597eea9 Binary files /dev/null and b/notes/impots2023/morgan-stanley-statement.pdf differ diff --git a/notes/impots_2022.org b/notes/impots_2022.org index a2afe055..39410323 100644 --- a/notes/impots_2022.org +++ b/notes/impots_2022.org @@ -4,8 +4,10 @@ #+Title: Impots 2022 #+Author: Yann Esposito #+Date: [2023-05-20] + - tags :: [[id:7051b4a2-b42b-4d6f-abf6-2396b68dc5ed][impots]] - source :: + * PERO (6QS) - Case 6RS versements volontaires diff --git a/notes/impots_2023.org b/notes/impots_2023.org new file mode 100644 index 00000000..5a25fd17 --- /dev/null +++ b/notes/impots_2023.org @@ -0,0 +1,255 @@ +:PROPERTIES: +:ID: 9952b8ac-59df-442c-b3aa-64e78e47d9b1 +:END: +#+title: Impots 2023 +#+Author: Yann Esposito +#+Date: [2024-05-18] + +- tags :: +- source :: + +* PERO (6QS) + +- Case 6RS versements volontaires +- Case 6QS versements obligatoire Pero + jours CET + +Cf Fiche Fiscale Cisco: 7611 + + +* Revenus Fonciers (2044?) + +- 3060€ dans la case 7FK (investissement Duflot 2014) + +* Actions (RSU/ESPP) (Form. 2074) + + | | Plus Values | + |-------+-------------| + | 03/01 | -37.86 | + | 17/02 | 274.94 | + | 05/04 | 201.11 | + | 16/06 | 775.31 | + | 04/07 | -107.53 | + | 26/07 | -24.10 | + | 10/08 | 3.0 | + | 19/09 | -57.35 | + | 15/10 | 156.69 | + |-------+-------------| + | TOTAL | 1184.21 | + #+TBLFM: @>$2=vsum(@I..@II) + +Par lignes: + +** 3 janvier 2023 (vente 162 ESPP => -37,86€) 1 vente + + +| Actions à vendre | 162 | +| Prix du marché par unité | × 47,89 $US | +| Produit | 7 758,18 $US | +| Frais de VEF/CCA | - 7,50 $US | +| Processing Fee | - 5,00 $US | +| Frais de transaction supplémentaires | - 0,18 $US | +| Produit net | 7 745,50 $US | +| Conversion de la devise | × 0,934951 | +| Produit net converti | 7 241,66 € | +| Revenu ordinaire | 1 851,66 $US | +| Gain ou perte de capital | −40,50 $US | + + +#+CONSTANTS: eu_03_01=0.934951 +| Date d’acquisition | Prix achat | Prix vente | Actions | Frais | Gain | +|---------------------+------------+------------+---------+-------+--------| +| 3 janvier 2023 en $ | 48.03085 | 47.89 | 162 | 17.68 | -40.50 | +| #ERROR | 44.91 | 44.77 | 151.46 | 16.53 | -37.87 | +#+TBLFM: @2$6=(((@2$3-@2$2)*@2$4) - @2$5);%.2f +#+TBLFM: @3=@2*$eu_03_01;%.2f + +** 17 fevrier 2023 (vente 59 RSU => 274,94€) 1 vente + +| Actions à vendre | 59 | +| Prix du marché par unité | × 51,36 $US | +| Produit | 3 030,24 $US | +| Frais de VEF/CCA | - 7,50 $US | +| Processing Fee | - 5,00 $US | +| Frais de transaction supplémentaires | - 0,07 $US | +| Produit net | 3 017,67 $US | +| Conversion de la devise | × 0,926536 | +| Produit net converti | 2 795,98 € | + + +#+CONSTANTS: eu_17_02=0.926536 +| Date d’acquisition | Prix achat | Prix vente | Actions | Frais | Gain | +|---------------------+------------+------------+---------+-------+--------| +| 3 janvier 2023 en $ | 46.70 | 51.36 | 59 | 12.57 | 262.37 | +| #ERROR | 43.27 | 47.59 | 54.67 | 11.65 | 243.10 | +#+TBLFM: @2$6=(((@2$3-@2$2)*@2$4) - @2$5);%.2f +#+TBLFM: @3=@2*$eu_17_02;%.2f + +** 5 avril 2023 (vente 76 RSU => 201€) 1 vente + + +| Actions à vendre | 76 | +| Prix du marché par unité | × 51,965 $US | +| Produit | 3 949,34 $US | +| Frais de VEF/CCA | - 7,50 $US | +| Processing Fee | - 5,00 $US | +| Frais de transaction supplémentaires | - 0,04 $US | +| Produit net | 3 936,34 $US | +| Conversion de la devise | × 0,907801 | +| Produit net converti | 3 573,83 € | +| Gain ou perte de capital | 233,70 $US | + + +#+CONSTANTS: eu_05_04=0.907801 +| Date d’acquisition | Prix achat | Prix vente | Actions | Frais | Gain | +|--------------------+------------+------------+---------+-------+--------| +| 10 mars 2023 en $ | 48.89 | 51.97 | 76 | 12.54 | 221.54 | +| #ERROR | 44.38 | 47.18 | 68.99 | 11.38 | 201.11 | +#+TBLFM: @2$6=(((@2$3-@2$2)*@2$4) - @2$5);%.2f +#+TBLFM: @3=@2*$eu_05_04;%.2f + +** 16 juin 2023 (vente 236 RSU => 775.31€) 2 vente + + +| Actions à vendre | 236 | +| Prix du marché par unité | × 48,82 $US | +| Produit | 12 349,88 $US | +| Frais de VEF/CCA | - 7,50 $US | +| Processing Fee | - 5,00 $US | +| Frais de transaction supplémentaires | - 0,10 $US | +| Produit net | 12 337,28 $US | +| Conversion de la devise | × 0,898033 | +| Produit net converti | 11 079,29 € | +| Gain ou perte de capital | −827,42 $US | + + +#+CONSTANTS: eu_16_06=0.898033 +| Date d’acquisition | Prix achat | Prix vente | Actions | Frais | Gain | +|--------------------+------------+------------+---------+-------+--------| +| 10 mai 2023 en $ | 46.70 | 52.33 | 59 | 12.57 | 319.60 | +| #ERROR | 41.94 | 46.99 | 52.98 | 11.29 | 287.01 | +| 10 juin 2023 en $ | 49.53 | 52.33 | 177 | | 495.60 | +| #ERROR | 44.48 | 46.99 | 158.95 | 0.00 | 445.07 | +|--------------------+------------+------------+---------+-------+--------| +| Total | | | | | 732.08 | +#+TBLFM: $6=((($3-$2)*$4) - $5);%.2f +#+TBLFM: @3=@2*$eu_16_06;%.2f +#+TBLFM: @5=@4*$eu_16_06;%.2f +#+TBLFM: @>$6=vsum(@3$6,@5$6);%.2f + +** 4 juillet 2023 (vente 149 ESPP => -107.53€) 1 vente + +| Actions à vendre | 149 | +| Prix du marché par unité | × 50,93 $US | +| Produit | 7 588,57 $US | +| Frais de VEF/CCA | - 7,50 $US | +| Processing Fee | - 5,00 $US | +| Frais de transaction supplémentaires | - 0,07 $US | +| Produit net | 7 576,00 $US | +| Conversion de la devise | × 0,897208 | +| Produit net converti | 6 797,25 € | +| Revenu ordinaire | 2 313,97 $US | +| Gain ou perte de capital | −120,69 $US | + +#+CONSTANTS: eu_04_07=0.897208 +| Date d’acquisition | Prix achat | Prix vente | Actions | Frais | Gain $ | Gain | +|---------------------+------------+------------+---------+-------+---------+---------| +| 4 juillet 2023 en $ | 51.65 | 50.93 | 149 | 12.57 | -119.85 | -107.53 | +| #ERROR | 46.34 | 45.69 | 133.68 | 11.28 | -107.53 | -96.48 | +#+TBLFM: @2$6=(((@2$3-@2$2)*@2$4) - @2$5);%.2f +#+TBLFM: @3=@2*$eu_04_07;%.2f + +** 26 juillet 2023 (vente 19 ESPP => -24€) 1 vente + + +| Actions à vendre | 19 | +| Prix du marché par unité | × 53,1649 $US | +| Produit | 1 010,13 $US | +| Frais de VEF/CCA | - 7,50 $US | +| Processing Fee | - 5,00 $US | +| Frais de transaction supplémentaires | - 0,01 $US | +| Produit net | 997,62 $US | +| Conversion de la devise | × 0,891041 | +| Produit net converti | 888,92 € | +| Revenu ordinaire | 295,07 $US | +| Gain ou perte de capital | 27,07 $US | + +#+CONSTANTS: eu_26_07=0.891041 +| Date d’acquisition | Prix achat | Prix vente | Actions | Frais | Gain $ | Gain | +|---------------------+------------+------------+---------+-------+--------+--------| +| 3 janvier 2023 en $ | 53.93 | 53.1649 | 19 | 12.51 | -27.05 | -24.10 | +| #ERROR | 48.05 | 47.37 | 16.93 | 11.15 | -24.10 | -21.47 | +#+TBLFM: @2$6=(((@2$3-@2$2)*@2$4) - @2$5);%.2f +#+TBLFM: @3=@2*$eu_26_07;%.2f + +** 15 aout 2023 (vente 61 RSU => 3€) 1 vente + + +| actions à vendre | 61 | +| Prix du marché par unité | × 53,67 $US | +| Produit | 3 273,87 $US | +| Frais de VEF/CCA | - 7,50 $US | +| Processing Fee | - 5,00 $US | +| Frais de transaction supplémentaires | - 0,03 $US | +| Produit net | 3 261,34 $US | +| Conversion de la devise | × 0,905048 | +| Produit net converti | 2 951,67 € | + + +#+CONSTANTS: eu_15_08=0.905048 +| Date d’acquisition | Prix achat | Prix vente | Actions | Frais | Gain | +|--------------------+------------+------------+---------+-------+------| +| 10 aout 2023 en $ | 53.41 | 53.67 | 61 | 12.53 | 3.33 | +| #ERROR | 48.34 | 48.57 | 55.21 | 11.34 | 3.01 | +#+TBLFM: @2$6=(((@2$3-@2$2)*@2$4) - @2$5);%.2f +#+TBLFM: @3=@2*$eu_15_08;%.2f + +** 19 septembre 2023 (vente 87 RSU => -57.35€) 1 vente + + +| Actions à vendre | 87 | +| Prix du marché par unité | × 56,19 $US | +| Produit | 4 888,53 $US | +| Frais de VEF/CCA | - 7,50 $US | +| Processing Fee | - 5,00 $US | +| Frais de transaction supplémentaires | - 0,04 $US | +| Produit net | 4 875,99 $US | +| Conversion de la devise | × 0,923115 | +| Produit net converti | 4 501,10 | + +#+CONSTANTS: eu_19_09=0.923115 +| Date d’acquisition | Prix achat | Prix vente | Actions | Frais | Gain | +|------------------------+------------+------------+---------+-------+--------| +| 10 septembre 2023 en $ | 56.76 | 56.19 | 87 | 12.54 | -62.13 | +| #ERROR | 52.40 | 51.87 | 80.31 | 11.58 | -57.35 | +#+TBLFM: $6=((($3-$2)*$4) - $5);%.2f +#+TBLFM: @3=@2*$eu_19_09;%.2f + +** 15 novembre 2023 (vente 182 RSU => 156.69€) 1 vente + +| Actions à vendre | 182 | +| Prix du marché par unité | × 53,27 $US | +| Produit | 9 695,14 $US | +| Frais de VEF/CCA | - 7,50 $US | +| Processing Fee | - 5,00 $US | +| Frais de transaction supplémentaires | - 0,08 $US | +| Produit net | 9 682,56 $US | +| Conversion de la devise | × 0,905196 | +| Produit net converti | 8 764,61 € | + +#+CONSTANTS: eu_15_10=0.905196 +| Date d’acquisition | Prix achat | Prix vente | Actions | Frais | Gain | +|-----------------------+------------+------------+---------+-------+--------| +| 10 novembre 2023 en $ | 52.25 | 53.27 | 182 | 12.54 | 173.10 | +| #ERROR | 47.30 | 48.22 | 164.75 | 11.35 | 156.69 | +#+TBLFM: $6=((($3-$2)*$4) - $5);%.2f +#+TBLFM: @3=@2*$eu_15_10;%.2f + +* Dons (7UD) + + +| assoc | don | +|-------------------------+-----| +| Unicef | 276 | +| Medecins Sans Frontiere | 120 | +|-------------------------+-----| +| | 396 | diff --git a/notes/mdph_recours.html b/notes/mdph_recours.html deleted file mode 100644 index 90f65ecd..00000000 --- a/notes/mdph_recours.html +++ /dev/null @@ -1,201 +0,0 @@ - - - - - - - - MDPH recours - - - - -
-

MDPH recours

-

Yann & Krystelle Esposito

-

[2021-12-22 Wed]

-
-

Nous demandons une réévaluation du dossier de notre fille, soit:

- -

Demande reconnaissance d'au moins 80% de handicap

-

Depuis avril 2021, date de la demande de création de dossier MDPH, l'anxiété et l'autonomie de notre fille Anna se sont dégradées.

-

Une ALD à 100% vient de lui être octroyée (cf attestation). Compte tenu de la majoration de ses angoisses et en s'appuyant sur le guide d'appui aux pratiques des maisons départementales des personnes handicapées de la Caisse Nationale de Solidarité pour l'Autonomie (CNSA, cf document en annexe) Anna est dans l'incapacité absolue de réaliser des actes et activités simples de la vie courante comme :

- -

C'est pourquoi nous vous demandons de réévaluer son taux de handicap à au moins 80%. Et aussi par conséquent de réévaluer l'AEEH complémentaire à la hausse.

-

Description des crises

-

L'intensité des crises d'angoisses autistiques de notre fille sont invalidantes. Ses dernières vont jusqu'à provoquer une incapacité à se mouvoir, hyperventilation, cécité et surdité temporaires, pertes de sensations. Lors des crises les risques de chutes sont présents car elle n'arrive pas à tenir la station debout. Afin d'assurer sa sécurité il est pratiquement impossible de la laisser seule, sauf chez elle.

-

Les crises sont provoquées par :

- -

Elle n'arrive à gérer les hyperstimulations que pendant une courte période. Attendre à une caisse peut, pour elle, être elle un calvaire. Si cela dure un peu trop longtemps, ou qu'une personne la touche par inadvertance, il n'y a pas d'autre solution que de sortir du magasin, en laissant le caddie pour retourner dans la voiture. Je vous laisse imaginer la difficulté pour traverser un parking avec une personne en crise que l'on ne peut pas toucher, qui ne voit et n'entend pratiquement rien !

-

C'est pour cela que nous vous demandons la CMI Invalidité/Priorité et Stationnement.

-

Scolarité

-

La phobie scolaire de notre fille l'empêche d'avoir un enseignement dans un établissement ordinaire. Nous avons essayé le CNED à domicile, cela fut un échec, car son anxiété de performance et son isolement social ont été à leurs apogées.

-

Pour l'aider, depuis septembre, nous avons orienté Anna vers un établissement privé à très petit effectif. Cela est toujours difficile pour elle (incapacité à assister à tous les cours à cause de son anxiété et de sa fatiguabilité), mais nous avons constaté avec les équipes médicales et pédagogiques de réels progrès d'autant plus qu'Anna est douée, motivée et intéressée par les études.

-

Cependant cela à un coût élevé.

-

Chien d'assistance

-

Pour la soutenir dans ses efforts et avec l'appui de sa psychiatre et de son psychologue (cf certificats médicaux joins) nous avons pour projet d'adopter un chien d'assistance qui pourrait :

- -

Anna est très motivée par ce projet, c'est pourquoi il est indispensable qu'elle puisse bénéficier de la carte CMI ainsi que d'un taux de handicap reconnu à au moins 50% sans lesquels un chien d'assistance ne pourrait pas lui être attribué.

-

Conclusion

-

Bien que le TSA ne sera jamais soigné, avec les bons soins et les bons outils, elle peut arriver à vivre avec ses phobies et devenir un membre actif, responsable et épanouie de notre société. C'est pourquoi nous avons besoin de la reconnaissance de handicap d'au moins 80% et de la carte CMI Invalidité/Priorité pour qu'on puisse lui attribuer un chien d'assistance qui est essentiel à la réalisation de son projet de vie.

- - diff --git a/notes/on_software_programming_evolution.org b/notes/on_software_programming_evolution.org new file mode 100644 index 00000000..06c0baec --- /dev/null +++ b/notes/on_software_programming_evolution.org @@ -0,0 +1,110 @@ +:PROPERTIES: +:ID: 3acde895-6fb6-433a-a46c-3ebd0dedcdbe +:END: +#+title: On software programming evolution +#+Author: Yann Esposito +#+Date: [2024-02-10] + +- tags :: +- source :: + +* Software Programming + +My first contact with programming occurred when I was about 10 years old. +I was confronted with BASIC on a local computer. +BASIC was the UI you need to use to do anything interesting with your computer. + +The hardware interface was, a keyboard, two joysticks with a single button and +an electronic pen. +You could push your pen on the screen and the computer could detect the position +of your pen. + +So as a child, to play any game I needed to put a magnetic tape in a recorder +and wait for prompt to show and write something like: + +#+begin_src basic +RUN "" +#+end_src + +And after a while I saw that you could play with this computer by writing +commands to draw things on the screen. +And quickly I copied from a book a few commands to make a loop that drawed +lines. +And I felt it was incredible. Just drawing a few lines on the computer because, +I could control how these lines were drawn. + +It wasn't easy to grasp what and how I could change things. But after a while I +did my first computer program that was really useful. + +Of course, if I wanted to draw the same thing again, I needed to write the +program from scratch all over again. + +I was lucky enough to also have to play with LOGO, and other programming +languages. +Year passed and I familiarized myself with Pascal. +Then I really started my studies and really learned how to program. +And a program was always something you mostly controlled. + +The mysterious part for a long time was the driver interface. +I could write program that did various complex things. +But I wouldn't be able to explain how my program could really write on the +screen, or print something on a printer, etc… +The layer provided by the OS was long a mystery to me. + +But mainly you had to accept the "Standard Library" that comes with your compiler. +That can makes commands like `println` to really print a string into your +terminal on your screen. + +And I quickly understood that if I wanted to create games or any kind of +graphics you need to adopt an external component. A Graphic Library which +exposed function that, if you used them, somehow, magically did things on the +screen. Or generate some sounds. + +But mainly, that was it. + +A program has always been, for a very long time something starting with the +standard library provided with the compiler of your programming language (C, +Pascal, Java, etc…), and perhaps, you need to install *ONE* big dependency. Like +QT, or something else. And that was it. +You started mostly from scratch every time. + +Then, years passed, and I started to earn money for programming. +And slowly, I witnessed the evolution of programs. +From a single man, a small team work from scratch. +To... a kind of social construction. + +In particular, I saw how Silicon Valley startups could use the power of many +open source projects, use many libraries to build more complex programs. +And it really changed the pace of the production of the end product. +But, more and more, people started to forget about this initial art of writing +something from scratch without the help of an external library or framework. + +Now, I feel, the situation appear to be a bit ridiculous. +We are not even talking about library but people consider to use paying services +instead of libs to provide and publish an application. +And what is left to software engineer is about how to put these external, paying +tools together. + +Of course, there is always a bit of code you need to write, but the objects you +manipulate are already pretty abstract things coming from external libraries. +And somehow, this is so much ingrained in people minds now, that people are +afraid to build something themselves. They prefer the comfort of using a bloated +external code that provide a feature they need. Generally, you introduce a new +dependency that could be quite big just for a small part of the proposed features. +This is not only code, but also, publication of your application that is done +that way. + +Instead of executing a binary on your own machine, or a machine you lend. +You kind of package all this in many layers of complex things. +Part of the complexity is justified, but probably a big part is not for most +applications. +This has simply became "best practices" to deploy and publish an application. +You add tons of dependencies, which are pretty huge comparatively to the feature +your app will provide, you deploy them in "the Cloud", or a pretty expensive +lent computers, generally inside a containers with a complex topology of +machines and services. + +To me it looks like an incredible waste of resources for most use case. +But as this is "cheap" nobody really cares. +But, doing things this way kind of removed the magic of feeling in control and +feeling that you really built something you understand top to bottom. diff --git a/notes/protection_juridique.org b/notes/protection_juridique.org new file mode 100644 index 00000000..031bae6d --- /dev/null +++ b/notes/protection_juridique.org @@ -0,0 +1,78 @@ +:PROPERTIES: +:ID: a6cd5474-53e9-465e-8f49-f544199ccb40 +:END: +#+Title: Protection Juridique +#+Author: Yann Esposito +#+Date: [2024-05-29] +#+Lang: fr + +- tags :: +- source :: + +* Contacts + +Le CSE n'intervient à aucun moment dans les échanges et procédures avec Solucia +Protection Juridique. +Pour avoir recours à leurs services, vous devez les contactez directement par +téléphone, en indiquant le numéro du contrat. + +Pour contacter Solucia Protection Juridique : + +Tel: 09 69 39 94 88 (du lundi au samedi, de 9 h à 20 h) +Code partenaire : 1000 63 99 + +* Toyota + +Envoyer courrier recommander. +Juridique. + +Pour la preuve, de la réception de la partie adverse. +Courrier avec délais recommandé de 15j a partir de la date de réception. + +** 1er courrier + +Objet: Erreur de carte grise - Changement de propriétaire + +Bonjour, + +Le 7 février 2024, nous avons contacté le service administratif pour faire par d'une +erreur de votre part lors de la création de la carte grise de la Aygo que j'ai +achetée le 26 février 2021. + +Bien qu'ayant acheté ce véhicule neuf, le propriétaire est Toyota Kredibank GMBH +et non pas Krystelle Esposito. + +Depuis mon déménagement je ne peux pas faire une procédure de changement +d'adresse car nous n'en sommes pas le propriétaire. + +Nous avons bien reçu deux courriels en février de la part du service administratif nous +demandant de fournir les documents nécessaires au changement de propriétaire de +la carte grise. +Nous avons pu joindre un peu après avoir envoyer ces documents une personne de vos +services qui nous a confirmer s'en occuper dans un délai proche. + +Malgré nos tentatives pour obtenir un retour de vos services - plusieurs +messages téléphoniques et des courriels avec mes coordonnées - nous n'avons depuis +reçu aucune nouvelle. +C'est pourquoi je vous envoie ce courrier avec accusé de réception pour +m'enquérir de l'avancement du changement de propriétaire de la carte grise de notre +Toyota Aygo. + +Je joins à nouveau les documents demandés, à savoir : + +- Une photocopie de la carte d'immatriculation de la Toyota Aygo +- Un mandat signé pour effectuer les formalités d'immatriculation auprès du ministère de l'Intérieur +- Une photocopie de la carte d'identité de Krystelle Esposito +- Une attestation de domicile + +Si je n'ai pas reçu une réponse de votre part dans les 15 jours suivant la date +de réception de cette lettre, j'aurai été contraint de lancer une procédure +judiciaire. + +Je vous prie d'accueillir favorablement ma requête et de prendre en compte mon +cas avec urgence. Je serai reconnaissant si vous pouviez me contacter pour +discuter plus avant de cette affaire. + +Cordialement, + +Krystelle & Yann Esposito. diff --git a/notes/retrieve_tokens_for_ai_assistant.org b/notes/retrieve_tokens_for_ai_assistant.org new file mode 100644 index 00000000..57e4ce8b --- /dev/null +++ b/notes/retrieve_tokens_for_ai_assistant.org @@ -0,0 +1,21 @@ +:PROPERTIES: +:ID: 7d934841-a145-4833-8389-18ba449a6de7 +:END: +#+title: Retrieve Tokens for AI Assistant +#+Author: Yann Esposito +#+Date: [2024-02-09] + +- tags :: +- source :: + +* TL;DR + +1. Call =/iroh/oauth2/custom/tokens= with body =client_id=client-ai-assistant= and + the user JWT as bearer token in the Authorization header. +2. From there you could use the access token to call the AI Assistant API. + + +* Working Example + + + + +*** Functional Requirements + +We plan on using part of the XDR UI inside another Web application SCC. +SCC is in charge of centralizing customer products and users. The SCC UI +session will be handled via a /PIAM token/[^1]. + +*** Specification + +**** PIAM Terminology and concepts + +An Enterprise can access to different regions. +Into each region, we can have "Platform Group". +Within each Platform Group, you can have at most 1 IROH headless org. +Or if the org upgrade to XDR 1 IROH and 1 XDR with the exact same tenant-id. + +Example from PIAM doc; PIAM Enterprise Structure + +#+NAME: Enterprise_0 +#+begin_src mermaid :file scc_integration_piam_enterprise_structure_0.png +flowchart TB; + Enterprise_3443 --> NAM + Enterprise_3443 --> APJC + NAM --> PlatformGroup_1 + APJC --> PlatformGroup_2 + NAM --> SecureAccess_49b9 + PlatformGroup_1 --> IROH_f122b + PlatformGroup_1 --> SSX_358e + APJC --> CDO_193a + PlatformGroup_2 --> IROH_57db + PlatformGroup_2 --> SSX_9dc5 +#+end_src + +Then the customer buy XDR in NAM in =PlatformGroup_1= + +#+NAME: Enterprise_1 +#+begin_src mermaid :file scc_integration_piam_enterprise_structure_1.png +flowchart TB; + Enterprise_3443 --> NAM + Enterprise_3443 --> APJC + NAM --> PlatformGroup_1 + APJC --> PlatformGroup_2 + NAM --> SecureAccess_49b9 + PlatformGroup_1 --> IROH_f122b + PlatformGroup_1 --> XDR_f122b + PlatformGroup_1 --> SSX_358e + APJC --> CDO_193a + PlatformGroup_2 --> IROH_57db + PlatformGroup_2 --> SSX_9dc5 +#+end_src + + +Then the customer buy a new XDR in NAM, they need to create a new Platform Group: + +#+NAME: Enterprise_2 +#+begin_src mermaid :file scc_integration_piam_enterprise_structure_2.png +flowchart TB; + Enterprise_3443 --> NAM + Enterprise_3443 --> APJC + NAM --> PlatformGroup_1 + APJC --> PlatformGroup_2 + NAM --> PlatformGroup_3 + NAM --> SecureAccess_49b9 + PlatformGroup_1 --> IROH_f122b + PlatformGroup_1 --> XDR_f122b + PlatformGroup_1 --> SSX_358e + PlatformGroup_3 --> IROH_1234 + PlatformGroup_3 --> XDR_1234 + APJC --> CDO_193a + PlatformGroup_2 --> IROH_57db + PlatformGroup_2 --> SSX_9dc5 +#+end_src + +***** PIAM Tokens + +A PIAM Token is a JWT signed and issued by PIAM. + +A client can request PIAM to issue a token. Depending on the requested scopes +and the identity of the client and parameter of the request different PIAM Token +could be generated. + +For this specific work we are interested in two different kind of tokens. + +- Tokens for SCC audience. +- Tokens for some Application (for example DI) + +In both cases, for this feature we are interested in the following claims: +- ~sub~: the PIAM identity which is an *email* and not an unique identifier, AN EMAIL! +- ~security-cloud~ claim which contain a list of strings. Each of this string is + intended to be parsed to represent a "Product Access". + For example the string + ="security:iroh:integration-admin:e0b9859c-3bdd-4e6c-87de-c7fb8caf122b"= + represent the fact that this token can give access to the product /iroh/ with + the role /integration-admin/ for the /tenant id/ =e0b9859c-3bdd-4e6c-87de-c7fb8caf122b=. + :warning: + IT IS NOT FIXED WHAT /tenant id/ WILL BE, FOR NOW, THIS IS THE IROH ORG-ID. + BUT IT IS PLANNED TO BE A /product tenant id/ GENERATED BY PIAM AND SAVED IN PIAM. + +For the three different states shown for <>, <> and +<>, the ~security-cloud~ , for a token dedicated to use the SCC UI will contain: + +For <> + +#+begin_src +"security-cloud": [ + "security:enterprise:member:2a715451-c4c2-4d46-b3e3-69d8b53b3443", + "security:iroh:integrations-admin:e0b9859c-3bdd-4e6c-87de-c7fb8caf122b", + "security:iroh:integrations-admin:61ad26da-bf66-44f3-9648-738704b957db" +] +#+end_src + +For <> + +#+begin_src +"security-cloud": [ + "security:enterprise:member:2a715451-c4c2-4d46-b3e3-69d8b53b3443", + "security:iroh:integrations-admin:e0b9859c-3bdd-4e6c-87de-c7fb8caf122b", + "security:iroh:integrations-admin:61ad26da-bf66-44f3-9648-738704b957db" +] +#+end_src + +For <> + +#+begin_src +"security-cloud": [ + "security:enterprise:member:2a715451-c4c2-4d46-b3e3-69d8b53b3443", + "security:iroh:integrations-admin:e0b9859c-3bdd-4e6c-87de-c7fb8caf122b", + "security:iroh:integrations-admin:61ad26da-bf66-44f3-9648-738704b957db" + "security:iroh:integrations-admin:12345678-ae36-1afb-3633-acf7147db123" +] +#+end_src + + +** Tasks + +- Create Token Exchange API (still working on gathering technical details) +- JIT user sync between PIAM and IROH (still need a few details) +- New module auth in IROH to support PIAM Auth (cc @msprunck) +- Create new role for PIAM Administrators within XDR (to be defined by PM) +- Role mapping with SCSO (to be defined by PM) +- SecureX Orgs migration to Common Orgs @yogsototh: should be handled via + Brownfield attach API effort, otherwise there is no known way to send the IROH + tenant ID to PIAM/SCC. As such this should be customer driven, and the related + work has not yet started for Q3. +- Licence Restriction in XDR based on module capability (cc @msprunck) +- Disable XDR functionality from IROH when XDR license expires (see another + comment expect about 1 to 2 releases of dev work, 1 to 2 releases of team + sync, perhaps more depending on the other team) + +*[Update 2024-03-14]: new tasks discovered after PIAM sync*: + +- Universal PIAM API with different onboard rules: + - creating an headless IROH Org + - creating an XDR Org + - upgrading an headless IROH Org to an XDR Org + - downgrading an XDR Org to an headless IROH Org +- Add a new Middleware to support PIAM token, we should also look for a header + containing a ~product-tenant-id~ in order to be able to transform this request + with a valid IROH user request-identity. +- Update the Universal PIAM API to keep track of the ~product-tenant-id~. +- Create a migration script to attach the PIAM ~product-tenant-id~ to existing IROH ~org-id~. + +*[Update 2024-03-18]: need to support Secure Client UI* + +- secure-client flag in the Org +- init flag of Orgs using Secure Access team to set +- Add secure-client flag during the provisioning +- Handle Invite flow target URL +- Show the Org flags (labels, applications) in the Registration UI + +#+begin_quote +Org Flags: + - scc + - xdr + - secure-client + - sx +#+end_quote + +[^1]: [PIAM Token Doc (+ tenant, user, rbac)](https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/access-control/index.md) + +** Detailled Tasks + +#+begin_quote +Unfixed Vocabulary: + +- headless org, common org +#+end_quote + +*** PIAM ⇒ IROH token + +From [[https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/access-control/index.md#example][PIAM Access Control Doc]] + +The PIAM token will look like: + +#+begin_src js +{ + "ver": 1, + "jti": "AT.zWFQnc9MVJQ9wtjFgzzCK88lqTNS3OshQJdQCOeCTHs", + "iss": "https://sso-staging.test.security.cisco.com/oauth2/aus3uzfwpumAvDegH357", + "aud": "api://preprod-mercury", + "iat": 1701291945, + "exp": 1701295545, + "cid": "0oa9sca662IshmWh1357", + "uid": "00udtubj15dIiqKti357", + "scp": [ + "email", + "openid", + "profile", + "security-cloud", + "security:xdr", + "security:cdo", + "security:ssx" + ], + "auth_time": 1701291942, + "sub": "rhofschn@cisco.com", + "security-cloud": [ + "security:enterprise:member:2a715451-c4c2-4d46-b3e3-69d8b53b3443", + "security:xdr:admin:e0b9859c-3bdd-4e6c-87de-c7fb8caf122b", + "security:cdo:read-only:5dbd3bb4-0e67-4379-a231-068c930a6e41", + "security:ssx:create-device:4ed0c951-4027-43e0-846f-b1b12789358e", + ], + "client-product": "xdr" +} +#+end_src + +Expectations: + +1. The PIAM token `security-cloud` claim will contain one and only one value + starting with `security:xdr:`. +2. PIAM will know the target region to call the correct XDR region URL. + +We will expose an endpoint: + +- ~POST /iroh/cisco-piam/token~ that given a PIAM token in the ~Authorization~ + header as Bearer token will: + 1. Look up for: + - user-email = sub claim of PIAM token + - org-id = TENANT_ID part of the ~security:xdr~ block + 2. If no org is found ⇒ return a 400 error + If the org is found ⇒ tag that org as an headless-compatible org + 3. If no user found; Create the new User and return a couple (IROH Session + Token/Session Refresh Token) + If user if found; optionally update the user (role) if necessary and return + a couple IROH Session Token/Session Refresh Token). + 4. Notes; + - User created via this JIT should have a specific flag to mark they were created via PIAM + - The token will have a specific audience + +*** Just In Time User sync + +We will only synchronize user on user login. No service to service +synchronization mechanism. For example, if a user is deleted from PIAM server +this user will never be deleted from IROH server. + +*Expectations*: +a. the role specified in the value for XDR product in the ~security-cloud~ claim + will always be ~admin~. +OR +b. the role specified in the value for XDR product in the ~security-cloud~ claim + will always be a valid, known XDR role id (~admin~, ~user~ or ~sat~ , for now). + +User will created or updated upon calls to retrieve an IROH token from a PIAM +Token only. + +Invitations as well as Organization Access Requests will still be handled by IROH. +This mean that a user login into SCC could create a user in an XDR tenant. +BUT, a user having access to this XDR tenant will not necessarily have an SCC account. + +In order to improve any future decision, we need to flag Users object to +determine if they only access XDR via SCC portal or if they login directly in +XDR or both. + +**** Subtasks + +- [ ] Add a flag when a user login into XDR so we will be able to know if user + logged in only via SCC, only via XDR or both. I suggest adding a field + ~{:login-product #{(s/enum :scc :xdr :sx :ctr :orbital :internal)}}~ and using + the ~allowed-login-origins~ to add a tag of the login product. + Ideally we could then support adding the login origin in the ~aud~ of the JWT. + +*** DELEGATED New module Auth in IROH to support PIAM token (cc @msprunck) +*** DELEGATED Role mapping with SCSO (to be defined by PM probably all admin) +*** SX Org migration (Brownfield attach mechanism enough?) YES +*** DELEGATED License Restriction in XDR based on module capability (cc @msprunck) +*** Disable XDR Functionalities when XDR license expires + +**** Change the org mode back to ~common~ (1 to 2 releases) + +Expectations: + +- The common org should already be tagged as ~common~. +- Every common org should have an ~enterprise-id~. + +Changes: + +Currently we have a single /scopes matrix/ with a "fake role" to simulate +admin user from inactive Orgs. +This need to be changed by a function that given an Org and its Entitlements +returns a /scopes matrix/. (Ideally sharing the same lines). +More precisely we will only need 3 scopes matrix in total: + +- a scopes matrix for XDR orgs +- a scopes matrix for inactive XDR orgs +- a scopes matrix for inactive XDR Org which are also a common Org + +Sub tasks: + +1. Make a decision about the list of scopes for the two new matrix, perhaps + there will be a need to have different matrices before and after SX EOL. + a. after SX EOL, unactivated and non common org are fully disabled (I don't + think that's the case to continue to support SE / Orbital for example) + b. after SX EOL, there will be an UI that should work for all possible + "scopes set". We are talking about 1 scopes-set per role per matrix. + Currently 6 scopes set (admin, user, sat). + +I would expect the scopes choice to be done in a few days, and about 1 to 2 releases +(2 to 4 weeks for the code change). + +**** Disabling Products +***** SXO (0 release, should already be supported) + +We could immediately remove the ~ao~ scope and it should be enough to prevent +Automation usage. + +SXO is already consuming Entitlement changes events and thus could detect and +Org becomes inactive and could therefore do the necessary tasks inside SXO. + +***** DAP / SCA (1 to 2 releases about team syncing, close to 0 dev effort) + +We need to configure a new hook on ~EntitlementSummary~ changes so this could +trigger a decommission. + +It should be a matter of adding a webhook with some configuration. So here we +mostly need time to sync with the dev teams to configure the webhooks. +Creating a new webhook should be easy but we will probably need a few days to +gather all necessary data to create this configuration. + +*** Org Schema change + +IROH will be an API that will be used for two different Applications. +SCC and XDR. +Notice IROH is already used as API for many different applications; +- CTR, +- SecureX, +- XDR, +- Orbital, +- Registration UI, +- Tactical Portal. +- IROH-Admin, +- SecureX UI Dev Env + +So SCC will be one more to add, but this time the login method will be different. +Also while all other existing cases are mostly synchronous, we should start to +enforce a lot better the application accessible or not. + +Regarding the functionality I suggest not to be too precise and only mention +SCC, XDR and SecureX. + +#+begin_src clojure +(s/defschema AllowedApplications + (s/enum :scc :xdr :sx)) +#+end_src + +This should probably not be used to enforce anything from the backend yet, but +should be useful for the UI and will help have a better data structure internally. +Currently we create a view with ~xdr-enabled?~, ~sx-enabled?~ etc… +It will be nice to transform this set to add many flags, the new one will be ~scc-enabled?~. + +With the current plan, every XDR org will be ~scc-enabled~, but some might not be +~xdr-enabled~, and all will have ~sx-enabled~ set to false. And we need to planify a +time where ~sx~ app will be removed. + +*** User Schema change +When we receive a token exchange to generate an IROH token with a PIAM token +containing in the ~security-cloud~ claim a value starting with ~security:iroh:~ then +we should mark that user to be an scc user. + +When we receive a token exchange or when a user login as usual, we should mark +that user to be an xdr user. + +*** Update Universal Provisioning + +Add a query parameter to the Universal Provisioning API (typically ~&headless=true~). +If the provisioning occurs with this parameter then: only onboard DI and SCC. +Keep track of the onboarding state somewhere (perhaps just looking for existing +module instances) + +If a provisioning occurs without this parameter then onboard DI, SCC, SXO & SCA. +If we receive an update: + onboard the missing product (looking at module instances) SXO & SCA. + +*** PIAM token support middleware + +We need a middleware that provide the ability to translate a PIAM token to an +IROH identity. +We already have a mechanism that depending on the JWT issuer returns a different user-identity. + +We should have a mechanism so that an API could accept PIAM token for both cases: + +- we just have the PIAM token, this API is not IROH tenant scoped. +- we have the PIAM token as well as a tenant-id (either PIAM product-tenant-id + or IROH org-id) and the API will be tenant scoped + +*** Update Universal Provisioning to track PIAM product-tenant-id +*** Create a migration script to attach the PIAM product-tenant-id to existing IROH org-id + +For every org provisioned before we keep track of the product-tenant-id we +should attach a product-tenant-id to the org. + +* Official Tasks + +[[https://airtable.com/appZKQe0zXhVMepC8/shrdGCDFRzqZoIIFc/tblP6J2lMHF942Emq][Airtable list]] + +- create a token exchange API +- JIT user sync between PIAM and IROH +- New module auth in IROH to support PIAM Auth +- Create new role for PIAM Administrators within XDR +- Role Mapping with Security Cloud Sign-on +- SX Orgs migration to Common Orgs +- License Restriction in XDR based on module capability +- Disable XDR functionality from IROH when XDR license expires + +Unknown: + +- PM how to handle SCC user vs XDR invited users +* Questions to [[webexteams://im?space=f4791010-c534-11ee-a02f-8b2b472f9d7c][channel]] +** User Session + +Hello All! + +I have a few technical questions for which I would like some clarifications. + +The plan as I understood would be to integrate some external UI to the SCC UI. +And this external UI will need to "exchange" the session of the user logged into +SCC into a user in IROH. + +As such, I would like to understand how is the session saved in the SCC UI. +Is it a cookie session? If it is, does the session contain a JWT? +If it is a JWT, is it a PIAM token? + +If we want to create a valid token in IROH out of such session we will need at least: + +A ~user-email~, an ~enterprise-id~ and an SCC user role (from my understanding there +are only two SCC roles, which should roughly be admin and user). + +More straight to the point, what would be a secure way to expose an API in IROH +that the integrated UI in SCC could use to exchange an SCC session to an IROH +user token? +If this is a JWT signed by PIAM which contain just an ~user-email~ and an +~enterprise-id~ then this should be fine as I will be able to search for the +single IROH tenant with this ~enterprise-id~ (as I understood we decided to keep +this constraint of preventing multi-XDR tenancy relatively to SCC tenancy). + +Also, let me know if my understanding that we will need to manage different type +of token is true? +I think what we call a _PIAM Token_ is an *access token* which is also a *JWT* that +will contain a list from which we could deduce the user-id and its role for +every product. Like: `::`. +I don't think the session in SCC is maintained using such token, could you +confirm this? + +I also have another question related to the PIAM tokens. +Should we support multiple entries for the same product in the list in the JWT +containing the user-id and role in the external products? + +Thanks! +* Sizing +** [[webexteams://im?space=b62bf8f0-6062-11ed-9564-a57f2c094899&message=c82ce020-db43-11ee-8e37-799ed57689d0][Jyoti question]] +#+begin_quote +2. Disable XDR functionality when XDR license expires (Yann) + a. Change the org mode back to `common` + b. Disable SXO, DAP, SAC tenants +#+end_quote + +*** Disable XDR Functionalities when XDR license expires + +**** Change the org mode back to ~common~ (1 to 2 releases) + +Expectations: + +- The common org should already be tagged as ~common~. +- Every common org should have an ~enterprise-id~. + +Changes: + +Currently we have a single /scopes matrix/ with a "fake role" to simulate +admin user from unactivated Orgs. +This need to be changed by a function that given an Org and its Entitlements +returns a /scopes matrix/. (Ideally sharing the same lines). +More precisely we will only need 3 scopes matrix in total: + +- a scopes matrix for XDR orgs +- a scopes matrix for unactivated XDR orgs +- a scopes matrix for unactivated XDR Org which are also a common Org + +Sub tasks: + +1. Make a decision about the list of scopes for the two new matrix, perhaps + there will be a need to have different matrices before and after SX EOL. + a. after SX EOL, unactivated and non common org are fully disabled (I don't + think that's the case to continue to support SE / Orbital for example) + b. after SX EOL, there will be an UI that should work for all possible + "scopes set". We are talking about 1 scopes-set per role per matrix. + Currently 6 scopes set (admin, user, sat). + +I would expect the scopes choice to be done in a few days, and about 1 to 2 releases +(2 to 4 weeks for the code change). +**** Disabling Products +***** SXO (0 release, should already be supported) + +We could immediately remove the ~ao~ scope and it should be enough to prevent +Automation usage. + +SXO is already consuming Entitlement changes events and thus could detect and +Org becomes inactive and could therefore do the necessary tasks inside SXO. + +***** DAP / SCA (1 to 2 releases about team syncing, close to 0 dev effort) + +We need to configure a new hook on EntitlementSummary changes so this could +trigger a decomission. + +It should be a matter of adding a webhook with some configuration. So here we +mostly need time to sync with the dev teams to configure the webhooks. +Creating a new webhook should be easy but we will probably need a few days to +gather all necessary data to create this configuration. diff --git a/notes/secure_client_and_orbital_sx_eol.org b/notes/secure_client_and_orbital_sx_eol.org new file mode 100644 index 00000000..9fe486c0 --- /dev/null +++ b/notes/secure_client_and_orbital_sx_eol.org @@ -0,0 +1,106 @@ +:PROPERTIES: +:ID: 26867184-57cf-472d-b5db-d6349665184e +:END: +#+title: Secure Client And Orbital SX EOL +#+Author: Yann Esposito +#+Date: [2024-06-26] + +- tags :: +- source :: + +* Orbital Modules Types + +- NAM: ~b7f21c6b-701a-4b45-8a3d-449001844efe~ +- EU: ~2c55baf0-5fa4-4ffc-a263-954920ddd8c6~ +- APJC: ~9b801b44-310d-432a-8668-8611c74415e9~ +- TEST: ~59bbd2bb-b2e9-4fa0-935d-61eafc663a07~ +- INT: ~59bbd2bb-b2e9-4fa0-935d-61eafc663a07~ + + +#+BEGIN_SRC js +{ + "description": "Orbital is an advanced capability in Cisco Secure Endpoint that is designed to make security investigation and threat hunting simple by providing an implementation of powerful Osquery technology on each of your Secure Endpoint-enabled endpoints. Orbital allows you to create custom queries to look across your network for anything of interest, but also comes with over a hundred pre-canned queries, allowing you to quickly run complex queries on any or all endpoints. This capability enables you to gain deeper visibility on what happened to any endpoint at any given time by taking a snapshot of its current state. Whether you are doing an investigation as part of incident response, threat hunting, IT operations, or vulnerability and compliance, we get you the answers you need about your endpoints fast. Orbital can enrich information presented in the relations graph by pivoting into Orbital to query and gather additional intelligence about your host, IP, IP4, IP6, MAC, and OS, etc. The Orbital app is available on the ribbon and it allows you to run a live query. You can view metrics and your recent queries in the right panel.\n\nThis integration also creates a target automatically in Automation for out-of-box workflows.", + "properties": "mPBDSYPMOUhPHmeNfjsPusJFa5qSvyxqkl2bRzDMUcPgWt5NUthziK/hfaBIEnPnAqyml0m8Epl7p4+2LGwJ2ESBCKpUKjzuv0+0RG4xbIxLf+gFRiERjjFwqexQsaexmQPgWflkoMhUar4fj2Crn9M6uh1Wz95FrCt618A2CFyPZaDmsbCBuqvdwMb+SpOuy4Fb9kS7ss5D1qZDzKpDuCwmFYWVwEMFoZUht1Lz0mNEc9DykFdLQFNgdejmSO+gGJRYbTq200+y0aikGc1IIaKStHJ3BB4MOuA3Bn4MO5NqQyRIRilU3JrXrV/m9/tmls2pkDzx0om7ca6VWYhwQtYkSvmGUFZwpzFiOloq76gVVEyIdKS+FOPxD3EPCyaA", + "capabilities": [ + { + "id": "health", + "description": "Healthcheck" + }, + { + "id": "refer", + "description": "Reference links" + }, + { + "id": "device_insights", + "description": "Device Insights" + } + ], + "app_link_meta": { + "url": "https://visibility.amp.cisco.com/iroh/iroh-auth/login?redirect_after_login=https%3A%2F%2Forbital.amp.cisco.com%2Firoh%3Fnext%3DaHR0cHM6Ly9vcmJpdGFsLmFtcC5jaXNjby5jb20v", + "title": "launch" + }, + "tips": "**Prerequisite:** Secure Endpoint Advantage license for North America and European Union.\n\n1. Complete the **Add Integration** form:\n \n * **Integration Name** - Leave the default name or enter a name that is meaningful to you. \n * **Integration with Device Insights** - The Devices feature consolidates your device inventory from multiple device managers into a unified view. \n By default, the check box is checked, which enables Orbital integration with the Devices feature and it allows you to view data from Orbital in Devices. \n Unchecking the check box disables Orbital integration with the Devices feature. Orbital will still integrate with the current platform, you just won’t be able to view data from Orbital in Devices.\n \n2. Click **Add** or **Save** to complete the Orbital integration configuration.", + "logo_dark": "https://brand-assets.security.cisco.com/secure-monochrome/orbital-dark.svg", + "logo": "https://brand-assets.security.cisco.com/secure-monochrome/orbital-light.svg", + "org_id": "964a8c3b-9aef-4e1d-aadf-e2754004d230", + "configuration_spec": [ + { + "key": "custom_enable_device_insight", + "type": "boolean", + "label": "Integration with Device Insights", + "default_value": true + } + ], + "short_description": "Cisco Orbital is a service that uses Osquery to provide you and your applications with detailed information about your hosts.", + "title": "Orbital", + "external_references": [ + { + "link": "https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/advanced-malware-protection/amp-endpoints-faq.pdf", + "label": "FAQ" + }, + { + "link": "https://orbital.amp.cisco.com/help/", + "label": "Help" + }, + { + "link": "https://trustportal.cisco.com/c/dam/r/ctp/docs/privacydatasheet/security/cisco-orbital-advanced-search-privacy-data-sheet.pdf", + "label": "Privacy" + }, + { + "class": "securex:di:asset_source", + "external_id": "securex:di:orbital" + }, + { + "class": "securex:ao:target", + "external_id": "securex:ao:orbital" + } + ], + "updated_at": "2024-03-27T14:30:16.763Z", + "id": "b7f21c6b-701a-4b45-8a3d-449001844efe", + "record": "relay-module.module/RelayModule+Orbital", + "user_id": "7b02b2d4-9961-4167-90ff-328df51f5b65", + "client_id": "iroh-ui", + "default_name": "Orbital", + "flags": [ + "default", + "cisco", + "managed" + ], + "enabled": true, + "visibility": "global", + "created_at": "2020-06-03T17:46:07.479Z" +} + #+END_SRC + + +* Request to create a new module-instance + +#+BEGIN_SRC +POST ${IROH_API}/iroh/iroh-int/module-instance +Authorization: Bearer ${JWT} +Content-Type: application/json + +{"name": "Orbital", + "module_type_id": "${MODULE_TYPE_ID}", + "settings": {"custom_enable_device_insight":true}} +#+END_SRC diff --git a/notes/sx_eol_phase_1.org b/notes/sx_eol_phase_1.org new file mode 100644 index 00000000..bc5cc3f3 --- /dev/null +++ b/notes/sx_eol_phase_1.org @@ -0,0 +1,180 @@ +:PROPERTIES: +:ID: c60e01f9-9513-46f7-85f8-994f90989b2f +:END: +#+title: SX EOL Phase 1 +#+Author: Yann Esposito +#+Date: [2024-04-02] + +- tags :: [[id:91f33b35-6e4e-4213-b214-972ee20722df][Cisco]] +- aha :: https://ciscosecurity.aha.io/epics/XDR-E-164?active_tab=related +- jira :: https://cisco-sbg.atlassian.net/browse/XDR-1523 + +* Epic SecureX EOL Phase 1 + +** Functional Specification +- Org Flag + + XDR Orgs (as usual) + + SC Orgs: + - only two roles (admin and user) + - authorizations: + - manage clients + - manage users (remove allow non-admin user section, should be checked by default) + - manage devices + - audit logs + - profile + - integrations (module-instances) + - no incident activity + - no incident investigation + - no Automation workflow nor response action + + SX-only Orgs (after EOL disabled) +- script to init Org flags +- create a new matrix Org-flags => role->scopes matrix +- reduce module-type +- provision script for SC-only orgs +- Check the org-view provided to Registration-UI to provide the applications flags +- Org switching + + SC Interim UI shows only SC orgs + + XDR UI only show XDR orgs +- Rebrand HTML Error pages (invitation, org join, account disabled, org disabled) +- SE should be able to provision new IROH Org for SC and Orbital + +** Technical Specification +*** Org Applications + +Add the following field to the ~Org~: + +#+begin_src clojure +:apps #{Application} +#+end_src + +Where + +#+begin_src clojure +(s/defschema Application + ;; use comment here because the name will change but the keywords will not + ;; and it will be useful to remember why we used `sc` if Secure Client is renamed to something + ;; else for example + (s/enum :xdr ;; XDR + :sx ;; SecureX to disappear after 31th of July + :sc ;; Secure Client + )) +#+end_src + +Make this field visible. With the following rules: + - org is enabled and has ~cisco/feature-flag/xdr~ in the ~additional-flags~ => provide ~:xdr~ app + - org is enabled and does not have the XDR flag => gives ~:sx~ app + - org is disabled => apps is the empty set + Note there is no way to have the ~sc~ flag without admin intervention + +*** Org View update + +Add a field ~sc-enabled?~ similar to ~sx-enabled?~ and ~xdr-enabled?~ +to the OrgView visible from the Profile API. + +*** Expose an API to manage app flags + +Along the feature-flag API, add a new route that can add/remove App flags. +Decide who can use this API and how (script?). + +*** Write a script to update (by batch) the app flag of an Org + +This would probably be run once before SX EOL date to init the Orgs. + +*** Org Application => Scopes Matrix + +With the introduction of these flags, we will now have 4 specific orgs kind: + +1. xdr org (contains :xdr, we do not care about :sc nor :sx) +2. sc org (does not contain :xdr, but contain :sc, we do not care about :sx presence) +3. sx-only org (does not contain :xdr nor sc, but contain :sx) +4. disabled org; when apps is empty, then we should disable the org (can use + ~get-org~ in the Org service for that, and we might update the DB accordingly) + +#+begin_src clojure +(defn org-scopes-matrix + [org] + (condp contains? (:apps org) + #{:xdr} xdr-scopes-matrix + #{:sc} sc-scopes-matrix + #{:sx} sx-scopes-matrix + empty-scopes-matrix)) +#+end_src + +And then the user scopes will be provided with: + +#+begin_src clojure +(defn user-scopes + [org user] + (let [scopes-matrix (org-scopes-matrix org)] + (scopula/scopes-union + (scopes-from-role (:role user) scopes-matrix) + (:additional-scopes org) + (:additional-scopes user)))) +#+end_src + +*NOTE*: + +- Have a test checking the XDR scopes matrix is a superset of the SC scopes matrix. +- SC scopes matrix is XDR without the scopes ~private-intel~ and ~ao~ and ~response~: + + +*** Depending on XDR apps reduce the visible and allowed list of module-types + +Change the list of available module-types for SC-only Orgs. +The Org service will contain a method named ~org-main-app~ and the logic should be: + +#+begin_src clojure +(defn available-modules + [org entitlement-tier] + (case (org-main-app org) + :xdr (xdr-available-module-types entitlement-tier) + :sc sc-available-module-types + :sx sx-available-module-types + nil)) +#+end_src + +*** Secure Endpoint Provisioning +Secure Endpoint already use the provisioning routes. +But we need some work to: + +1. Add the ~sc~ flag to these org +2. Support async onboarding as well +3. When ~sc~ only provision CSC and DI + +*** Add value in whoami to state we reached SX EOL + +#+begin_src clojure +:before-sx-eol? (describe s/Bool "true before sx-eol false after.") +#+end_src + +* Tasks + +- [X] https://github.com/advthreat/iroh/pull/9175 Org Application +- [X] [[https://github.com/advthreat/iroh/pull/9192]] Org View with Apps +- [X] https://github.com/advthreat/iroh/pull/9195 API to manage app flags +- [ ] Write a script to batch update apps of orgs +- [ ] https://github.com/advthreat/iroh/pull/9247 Add a scopes-matrix per org apps +- [ ] PR that will change SX orgs to SC orgs after SX EOL date. + - [ ] Create a service that manage deadlines dates (from the backend) + - [ ] Exposes the dates managed by this service to the ~/whoami~ endpoint + - [ ] Have an Admin API able to change the list of timers + - [ ] Have SX orgs become SC orgs after ~sx-eol?~ deadline. +- [ ] Org Applications change visibility of modules +- [ ] Provisioning + - [ ] Support adding the ~sc~ app + - [ ] Support async onboarding (or keep non async endpoints conf) + - [ ] When ~sc~ app, only provision CSC and DI + +* Questions + +- What about downgrade? + + XDR orgs have more 3 roles + SC orgs have 2 roles + + 1. customer start with SC + 2. customer then buy XDR, set some user to SAT role (security analyst neither admin nor user) + 3. customer leave XDR, so get back to XDR + Should the TAC role user be back to user? + What if a new role has fewer scopes than SC user? changing their role will + mean escalation of authorization, should we disable them? diff --git a/notes/sx_eol_phase_1_presentation.org b/notes/sx_eol_phase_1_presentation.org new file mode 100644 index 00000000..6e2b2977 --- /dev/null +++ b/notes/sx_eol_phase_1_presentation.org @@ -0,0 +1,58 @@ +:PROPERTIES: +:ID: 7ddbbc9f-a3a9-4ef3-b751-3f12be315482 +:END: +#+title: SX EOL Phase 1 Presentation +#+Author: Yann Esposito +#+Date: [2024-04-23] + +- tags :: +- source :: + +* SecureX EOL Cases + +- What occurs during downgrade +- What occurs for an XDR admin +- What occurs for an SX admin when they go XDR after 31th July +- What occurs to Sat user in XDR if they downgrade to SC? +- What should be the roles + +** Existing SecureX Orgs +*** IdP + +- SXSO => easy +- CSA => should have been migrated to SXSO ? +- TG => some beta Org with the XDR flag but no solution to migrate to PIAM + +*** SX to XDR? + +- XDR feature flag; + - manually added; give access to SX and XDR + - PIAM Provisioning => + - add a PIAM enterprise-id to the Org + - remove access to SX, only XDR becomes available + +*** Downgrading? + +- PIAM Provisioning => remove entitlements ; + undefined behavior + currently no code taking care of this case. + Now: + - the XDR feature-flag stays + - the PIAM enterprise-id is still kept + - remove data retention policy, all data is here forever and never deleted. + So, for example, expired XDR cost more than paying customer. +- Manual downgrade; remove the XDR feature-flag + - XDR UI becomes inaccessible + - XDR roles becomes inaccessible + - if a user with an XDR-role only exists, IROH API, SX UI (or even SC UI) will probably break + + +*** Example + +1. today SX +2. mark it as SC org +3. SX EOL comes => SC org +4. Upgrade to XDR +5. XDR expires +6. ??? should it become back an SC org? I would say yes. + - Same issue with roles diff --git a/notes/the_new_web_and_how_to_achieve_it.org b/notes/the_new_web_and_how_to_achieve_it.org new file mode 100644 index 00000000..08c7684b --- /dev/null +++ b/notes/the_new_web_and_how_to_achieve_it.org @@ -0,0 +1,122 @@ +:PROPERTIES: +:ID: d8304f8a-8db3-4b57-b87a-1d31230fbe93 +:END: +#+title: The new web and how to achieve it +#+Author: Yann Esposito +#+Date: [2024-06-27] + +- tags :: [[id:a5be1daf-1010-428f-a30f-8faf95c1a42f][blog]] +- source :: + +* The new web and how to achieve it + +I was born before the web, and discovered Internet via the web first as most +people. +Clearly now, the web is polluted to the point where it is almost unbearable for +me. +I don't want to start the analysis about exactly went wrong about it. A lot as +already been written about it. +But let just say, people now forgot about the Internet and focus on the Web. + +So the spirit about consuming the Internet changed a lot. +As I remember the Internet, it was first focused on protocols. +People would create a new protocol to provide a feature. +Typically, chat, voice, file sharing, etc… +Let's take for example, chatting. + +The IRC protocol is provide. +The IRC need two applications, an IRC server and an IRC client. +We saw many different IRC servers be built, in different programming languages. +And we saw, also many different IRC clients. +Of course, there was always some tension between some server not respecting +exactly the same conventions than others, but mostly. This was entirely +interoperable. +As a consumer you choose the application you preferred to use IRC. + +And the same occurred for, the Web (even if it has changed a lot; [[org:web-engines][see footnote]]), +file sharing (FTP, sFTP, then so many P2P protocols), discussion/forum (BBS, +Usenet). + +In fact, I would argue that, the "real Internet" consumption, I mean, in the +spirit of the founders was the P2P networks. +The net was supposed to make direct communication between people. + +Not everything was perfect, very far from it. But it had the property of being +really free, as consumer we had a lot more choices. + +So now, we mostly consume the Internet only via the Web and emails. +And, as the Web becomes crap, we see a resurgence from the geekiest between us +of a will to go back to the old direction. Mainly, decentralization to prevent +a single player (generally a big corp) to "enshitify" the experience for +everyone of us. + +I feel the crappy web will be here to stay for a long time. +But, we can do something about it. +First, there is the recent [[https://www.w3.org/TR/activitypub/][ActivityPub]] protocol. +This protocol is recently used to build a [[https://en.wikipedia.org/wiki/Fediverse][Fediverse]]. +I feel this protocol has its flaw, but so far, we have not reached [[https://en.wikipedia.org/wiki/Eternal_September][Eternal +September]] yet and I enjoy [[https://joinmastodon.org][Mastodon]] (a twitter clone) and [[https://join-lemmy.org][Lemmy]] (a reddit +clone) for example. +But I wouldn't write this blog post if I didn't believe that we can do better. + +I feel we reached a point where the web is screwed for good. +It is now time to create another protocol that does not need a "Web Browser". +Here is my doleances: + +- The client of this new protocol should be EASY to write from scratch. +- The client should NEVER allow client-side scripting. +- The language into which we express a rendering should be expressive enough but + NOT Turing Complete, we must have a language that can be proven to stop. +- The user should be in control of the rendering of the content. Disabled people + deserve the right to access the content they way they see fit. + No equivalent of CSS which should naturally provide a more "article" or + "content" type of things. +- Bonuses: + - the client is mostly retro compatible with small-websites. + Can parse basic HTML, will not load js, will not load CSS, will take care of + checking some properties before redirect the user. Ideally we should ask use + HTTP to ask a HEAD on the resource, and check a specific header that tell + us, that yes, this website is compatible with the "small-web" + - the client should also be compatible with gopher and gemini. + + +* Footnotes + +** <> The Web is entirely controlled by Big corps now + +As a reminder, the Web is just one way to consume the Internet. +Internet is about protocols so different computers can communicate across the +globe and beyond. +And I would like to remind a time were attached to every new protocol there were +a set of applications tied to it. +So the Web turns around the HTTP/HTTPs protocols whose content is HTML+CSS+JS. +The Applications to consume the Web are Web browsers. +For web browser to render a website correctly should have a lot of features, so +much that for that you need a /Browser Engine/. +The complexity of these Browser Engine is so huge that it would be very +difficult if not impossible for just a small group of people to be able to +create a new one from scratch. +As of today, there are very few choices, looking at this [[https://en.wikipedia.org/wiki/Comparison_of_browser_engines][Wikipedia page]] there +are only 4 active browser engine. +Most controlled by tech Giants (Apple, Google and Microsoft) and the last one +Gecko is controlled, mostly, by Mozilla but is currently very dependent +financially from Google. + +Does it matter? I think so yes. It is now, very easy, for these big players to +enforce policies that are against consumers best interests. +I guess you can imagine a few of them. +Through the browser engine you could alter the rendering of any website. + +** The new web became an open application download platform. +What really changed recently, is that, we added, layer after layer. +The new web mix content website with applications. +A website that is in fact an application, or contain an application. +As long as you use the application in the "virtual machine" that is the browser +engine, you're good to go. +The system will download the application without any warning, and it will launch +the application without any warning. And you are slightly protected from most +nefarious use case but not all. Typically, I could easily put an js that run +crypto-money mining and there is not really anything you could do about it. +I am even very surprised most website are not already doing something like this. +This might be an even better mechanism to earn money than ads... Anyway, it +would waste so much resources, I'm glad this is not the norm... yet. diff --git a/notes/xdr_monetization.html b/notes/xdr_monetization.html deleted file mode 100644 index e91b2df5..00000000 --- a/notes/xdr_monetization.html +++ /dev/null @@ -1,543 +0,0 @@ - - - - -XDR Monetization - - - - - - - -
-
-
-

XDR Monetization

Yann Esposito

2023-07-12 Wed 00:00

Created: 2023-07-12 Wed 17:38

-
-
- -
- -
-
-

1. Intro

-
-
-
-
-

1.1. What?

-
    -
  • Entitlements: What the customer is paying for.
    • -
  • Access Rules: What services should allow, restrict.
    • - -
- -
-
-

1.2. Example

-
-
-
-
-

1.2.1. Entitlements:

-
    -
  • Tier: Essentials for 1000 users (number of Lees).
    • -
  • Extra Data Retention “add-on”: 180 days
    • -
  • Extra Ingest “add-on”: 2 GB
    • - -
- -
-
-

1.2.2. Access Rule example:

-
    -
  • Total Ingest: 4000GB (1000 user × (2GB + 2GB))
    • -
  • Time to Keep Data: 180 days (yes, extra might not mean what we could expect)
    • - -
- -

-ref: https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/provisioning/xdr/xdr-ga.md#entitlements -

- -
-
-

1.3. How?

-

-Entitlement represent what the customer pays for. -PIAM creates and updates them. -

- - -
-

xdr-monetization-piam-entitlements.png -

-
- -
-
-

1.4. Also Entitlement Summary

-

-IROH exposes an API to retrieve an EntitlementSummary. -A data structure easier to consume than the list of entitlements. -

- - -
-

xdr-monetization-piam-entitlement-summary.png -

-
- -
-
-
-
-

2. Entitlements (technically)

-

-Example of a list of Entitlements sent by PIAM to IROH: -

- -
-
-

2.1. Just the Tier, no add-on:

-
- -
[{"name" "tier",
-  "value" "advantage",
-  "quantity" {"value" 1000, "unit" "users"},
-  "enforce-quantity" true}]
-
-
- - -
-
-

2.2. Tier with add-ons

-
- -
[{"name":"tier",
-  "value":"essentials",
-  "quantity":{"value":1000, "unit":"users"},
-  "enforce-quantity":true},
- {"name":"extra_ingest",
-  "value":"",
-  "quantity":{"value":2, "unit":"GB"},
-  "enforce-quantity":true},
- {"name":"extra_data_retention",
-  "value":"",
-  "quantity":{"value":180, "unit":"days"},
-  "enforce-quantity":true}]
-
-
- -
-
-

2.3. PIAM Doc

-

-From Paul Chichonski’s doc -

- -

-https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/provisioning/product-spec.md#multi-valued-attributes -

- -
-
-

2.3.1. Entitlements

-
    -
  • entitlements – A list of entitlements the tenant is allowed to use. Each item in -the list is an object with the following fields:
    • - -
- -
- -
[{"name":"tier",
-  "value":"essentials",
-  "quantity":{"value":1000, "unit":"users"},
-  "enforce-quantity":true},
- {"name":"extra_ingest",
-  "value":"",
-  "quantity":{"value":2, "unit":"GB"},
-  "enforce-quantity":true}]
-
-
- -
-
-

2.3.2. name

-
    -
  • name – The name of the entitlement (defined as part of the entitlement -controlled vocabulary between PIAM and the product)
    • - -
- -
-
-

2.3.3. value

-
    -
  • value – Some entitlements will have a string value that serves to qualify the -entitlement. For example an entitlement with name=tier may have three -different manifestations if there are three different tiers (e.g., {"name": - "tier", "value": "essentials"}, {"name": "tier", "value": "primary"}, - {"name": "tier", "value": "advantage"})
    • - -
- -
-
-

2.3.4. quantity

-
    -
  • quantity – Some entitlements will have numeric quantity associated with the -entitlement, this represents the amount of this entitlement the tenant is -permitted to consume. Each quantity field will contain an object with the -following values: -
      -
    • value - The number holding the actual quantity.
      • -
    • unit - A string representing what unit to use when interpreting the quantity.
      • - -
    • - -
- -
-
-

2.3.5. quantityenforced

-
    -
  • quantity_enforced – A boolean field, if true it means that the product -should enforce the allocated quantity of the entitlement for this tenant. It -is up to the product to determine how to do this. Cases where this will be -false are if the customer purchased via a buying program that supports a -“pay as you go” pricing model.
    • - -
- -
-
-
-
-

3. Entitlement Summary

-

-The Entitlement Summary provides a data-structure easier to consume -than the entitlements list. -

- -
    -
  • A JSON Object instead of list.
    • -
  • Additional technically useful entries.
    • - -
- -
-
-

3.1. Structure

-

-The main structure of the EntitlementSummary is: -

- -
-{<entitlement-name>: <entitlement-details>}
-
- -

-Where <entitlement-details> looks like: -

- -
- -
{"title": "something", // <- optional instead of value:""
- "quantity": Integer,
- "unit": "human-readable-unit",
- "enforce?": Boolean}
-
-
-
-
-

3.2. Tier-only Entitlement

-

-When PIAM send this list of Entitlements: -

- -
- -
[{"name" : "tier",
-  "value" : "advantage",
-  "quantity" : {"value" : 32000,
-                "unit" : "users"},
-  "enforce-quantity" : true}]
-
-
- -
-
-

3.3. The EntitlementSummary will look like this:

-
- -
{"tier" : {"title" : "advantage",
-           "quantity" : 32000,
-           "unit" : "users",
-           "enforce?" : true}}
-
-
- -
-
-

3.4. With Add-ons

-

-If PIAM send a list of Entitlements with add-ons: -

- -
- -
[ {"name" : "tier",
-   "value" : "premier",
-   "quantity" : {"value" : 1000, "unit" : "users"},
-   "enforce-quantity" : true},
-  {"name" : "extra_ingest",
-   "value" : "",
-   "quantity" : {"value" : 2, "unit" : "GB"},
-   "enforce-quantity" : true},
-  {"name" : "extra_data_retention",
-   "value" : "",
-   "quantity" : {"value" : 180, "unit" : "days"},
-   "enforce-quantity" : true}]
-
-
- -
-
-

3.5. The EntitlementSummary will be:

-
- -
{"tier": {"title": "premier",
-          "quantity": 1000,
-          "unit": "users",
-          "enforce?": true},
- "extra_data_retention": {"quantity": 180,
-                          "unit": "days",
-                          "enforce?": true},
- "extra_ingest": {"quantity": 2,
-                  "unit": "GB",
-                  "enforce?": true}}
-
-
- -
-
-

3.6. Entitlements consumption in js

-
- -
function get_entitlement_tier (entitlements) {
-    for (entitlement in org.entitlements) {
-        if (entitlement.name == "tier") {
-            return entitlement.title;
-        }
-    }
-}
-let tier =  get_entitlement_tier (entitlements);
-
-
- -
-
-

3.7. EntitlementSummary consumption in js

-
- -
let tier = whoami.org["entitlement-summary"].tier.title;
-
-
- -
-
-

3.8. More to come

-
-
-
-
-

3.8.1. IROH Internal

-

-But we plan to add more technical specific values so it helps every Entitlement consumer. -That way it would make possible to share between product specific technical values. -

- -

-For example, we plan to add: -

-
    -
  • a list of allowed modules.
    • -
  • an optional list of additional scopes
    • -
  • rate limits
    • - -
- -
-
-

3.8.2. XDR global values

-

-If you want us to add some information, so we could centralize some logic -related to entitlement into IROH just ask us to add it. -Ideally, this should only contain data that could be shared between different modules. -For example: -

- -
    -
  • allowed workflows, or allowed properties for workflows
    • -
  • specific limitations for a specific module (read-only, etc…)
    • - -
- -
-
-

3.8.3. Example

-
- -
{"tier": {"title": "premier",
-          "quantity": 1000,
-          "unit": "users",
-          "enforce?": true},
- "extra_data_retention": {"quantity": 180,
-                          "unit": "days",
-                          "enforce?": true},
- "extra_ingest": {"quantity": 2,
-                  "unit": "GB",
-                  "enforce?": true},
- // ---- SUMMARY OF TECHNICAL LIMITS
- "summary" {...}}
-
-
- -
-
-

3.8.4. Summary

-
- -
{// ---- SUMMARY OF TECHNICAL LIMITS
- "summary" {
-     // PIAM Logic
-     "data-retention-in-days": 180, // use extra_data_retention + tier
-     "data-maximal-size-in-GB": 4000, // use extra_ingest + tier quantity
-     // IROH Internal
-     "additional-scopes": [ ... ],  // depends on the tier
-     "allowed-modules": [ ... ],    // depends on the tier
-     // XDR Shared Global Rules
-     "restricted-workflows": [...], // depends on the tier (or something else)
-     "rate-limits": // can change depending on the tier
-         {"sca": {"queries-per-minutes": "100"},
-          "sxo": {"queries-per-minutes": "80"},
-          "csc": ...},
-     ...
- }
-}
-
-
- -
-
-
-
-

4. Conclusion

-
    -
  • tier? GET /iroh/profile/whoami -then whoami.org["entitlement-summary"].tier.title
    • -
  • Summary only: GET /iroh/profile/entitlement-summary
    • -
  • raw entitlements: GET /iroh/profile/entitlements
    • - -
-
-
-
-
- - - - - - - - diff --git a/notes/xdr_monetization.tex b/notes/xdr_monetization.tex deleted file mode 100644 index 519255c9..00000000 --- a/notes/xdr_monetization.tex +++ /dev/null @@ -1,376 +0,0 @@ -% Created 2023-07-12 Wed 17:18 -% Intended LaTeX compiler: pdflatex -\documentclass[11pt]{article} -\usepackage[utf8]{inputenc} -\usepackage[T1]{fontenc} -\usepackage{graphicx} -\usepackage{longtable} -\usepackage{wrapfig} -\usepackage{rotating} -\usepackage[normalem]{ulem} -\usepackage{amsmath} -\usepackage{amssymb} -\usepackage{capt-of} -\usepackage{hyperref} -\author{Yann Esposito} -\date{\textit{[2023-07-12 Wed]}} -\title{XDR Monetization} -\hypersetup{ - pdfauthor={Yann Esposito}, - pdftitle={XDR Monetization}, - pdfkeywords={}, - pdfsubject={}, - pdfcreator={Emacs 29.0.60 (Org mode 9.6.1)}, - pdflang={English}} -\begin{document} - -\maketitle -\tableofcontents - - -\section{Intro} -\label{sec:orgccd9c9c} - -\subsection{What?} -\label{sec:org3c93695} - -\begin{itemize} -\item \textbf{Entitlements}: What the customer is paying for. -\item \textbf{Access Rules}: What services should allow, restrict. -\end{itemize} - -\subsection{Example} -\label{sec:org4004377} - -\subsubsection{Entitlements:} -\label{sec:org4d9cf8d} - -\begin{itemize} -\item Tier: Essentials for 1000 \emph{users} (number of \href{https://cisco.sharepoint.com/sites/SecurityPersonas/SitePages/prime-employee.aspx?csf=1\&web=1\&e=LcTwTp}{Lees}). -\item Extra Data Retention ``add-on'': 180 \emph{days} -\item Extra Ingest ``add-on'': 2 \emph{GB} -\end{itemize} - -\subsubsection{Access Rule example:} -\label{sec:org0a71eba} - -\begin{itemize} -\item \textbf{Total Ingest}: 4000GB (1000 user × (2GB + 2GB)) -\item \textbf{Time to Keep Data}: 180 days (yes, \textbf{extra} might not mean what we could expect) -\end{itemize} - -ref: \url{https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/provisioning/xdr/xdr-ga.md\#entitlements} - -\subsection{How?} -\label{sec:org102ca4d} - -Entitlement represent what the customer pays for. -PIAM creates and updates them. - -\begin{center} -\includegraphics[width=.9\linewidth]{xdr-monetization-piam-entitlements.png} -\end{center} - -\subsection{Also Entitlement Summary} -\label{sec:org9a0848a} - -IROH exposes an API to retrieve an \texttt{EntitlementSummary}. -A data structure easier to consume than the list of entitlements. - -\begin{center} -\includegraphics[width=.9\linewidth]{xdr-monetization-piam-entitlement-summary.png} -\end{center} - -\section{Entitlements (technically)} -\label{sec:org7404848} - -Example of a list of \texttt{Entitlements} sent by PIAM to IROH: - -\subsection{Just the Tier, no add-on:} -\label{sec:orgc760d26} - -\begin{verbatim} -[{"name" "tier", - "value" "advantage", - "quantity" {"value" 1000, "unit" "users"}, - "enforce-quantity" true}] -\end{verbatim} - - -\subsection{Tier with add-ons} -\label{sec:org39f5857} - -\begin{verbatim} -[{"name":"tier", - "value":"essentials", - "quantity":{"value":1000, "unit":"users"}, - "enforce-quantity":true}, - {"name":"extra_ingest", - "value":"", - "quantity":{"value":2, "unit":"GB"}, - "enforce-quantity":true}, - {"name":"extra_data_retention", - "value":"", - "quantity":{"value":180, "unit":"days"}, - "enforce-quantity":true}] -\end{verbatim} - -\subsection{PIAM Doc} -\label{sec:orgeacc44a} - -From \href{https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/provisioning/xdr/xdr-ga.md\#entitlements}{Paul Chichonski's doc} - -\url{https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/provisioning/product-spec.md\#multi-valued-attributes} - -\subsubsection{Entitlements} -\label{sec:org4517481} - -\begin{itemize} -\item \texttt{entitlements} -- A list of entitlements the tenant is allowed to use. Each item in -the list is an object with the following fields: -\end{itemize} - -\begin{verbatim} -[{"name":"tier", - "value":"essentials", - "quantity":{"value":1000, "unit":"users"}, - "enforce-quantity":true}, - {"name":"extra_ingest", - "value":"", - "quantity":{"value":2, "unit":"GB"}, - "enforce-quantity":true}] -\end{verbatim} - -\subsubsection{name} -\label{sec:org4fd025b} - -\begin{itemize} -\item \texttt{name} -- The name of the entitlement (defined as part of the entitlement -controlled vocabulary between PIAM and the product) -\end{itemize} - -\subsubsection{value} -\label{sec:org7d691e0} - -\begin{itemize} -\item \texttt{value} -- Some entitlements will have a string value that serves to qualify the -entitlement. For example an entitlement with \texttt{name=tier} may have three -different manifestations if there are three different tiers (e.g., \texttt{\{"name": - "tier", "value": "essentials"\}}, \texttt{\{"name": "tier", "value": "primary"\}}, - \texttt{\{"name": "tier", "value": "advantage"\}}) -\end{itemize} - -\subsubsection{quantity} -\label{sec:orgd8af516} - -\begin{itemize} -\item \texttt{quantity} -- Some entitlements will have numeric quantity associated with the -entitlement, this represents the amount of this entitlement the tenant is -permitted to consume. Each quantity field will contain an object with the -following values: -\begin{itemize} -\item \texttt{value} - The number holding the actual quantity. -\item \texttt{unit} - A string representing what unit to use when interpreting the quantity. -\end{itemize} -\end{itemize} - -\subsubsection{quantity\textsubscript{enforced}} -\label{sec:org70e8a50} - -\begin{itemize} -\item \texttt{quantity\_enforced} -- A boolean field, if \texttt{true} it means that the product -should enforce the allocated quantity of the entitlement for this tenant. It -is up to the product to determine how to do this. Cases where this will be -\texttt{false} are if the customer purchased via a buying program that supports a -``pay as you go'' pricing model. -\end{itemize} - -\section{Entitlement Summary} -\label{sec:orgd343c8e} - -The Entitlement Summary provides a data-structure easier to consume -than the entitlements list. - -\begin{itemize} -\item A JSON Object instead of list. -\item Additional technically useful entries. -\end{itemize} - -\subsection{Structure} -\label{sec:orge20a61f} - -The main structure of the \texttt{EntitlementSummary} is: - -\begin{verbatim} -{: } -\end{verbatim} - -Where \texttt{} looks like: - -\begin{verbatim} -{"title": "something", // <- optional instead of value:"" - "quantity": Integer, - "unit": "human-readable-unit", - "enforce?": Boolean} -\end{verbatim} -\subsection{Tier-only Entitlement} -\label{sec:orgd758f52} - -When PIAM send this list of \texttt{Entitlements}: - -\begin{verbatim} -[{"name" : "tier", - "value" : "advantage", - "quantity" : {"value" : 32000, - "unit" : "users"}, - "enforce-quantity" : true}] -\end{verbatim} - -\subsection{The \texttt{EntitlementSummary} will look like this:} -\label{sec:orgc8e6e94} - -\begin{verbatim} -{"tier" : {"title" : "advantage", - "quantity" : 32000, - "unit" : "users", - "enforce?" : true}} -\end{verbatim} - -\subsection{With Add-ons} -\label{sec:orgbb2ae87} - -If PIAM send a list of \texttt{Entitlements} with add-ons: - -\begin{verbatim} -[ {"name" : "tier", - "value" : "premier", - "quantity" : {"value" : 1000, "unit" : "users"}, - "enforce-quantity" : true}, - {"name" : "extra_ingest", - "value" : "", - "quantity" : {"value" : 2, "unit" : "GB"}, - "enforce-quantity" : true}, - {"name" : "extra_data_retention", - "value" : "", - "quantity" : {"value" : 180, "unit" : "days"}, - "enforce-quantity" : true}] -\end{verbatim} - -\subsection{The \texttt{EntitlementSummary} will be:} -\label{sec:orga1d4095} - -\begin{verbatim} -{"tier": {"title": "premier", - "quantity": 1000, - "unit": "users", - "enforce?": true}, - "extra_data_retention": {"quantity": 180, - "unit": "days", - "enforce?": true}, - "extra_ingest": {"quantity": 2, - "unit": "GB", - "enforce?": true}} -\end{verbatim} - -\subsection{\texttt{Entitlements} consumption in js} -\label{sec:orgab7d502} - -\begin{verbatim} -function get_entitlement_tier (entitlements) { - for (entitlement in org.entitlements) { - if (entitlement.name == "tier") { - return entitlement.title; - } - } -} -let tier = get_entitlement_tier (entitlements); -\end{verbatim} - -\subsection{EntitlementSummary consumption in js} -\label{sec:orgd3ca5ad} - -\begin{verbatim} -let tier = whoami.org["entitlement-summary"].tier.title; -\end{verbatim} - -\subsection{More to come} -\label{sec:org9a60163} - -\subsubsection{IROH Internal} -\label{sec:org6a8035d} - -But we plan to add more technical specific values so it helps every Entitlement consumer. -That way it would make possible to share between product specific technical values. - -For example, we plan to add: -\begin{itemize} -\item a list of allowed modules. -\item an optional list of additional scopes -\item rate limits -\end{itemize} - -\subsubsection{XDR global values} -\label{sec:org7090a59} - -If you want us to add some information, so we could centralize some logic -related to entitlement into IROH just ask us to add it. -Ideally, this should only contain data that could be shared between different modules. -For example: - -\begin{itemize} -\item allowed workflows, or allowed properties for workflows -\item specific limitations for a specific module (read-only, etc…) -\end{itemize} - -\subsubsection{Example} -\label{sec:org83305cb} - -\begin{verbatim} -{"tier": {"title": "premier", - "quantity": 1000, - "unit": "users", - "enforce?": true}, - "extra_data_retention": {"quantity": 180, - "unit": "days", - "enforce?": true}, - "extra_ingest": {"quantity": 2, - "unit": "GB", - "enforce?": true}, - // ---- SUMMARY OF TECHNICAL LIMITS - "summary" {...}} -\end{verbatim} - -\subsubsection{Summary} -\label{sec:org903d7c1} - - -\begin{verbatim} -{// ---- SUMMARY OF TECHNICAL LIMITS - "summary" { - // PIAM Logic - "data-retention-in-days": 180, // use extra_data_retention + tier - "data-maximal-size-in-GB": 4000, // use extra_ingest + tier quantity - // IROH Internal - "additional-scopes": [ ... ], // depends on the tier - "allowed-modules": [ ... ], // depends on the tier - // XDR Shared Global Rules - "restricted-workflows": [...], // depends on the tier (or something else) - "rate-limits": // can change depending on the tier - {"sca": {"queries-per-minutes": "100"}, - "sxo": {"queries-per-minutes": "80"}, - "csc": ...}, - ... - } -} -\end{verbatim} - -\section{Conclusion} -\label{sec:org9d9f957} - -\begin{itemize} -\item tier? \texttt{GET /iroh/profile/whoami} -then \texttt{whoami.org["entitlement-summary"].tier.title} -\item Summary only: \texttt{GET /iroh/profile/entitlement-summary} -\item raw entitlements: \texttt{GET /iroh/profile/entitlements} -\end{itemize} -\end{document} \ No newline at end of file diff --git a/notes/yann_s_personal_retrospective_2023_offsite.html b/notes/yann_s_personal_retrospective_2023_offsite.html deleted file mode 100644 index d2501950..00000000 --- a/notes/yann_s_personal_retrospective_2023_offsite.html +++ /dev/null @@ -1,244 +0,0 @@ - - - - -Yann’s Personal Retrospective 2023 Offsite - - - - - - - -
-
-
-

Yann’s Personal Retrospective 2023 Offsite

Yann Esposito

2023-09-25 Mon 00:00

Created: 2023-10-10 Tue 17:37

-
-
- -
- -
-
-

1. Yann’s Personal Retrospective 2023 Offsite

-
-
-
-
-

1.1. Short presentation

-
    -
  • years of Experience: 22 years (11 in Clojure)
    • -
  • years at Cisco: 7 years (7 in this team)
    • -
  • location: France (GMT+1)
    • - -
- -
-
-

1.1.1. Anecdotes

-
    -
  • Math & Abstractions: ML, Probability Automata, indecidability proofs
    • -
  • bash + Perl + templates CMS with horror stories like HTML Perl template in DB
    • -
  • VG: nodejs, hyperloglog, then clojure, and real time data analysis on a single -dimentional object. SCRUM-hate, etc…
    • - -
- -
-
-

1.2. Quick Recap about your main accomplishments these recent years

-
-
-
-
-

1.2.1. XDR

-
    -
  • RBAC (technical design) -
      -
    • role introspection endpoint to help UI
      • - -
    • -
  • Provisioning (with PIAM) -
      -
    • provided script handled to TAC team
      • - -
    • -
  • HTML templates for IROH-Auth
    • -
  • Feature-Flag script management
    • -
  • Rebrand SXSO to SCSO
    • -
  • Entitlement Summary (technical design)
    • - -
- -
-
-

1.2.2. Product

-
    -
  • Provisioning (with SE, Orbital)
    • -
  • Dynamic Session Token lifetime (Asked by Security/UI Chris Duane) started but cancelled by XDR
    • -
  • Delete duplicate accounts (was allowed first)
    • -
  • Fix Allow all role to login logic (UI bug)
    • -
  • TAC: expose change user role route
    • -
  • Replace some JWT by short random strings in IROH-Auth
    • -
  • UI Session Logout in IROH-Auth
    • -
  • Support displaying virtual users
    • - -
- -
-
-

1.2.3. Administration

-
    -
  • Fix Cross-Region UI bug
    • -
  • Links to kibana to see “master-only” events
    • -
  • Move some OAuth2 clients out of config to DB
    • - -
- -
-
-

1.2.4. Devs

-
    -
  • Matrix role representation
    • -
  • Eithers in Clojure
    • -
  • Improve logs; for SSE proxy, for impersonate
    • -
  • Expose open impersonate for UI devs on INT and TEST
    • -
  • composable shell.nix to replace docker compose
    • -
  • default-config.edn
    • -
  • config.edn as tree structure
    • -
  • scope aliases
    • - -
- - -
-
-

1.3. Old Important things

-
    -
  • Structured Logs (riemann not used at its full power)
    • -
  • TK Store (abstraction learned from CTIA’s limitation)
    • -
  • Admin UI (first)
    • -
  • Admin UI (second)
    • -
  • Admin scripts (now)
    • - -
- -
-
-

1.4. Working in this Team

-
    -
  • What I expected (7 years ago): Work on real time data streaming
    • -
  • What I am doing: Work on Authentication and Authorization
    • -
  • What my day to day looks like? -
      -
    • 50 to 70%: lot of communication via; webex, email, meetings, issues -
        -
      • planning (design, checking timeline)
        • -
      • help people on webex, fix issues, look in kibana, create orgs, create -clients, link to documentation, etc….
        • - -
      • -
    • 20% to 50%: lot of time thinking about design improvements;
      • -
    • 10% to 20%: lot of time focused on product improvement (not code).
      • -
    • 0% to 20%: code, code review, etc…
      • - -
    • - -
- -
-
-

1.5. What we should NOT change (tailwind)

-
    -
  • Not having daily standup
    • - -
- -
-
-

1.6. What we should improve (headwind)

-
    -
  • Not having more focus days.
    • -
  • Advertise that IROH (not XDR, not SecureX, not CTR) -
      -
    • IROH is a platform
      • - -
    • - -
- -
-
-

1.7. Workstation (demo time optional)

-
-
-
-
- - - - - - - - diff --git a/reports/FY24Q3-tmp-report.html b/reports/FY24Q3-tmp-report.html new file mode 100644 index 00000000..0fad33a4 --- /dev/null +++ b/reports/FY24Q3-tmp-report.html @@ -0,0 +1,1954 @@ + + + + + + + + FY24Q3 Report + + + + + +
+

FY24Q3 Report

+

logs goes 7 month back

+

2024-05-13

+
+ +

IROH

+

lead

+

Guillaume Buisson [12]

+

ctia [2]

+
    +
  • Properly filter Relationships to assemble a Feed View #1421
    • +
  • Filter out some infrastructure details from Error API Responses #1412
    • +
+

iroh [8]

+
    +
  • fix a flaky test in iroh-web #9250
    • +
  • Don't use pp-str to log the request in the rate limiter service #9249
    • +
  • Fix iroh-kafka* logs #9240
    • +
  • Update the json appender to rename the output level key #9187
    • +
  • update the logstash-v2 logging preset #9178
    • +
  • Don't fire disabled webhooks #8741
    • +
  • upgrade ctia-investigate to use transit+json instead of edn #8623
    • +
+

between 6 month and 7 month old

+
    +
  • A new script to update a record :created in ES #8574
    • +
+

tenzin-config [2]

+
    +
  • setup the IROH json logging appender
    • +
  • Re-apply the default rate limit for the NGFW Incident promotion +client #1063
    • +
+

data

+

Mario Aquino [41]

+

iroh [33]

+
    +
  • Threat hunt integration tests #9218
    • +
  • Threat hunt module instance pagination #9200
    • +
  • iroh-async Telemetry Identity Data #9166
    • +
  • Xdr 1086/crud store fields filtering #9147
    • +
  • iroh-async task (metric) tag #9123
    • +
  • iroh-metrics in default bootstrap #9118
    • +
  • Metrics Service (micrometer) #9029
    • +
  • Disable color logging for test execution #9097
    • +
  • Carmine & Timbre upgrade v2 #9005
    • +
  • Loosen Risk Score Incident validation #9013
    • +
  • Apply risk score valid ranges to incident schemas #8976
    • +
  • Revert "Upgrade carmine version (#8888)" #9003
    • +
  • Log Tuning #8978
    • +
  • Upgrade carmine version #8888
    • +
  • Fix flaky test #8956
    • +
  • iroh-async high-traffic adjustments #8835
    • +
  • Fix disabled threat-hunt test #8814
    • +
  • Update incident_time when updating incident status #8801
    • +
  • incident enrichment activity diagram #8712
    • +
  • Separate Risk score & incident enrichment #8751
    • +
  • Improve safe-filtering #8731
    • +
  • iroh-async: Flatten Datadog context #8706
    • +
  • iroh-async logging & tracing context #8705
    • +
  • Socket timeout milliseconds (not seconds) #8690
    • +
  • Risk Score socket-timeout #8687
    • +
  • Threat Hunt Module Exclusion #8646
    • +
  • Remove dead code #8626
    • +
  • Incident Summary migration re-run #8597
    • +
  • Notification request uses paginated user search #8606
    • +
+

between 6 month and 7 month old

+
    +
  • Add support for role-targetted notification #8557
    • +
  • Issue 8438/notification request phase 1 #8470
    • +
  • Fix flaky test #8521
    • +
  • Use int-req-ctx when calling post-bundle-import #8500
    • +
+

tenzin-config [8]

+
    +
  • Exclude CTIA modules from threat hunt execution #1122
    • +
  • Add iroh-async client-id to rate unlimited list #1053
    • +
  • Increase conn-manager thread count after PROD performance monitoring +#1042
    • +
  • Increase thread pool size for EU private intel conn mgr #1039
    • +
  • Increase connection mgr thread pool for NAM/EU/TEST #1030
    • +
  • Increase thread pool size for engine connection manager #1012
    • +
  • Config for skipping Private Intel during investigation threat hunt +#1009
    • +
  • Rerun incident summary migration and update ES index #1001
    • +
+

Guillaume Erétéo [55]

+

ctia [11]

+
    +
  • remove ES5 support #1419
    • +
  • Optimize lucene searches #1420
    • +
  • bump ctim / remove status disposition #1417
    • +
  • ctim 1.3.15 #1415
    • +
  • silent this too noisy log #1414
    • +
  • ctim-1.3.14 #1413
    • +
  • remove un-store #1410
    • +
  • fix wait_for for delete search #1399
    • +
  • incident meta #1391
    • +
  • Incident status disposition #1389
    • +
+

between 6 month and 7 month old

+
    +
  • Update CODEOWNERS #1387
    • +
+

iroh [41]

+
    +
  • Dump events with dump metrics script #9180
    • +
  • Sca clean phase 2 #9176
    • +
  • add backup clusters for delete #9173
    • +
  • Scripts for SCA issue cleaning #9161
    • +
  • simplify sorting in telemetry reports #9144
    • +
  • Add logs to better monitor reports #9142
    • +
  • Report service: consider missing user/org ids #9134
    • +
  • filter ids on search #9130
    • +
  • Generate statistics about modules #9108
    • +
  • Refactor iops report generation #9099
    • +
  • bump ctim / remove status disposition #9114
    • +
  • fix flaky ES test: wait some more #9089
    • +
  • telemetry report: fix search iteration for batch size 10000 #9082
    • +
  • reduce logs by adding user-scopes #9078
    • +
  • tk store: update ES index state #8664
    • +
  • Add admin maintenance route to load MITRE stix #8967
    • +
  • ctim 1.3.15 #9068
    • +
  • limit walk entities to the necessary exports #9039
    • +
  • ctim 1.3.14 #9016
    • +
  • Dump ES metrics telemetry events #8999
    • +
  • script to clean SE false positive incidents and sightings #8846
    • +
  • MITRE Matrix: dynamic components design #8973
    • +
  • fix Talos threat hunt #8969
    • +
  • update the design of static MITRE matrix rendering #8949
    • +
  • replace lazyseq by iteration in reports #8957
    • +
  • For Jeetu by G2 #8920
    • +
  • Some more incident stats #8861
    • +
  • import mitre matrix backbone #8899
    • +
  • Mitre coverage static matrix #8882
    • +
  • add created and modified to IROH CTIM entities #8810
    • +
  • bundle import activity diagrams #8708
    • +
  • scoring at bundle import #8694
    • +
  • Meta incident field #8617
    • +
  • entitlement-enforcement-jobs-service in default #8612
    • +
  • incident status_disposition #8587
    • +
+

between 6 month and 7 month old

+
    +
  • introduce admin common web service for cisco services #8573
    • +
  • speed up listing of entilements #8516
    • +
  • Update CODEOWNERS #8524
    • +
  • Add entitlement summaries endpoint for external policy enforcement +jobs #8508
    • +
  • ductile 0.4.8 #8453
    • +
  • XDR intel retention design #8153
    • +
+

tenzin-config [3]

+
    +
  • configure / tune private intel proxy cm #1074
    • +
  • increase bundle-batch-size #1071
    • +
+

between 6 month and 7 month old

+
    +
  • fix config path in README.md #1000
    • +
+

Ambrose Bonnaire-Sergeant +[43]

+

ctia [15]

+
    +
  • Bump ring-swagger with proof of memory leak fix #1423
    • +
  • Clojure 1.11.1 -> 1.11.2 #1416
    • +
  • Revert patch bundle commits #1411
    • +
  • Fix 2XX response swagger/coercion, ban :return #1407
    • +
  • Remove asset properties/mapping merging during bundle patch #1408
    • +
  • Fix :body descriptions #1409
    • +
  • Fix POST /bulk schema checking #1406
    • +
  • Use prn instead of pprint for logs #1401
    • +
  • Eval routes and options given to context at +initialization time #1394
    • +
  • Use st/merge to merge schemas instead of +into #1398
    • +
  • Never match existing asset-* entities when patch-existing=false #1395
    • +
  • Re-enable incident tests #1393
    • +
  • Add external_ids to investigation select fields #1392
    • +
+

between 6 month and 7 month old

+
    +
  • New bundle/import option: merge previous incident tactics/techniques +#1388
    • +
  • Patch existing entities in POST /bundle/import #1383
    • +
+

iroh [24]

+
    +
  • Bump ring-swagger and prove it fixes the memory leak #9244
    • +
  • Fix typo in debug log #9228
    • +
  • Debug logs to investigate person assets not being imported #9227
    • +
  • Update status endpoint to keep conure updated #9209
    • +
  • Update test for new carmine non-FIFO queues: +queue-status-report-test #9103
    • +
  • Make generated tk meta easier to review using pprint #8805
    • +
  • Restrict possible values for updated asset properties #9022
    • +
  • Don't forward response headers from CTIA to IROH #9014
    • +
  • Only subscribe incidents with supported observables #9000
    • +
  • Fix flaky test #9001
    • +
  • Redis: Set NX / XX #8970
    • +
  • Bulk asset update + rescoring route #8963
    • +
  • Fix logf call #8925
    • +
  • Fix incident subscription args, and only subscribe incident if +observables/identities are non-empty #8921
    • +
  • Fix DI subscription URL #8914
    • +
  • Revert patch bundle commits #8903
    • +
  • Fix swagger description #8905
    • +
  • Asset properties update and incident rescoring route #8843
    • +
  • Rescoring task #8869
    • +
  • Generate valid DI auth tokens for incident subscriptions #8804
    • +
  • Fix (reset) #8799
    • +
  • Subscribe to incident asset rescoring via DI #8699
    • +
  • Only pass default patch-existing query params in bundle/import proxy +if patch-existing=true #8725
    • +
+

between 6 month and 7 month old

+
    +
  • Enable entity patching in POST /private-intel/bundle/import #8492
    • +
+

tenzin-config [4]

+
    +
  • Bulk asset update limits #1059
    • +
  • Add Conure url to Private intel config #1052
    • +
  • Add config for DI client in iroh-engine #1036
    • +
  • Add device insights url to iroh-engine config #1014
    • +
+

integrations

+

Matthieu Sprunck [22]

+

iroh [18]

+
    +
  • Rename automation_workflow_disabled to +automation_workflow_definition #9196
    • +
  • Revert "Update the json appender to rename the output level key +(#9187)" #9191
    • +
  • Change Incident Assignment Notification wording #9189
    • +
  • Add title and link to the incident in the incident assignment +notification #9188
    • +
  • Add a log when an unexpected status is returned from KafkaConnect #9153
    • +
  • IROH Proxy: Correct handling for path with spaces (%20) #9149
    • +
  • Build notification type name from notification type #9140
    • +
  • JMX metrics for clj-http connection manager #8765
    • +
  • Always decompress the body when status is not 2xx #8527
    • +
  • Restore default expiration (24h) for the local session token #8747
    • +
  • Workflow event schema changes #8656
    • +
  • IROH Proxy: remove headers set by the reverse proxy #8655
    • +
  • More log context to investigate #8638 #8654
    • +
  • Add logging info to investigate #8638 #8653
    • +
  • StackOverflowError temporary fix #8607
    • +
+

between 6 month and 7 month old

+
    +
  • Allow any header name in the remote module auth configuration #8529
    • +
  • Add ciscoxdr as a valid Feedback source #8515
    • +
  • Fix Duo Admin API Auth (sigv2) for POST requests #8330
    • +
+

tenzin-config [4]

+
    +
  • Configure XDR URL in the PrivateIntel service for the Assignment +notification #1116
    • +
  • Create a module record for Microsoft Graph API #1050
    • +
  • Fix settings names for JAMF auth upgrade #1048
    • +
  • Use Token Auth with the JAMF Classic API #1038
    • +
+

Kirill Chernyshov [46]

+

iroh [39]

+
    +
  • Draft design #9201
    • +
  • Format redirect url for email notification #9211
    • +
  • Use static string 'Cisco' as a subtitle #9210
    • +
  • Coerce incoming notification before email format #9204
    • +
  • [REFACTORING] Standardize trapperkeeper usage #9177
    • +
  • Use notify! to create notification via API call #9162
    • +
  • Fix copyright notice in email template #9159
    • +
  • Add simple template for notification email #9150
    • +
  • Allow nil as a correlation id #9143
    • +
  • Fix for EventService initialization #9141
    • +
  • Respect user notification preferences #9133
    • +
  • Add default config for NotificationInDelivery #9128
    • +
  • 8938 e8811 process email notification delivery #9127
    • +
  • Fix config key #9115
    • +
  • Fix dev config for NotificationInDeliveryService #9113
    • +
  • On recieving NotificationRequest notify users according to their +preference #9087
    • +
  • Upgrade clojure 1.11.1 -> 1.11.2 #9072
    • +
  • Remove maintenance notification type #9069
    • +
  • 8933 e8811 create notificationindeliveryservice persistence only #9025
    • +
  • "In App" -> "In-App" #9020
    • +
  • Add correct :name and :description to notification type meta #9012
    • +
  • NotificationPreference API real endpoint #8995
    • +
  • NotificationPreference Service #8982
    • +
  • Fixes for notification endpoint #8964
    • +
  • Add notification preference api endpoints #8947
    • +
  • Initial draft design of notifications delivery #8844
    • +
  • Refactor data streams service #8793
    • +
  • DRY'ed out client-creds-token namespace #8783
    • +
  • Kafka connect monitoring #8278
    • +
  • Handle undelivered records #8634
    • +
  • Events data retention enforcement job #8722
    • +
  • Iroh events data retention implementation #8666
    • +
  • Iroh events postgres data retention #8693
    • +
  • Use timbre for logging #8651
    • +
  • Add draft design for IROH Events data retention #8585
    • +
+

between 6 month and 7 month old

+
    +
  • Fix shutdown process of Kafka Consumer #8558
    • +
  • Fixes for CTIA Transfer service #8552
    • +
  • Transfer CTIA Events #8514
    • +
  • Tiny fix for EventWebservice router #8493
    • +
+

tenzin-config [7]

+
    +
  • Add KafkaProducerService to all envs #1107
    • +
  • Add email kafka consumer to all envs #1106
    • +
  • Enable kafka consumer for email notifications #1099
    • +
  • Add new kafka topics for IROH notifications #1070
    • +
  • Add ES sink connector v2 to test full migration #1035
    • +
  • Fix broken data stream on TEST #1034
    • +
  • Config for DataStreams service #1033
    • +
+

Shafiq [31]

+

iroh [28]

+
    +
  • Design Automation-Remote target for iroh-proxy #9190
    • +
  • Trim whitespace when interpolating pipe transforms #9121
    • +
  • Support for GoogleAPI Authorization #9106
    • +
  • Refactor proxy health check #9066
    • +
  • Data retention cleanup of notification services #9064
    • +
  • Apply data retention policy on iroh-notifications #9054
    • +
  • Add :remote type in configuration spec fields #9046
    • +
  • Refactor proxy-health-check #9033
    • +
  • Update proxy-health-check logging #9028
    • +
  • Update proxy health check logging #9024
    • +
  • Perform relay-api request based on observable-types #9017
    • +
  • Add selection of settings for configuration-token auth #9007
    • +
  • Support for dedicated url setting for iroh-proxy requests #8998
    • +
  • Route for patching module-type documentation #8981
    • +
  • Add filtering of notifications using multiple statuses #8974
    • +
  • Support for transforming interpolated strings. #8945
    • +
  • Construct token url from base-url setting #8923
    • +
  • [IROH Proxy] Support for Rubrik and Commvault API services #8902
    • +
  • [iroh-proxy] Include POST method for proxy health check #8878
    • +
  • Update relay-module schemas for Checkpoint auth #8875
    • +
  • [iroh-proxy] Implement Checkpoint Smart-1 authentication #8873
    • +
  • Fix schema of proxy health check #8827
    • +
  • Add string matching for health check #8815
    • +
  • Fallback to iroh-events store when kafka send fails #8786
    • +
  • Fix mapping for incident events #8703
    • +
+

between 6 month and 7 month old

+
    +
  • Update iroh-event developer doc #8596
    • +
  • Add x-sort header to support search_after pagination #8586
    • +
  • Identify trusted service to service req for SE #8495
    • +
+

tenzin-config [3]

+
    +
  • Swtich to new sink-connector in INT #1024
    • +
  • Add updated sink connector for all envs #1021
    • +
  • Add sink connector for new iroh-event datastream #1019
    • +
+

auth

+

bartuka [71]

+

iroh [52]

+
    +
  • add :content-type :json explicitly to clj-http #9090
    • +
  • Brownfield Provisioning - make the region field +available for TEST purposes only #9079
    • +
  • Improve logs for Brownfield provisioning #9076
    • +
  • [IROH Auth] update QA routes for Universal Provisioning flow #9053
    • +
  • [IROH Auth] Fix access token brownfield provisioning #9049
    • +
  • [IROH Auth] bugfix - accept empty string as entitlement value for +universal provisioning #9021
    • +
  • [IROH Auth] FMC add re-token proxy request #9011
    • +
  • [IROH Auth] fix FMC redirect call to /device #8987
    • +
  • [IROH Auth] fix device verification redirection #8979
    • +
  • fix proxy requests to FMC #8972
    • +
  • [IROH Auth] FMC OAuth2 and SSE proxies #8840
    • +
  • [IROH Auth] Improvements to universal provisioning callback #8913
    • +
  • [IROH Auth] bugfix #4: add :content-type :json to +callback request #8909
    • +
  • [IROH Auth] fix payload sent to PIAM callback_url after provisioning +was complete #8900
    • +
  • [IROH Auth] bugfix Universal Provisioning created schema error #8892
    • +
  • [IROH Auth] bugfix parsing OKTA JWT scopes #8880
    • +
  • [IROH Auth] Brownfield provisioning - endpoint to attach existing +tenant to a SBG product #8806
    • +
  • [IROH Auth] Support FMC in the jwks service #8830
    • +
  • [IROH Auth] Fix DI onboarding in Universal Provisioning Flow #8813
    • +
  • Revert "[IROH Auth] support for FMC token in JWKS Service" #8816
    • +
  • [IROH Auth] support for FMC token in JWKS Service #8808
    • +
  • [IROH Auth] Check QA callback_url to complete +provisioning tests #8763
    • +
  • [IROH Auth] better swagger descriptions for Universal Provisioning +#8752
    • +
  • [IROH Auth] remove empty strings from client-id got +from Vault #8760
    • +
  • [IROH Auth] add missing scope to get OKTA JWT #8759
    • +
  • [IROH Auth] add logs to investigate get okta jwt #8758
    • +
  • [IROH Auth] bugfix - client/post should use +:form-params instead of :body #8753
    • +
  • [IROH Auth] bugfixes - arity exception, change +product-response datatype, change pmap to +map #8738
    • +
  • [IROH Auth] bugfix - fix urls in POST /tenants returned +value and payload field names #8733
    • +
  • [IROH Auth] Cache OKTA JWT used for provisioning callback #8727
    • +
  • [IROH Auth] Improvements on logs and error handling to +UniversalProvisioning and JWKSService #8707
    • +
  • [IROH Auth] Duplicate universal-provisioning web routes +to accept IROH JWTs #8675
    • +
  • [IROH Auth] Expose callbacks packages store to check +Universal Provisioning status #8702
    • +
  • [IROH Auth] Improve 202 Accepted response for +/universal-provisioning/create-tenants #8701
    • +
  • [IROH Auth] Fix name convention to callbacks route in Universal +Provisioning flow #8691
    • +
  • [IROH Auth] Gen OKTA JWT to callback request in Universal +Provisioning flow #8673
    • +
  • bugfix - missing UniversalProvisioningCallbackService +to deploy IROH nodes #8680
    • +
  • [IROH Auth] Check pending provisions from time-to-time. Endpoint +that will be called by OPS tick #8674
    • +
  • [IROH Auth] Add callback handler to receive provisioning status from +downstream apps #8633
    • +
  • [IROH Auth] Add support to UserIdentity JWTs in +JWKSService #8647
    • +
  • [IROH Auth] Bugfix in JWKSService logic #8659
    • +
  • [IROH Auth] update docs for Universal Provisioning work #8640
    • +
  • [IROH Auth] Simplify IROH Web Core by leveraging +JWKSService for all webservices #8632
    • +
  • [IROH Auth] Add structure to keep track of onboardings to support +async flow in Universal Provisioning #8599
    • +
+

between 6 month and 7 month old

+
    +
  • [IROH Auth] Add support to accept IROH Auth JWTs and External JWTs +in a WebService #8528
    • +
  • [IROH Auth] bump ring-jwt-middleware to +1.1.5 #8568
    • +
  • [IROH Auth] check entitlements schema in universal piam flow #8560
    • +
  • [IROH Auth] fix check of allowed-origins for +registration_redirect query param #8559
    • +
  • [IROH Auth] move oauth2-jwkset to jwks-svc +#8534
    • +
  • [IROH Auth] - Expose universal-provisioning-web-service +#8499
    • +
  • [IROH Auth] move is-trusted-clients? to +OAuth2ClientService #8502
    • +
  • [IROH Auth] add UniversalProvisioningService #8459
    • +
+

ring-jwt-middleware [11]

+

between 6 month and 7 month old

+
    +
  • add test case
    • +
  • update readme
    • +
  • fix schema
    • +
  • log the full jwt when error
    • +
  • use the default value
    • +
  • fix tests by adding post-jwt-format-fn-arg-fn to config +and schema
    • +
  • fix all tests by changing the output of decode
    • +
  • Merge pull request #28 from threatgrid/pubkey-fn-arg-fn
    • +
  • fix config_test
    • +
  • add test case
    • +
  • initial commit
    • +
+

tenzin-config [8]

+
    +
  • add fmc client id for each env #1065
    • +
  • fix url for device verification #1058
    • +
  • Add FMC Proxy configuration #1056
    • +
  • fix okta links #1043
    • +
  • FMC base-urls to configure JWKS #1040
    • +
  • [IROH Auth] bugfix - add config to okta jwks #1017
    • +
  • [IROH Auth] add OKTA config for Universal Provisioning flow #1010 #1013
    • +
  • add universal_provisioning_callbacks store #1011
    • +
+

Yann Esposito [130]

+

iroh [55]

+
    +
  • improve Client credentials error message to help debug #9213
    • +
  • Attempt to provide a body to the onboarding with mustache #9151
    • +
  • provisioning API for Org apps #9195
    • +
  • Revert "add admin-ui to the gh-pages (#9222)" #9223
    • +
  • add admin-ui to the gh-pages #9222
    • +
  • Add sc-enabled? flag to profile API views #9192
    • +
  • [PIAM Brownfield Provisioning]: Provide a way to update link tenants +#9186
    • +
  • Add apps field to Orgs #9175
    • +
  • improve response when PIAM returns an error #9183
    • +
  • fix flaky test invite-test paging #9182
    • +
  • Support aero configurations #9170
    • +
  • Fix invites pagination #9138
    • +
  • Support FMC returning Bearer instead of bearer #9126
    • +
  • composable jwks test helper #9120
    • +
  • Sync user-name during SCSO login #9117
    • +
  • Another IPv6 in URL fix #9084
    • +
  • Support IPv6 in URL for inspect service #9083
    • +
  • Update of the login doc #9067
    • +
  • optimize search user given a list of ids #9018
    • +
  • Fix link tenant bug #8975
    • +
  • Upgrade Org to XDR on first entitlement update. #8881
    • +
  • [IROH-Auth]: Auth Code Grant Client that do not generate any refresh +token #8927
    • +
  • Specialize TAC routes access #8884
    • +
  • Remove legacy restriction of AO scopes #8890
    • +
  • Update deps to accept JWT without nbf claim #8872
    • +
  • New endpoint to ease impersonation usage #8855
    • +
  • Fix PIAM Universal Provisioning routes #8828
    • +
  • Should fix open impersonate flaky test #8809
    • +
  • Keep track of impersonators #8736
    • +
  • Restrict TAC routes to admins #8794
    • +
  • Remove with-tk #8779
    • +
  • Code/Test Improvements #8767
    • +
  • add a test for matching schema #8770
    • +
  • Custom Role Design doc #8497
    • +
  • Attempt to improve error message of match? #8769
    • +
  • Use cid for trace_id when present #8754
    • +
  • Support public client for custom routes #8749
    • +
  • Add playbook scope #8739
    • +
  • Fix webhook race condition risk #8728
    • +
  • Call get-org only once for org-virtual user #8724
    • +
  • Use a cache for entitlement summaries #8667
    • +
  • upgrade jetty version #8714
    • +
  • Remove a forgotten pretty printer #8713
    • +
  • Fast Event Notifier dispatch using event-type #8650
    • +
  • Fix DI onboarding #8657
    • +
+

between 6 month and 7 month old

+
    +
  • Generalize default indexes for data retention #8598
    • +
  • [Data Retention Policy]: Delete incident summaries along incident #8576
    • +
  • [Provisioning] Introduce product-instance-id #8577
    • +
  • Simply wait a lot more for ES to sync #8553
    • +
  • Quick fix on the IROH login page #8564
    • +
  • Prevent org duplication during provisioning #8556
    • +
  • Declared scopes tree #8537
    • +
  • Improve constraints against Entitlements #8525
    • +
  • Fix admin route to support combinators #8377
    • +
  • Data Retention endpoint returns immediately #8486
    • +
+

iroh-scripts [43]

+
    +
  • fix a bug with trust client
    • +
  • fix resend-invite
    • +
  • script to remove flags
    • +
  • fix a bug in create-super-org
    • +
  • relink scc script
    • +
  • prevent id collision
    • +
  • cleaned-up get-org response
    • +
  • Added add-flag script here
    • +
  • CSE client and better patch
    • +
  • resend-invite
    • +
  • add SXP riles prod clients
    • +
  • improve client manipulations
    • +
  • Updated scripts
    • +
  • use include
    • +
  • use local clojure
    • +
  • Added a better alias for sxo clients
    • +
  • SXO rules
    • +
  • added ai client with script
    • +
  • Fix
    • +
  • A few new scripts
    • +
  • Super client should be part of XDR orgs
    • +
  • Super org should have the XDR flag
    • +
  • Add admin user
    • +
  • updated and added scripts
    • +
  • save and improve client aliases
    • +
  • save improvements
    • +
  • create dashboard clients
    • +
  • Support client aliases in get-client
    • +
  • Update client with client-aliases
    • +
  • many new scripts
    • +
  • added a 1-time script
    • +
  • Add trusted to get-client
    • +
  • Improve search and error messages
    • +
  • Prepare TG to SCSO org migration
    • +
+

between 6 month and 7 month old

+
    +
  • add scope to a client
    • +
  • Help support cider
    • +
  • add admin to org
    • +
  • Improved descriptions
    • +
  • promote-to-master script
    • +
  • Fix and small improvements
    • +
  • Improve robustness
    • +
  • Scripts for admin
    • +
  • client-pass
    • +
+

oauth2-client-demo [3]

+
    +
  • pin packages
    • +
  • reuse authorized url
    • +
  • added Meraki client to the list
    • +
+

ring-jwt-middleware [7]

+
    +
  • Version 1.1.7-SNAPSHOT
    • +
  • Version 1.1.6
    • +
  • Support missing nbf JWT #30
    • +
+

between 6 month and 7 month old

+
    +
  • Version 1.1.6-SNAPSHOT
    • +
  • Version 1.1.5
    • +
  • v1.1.5-SNAPSHOT
    • +
  • Version 1.1.4
    • +
+

scopula [6]

+
    +
  • Version 0.3.3-SNAPSHOT
    • +
  • Version 0.3.2
    • +
  • real cljs support
    • +
  • Version 0.3.2-SNAPSHOT
    • +
  • Version 0.3.1
    • +
  • support cljs
    • +
+

tenzin-config [12]

+
    +
  • add iroh gh-pages to allowed login origin #1123
    • +
  • New SCA env for TEST/STAGING #1114
    • +
  • configure automatio rules clients to not be rate limited #1111
    • +
  • interpolation improvements #1112
    • +
  • Add support for interpolation and self ref #1110
    • +
  • Remove rate-limit for another SXO client on INT #1087
    • +
  • Disable rate-limit SXO client for rules #1084
    • +
  • Double threads dedicated for VirusTotal http calls #1051
    • +
  • fix vault tpl transformations and checks #1041
    • +
  • Remove rate-limit for automation #1044
    • +
  • Check vault templating error #1023
    • +
  • Add Universal Provisioning Services #1015
    • +
+

xdr-provisioning [4]

+
    +
  • improved re-onboarding script
    • +
  • use local clojure
    • +
  • Manage entitlements add-ons
    • +
  • add a re-provisioning script that rerun onboardings
    • +
+

Olivier Barbeau [50]

+

iroh [34]

+
    +
  • Add number of incidents to each technique in the Mitre matrix #9157
    • +
  • Fix events and incidents ES stores for DEV #9154
    • +
  • E8851: XDR Native & detections #9122
    • +
  • E8851: Design of changes for XDR native detections #9110
    • +
  • E8851: Product ordering in the coverage of techniques #9100
    • +
  • E8851: Product ordering and SCA renaming #9086
    • +
  • E8851: Add Org's integrations to the Mitre matrix #8993
    • +
  • E8851: Sorting of Mitre elements #8992
    • +
  • E8851: Static matrix common to all Orgs #8939
    • +
  • E8851: Talos MITRE coverage files import #8876
    • +
  • Design of the Talos MITRE coverage files import #8856
    • +
  • 'iroh' node type and default services for all node types #8817
    • +
  • Check the list of services for a node type #8800
    • +
  • Fix merge error on PR 8784 #8797
    • +
  • [IROH configuration]: Move role-web-service config to default tk +files #8782
    • +
  • [IROH configuration]: Universal Provisioning Services config +refactor #8784
    • +
  • [IROH configuration]: explicit name for generated conf and meta #8785
    • +
  • Clean bootstrap.cfg; remove tmp file #8781
    • +
  • Add few additional tests to iroh services #8762
    • +
  • rewrite tests #8773
    • +
  • more info for debugging #8717
    • +
  • [IROH configuration]: general documentation #8764
    • +
  • update developer doc for api-gateway #8723
    • +
  • Some test clean-up #8716
    • +
  • High volume of SQL queries for a single observe/deliberate call #8682
    • +
  • Remove the state of module instances in +obfuscate-module-instance #8670
    • +
  • E8388: update proxy-endpoints-metadata endpoint and metadata #8663
    • +
  • E8388: update x-proxy endpoint and IntService ACL filters #8608
    • +
  • E8388 : Simplifies upgrade/downgrade tests #8635
    • +
  • Implement Module Instance service event handler #8592
    • +
  • Updates to the design 'entitlement changes for integration modules' +#8541
    • +
+

between 6 month and 7 month old

+
    +
  • E8388: add new module-instance events, register Module Instance +service as handler #8547
    • +
  • E8388: Issue 8531 add state to module instance schema #8544
    • +
  • Issue 8389 design entitlement changes for integration modules #8510
    • +
+

tenzin-config [16]

+
    +
  • add XDR native module types for PROD #1115
    • +
  • add SCA module-type-id for XDR Native on TEST [temp UI fix] #1109
    • +
  • add SCA module-type-id for XDR Native [temp UI fix] #1108
    • +
  • Mitre: Add detections for XDR Native #1098
    • +
  • product ordering and SCA renaming #1079
    • +
  • Config for Mitre covering products #1072
    • +
  • Deep merge for vectors and sets with duplicates check #1032
    • +
  • Reduce configuration duplicates - config.edn part #1031
    • +
  • Reduce configuration duplicates - bootstrap.cfg part #1028
    • +
  • Move role-web-service config to IROH #1026
    • +
  • Move Universal Provisioning Services config to IROH #1027
    • +
  • Clean bootstrap cfg #1025
    • +
  • Remove the :registration flag in all environments #963
    • +
  • Remove the :merge-users-by-email flag in all +environments #962
    • +
  • Remove the :account-activation-optim flag in all +environments as it is now activated everywhere. #961
    • +
  • Remove the xdr-roles flag in all environments #964
    • +
+

(Yogsototh) [62]

+

iroh-scripts [43]

+
    +
  • fix a bug with trust client
    • +
  • fix resend-invite
    • +
  • script to remove flags
    • +
  • fix a bug in create-super-org
    • +
  • relink scc script
    • +
  • prevent id collision
    • +
  • cleaned-up get-org response
    • +
  • Added add-flag script here
    • +
  • CSE client and better patch
    • +
  • resend-invite
    • +
  • add SXP riles prod clients
    • +
  • improve client manipulations
    • +
  • Updated scripts
    • +
  • use include
    • +
  • use local clojure
    • +
  • Added a better alias for sxo clients
    • +
  • SXO rules
    • +
  • added ai client with script
    • +
  • Fix
    • +
  • A few new scripts
    • +
  • Super client should be part of XDR orgs
    • +
  • Super org should have the XDR flag
    • +
  • Add admin user
    • +
  • updated and added scripts
    • +
  • save and improve client aliases
    • +
  • save improvements
    • +
  • create dashboard clients
    • +
  • Support client aliases in get-client
    • +
  • Update client with client-aliases
    • +
  • many new scripts
    • +
  • added a 1-time script
    • +
  • Add trusted to get-client
    • +
  • Improve search and error messages
    • +
  • Prepare TG to SCSO org migration
    • +
+

between 6 month and 7 month old

+
    +
  • add scope to a client
    • +
  • Help support cider
    • +
  • add admin to org
    • +
  • Improved descriptions
    • +
  • promote-to-master script
    • +
  • Fix and small improvements
    • +
  • Improve robustness
    • +
  • Scripts for admin
    • +
  • client-pass
    • +
+

oauth2-client-demo [3]

+
    +
  • pin packages
    • +
  • reuse authorized url
    • +
  • added Meraki client to the list
    • +
+

ring-jwt-middleware [6]

+
    +
  • Version 1.1.7-SNAPSHOT
    • +
  • Version 1.1.6
    • +
+

between 6 month and 7 month old

+
    +
  • Version 1.1.6-SNAPSHOT
    • +
  • Version 1.1.5
    • +
  • v1.1.5-SNAPSHOT
    • +
  • Version 1.1.4
    • +
+

scopula [6]

+
    +
  • Version 0.3.3-SNAPSHOT
    • +
  • Version 0.3.2
    • +
  • real cljs support
    • +
  • Version 0.3.2-SNAPSHOT
    • +
  • Version 0.3.1
    • +
  • support cljs
    • +
+

xdr-provisioning [4]

+
    +
  • improved re-onboarding script
    • +
  • use local clojure
    • +
  • Manage entitlements add-ons
    • +
  • add a re-provisioning script that rerun onboardings
    • +
+

iroh-ops

+

Jerome Schneider [1]

+

tenzin-config [1]

+
    +
  • IROH migrate to new MSK SASL/SCRAM cluster!
    • +
+

Patrick Patat [1]

+

tenzin-config [1]

+
    +
  • refactor ops config with new ref system #1113
    • +
+

Other

+

Other

+

Robert Levy [7]

+

iroh [6]

+
    +
  • Inherit properties from type in hierarchical modules #9042
    • +
  • Format hierarchical modules invalid-parent-id error with context and +error type #8901
    • +
  • Update hardcoded source in Secure Endpoint module #8874
    • +
  • Expose pagination & search functionality in notifications api #8803
    • +
  • Fix bug in hierarchical module logic producing empty +settings/settings_effective map #8745
    • +
  • Issue 8158 hierarchical module #8469
    • +
+

tenzin-config [1]

+
    +
  • Revert "Adds cache configuration for CrowdStrike (#1002)" #1005
    • +
+

Eric Gierach [5]

+

iroh [2]

+

between 6 month and 7 month old

+
    +
  • bumping iroh-engine to 0.15.13 #8520
    • +
  • bumping iroh-engine to 0.15.12 #8509
    • +
+

tenzin-config [3]

+
    +
  • removing duplicate entry #1078
    • +
  • Swap stg and test configs for reporting. #1077
    • +
  • Disabling reporting until Ops gets the infra set up. #1075
    • +
+

II [20]

+

iroh [16]

+
    +
  • Keeps Kondo from being run on dev start #9220
    • +
  • Xdr 1282 Adds new Umbrella service to default services #9214
    • +
  • Xdr 1282 add v 2 token cache to umbrella integration #9208
    • +
  • XDR-1411 Fixes inconsistent v1 v2 refer #9197
    • +
  • 9074 remove settings effective #9075
    • +
  • 8990 umbrella investigate v2 #9030
    • +
  • 8958 Adds Missing Umbrella v2 Sightings #8960
    • +
  • 8498 fix token cache #8911
    • +
  • 8798 create migration to add parents to existing microsoft defender +modules #8870
    • +
  • Throws exception in parent validation on non-existent parent #8850
    • +
  • Merges module type props on create and update health check #8845
    • +
  • Implements v2 threat hunting #8833
    • +
  • This should fix issue with parent settings not used on create-patch +#8822
    • +
  • Adds insights scope to allowed Automation scopes in gen-ao-jwt #8678
    • +
  • 8496 token cache fix #8637
    • +
+

between 6 month and 7 month old

+
    +
  • 8496 - relay module token cache #8580
    • +
+

tenzin-config [4]

+
    +
  • Disables Umbrella module auto load so service does it #1120
    • +
  • Enables Umbrella token caches #1119
    • +
  • Revert "Revert "Adds cache configuration for CrowdStrike (#1002)" +(#1005)" #1008
    • +
+

between 6 month and 7 month old

+
    +
  • Adds cache configuration for CrowdStrike #1002
    • +
+

Devin Walters [9]

+

tenzin-config [9]

+
    +
  • Configure s3-http-client connection pool size for PROD environments +#1105
    • +
  • Turn on reporting pipeline in TEST #1097
    • +
  • Up hikari pool size in INT for conure #1095
    • +
  • Configure incident import bucket per PROD env for iroh and +iroh-async #1092
    • +
  • Configure incident pipeline #1091
    • +
  • Fix bucket name #1083
    • +
  • Match s3 bucket key #1082
    • +
  • Add INT and TEST enrichment bucket names to relevant configs #1057
    • +
+

between 6 month and 7 month old

+
    +
  • Add port 443 to ctia base urls #996
    • +
+

Mia [5]

+

iroh [5]

+
    +
  • create permanent logs to unobtrusively monitor bundle import results +#9242
    • +
  • New iroh event docs #9181
    • +
  • iroh-engine 0.16.2 #9125
    • +
  • Engine 0.16.1 #9116
    • +
  • Engine 0.16.0 #8997
    • +
+

Martin Bruchanov [1]

+

tenzin-config [1]

+
    +
  • XDRSRE-64: Authentication for public CTIA in INT #1081
    • +
+

James Moser [1]

+

tenzin-config [1]

+
    +
  • added QA domain to idps email domain whitelists #1085
    • +
+

[20]

+

iroh [16]

+
    +
  • Keeps Kondo from being run on dev start #9220
    • +
  • Xdr 1282 Adds new Umbrella service to default services #9214
    • +
  • Xdr 1282 add v 2 token cache to umbrella integration #9208
    • +
  • XDR-1411 Fixes inconsistent v1 v2 refer #9197
    • +
  • 9074 remove settings effective #9075
    • +
  • 8990 umbrella investigate v2 #9030
    • +
  • 8958 Adds Missing Umbrella v2 Sightings #8960
    • +
  • 8498 fix token cache #8911
    • +
  • 8798 create migration to add parents to existing microsoft defender +modules #8870
    • +
  • Throws exception in parent validation on non-existent parent #8850
    • +
  • Merges module type props on create and update health check #8845
    • +
  • Implements v2 threat hunting #8833
    • +
  • This should fix issue with parent settings not used on create-patch +#8822
    • +
  • Adds insights scope to allowed Automation scopes in gen-ao-jwt #8678
    • +
  • 8496 token cache fix #8637
    • +
+

between 6 month and 7 month old

+
    +
  • 8496 - relay module token cache #8580
    • +
+

tenzin-config [4]

+
    +
  • Disables Umbrella module auto load so service does it #1120
    • +
  • Enables Umbrella token caches #1119
    • +
  • Revert "Revert "Adds cache configuration for CrowdStrike (#1002)" +(#1005)" #1008
    • +
+

between 6 month and 7 month old

+
    +
  • Adds cache configuration for CrowdStrike #1002
    • +
+

Martin Bruchanov [1]

+

iroh [1]

+
    +
  • XDR-1344: Final version of deletion script used for PROD change #9174
    • +
+

Ruslan Yemelianov [2]

+

tenzin-config [2]

+
    +
  • Revert "enable ES auth private-ctia INT"
    • +
  • enable ES auth private-ctia INT
    • +
+

Andrew Parisi [2]

+

tenzin-config [2]

+
    +
  • [data-retention/update-iroh-internal-for-prod] #1018
    • +
  • [data-retention/update-entitlement-route-information] #1004
    • +
+

Scott McLeod [7]

+

iroh [6]

+
    +
  • Notification service timestamp filter #9252
    • +
  • Tk store half bounded intervals #9158
    • +
  • Extend tk search with range queries #8912
    • +
  • Resolves postgres driver sql-injection vulnerability #9091 #9092
    • +
  • Implement searching risk scores by score #8907
    • +
  • tk store: Add delete-search method #8213 #8692
    • +
+

tenzin-config [1]

+
    +
  • Increase ReportService batch size to ES maximum #1055
    • +
+

Sam Waggoner [1]

+

tenzin-config [1]

+
    +
  • hydrant/912 add clean hashes importer.
    • +
+

t2sw [2]

+

ctia [1]

+

between 6 month and 7 month old

+
    +
  • Update CODEOWNERS #1390
    • +
+

iroh [1]

+
    +
  • add health endpoint to tac portal and update tests #9002
    • +
+

Jerome Schneider [1]

+

iroh [1]

+
    +
  • Upgrade PostgreSQL to 12.15 #8618
    • +
+

Brooke Swanson [24]

+

ctia [2]

+
    +
  • XDR-1769: bump CTIM to 1.3.17. #1422
    • +
  • Add brookeswanson to codeowners. #1396
    • +
+

iroh [8]

+
    +
  • Maintain behavior for existing events, but also notify s3 if an +incid… #9172
    • +
  • XDR-1769: bump CTIM to 1.3.17. #9226
    • +
  • Reformat bucket path #9102
    • +
  • Save to s3 on bundle import. #8977
    • +
  • Replace CTIA Crud with Conure Calls #8924
    • +
  • Limit risk score #8906
    • +
  • Set Limits around observe targets call #8910
    • +
  • Add no-doc true and prevent explosion due to mismatched types. #8548
    • +
+

tenzin-config [14]

+
    +
  • Failure to configure correct url. #1100
    • +
  • These were flipped in TEST and we would like to test reports. #1094
    • +
  • One more time see if the report tab will work. #1088
    • +
  • Toggle report feature until Infrastructure is stable. #1086
    • +
  • update config. #1080
    • +
  • Report in test. #1076
    • +
  • conure -> base-url. #1073
    • +
  • Temporary flip this to not spam logs. #1069
    • +
  • Output buckets. #1068
    • +
  • Distributor and Conure configs. #1067
    • +
  • Add base-url for incident export (and incident report). #1064
    • +
  • Add playbook to conure configs. #1060
    • +
  • Add ouath2 config for all regions. #1020
    • +
  • Playbook automation config. #1037
    • +
+

Yurii Ivanisenko [1]

+

tenzin-config [1]

+
    +
  • tactical-portal moved to vercel #1022
    • +
+

James Brock [1]

+

easy-purescript-nix [1]

+
    +
  • purs: 0.15.10 -> 0.15.15
    • +
+

ryemelia [6]

+

tenzin-config [6]

+
    +
  • XDRSRE-1150: [TEST] Enable ES auth iroh/iroh-async #1128
    • +
  • Enable ES auth private-ctia TEST #1126
    • +
  • Enable es auth CTIA test #1127
    • +
  • fix kafka connector ES AUTH for INT #1129
    • +
  • Enable ES auth private-ctia INT #1125
    • +
  • XDRSRE-1273: [INT] Enable ES auth for iroh iroh-async #1124
    • +
+ + diff --git a/reports/FY24Q3-tmp-report.org b/reports/FY24Q3-tmp-report.org new file mode 100644 index 00000000..5dce2430 --- /dev/null +++ b/reports/FY24Q3-tmp-report.org @@ -0,0 +1,996 @@ +#+title: FY24Q3 Report +#+subtitle: logs goes 7 month back +#+date: 2024-05-13 +#+options: H:6 ^:nil +* IROH +** lead + + +*** Guillaume Buisson [12] + +**** ctia [2] + +- Properly filter Relationships to assemble a Feed View [[https://github.com/threatgrid/ctia/pull/1421][#1421]] +- Filter out some infrastructure details from Error API Responses [[https://github.com/threatgrid/ctia/pull/1412][#1412]] +**** iroh [8] + +- fix a flaky test in iroh-web [[https://github.com/advthreat/iroh/pull/9250][#9250]] +- Don't use pp-str to log the request in the rate limiter service [[https://github.com/advthreat/iroh/pull/9249][#9249]] +- Fix iroh-kafka* logs [[https://github.com/advthreat/iroh/pull/9240][#9240]] +- Update the json appender to rename the output level key [[https://github.com/advthreat/iroh/pull/9187][#9187]] +- update the logstash-v2 logging preset [[https://github.com/advthreat/iroh/pull/9178][#9178]] +- Don't fire disabled webhooks [[https://github.com/advthreat/iroh/pull/8741][#8741]] +- upgrade ctia-investigate to use transit+json instead of edn [[https://github.com/advthreat/iroh/pull/8623][#8623]] + +_between 6 month and 7 month old_ + +- A new script to update a record :created in ES [[https://github.com/advthreat/iroh/pull/8574][#8574]] +**** tenzin-config [2] + +- setup the IROH json logging appender +- Re-apply the default rate limit for the NGFW Incident promotion client [[https://github.com/advthreat/tenzin-config/pull/1063][#1063]] +** data + + +*** Mario Aquino [41] + +**** iroh [33] + +- Threat hunt integration tests [[https://github.com/advthreat/iroh/pull/9218][#9218]] +- Threat hunt module instance pagination [[https://github.com/advthreat/iroh/pull/9200][#9200]] +- iroh-async Telemetry Identity Data [[https://github.com/advthreat/iroh/pull/9166][#9166]] +- Xdr 1086/crud store fields filtering [[https://github.com/advthreat/iroh/pull/9147][#9147]] +- iroh-async task (metric) tag [[https://github.com/advthreat/iroh/pull/9123][#9123]] +- iroh-metrics in default bootstrap [[https://github.com/advthreat/iroh/pull/9118][#9118]] +- Metrics Service (micrometer) [[https://github.com/advthreat/iroh/pull/9029][#9029]] +- Disable color logging for test execution [[https://github.com/advthreat/iroh/pull/9097][#9097]] +- Carmine & Timbre upgrade v2 [[https://github.com/advthreat/iroh/pull/9005][#9005]] +- Loosen Risk Score Incident validation [[https://github.com/advthreat/iroh/pull/9013][#9013]] +- Apply risk score valid ranges to incident schemas [[https://github.com/advthreat/iroh/pull/8976][#8976]] +- Revert "Upgrade carmine version (#8888)" [[https://github.com/advthreat/iroh/pull/9003][#9003]] +- Log Tuning [[https://github.com/advthreat/iroh/pull/8978][#8978]] +- Upgrade carmine version [[https://github.com/advthreat/iroh/pull/8888][#8888]] +- Fix flaky test [[https://github.com/advthreat/iroh/pull/8956][#8956]] +- iroh-async high-traffic adjustments [[https://github.com/advthreat/iroh/pull/8835][#8835]] +- Fix disabled threat-hunt test [[https://github.com/advthreat/iroh/pull/8814][#8814]] +- Update incident_time when updating incident status [[https://github.com/advthreat/iroh/pull/8801][#8801]] +- incident enrichment activity diagram [[https://github.com/advthreat/iroh/pull/8712][#8712]] +- Separate Risk score & incident enrichment [[https://github.com/advthreat/iroh/pull/8751][#8751]] +- Improve safe-filtering [[https://github.com/advthreat/iroh/pull/8731][#8731]] +- iroh-async: Flatten Datadog context [[https://github.com/advthreat/iroh/pull/8706][#8706]] +- iroh-async logging & tracing context [[https://github.com/advthreat/iroh/pull/8705][#8705]] +- Socket timeout milliseconds (not seconds) [[https://github.com/advthreat/iroh/pull/8690][#8690]] +- Risk Score socket-timeout [[https://github.com/advthreat/iroh/pull/8687][#8687]] +- Threat Hunt Module Exclusion [[https://github.com/advthreat/iroh/pull/8646][#8646]] +- Remove dead code [[https://github.com/advthreat/iroh/pull/8626][#8626]] +- Incident Summary migration re-run [[https://github.com/advthreat/iroh/pull/8597][#8597]] +- Notification request uses paginated user search [[https://github.com/advthreat/iroh/pull/8606][#8606]] + +_between 6 month and 7 month old_ + +- Add support for role-targetted notification [[https://github.com/advthreat/iroh/pull/8557][#8557]] +- Issue 8438/notification request phase 1 [[https://github.com/advthreat/iroh/pull/8470][#8470]] +- Fix flaky test [[https://github.com/advthreat/iroh/pull/8521][#8521]] +- Use int-req-ctx when calling post-bundle-import [[https://github.com/advthreat/iroh/pull/8500][#8500]] +**** tenzin-config [8] + +- Exclude CTIA modules from threat hunt execution [[https://github.com/advthreat/tenzin-config/pull/1122][#1122]] +- Add iroh-async client-id to rate unlimited list [[https://github.com/advthreat/tenzin-config/pull/1053][#1053]] +- Increase conn-manager thread count after PROD performance monitoring [[https://github.com/advthreat/tenzin-config/pull/1042][#1042]] +- Increase thread pool size for EU private intel conn mgr [[https://github.com/advthreat/tenzin-config/pull/1039][#1039]] +- Increase connection mgr thread pool for NAM/EU/TEST [[https://github.com/advthreat/tenzin-config/pull/1030][#1030]] +- Increase thread pool size for engine connection manager [[https://github.com/advthreat/tenzin-config/pull/1012][#1012]] +- Config for skipping Private Intel during investigation threat hunt [[https://github.com/advthreat/tenzin-config/pull/1009][#1009]] +- Rerun incident summary migration and update ES index [[https://github.com/advthreat/tenzin-config/pull/1001][#1001]] + +*** Guillaume Erétéo [55] + +**** ctia [11] + +- remove ES5 support [[https://github.com/threatgrid/ctia/pull/1419][#1419]] +- Optimize lucene searches [[https://github.com/threatgrid/ctia/pull/1420][#1420]] +- bump ctim / remove status disposition [[https://github.com/threatgrid/ctia/pull/1417][#1417]] +- ctim 1.3.15 [[https://github.com/threatgrid/ctia/pull/1415][#1415]] +- silent this too noisy log [[https://github.com/threatgrid/ctia/pull/1414][#1414]] +- ctim-1.3.14 [[https://github.com/threatgrid/ctia/pull/1413][#1413]] +- remove un-store [[https://github.com/threatgrid/ctia/pull/1410][#1410]] +- fix wait_for for delete search [[https://github.com/threatgrid/ctia/pull/1399][#1399]] +- incident meta [[https://github.com/threatgrid/ctia/pull/1391][#1391]] +- Incident status disposition [[https://github.com/threatgrid/ctia/pull/1389][#1389]] + +_between 6 month and 7 month old_ + +- Update CODEOWNERS [[https://github.com/threatgrid/ctia/pull/1387][#1387]] +**** iroh [41] + +- Dump events with dump metrics script [[https://github.com/advthreat/iroh/pull/9180][#9180]] +- Sca clean phase 2 [[https://github.com/advthreat/iroh/pull/9176][#9176]] +- add backup clusters for delete [[https://github.com/advthreat/iroh/pull/9173][#9173]] +- Scripts for SCA issue cleaning [[https://github.com/advthreat/iroh/pull/9161][#9161]] +- simplify sorting in telemetry reports [[https://github.com/advthreat/iroh/pull/9144][#9144]] +- Add logs to better monitor reports [[https://github.com/advthreat/iroh/pull/9142][#9142]] +- Report service: consider missing user/org ids [[https://github.com/advthreat/iroh/pull/9134][#9134]] +- filter ids on search [[https://github.com/advthreat/iroh/pull/9130][#9130]] +- Generate statistics about modules [[https://github.com/advthreat/iroh/pull/9108][#9108]] +- Refactor iops report generation [[https://github.com/advthreat/iroh/pull/9099][#9099]] +- bump ctim / remove status disposition [[https://github.com/advthreat/iroh/pull/9114][#9114]] +- fix flaky ES test: wait some more [[https://github.com/advthreat/iroh/pull/9089][#9089]] +- telemetry report: fix search iteration for batch size 10000 [[https://github.com/advthreat/iroh/pull/9082][#9082]] +- reduce logs by adding user-scopes [[https://github.com/advthreat/iroh/pull/9078][#9078]] +- tk store: update ES index state [[https://github.com/advthreat/iroh/pull/8664][#8664]] +- Add admin maintenance route to load MITRE stix [[https://github.com/advthreat/iroh/pull/8967][#8967]] +- ctim 1.3.15 [[https://github.com/advthreat/iroh/pull/9068][#9068]] +- limit walk entities to the necessary exports [[https://github.com/advthreat/iroh/pull/9039][#9039]] +- ctim 1.3.14 [[https://github.com/advthreat/iroh/pull/9016][#9016]] +- Dump ES metrics telemetry events [[https://github.com/advthreat/iroh/pull/8999][#8999]] +- script to clean SE false positive incidents and sightings [[https://github.com/advthreat/iroh/pull/8846][#8846]] +- MITRE Matrix: dynamic components design [[https://github.com/advthreat/iroh/pull/8973][#8973]] +- fix Talos threat hunt [[https://github.com/advthreat/iroh/pull/8969][#8969]] +- update the design of static MITRE matrix rendering [[https://github.com/advthreat/iroh/pull/8949][#8949]] +- replace lazyseq by iteration in reports [[https://github.com/advthreat/iroh/pull/8957][#8957]] +- For Jeetu by G2 [[https://github.com/advthreat/iroh/pull/8920][#8920]] +- Some more incident stats [[https://github.com/advthreat/iroh/pull/8861][#8861]] +- import mitre matrix backbone [[https://github.com/advthreat/iroh/pull/8899][#8899]] +- Mitre coverage static matrix [[https://github.com/advthreat/iroh/pull/8882][#8882]] +- add created and modified to IROH CTIM entities [[https://github.com/advthreat/iroh/pull/8810][#8810]] +- bundle import activity diagrams [[https://github.com/advthreat/iroh/pull/8708][#8708]] +- scoring at bundle import [[https://github.com/advthreat/iroh/pull/8694][#8694]] +- Meta incident field [[https://github.com/advthreat/iroh/pull/8617][#8617]] +- entitlement-enforcement-jobs-service in default [[https://github.com/advthreat/iroh/pull/8612][#8612]] +- incident status_disposition [[https://github.com/advthreat/iroh/pull/8587][#8587]] + +_between 6 month and 7 month old_ + +- introduce admin common web service for cisco services [[https://github.com/advthreat/iroh/pull/8573][#8573]] +- speed up listing of entilements [[https://github.com/advthreat/iroh/pull/8516][#8516]] +- Update CODEOWNERS [[https://github.com/advthreat/iroh/pull/8524][#8524]] +- Add entitlement summaries endpoint for external policy enforcement jobs [[https://github.com/advthreat/iroh/pull/8508][#8508]] +- ductile 0.4.8 [[https://github.com/advthreat/iroh/pull/8453][#8453]] +- XDR intel retention design [[https://github.com/advthreat/iroh/pull/8153][#8153]] +**** tenzin-config [3] + +- configure / tune private intel proxy cm [[https://github.com/advthreat/tenzin-config/pull/1074][#1074]] +- increase bundle-batch-size [[https://github.com/advthreat/tenzin-config/pull/1071][#1071]] + +_between 6 month and 7 month old_ + +- fix config path in README.md [[https://github.com/advthreat/tenzin-config/pull/1000][#1000]] + +*** Ambrose Bonnaire-Sergeant [43] + +**** ctia [15] + +- Bump ring-swagger with proof of memory leak fix [[https://github.com/threatgrid/ctia/pull/1423][#1423]] +- Clojure 1.11.1 -> 1.11.2 [[https://github.com/threatgrid/ctia/pull/1416][#1416]] +- Revert patch bundle commits [[https://github.com/threatgrid/ctia/pull/1411][#1411]] +- Fix 2XX response swagger/coercion, ban ~:return~ [[https://github.com/threatgrid/ctia/pull/1407][#1407]] +- Remove asset properties/mapping merging during bundle patch [[https://github.com/threatgrid/ctia/pull/1408][#1408]] +- Fix :body descriptions [[https://github.com/threatgrid/ctia/pull/1409][#1409]] +- Fix POST /bulk schema checking [[https://github.com/threatgrid/ctia/pull/1406][#1406]] +- Use prn instead of pprint for logs [[https://github.com/threatgrid/ctia/pull/1401][#1401]] +- Eval routes and options given to ~context~ at initialization time [[https://github.com/threatgrid/ctia/pull/1394][#1394]] +- Use ~st/merge~ to merge schemas instead of ~into~ [[https://github.com/threatgrid/ctia/pull/1398][#1398]] +- Never match existing asset-* entities when patch-existing=false [[https://github.com/threatgrid/ctia/pull/1395][#1395]] +- Re-enable incident tests [[https://github.com/threatgrid/ctia/pull/1393][#1393]] +- Add external_ids to investigation select fields [[https://github.com/threatgrid/ctia/pull/1392][#1392]] + +_between 6 month and 7 month old_ + +- New bundle/import option: merge previous incident tactics/techniques [[https://github.com/threatgrid/ctia/pull/1388][#1388]] +- Patch existing entities in ~POST /bundle/import~ [[https://github.com/threatgrid/ctia/pull/1383][#1383]] +**** iroh [24] + +- Bump ring-swagger and prove it fixes the memory leak [[https://github.com/advthreat/iroh/pull/9244][#9244]] +- Fix typo in debug log [[https://github.com/advthreat/iroh/pull/9228][#9228]] +- Debug logs to investigate person assets not being imported [[https://github.com/advthreat/iroh/pull/9227][#9227]] +- Update status endpoint to keep conure updated [[https://github.com/advthreat/iroh/pull/9209][#9209]] +- Update test for new carmine non-FIFO queues: ~queue-status-report-test~ [[https://github.com/advthreat/iroh/pull/9103][#9103]] +- Make generated tk meta easier to review using pprint [[https://github.com/advthreat/iroh/pull/8805][#8805]] +- Restrict possible values for updated asset properties [[https://github.com/advthreat/iroh/pull/9022][#9022]] +- Don't forward response headers from CTIA to IROH [[https://github.com/advthreat/iroh/pull/9014][#9014]] +- Only subscribe incidents with supported observables [[https://github.com/advthreat/iroh/pull/9000][#9000]] +- Fix flaky test [[https://github.com/advthreat/iroh/pull/9001][#9001]] +- Redis: Set NX / XX [[https://github.com/advthreat/iroh/pull/8970][#8970]] +- Bulk asset update + rescoring route [[https://github.com/advthreat/iroh/pull/8963][#8963]] +- Fix logf call [[https://github.com/advthreat/iroh/pull/8925][#8925]] +- Fix incident subscription args, and only subscribe incident if observables/identities are non-empty [[https://github.com/advthreat/iroh/pull/8921][#8921]] +- Fix DI subscription URL [[https://github.com/advthreat/iroh/pull/8914][#8914]] +- Revert patch bundle commits [[https://github.com/advthreat/iroh/pull/8903][#8903]] +- Fix swagger description [[https://github.com/advthreat/iroh/pull/8905][#8905]] +- Asset properties update and incident rescoring route [[https://github.com/advthreat/iroh/pull/8843][#8843]] +- Rescoring task [[https://github.com/advthreat/iroh/pull/8869][#8869]] +- Generate valid DI auth tokens for incident subscriptions [[https://github.com/advthreat/iroh/pull/8804][#8804]] +- Fix ~(reset)~ [[https://github.com/advthreat/iroh/pull/8799][#8799]] +- Subscribe to incident asset rescoring via DI [[https://github.com/advthreat/iroh/pull/8699][#8699]] +- Only pass default patch-existing query params in bundle/import proxy if patch-existing=true [[https://github.com/advthreat/iroh/pull/8725][#8725]] + +_between 6 month and 7 month old_ + +- Enable entity patching in POST /private-intel/bundle/import [[https://github.com/advthreat/iroh/pull/8492][#8492]] +**** tenzin-config [4] + +- Bulk asset update limits [[https://github.com/advthreat/tenzin-config/pull/1059][#1059]] +- Add Conure url to Private intel config [[https://github.com/advthreat/tenzin-config/pull/1052][#1052]] +- Add config for DI client in iroh-engine [[https://github.com/advthreat/tenzin-config/pull/1036][#1036]] +- Add device insights url to iroh-engine config [[https://github.com/advthreat/tenzin-config/pull/1014][#1014]] +** integrations + + +*** Matthieu Sprunck [22] + +**** iroh [18] + +- Rename automation_workflow_disabled to automation_workflow_definition [[https://github.com/advthreat/iroh/pull/9196][#9196]] +- Revert "Update the json appender to rename the output level key (#9187)" [[https://github.com/advthreat/iroh/pull/9191][#9191]] +- Change Incident Assignment Notification wording [[https://github.com/advthreat/iroh/pull/9189][#9189]] +- Add title and link to the incident in the incident assignment notification [[https://github.com/advthreat/iroh/pull/9188][#9188]] +- Add a log when an unexpected status is returned from KafkaConnect [[https://github.com/advthreat/iroh/pull/9153][#9153]] +- IROH Proxy: Correct handling for path with spaces (%20) [[https://github.com/advthreat/iroh/pull/9149][#9149]] +- Build notification type name from notification type [[https://github.com/advthreat/iroh/pull/9140][#9140]] +- JMX metrics for clj-http connection manager [[https://github.com/advthreat/iroh/pull/8765][#8765]] +- Always decompress the body when status is not 2xx [[https://github.com/advthreat/iroh/pull/8527][#8527]] +- Restore default expiration (24h) for the local session token [[https://github.com/advthreat/iroh/pull/8747][#8747]] +- Workflow event schema changes [[https://github.com/advthreat/iroh/pull/8656][#8656]] +- IROH Proxy: remove headers set by the reverse proxy [[https://github.com/advthreat/iroh/pull/8655][#8655]] +- More log context to investigate #8638 [[https://github.com/advthreat/iroh/pull/8654][#8654]] +- Add logging info to investigate #8638 [[https://github.com/advthreat/iroh/pull/8653][#8653]] +- StackOverflowError temporary fix [[https://github.com/advthreat/iroh/pull/8607][#8607]] + +_between 6 month and 7 month old_ + +- Allow any header name in the remote module auth configuration [[https://github.com/advthreat/iroh/pull/8529][#8529]] +- Add ciscoxdr as a valid Feedback source [[https://github.com/advthreat/iroh/pull/8515][#8515]] +- Fix Duo Admin API Auth (sigv2) for POST requests [[https://github.com/advthreat/iroh/pull/8330][#8330]] +**** tenzin-config [4] + +- Configure XDR URL in the PrivateIntel service for the Assignment notification [[https://github.com/advthreat/tenzin-config/pull/1116][#1116]] +- Create a module record for Microsoft Graph API [[https://github.com/advthreat/tenzin-config/pull/1050][#1050]] +- Fix settings names for JAMF auth upgrade [[https://github.com/advthreat/tenzin-config/pull/1048][#1048]] +- Use Token Auth with the JAMF Classic API [[https://github.com/advthreat/tenzin-config/pull/1038][#1038]] + +*** Kirill Chernyshov [46] + +**** iroh [39] + +- Draft design [[https://github.com/advthreat/iroh/pull/9201][#9201]] +- Format redirect url for email notification [[https://github.com/advthreat/iroh/pull/9211][#9211]] +- Use static string 'Cisco' as a subtitle [[https://github.com/advthreat/iroh/pull/9210][#9210]] +- Coerce incoming notification before email format [[https://github.com/advthreat/iroh/pull/9204][#9204]] +- [REFACTORING] Standardize trapperkeeper usage [[https://github.com/advthreat/iroh/pull/9177][#9177]] +- Use ~notify!~ to create notification via API call [[https://github.com/advthreat/iroh/pull/9162][#9162]] +- Fix copyright notice in email template [[https://github.com/advthreat/iroh/pull/9159][#9159]] +- Add simple template for notification email [[https://github.com/advthreat/iroh/pull/9150][#9150]] +- Allow nil as a correlation id [[https://github.com/advthreat/iroh/pull/9143][#9143]] +- Fix for EventService initialization [[https://github.com/advthreat/iroh/pull/9141][#9141]] +- Respect user notification preferences [[https://github.com/advthreat/iroh/pull/9133][#9133]] +- Add default config for NotificationInDelivery [[https://github.com/advthreat/iroh/pull/9128][#9128]] +- 8938 e8811 process email notification delivery [[https://github.com/advthreat/iroh/pull/9127][#9127]] +- Fix config key [[https://github.com/advthreat/iroh/pull/9115][#9115]] +- Fix dev config for NotificationInDeliveryService [[https://github.com/advthreat/iroh/pull/9113][#9113]] +- On recieving NotificationRequest notify users according to their preference [[https://github.com/advthreat/iroh/pull/9087][#9087]] +- Upgrade clojure 1.11.1 -> 1.11.2 [[https://github.com/advthreat/iroh/pull/9072][#9072]] +- Remove maintenance notification type [[https://github.com/advthreat/iroh/pull/9069][#9069]] +- 8933 e8811 create notificationindeliveryservice persistence only [[https://github.com/advthreat/iroh/pull/9025][#9025]] +- "In App" -> "In-App" [[https://github.com/advthreat/iroh/pull/9020][#9020]] +- Add correct :name and :description to notification type meta [[https://github.com/advthreat/iroh/pull/9012][#9012]] +- NotificationPreference API real endpoint [[https://github.com/advthreat/iroh/pull/8995][#8995]] +- NotificationPreference Service [[https://github.com/advthreat/iroh/pull/8982][#8982]] +- Fixes for notification endpoint [[https://github.com/advthreat/iroh/pull/8964][#8964]] +- Add notification preference api endpoints [[https://github.com/advthreat/iroh/pull/8947][#8947]] +- Initial draft design of notifications delivery [[https://github.com/advthreat/iroh/pull/8844][#8844]] +- Refactor data streams service [[https://github.com/advthreat/iroh/pull/8793][#8793]] +- DRY'ed out client-creds-token namespace [[https://github.com/advthreat/iroh/pull/8783][#8783]] +- Kafka connect monitoring [[https://github.com/advthreat/iroh/pull/8278][#8278]] +- Handle undelivered records [[https://github.com/advthreat/iroh/pull/8634][#8634]] +- Events data retention enforcement job [[https://github.com/advthreat/iroh/pull/8722][#8722]] +- Iroh events data retention implementation [[https://github.com/advthreat/iroh/pull/8666][#8666]] +- Iroh events postgres data retention [[https://github.com/advthreat/iroh/pull/8693][#8693]] +- Use timbre for logging [[https://github.com/advthreat/iroh/pull/8651][#8651]] +- Add draft design for IROH Events data retention [[https://github.com/advthreat/iroh/pull/8585][#8585]] + +_between 6 month and 7 month old_ + +- Fix shutdown process of Kafka Consumer [[https://github.com/advthreat/iroh/pull/8558][#8558]] +- Fixes for CTIA Transfer service [[https://github.com/advthreat/iroh/pull/8552][#8552]] +- Transfer CTIA Events [[https://github.com/advthreat/iroh/pull/8514][#8514]] +- Tiny fix for EventWebservice router [[https://github.com/advthreat/iroh/pull/8493][#8493]] +**** tenzin-config [7] + +- Add KafkaProducerService to all envs [[https://github.com/advthreat/tenzin-config/pull/1107][#1107]] +- Add email kafka consumer to all envs [[https://github.com/advthreat/tenzin-config/pull/1106][#1106]] +- Enable kafka consumer for email notifications [[https://github.com/advthreat/tenzin-config/pull/1099][#1099]] +- Add new kafka topics for IROH notifications [[https://github.com/advthreat/tenzin-config/pull/1070][#1070]] +- Add ES sink connector v2 to test full migration [[https://github.com/advthreat/tenzin-config/pull/1035][#1035]] +- Fix broken data stream on TEST [[https://github.com/advthreat/tenzin-config/pull/1034][#1034]] +- Config for DataStreams service [[https://github.com/advthreat/tenzin-config/pull/1033][#1033]] + +*** Shafiq [31] + +**** iroh [28] + +- Design Automation-Remote target for iroh-proxy [[https://github.com/advthreat/iroh/pull/9190][#9190]] +- Trim whitespace when interpolating pipe transforms [[https://github.com/advthreat/iroh/pull/9121][#9121]] +- Support for GoogleAPI Authorization [[https://github.com/advthreat/iroh/pull/9106][#9106]] +- Refactor proxy health check [[https://github.com/advthreat/iroh/pull/9066][#9066]] +- Data retention cleanup of notification services [[https://github.com/advthreat/iroh/pull/9064][#9064]] +- Apply data retention policy on iroh-notifications [[https://github.com/advthreat/iroh/pull/9054][#9054]] +- Add ~:remote~ type in configuration spec fields [[https://github.com/advthreat/iroh/pull/9046][#9046]] +- Refactor proxy-health-check [[https://github.com/advthreat/iroh/pull/9033][#9033]] +- Update proxy-health-check logging [[https://github.com/advthreat/iroh/pull/9028][#9028]] +- Update proxy health check logging [[https://github.com/advthreat/iroh/pull/9024][#9024]] +- Perform relay-api request based on observable-types [[https://github.com/advthreat/iroh/pull/9017][#9017]] +- Add selection of settings for configuration-token auth [[https://github.com/advthreat/iroh/pull/9007][#9007]] +- Support for dedicated url setting for iroh-proxy requests [[https://github.com/advthreat/iroh/pull/8998][#8998]] +- Route for patching module-type documentation [[https://github.com/advthreat/iroh/pull/8981][#8981]] +- Add filtering of notifications using multiple statuses [[https://github.com/advthreat/iroh/pull/8974][#8974]] +- Support for transforming interpolated strings. [[https://github.com/advthreat/iroh/pull/8945][#8945]] +- Construct token url from base-url setting [[https://github.com/advthreat/iroh/pull/8923][#8923]] +- [IROH Proxy] Support for Rubrik and Commvault API services [[https://github.com/advthreat/iroh/pull/8902][#8902]] +- [iroh-proxy] Include POST method for proxy health check [[https://github.com/advthreat/iroh/pull/8878][#8878]] +- Update relay-module schemas for Checkpoint auth [[https://github.com/advthreat/iroh/pull/8875][#8875]] +- [iroh-proxy] Implement Checkpoint Smart-1 authentication [[https://github.com/advthreat/iroh/pull/8873][#8873]] +- Fix schema of proxy health check [[https://github.com/advthreat/iroh/pull/8827][#8827]] +- Add string matching for health check [[https://github.com/advthreat/iroh/pull/8815][#8815]] +- Fallback to iroh-events store when kafka send fails [[https://github.com/advthreat/iroh/pull/8786][#8786]] +- Fix mapping for incident events [[https://github.com/advthreat/iroh/pull/8703][#8703]] + +_between 6 month and 7 month old_ + +- Update iroh-event developer doc [[https://github.com/advthreat/iroh/pull/8596][#8596]] +- Add x-sort header to support search_after pagination [[https://github.com/advthreat/iroh/pull/8586][#8586]] +- Identify trusted service to service req for SE [[https://github.com/advthreat/iroh/pull/8495][#8495]] +**** tenzin-config [3] + +- Swtich to new sink-connector in INT [[https://github.com/advthreat/tenzin-config/pull/1024][#1024]] +- Add updated sink connector for all envs [[https://github.com/advthreat/tenzin-config/pull/1021][#1021]] +- Add sink connector for new iroh-event datastream [[https://github.com/advthreat/tenzin-config/pull/1019][#1019]] +** auth + + +*** bartuka [71] + +**** iroh [52] + +- add ~:content-type :json~ explicitly to clj-http [[https://github.com/advthreat/iroh/pull/9090][#9090]] +- Brownfield Provisioning - make the ~region~ field available for TEST purposes only [[https://github.com/advthreat/iroh/pull/9079][#9079]] +- Improve logs for Brownfield provisioning [[https://github.com/advthreat/iroh/pull/9076][#9076]] +- [IROH Auth] update QA routes for Universal Provisioning flow [[https://github.com/advthreat/iroh/pull/9053][#9053]] +- [IROH Auth] Fix access token brownfield provisioning [[https://github.com/advthreat/iroh/pull/9049][#9049]] +- [IROH Auth] bugfix - accept empty string as entitlement value for universal provisioning [[https://github.com/advthreat/iroh/pull/9021][#9021]] +- [IROH Auth] FMC add re-token proxy request [[https://github.com/advthreat/iroh/pull/9011][#9011]] +- [IROH Auth] fix FMC redirect call to ~/device~ [[https://github.com/advthreat/iroh/pull/8987][#8987]] +- [IROH Auth] fix device verification redirection [[https://github.com/advthreat/iroh/pull/8979][#8979]] +- fix proxy requests to FMC [[https://github.com/advthreat/iroh/pull/8972][#8972]] +- [IROH Auth] FMC OAuth2 and SSE proxies [[https://github.com/advthreat/iroh/pull/8840][#8840]] +- [IROH Auth] Improvements to universal provisioning callback [[https://github.com/advthreat/iroh/pull/8913][#8913]] +- [IROH Auth] bugfix #4: add ~:content-type :json~ to callback request [[https://github.com/advthreat/iroh/pull/8909][#8909]] +- [IROH Auth] fix payload sent to PIAM callback_url after provisioning was complete [[https://github.com/advthreat/iroh/pull/8900][#8900]] +- [IROH Auth] bugfix Universal Provisioning created schema error [[https://github.com/advthreat/iroh/pull/8892][#8892]] +- [IROH Auth] bugfix parsing OKTA JWT scopes [[https://github.com/advthreat/iroh/pull/8880][#8880]] +- [IROH Auth] Brownfield provisioning - endpoint to attach existing tenant to a SBG product [[https://github.com/advthreat/iroh/pull/8806][#8806]] +- [IROH Auth] Support FMC in the ~jwks~ service [[https://github.com/advthreat/iroh/pull/8830][#8830]] +- [IROH Auth] Fix DI onboarding in Universal Provisioning Flow [[https://github.com/advthreat/iroh/pull/8813][#8813]] +- Revert "[IROH Auth] support for FMC token in JWKS Service" [[https://github.com/advthreat/iroh/pull/8816][#8816]] +- [IROH Auth] support for FMC token in JWKS Service [[https://github.com/advthreat/iroh/pull/8808][#8808]] +- [IROH Auth] Check QA ~callback_url~ to complete provisioning tests [[https://github.com/advthreat/iroh/pull/8763][#8763]] +- [IROH Auth] better swagger descriptions for Universal Provisioning [[https://github.com/advthreat/iroh/pull/8752][#8752]] +- [IROH Auth] remove empty strings from ~client-id~ got from Vault [[https://github.com/advthreat/iroh/pull/8760][#8760]] +- [IROH Auth] add missing scope to get OKTA JWT [[https://github.com/advthreat/iroh/pull/8759][#8759]] +- [IROH Auth] add logs to investigate get okta jwt [[https://github.com/advthreat/iroh/pull/8758][#8758]] +- [IROH Auth] bugfix - ~client/post~ should use ~:form-params~ instead of ~:body~ [[https://github.com/advthreat/iroh/pull/8753][#8753]] +- [IROH Auth] bugfixes - arity exception, change ~product-response~ datatype, change ~pmap~ to ~map~ [[https://github.com/advthreat/iroh/pull/8738][#8738]] +- [IROH Auth] bugfix - fix urls in ~POST /tenants~ returned value and payload field names [[https://github.com/advthreat/iroh/pull/8733][#8733]] +- [IROH Auth] Cache OKTA JWT used for provisioning callback [[https://github.com/advthreat/iroh/pull/8727][#8727]] +- [IROH Auth] Improvements on logs and error handling to UniversalProvisioning and JWKSService [[https://github.com/advthreat/iroh/pull/8707][#8707]] +- [IROH Auth] Duplicate ~universal-provisioning~ web routes to accept IROH JWTs [[https://github.com/advthreat/iroh/pull/8675][#8675]] +- [IROH Auth] Expose ~callbacks packages~ store to check Universal Provisioning status [[https://github.com/advthreat/iroh/pull/8702][#8702]] +- [IROH Auth] Improve 202 Accepted response for ~/universal-provisioning/create-tenants~ [[https://github.com/advthreat/iroh/pull/8701][#8701]] +- [IROH Auth] Fix name convention to callbacks route in Universal Provisioning flow [[https://github.com/advthreat/iroh/pull/8691][#8691]] +- [IROH Auth] Gen OKTA JWT to callback request in Universal Provisioning flow [[https://github.com/advthreat/iroh/pull/8673][#8673]] +- bugfix - missing ~UniversalProvisioningCallbackService~ to deploy IROH nodes [[https://github.com/advthreat/iroh/pull/8680][#8680]] +- [IROH Auth] Check pending provisions from time-to-time. Endpoint that will be called by OPS tick [[https://github.com/advthreat/iroh/pull/8674][#8674]] +- [IROH Auth] Add callback handler to receive provisioning status from downstream apps [[https://github.com/advthreat/iroh/pull/8633][#8633]] +- [IROH Auth] Add support to UserIdentity JWTs in ~JWKSService~ [[https://github.com/advthreat/iroh/pull/8647][#8647]] +- [IROH Auth] Bugfix in JWKSService logic [[https://github.com/advthreat/iroh/pull/8659][#8659]] +- [IROH Auth] update docs for Universal Provisioning work [[https://github.com/advthreat/iroh/pull/8640][#8640]] +- [IROH Auth] Simplify IROH Web Core by leveraging ~JWKSService~ for all webservices [[https://github.com/advthreat/iroh/pull/8632][#8632]] +- [IROH Auth] Add structure to keep track of onboardings to support async flow in Universal Provisioning [[https://github.com/advthreat/iroh/pull/8599][#8599]] + +_between 6 month and 7 month old_ + +- [IROH Auth] Add support to accept IROH Auth JWTs and External JWTs in a WebService [[https://github.com/advthreat/iroh/pull/8528][#8528]] +- [IROH Auth] bump ~ring-jwt-middleware~ to ~1.1.5~ [[https://github.com/advthreat/iroh/pull/8568][#8568]] +- [IROH Auth] check entitlements schema in universal piam flow [[https://github.com/advthreat/iroh/pull/8560][#8560]] +- [IROH Auth] fix check of ~allowed-origins~ for ~registration_redirect~ query param [[https://github.com/advthreat/iroh/pull/8559][#8559]] +- [IROH Auth] move ~oauth2-jwkset~ to ~jwks-svc~ [[https://github.com/advthreat/iroh/pull/8534][#8534]] +- [IROH Auth] - Expose ~universal-provisioning-web-service~ [[https://github.com/advthreat/iroh/pull/8499][#8499]] +- [IROH Auth] move ~is-trusted-clients?~ to ~OAuth2ClientService~ [[https://github.com/advthreat/iroh/pull/8502][#8502]] +- [IROH Auth] add ~UniversalProvisioningService~ [[https://github.com/advthreat/iroh/pull/8459][#8459]] +**** ring-jwt-middleware [11] + + +_between 6 month and 7 month old_ + +- add test case +- update readme +- fix schema +- log the full jwt when error +- use the default value +- fix tests by adding ~post-jwt-format-fn-arg-fn~ to config and schema +- fix all tests by changing the output of ~decode~ +- Merge pull request #28 from threatgrid/pubkey-fn-arg-fn +- fix config_test +- add test case +- initial commit +**** tenzin-config [8] + +- add fmc client id for each env [[https://github.com/advthreat/tenzin-config/pull/1065][#1065]] +- fix url for device verification [[https://github.com/advthreat/tenzin-config/pull/1058][#1058]] +- Add FMC Proxy configuration [[https://github.com/advthreat/tenzin-config/pull/1056][#1056]] +- fix okta links [[https://github.com/advthreat/tenzin-config/pull/1043][#1043]] +- FMC base-urls to configure JWKS [[https://github.com/advthreat/tenzin-config/pull/1040][#1040]] +- [IROH Auth] bugfix - add config to okta jwks [[https://github.com/advthreat/tenzin-config/pull/1017][#1017]] +- [IROH Auth] add OKTA config for Universal Provisioning flow #1010 [[https://github.com/advthreat/tenzin-config/pull/1013][#1013]] +- add universal_provisioning_callbacks store [[https://github.com/advthreat/tenzin-config/pull/1011][#1011]] + +*** Yann Esposito [130] + +**** iroh [55] + +- improve Client credentials error message to help debug [[https://github.com/advthreat/iroh/pull/9213][#9213]] +- Attempt to provide a body to the onboarding with mustache [[https://github.com/advthreat/iroh/pull/9151][#9151]] +- provisioning API for Org apps [[https://github.com/advthreat/iroh/pull/9195][#9195]] +- Revert "add admin-ui to the gh-pages (#9222)" [[https://github.com/advthreat/iroh/pull/9223][#9223]] +- add admin-ui to the gh-pages [[https://github.com/advthreat/iroh/pull/9222][#9222]] +- Add sc-enabled? flag to profile API views [[https://github.com/advthreat/iroh/pull/9192][#9192]] +- [PIAM Brownfield Provisioning]: Provide a way to update link tenants [[https://github.com/advthreat/iroh/pull/9186][#9186]] +- Add apps field to Orgs [[https://github.com/advthreat/iroh/pull/9175][#9175]] +- improve response when PIAM returns an error [[https://github.com/advthreat/iroh/pull/9183][#9183]] +- fix flaky test invite-test paging [[https://github.com/advthreat/iroh/pull/9182][#9182]] +- Support aero configurations [[https://github.com/advthreat/iroh/pull/9170][#9170]] +- Fix invites pagination [[https://github.com/advthreat/iroh/pull/9138][#9138]] +- Support FMC returning Bearer instead of bearer [[https://github.com/advthreat/iroh/pull/9126][#9126]] +- composable jwks test helper [[https://github.com/advthreat/iroh/pull/9120][#9120]] +- Sync user-name during SCSO login [[https://github.com/advthreat/iroh/pull/9117][#9117]] +- Another IPv6 in URL fix [[https://github.com/advthreat/iroh/pull/9084][#9084]] +- Support IPv6 in URL for inspect service [[https://github.com/advthreat/iroh/pull/9083][#9083]] +- Update of the login doc [[https://github.com/advthreat/iroh/pull/9067][#9067]] +- optimize search user given a list of ids [[https://github.com/advthreat/iroh/pull/9018][#9018]] +- Fix link tenant bug [[https://github.com/advthreat/iroh/pull/8975][#8975]] +- Upgrade Org to XDR on first entitlement update. [[https://github.com/advthreat/iroh/pull/8881][#8881]] +- [IROH-Auth]: Auth Code Grant Client that do not generate any refresh token [[https://github.com/advthreat/iroh/pull/8927][#8927]] +- Specialize TAC routes access [[https://github.com/advthreat/iroh/pull/8884][#8884]] +- Remove legacy restriction of AO scopes [[https://github.com/advthreat/iroh/pull/8890][#8890]] +- Update deps to accept JWT without nbf claim [[https://github.com/advthreat/iroh/pull/8872][#8872]] +- New endpoint to ease impersonation usage [[https://github.com/advthreat/iroh/pull/8855][#8855]] +- Fix PIAM Universal Provisioning routes [[https://github.com/advthreat/iroh/pull/8828][#8828]] +- Should fix open impersonate flaky test [[https://github.com/advthreat/iroh/pull/8809][#8809]] +- Keep track of impersonators [[https://github.com/advthreat/iroh/pull/8736][#8736]] +- Restrict TAC routes to admins [[https://github.com/advthreat/iroh/pull/8794][#8794]] +- Remove with-tk [[https://github.com/advthreat/iroh/pull/8779][#8779]] +- Code/Test Improvements [[https://github.com/advthreat/iroh/pull/8767][#8767]] +- add a test for matching schema [[https://github.com/advthreat/iroh/pull/8770][#8770]] +- Custom Role Design doc [[https://github.com/advthreat/iroh/pull/8497][#8497]] +- Attempt to improve error message of match? [[https://github.com/advthreat/iroh/pull/8769][#8769]] +- Use ~cid~ for ~trace_id~ when present [[https://github.com/advthreat/iroh/pull/8754][#8754]] +- Support public client for custom routes [[https://github.com/advthreat/iroh/pull/8749][#8749]] +- Add playbook scope [[https://github.com/advthreat/iroh/pull/8739][#8739]] +- Fix webhook race condition risk [[https://github.com/advthreat/iroh/pull/8728][#8728]] +- Call get-org only once for org-virtual user [[https://github.com/advthreat/iroh/pull/8724][#8724]] +- Use a cache for entitlement summaries [[https://github.com/advthreat/iroh/pull/8667][#8667]] +- upgrade jetty version [[https://github.com/advthreat/iroh/pull/8714][#8714]] +- Remove a forgotten pretty printer [[https://github.com/advthreat/iroh/pull/8713][#8713]] +- Fast Event Notifier dispatch using event-type [[https://github.com/advthreat/iroh/pull/8650][#8650]] +- Fix DI onboarding [[https://github.com/advthreat/iroh/pull/8657][#8657]] + +_between 6 month and 7 month old_ + +- Generalize default indexes for data retention [[https://github.com/advthreat/iroh/pull/8598][#8598]] +- [Data Retention Policy]: Delete incident summaries along incident [[https://github.com/advthreat/iroh/pull/8576][#8576]] +- [Provisioning] Introduce ~product-instance-id~ [[https://github.com/advthreat/iroh/pull/8577][#8577]] +- Simply wait a lot more for ES to sync [[https://github.com/advthreat/iroh/pull/8553][#8553]] +- Quick fix on the IROH login page [[https://github.com/advthreat/iroh/pull/8564][#8564]] +- Prevent org duplication during provisioning [[https://github.com/advthreat/iroh/pull/8556][#8556]] +- Declared scopes tree [[https://github.com/advthreat/iroh/pull/8537][#8537]] +- Improve constraints against Entitlements [[https://github.com/advthreat/iroh/pull/8525][#8525]] +- Fix admin route to support combinators [[https://github.com/advthreat/iroh/pull/8377][#8377]] +- Data Retention endpoint returns immediately [[https://github.com/advthreat/iroh/pull/8486][#8486]] +**** iroh-scripts [43] + +- fix a bug with trust client +- fix resend-invite +- script to remove flags +- fix a bug in create-super-org +- relink scc script +- prevent id collision +- cleaned-up get-org response +- Added add-flag script here +- CSE client and better patch +- resend-invite +- add SXP riles prod clients +- improve client manipulations +- Updated scripts +- use include +- use local clojure +- Added a better alias for sxo clients +- SXO rules +- added ai client with script +- Fix +- A few new scripts +- Super client should be part of XDR orgs +- Super org should have the XDR flag +- Add admin user +- updated and added scripts +- save and improve client aliases +- save improvements +- create dashboard clients +- Support client aliases in get-client +- Update client with client-aliases +- many new scripts +- added a 1-time script +- Add trusted to get-client +- Improve search and error messages +- Prepare TG to SCSO org migration + +_between 6 month and 7 month old_ + +- add scope to a client +- Help support cider +- add admin to org +- Improved descriptions +- promote-to-master script +- Fix and small improvements +- Improve robustness +- Scripts for admin +- client-pass +**** oauth2-client-demo [3] + +- pin packages +- reuse authorized url +- added Meraki client to the list +**** ring-jwt-middleware [7] + +- Version 1.1.7-SNAPSHOT +- Version 1.1.6 +- Support missing nbf JWT [[https://github.com/advthreat/ring-jwt-middleware/pull/30][#30]] + +_between 6 month and 7 month old_ + +- Version 1.1.6-SNAPSHOT +- Version 1.1.5 +- v1.1.5-SNAPSHOT +- Version 1.1.4 +**** scopula [6] + +- Version 0.3.3-SNAPSHOT +- Version 0.3.2 +- real cljs support +- Version 0.3.2-SNAPSHOT +- Version 0.3.1 +- support cljs +**** tenzin-config [12] + +- add iroh gh-pages to allowed login origin [[https://github.com/advthreat/tenzin-config/pull/1123][#1123]] +- New SCA env for TEST/STAGING [[https://github.com/advthreat/tenzin-config/pull/1114][#1114]] +- configure automatio rules clients to not be rate limited [[https://github.com/advthreat/tenzin-config/pull/1111][#1111]] +- interpolation improvements [[https://github.com/advthreat/tenzin-config/pull/1112][#1112]] +- Add support for interpolation and self ref [[https://github.com/advthreat/tenzin-config/pull/1110][#1110]] +- Remove rate-limit for another SXO client on INT [[https://github.com/advthreat/tenzin-config/pull/1087][#1087]] +- Disable rate-limit SXO client for rules [[https://github.com/advthreat/tenzin-config/pull/1084][#1084]] +- Double threads dedicated for VirusTotal http calls [[https://github.com/advthreat/tenzin-config/pull/1051][#1051]] +- fix vault tpl transformations and checks [[https://github.com/advthreat/tenzin-config/pull/1041][#1041]] +- Remove rate-limit for automation [[https://github.com/advthreat/tenzin-config/pull/1044][#1044]] +- Check vault templating error [[https://github.com/advthreat/tenzin-config/pull/1023][#1023]] +- Add Universal Provisioning Services [[https://github.com/advthreat/tenzin-config/pull/1015][#1015]] +**** xdr-provisioning [4] + +- improved re-onboarding script +- use local clojure +- Manage entitlements add-ons +- add a re-provisioning script that rerun onboardings + +*** Olivier Barbeau [50] + +**** iroh [34] + +- Add number of incidents to each technique in the Mitre matrix [[https://github.com/advthreat/iroh/pull/9157][#9157]] +- Fix events and incidents ES stores for DEV [[https://github.com/advthreat/iroh/pull/9154][#9154]] +- E8851: XDR Native & detections [[https://github.com/advthreat/iroh/pull/9122][#9122]] +- E8851: Design of changes for XDR native detections [[https://github.com/advthreat/iroh/pull/9110][#9110]] +- E8851: Product ordering in the coverage of techniques [[https://github.com/advthreat/iroh/pull/9100][#9100]] +- E8851: Product ordering and SCA renaming [[https://github.com/advthreat/iroh/pull/9086][#9086]] +- E8851: Add Org's integrations to the Mitre matrix [[https://github.com/advthreat/iroh/pull/8993][#8993]] +- E8851: Sorting of Mitre elements [[https://github.com/advthreat/iroh/pull/8992][#8992]] +- E8851: Static matrix common to all Orgs [[https://github.com/advthreat/iroh/pull/8939][#8939]] +- E8851: Talos MITRE coverage files import [[https://github.com/advthreat/iroh/pull/8876][#8876]] +- Design of the Talos MITRE coverage files import [[https://github.com/advthreat/iroh/pull/8856][#8856]] +- 'iroh' node type and default services for all node types [[https://github.com/advthreat/iroh/pull/8817][#8817]] +- Check the list of services for a node type [[https://github.com/advthreat/iroh/pull/8800][#8800]] +- Fix merge error on PR 8784 [[https://github.com/advthreat/iroh/pull/8797][#8797]] +- [IROH configuration]: Move role-web-service config to default tk files [[https://github.com/advthreat/iroh/pull/8782][#8782]] +- [IROH configuration]: Universal Provisioning Services config refactor [[https://github.com/advthreat/iroh/pull/8784][#8784]] +- [IROH configuration]: explicit name for generated conf and meta [[https://github.com/advthreat/iroh/pull/8785][#8785]] +- Clean bootstrap.cfg; remove tmp file [[https://github.com/advthreat/iroh/pull/8781][#8781]] +- Add few additional tests to iroh services [[https://github.com/advthreat/iroh/pull/8762][#8762]] +- rewrite tests [[https://github.com/advthreat/iroh/pull/8773][#8773]] +- more info for debugging [[https://github.com/advthreat/iroh/pull/8717][#8717]] +- [IROH configuration]: general documentation [[https://github.com/advthreat/iroh/pull/8764][#8764]] +- update developer doc for api-gateway [[https://github.com/advthreat/iroh/pull/8723][#8723]] +- Some test clean-up [[https://github.com/advthreat/iroh/pull/8716][#8716]] +- High volume of SQL queries for a single observe/deliberate call [[https://github.com/advthreat/iroh/pull/8682][#8682]] +- Remove the state of module instances in ~obfuscate-module-instance~ [[https://github.com/advthreat/iroh/pull/8670][#8670]] +- E8388: update proxy-endpoints-metadata endpoint and metadata [[https://github.com/advthreat/iroh/pull/8663][#8663]] +- E8388: update x-proxy endpoint and IntService ACL filters [[https://github.com/advthreat/iroh/pull/8608][#8608]] +- E8388 : Simplifies upgrade/downgrade tests [[https://github.com/advthreat/iroh/pull/8635][#8635]] +- Implement ~Module Instance service~ event handler [[https://github.com/advthreat/iroh/pull/8592][#8592]] +- Updates to the design 'entitlement changes for integration modules' [[https://github.com/advthreat/iroh/pull/8541][#8541]] + +_between 6 month and 7 month old_ + +- E8388: add new module-instance events, register Module Instance service as handler [[https://github.com/advthreat/iroh/pull/8547][#8547]] +- E8388: Issue 8531 add state to module instance schema [[https://github.com/advthreat/iroh/pull/8544][#8544]] +- Issue 8389 design entitlement changes for integration modules [[https://github.com/advthreat/iroh/pull/8510][#8510]] +**** tenzin-config [16] + +- add XDR native module types for PROD [[https://github.com/advthreat/tenzin-config/pull/1115][#1115]] +- add SCA module-type-id for XDR Native on TEST [temp UI fix] [[https://github.com/advthreat/tenzin-config/pull/1109][#1109]] +- add SCA module-type-id for XDR Native [temp UI fix] [[https://github.com/advthreat/tenzin-config/pull/1108][#1108]] +- Mitre: Add detections for XDR Native [[https://github.com/advthreat/tenzin-config/pull/1098][#1098]] +- product ordering and SCA renaming [[https://github.com/advthreat/tenzin-config/pull/1079][#1079]] +- Config for Mitre covering products [[https://github.com/advthreat/tenzin-config/pull/1072][#1072]] +- Deep merge for vectors and sets with duplicates check [[https://github.com/advthreat/tenzin-config/pull/1032][#1032]] +- Reduce configuration duplicates - config.edn part [[https://github.com/advthreat/tenzin-config/pull/1031][#1031]] +- Reduce configuration duplicates - bootstrap.cfg part [[https://github.com/advthreat/tenzin-config/pull/1028][#1028]] +- Move role-web-service config to IROH [[https://github.com/advthreat/tenzin-config/pull/1026][#1026]] +- Move Universal Provisioning Services config to IROH [[https://github.com/advthreat/tenzin-config/pull/1027][#1027]] +- Clean bootstrap cfg [[https://github.com/advthreat/tenzin-config/pull/1025][#1025]] +- Remove the ~:registration~ flag in all environments [[https://github.com/advthreat/tenzin-config/pull/963][#963]] +- Remove the ~:merge-users-by-email~ flag in all environments [[https://github.com/advthreat/tenzin-config/pull/962][#962]] +- Remove the ~:account-activation-optim~ flag in all environments as it is now activated everywhere. [[https://github.com/advthreat/tenzin-config/pull/961][#961]] +- Remove the ~xdr-roles~ flag in all environments [[https://github.com/advthreat/tenzin-config/pull/964][#964]] + +*** (Yogsototh) [62] + +**** iroh-scripts [43] + +- fix a bug with trust client +- fix resend-invite +- script to remove flags +- fix a bug in create-super-org +- relink scc script +- prevent id collision +- cleaned-up get-org response +- Added add-flag script here +- CSE client and better patch +- resend-invite +- add SXP riles prod clients +- improve client manipulations +- Updated scripts +- use include +- use local clojure +- Added a better alias for sxo clients +- SXO rules +- added ai client with script +- Fix +- A few new scripts +- Super client should be part of XDR orgs +- Super org should have the XDR flag +- Add admin user +- updated and added scripts +- save and improve client aliases +- save improvements +- create dashboard clients +- Support client aliases in get-client +- Update client with client-aliases +- many new scripts +- added a 1-time script +- Add trusted to get-client +- Improve search and error messages +- Prepare TG to SCSO org migration + +_between 6 month and 7 month old_ + +- add scope to a client +- Help support cider +- add admin to org +- Improved descriptions +- promote-to-master script +- Fix and small improvements +- Improve robustness +- Scripts for admin +- client-pass +**** oauth2-client-demo [3] + +- pin packages +- reuse authorized url +- added Meraki client to the list +**** ring-jwt-middleware [6] + +- Version 1.1.7-SNAPSHOT +- Version 1.1.6 + +_between 6 month and 7 month old_ + +- Version 1.1.6-SNAPSHOT +- Version 1.1.5 +- v1.1.5-SNAPSHOT +- Version 1.1.4 +**** scopula [6] + +- Version 0.3.3-SNAPSHOT +- Version 0.3.2 +- real cljs support +- Version 0.3.2-SNAPSHOT +- Version 0.3.1 +- support cljs +**** xdr-provisioning [4] + +- improved re-onboarding script +- use local clojure +- Manage entitlements add-ons +- add a re-provisioning script that rerun onboardings +** iroh-ops + + +*** Jerome Schneider [1] + +**** tenzin-config [1] + +- IROH migrate to new MSK SASL/SCRAM cluster! + +*** Patrick Patat [1] + +**** tenzin-config [1] + +- refactor ops config with new ref system [[https://github.com/advthreat/tenzin-config/pull/1113][#1113]] +* Other +** Other + + +*** Robert Levy [7] + +**** iroh [6] + +- Inherit properties from type in hierarchical modules [[https://github.com/advthreat/iroh/pull/9042][#9042]] +- Format hierarchical modules invalid-parent-id error with context and error type [[https://github.com/advthreat/iroh/pull/8901][#8901]] +- Update hardcoded source in Secure Endpoint module [[https://github.com/advthreat/iroh/pull/8874][#8874]] +- Expose pagination & search functionality in notifications api [[https://github.com/advthreat/iroh/pull/8803][#8803]] +- Fix bug in hierarchical module logic producing empty settings/settings_effective map [[https://github.com/advthreat/iroh/pull/8745][#8745]] +- Issue 8158 hierarchical module [[https://github.com/advthreat/iroh/pull/8469][#8469]] +**** tenzin-config [1] + +- Revert "Adds cache configuration for CrowdStrike (#1002)" [[https://github.com/advthreat/tenzin-config/pull/1005][#1005]] + +*** Eric Gierach [5] + +**** iroh [2] + + +_between 6 month and 7 month old_ + +- bumping iroh-engine to 0.15.13 [[https://github.com/advthreat/iroh/pull/8520][#8520]] +- bumping iroh-engine to 0.15.12 [[https://github.com/advthreat/iroh/pull/8509][#8509]] +**** tenzin-config [3] + +- removing duplicate entry [[https://github.com/advthreat/tenzin-config/pull/1078][#1078]] +- Swap stg and test configs for reporting. [[https://github.com/advthreat/tenzin-config/pull/1077][#1077]] +- Disabling reporting until Ops gets the infra set up. [[https://github.com/advthreat/tenzin-config/pull/1075][#1075]] + +*** II [20] + +**** iroh [16] + +- Keeps Kondo from being run on dev start [[https://github.com/advthreat/iroh/pull/9220][#9220]] +- Xdr 1282 Adds new Umbrella service to default services [[https://github.com/advthreat/iroh/pull/9214][#9214]] +- Xdr 1282 add v 2 token cache to umbrella integration [[https://github.com/advthreat/iroh/pull/9208][#9208]] +- XDR-1411 Fixes inconsistent v1 v2 refer [[https://github.com/advthreat/iroh/pull/9197][#9197]] +- 9074 remove settings effective [[https://github.com/advthreat/iroh/pull/9075][#9075]] +- 8990 umbrella investigate v2 [[https://github.com/advthreat/iroh/pull/9030][#9030]] +- 8958 Adds Missing Umbrella v2 Sightings [[https://github.com/advthreat/iroh/pull/8960][#8960]] +- 8498 fix token cache [[https://github.com/advthreat/iroh/pull/8911][#8911]] +- 8798 create migration to add parents to existing microsoft defender modules [[https://github.com/advthreat/iroh/pull/8870][#8870]] +- Throws exception in parent validation on non-existent parent [[https://github.com/advthreat/iroh/pull/8850][#8850]] +- Merges module type props on create and update health check [[https://github.com/advthreat/iroh/pull/8845][#8845]] +- Implements v2 threat hunting [[https://github.com/advthreat/iroh/pull/8833][#8833]] +- This should fix issue with parent settings not used on create-patch [[https://github.com/advthreat/iroh/pull/8822][#8822]] +- Adds insights scope to allowed Automation scopes in gen-ao-jwt [[https://github.com/advthreat/iroh/pull/8678][#8678]] +- 8496 token cache fix [[https://github.com/advthreat/iroh/pull/8637][#8637]] + +_between 6 month and 7 month old_ + +- 8496 - relay module token cache [[https://github.com/advthreat/iroh/pull/8580][#8580]] +**** tenzin-config [4] + +- Disables Umbrella module auto load so service does it [[https://github.com/advthreat/tenzin-config/pull/1120][#1120]] +- Enables Umbrella token caches [[https://github.com/advthreat/tenzin-config/pull/1119][#1119]] +- Revert "Revert "Adds cache configuration for CrowdStrike (#1002)" (#1005)" [[https://github.com/advthreat/tenzin-config/pull/1008][#1008]] + +_between 6 month and 7 month old_ + +- Adds cache configuration for CrowdStrike [[https://github.com/advthreat/tenzin-config/pull/1002][#1002]] + +*** Devin Walters [9] + +**** tenzin-config [9] + +- Configure s3-http-client connection pool size for PROD environments [[https://github.com/advthreat/tenzin-config/pull/1105][#1105]] +- Turn on reporting pipeline in TEST [[https://github.com/advthreat/tenzin-config/pull/1097][#1097]] +- Up hikari pool size in INT for conure [[https://github.com/advthreat/tenzin-config/pull/1095][#1095]] +- Configure incident import bucket per PROD env for iroh and iroh-async [[https://github.com/advthreat/tenzin-config/pull/1092][#1092]] +- Configure incident pipeline [[https://github.com/advthreat/tenzin-config/pull/1091][#1091]] +- Fix bucket name [[https://github.com/advthreat/tenzin-config/pull/1083][#1083]] +- Match s3 bucket key [[https://github.com/advthreat/tenzin-config/pull/1082][#1082]] +- Add INT and TEST enrichment bucket names to relevant configs [[https://github.com/advthreat/tenzin-config/pull/1057][#1057]] + +_between 6 month and 7 month old_ + +- Add port 443 to ctia base urls [[https://github.com/advthreat/tenzin-config/pull/996][#996]] + +*** Mia [5] + +**** iroh [5] + +- create permanent logs to unobtrusively monitor bundle import results [[https://github.com/advthreat/iroh/pull/9242][#9242]] +- New iroh event docs [[https://github.com/advthreat/iroh/pull/9181][#9181]] +- iroh-engine 0.16.2 [[https://github.com/advthreat/iroh/pull/9125][#9125]] +- Engine 0.16.1 [[https://github.com/advthreat/iroh/pull/9116][#9116]] +- Engine 0.16.0 [[https://github.com/advthreat/iroh/pull/8997][#8997]] + +*** Martin Bruchanov [1] + +**** tenzin-config [1] + +- XDRSRE-64: Authentication for public CTIA in INT [[https://github.com/advthreat/tenzin-config/pull/1081][#1081]] + +*** James Moser [1] + +**** tenzin-config [1] + +- added QA domain to idps email domain whitelists [[https://github.com/advthreat/tenzin-config/pull/1085][#1085]] + +*** [20] + +**** iroh [16] + +- Keeps Kondo from being run on dev start [[https://github.com/advthreat/iroh/pull/9220][#9220]] +- Xdr 1282 Adds new Umbrella service to default services [[https://github.com/advthreat/iroh/pull/9214][#9214]] +- Xdr 1282 add v 2 token cache to umbrella integration [[https://github.com/advthreat/iroh/pull/9208][#9208]] +- XDR-1411 Fixes inconsistent v1 v2 refer [[https://github.com/advthreat/iroh/pull/9197][#9197]] +- 9074 remove settings effective [[https://github.com/advthreat/iroh/pull/9075][#9075]] +- 8990 umbrella investigate v2 [[https://github.com/advthreat/iroh/pull/9030][#9030]] +- 8958 Adds Missing Umbrella v2 Sightings [[https://github.com/advthreat/iroh/pull/8960][#8960]] +- 8498 fix token cache [[https://github.com/advthreat/iroh/pull/8911][#8911]] +- 8798 create migration to add parents to existing microsoft defender modules [[https://github.com/advthreat/iroh/pull/8870][#8870]] +- Throws exception in parent validation on non-existent parent [[https://github.com/advthreat/iroh/pull/8850][#8850]] +- Merges module type props on create and update health check [[https://github.com/advthreat/iroh/pull/8845][#8845]] +- Implements v2 threat hunting [[https://github.com/advthreat/iroh/pull/8833][#8833]] +- This should fix issue with parent settings not used on create-patch [[https://github.com/advthreat/iroh/pull/8822][#8822]] +- Adds insights scope to allowed Automation scopes in gen-ao-jwt [[https://github.com/advthreat/iroh/pull/8678][#8678]] +- 8496 token cache fix [[https://github.com/advthreat/iroh/pull/8637][#8637]] + +_between 6 month and 7 month old_ + +- 8496 - relay module token cache [[https://github.com/advthreat/iroh/pull/8580][#8580]] +**** tenzin-config [4] + +- Disables Umbrella module auto load so service does it [[https://github.com/advthreat/tenzin-config/pull/1120][#1120]] +- Enables Umbrella token caches [[https://github.com/advthreat/tenzin-config/pull/1119][#1119]] +- Revert "Revert "Adds cache configuration for CrowdStrike (#1002)" (#1005)" [[https://github.com/advthreat/tenzin-config/pull/1008][#1008]] + +_between 6 month and 7 month old_ + +- Adds cache configuration for CrowdStrike [[https://github.com/advthreat/tenzin-config/pull/1002][#1002]] + +*** Martin Bruchanov [1] + +**** iroh [1] + +- XDR-1344: Final version of deletion script used for PROD change [[https://github.com/advthreat/iroh/pull/9174][#9174]] + +*** Ruslan Yemelianov [2] + +**** tenzin-config [2] + +- Revert "enable ES auth private-ctia INT" +- enable ES auth private-ctia INT + +*** Andrew Parisi [2] + +**** tenzin-config [2] + +- [data-retention/update-iroh-internal-for-prod] [[https://github.com/advthreat/tenzin-config/pull/1018][#1018]] +- [data-retention/update-entitlement-route-information] [[https://github.com/advthreat/tenzin-config/pull/1004][#1004]] + +*** Scott McLeod [7] + +**** iroh [6] + +- Notification service timestamp filter [[https://github.com/advthreat/iroh/pull/9252][#9252]] +- Tk store half bounded intervals [[https://github.com/advthreat/iroh/pull/9158][#9158]] +- Extend tk search with range queries [[https://github.com/advthreat/iroh/pull/8912][#8912]] +- Resolves postgres driver sql-injection vulnerability #9091 [[https://github.com/advthreat/iroh/pull/9092][#9092]] +- Implement searching risk scores by score [[https://github.com/advthreat/iroh/pull/8907][#8907]] +- tk store: Add delete-search method #8213 [[https://github.com/advthreat/iroh/pull/8692][#8692]] +**** tenzin-config [1] + +- Increase ReportService batch size to ES maximum [[https://github.com/advthreat/tenzin-config/pull/1055][#1055]] + +*** Sam Waggoner [1] + +**** tenzin-config [1] + +- hydrant/912 add clean hashes importer. + +*** t2sw [2] + +**** ctia [1] + + +_between 6 month and 7 month old_ + +- Update CODEOWNERS [[https://github.com/threatgrid/ctia/pull/1390][#1390]] +**** iroh [1] + +- add health endpoint to tac portal and update tests [[https://github.com/advthreat/iroh/pull/9002][#9002]] + +*** Jerome Schneider [1] + +**** iroh [1] + +- Upgrade PostgreSQL to 12.15 [[https://github.com/advthreat/iroh/pull/8618][#8618]] + +*** Brooke Swanson [24] + +**** ctia [2] + +- XDR-1769: bump CTIM to 1.3.17. [[https://github.com/threatgrid/ctia/pull/1422][#1422]] +- Add brookeswanson to codeowners. [[https://github.com/threatgrid/ctia/pull/1396][#1396]] +**** iroh [8] + +- Maintain behavior for existing events, but also notify s3 if an incid… [[https://github.com/advthreat/iroh/pull/9172][#9172]] +- XDR-1769: bump CTIM to 1.3.17. [[https://github.com/advthreat/iroh/pull/9226][#9226]] +- Reformat bucket path [[https://github.com/advthreat/iroh/pull/9102][#9102]] +- Save to s3 on bundle import. [[https://github.com/advthreat/iroh/pull/8977][#8977]] +- Replace CTIA Crud with Conure Calls [[https://github.com/advthreat/iroh/pull/8924][#8924]] +- Limit risk score [[https://github.com/advthreat/iroh/pull/8906][#8906]] +- Set Limits around observe targets call [[https://github.com/advthreat/iroh/pull/8910][#8910]] +- Add no-doc true and prevent explosion due to mismatched types. [[https://github.com/advthreat/iroh/pull/8548][#8548]] +**** tenzin-config [14] + +- Failure to configure correct url. [[https://github.com/advthreat/tenzin-config/pull/1100][#1100]] +- These were flipped in TEST and we would like to test reports. [[https://github.com/advthreat/tenzin-config/pull/1094][#1094]] +- One more time see if the report tab will work. [[https://github.com/advthreat/tenzin-config/pull/1088][#1088]] +- Toggle report feature until Infrastructure is stable. [[https://github.com/advthreat/tenzin-config/pull/1086][#1086]] +- update config. [[https://github.com/advthreat/tenzin-config/pull/1080][#1080]] +- Report in test. [[https://github.com/advthreat/tenzin-config/pull/1076][#1076]] +- conure -> base-url. [[https://github.com/advthreat/tenzin-config/pull/1073][#1073]] +- Temporary flip this to not spam logs. [[https://github.com/advthreat/tenzin-config/pull/1069][#1069]] +- Output buckets. [[https://github.com/advthreat/tenzin-config/pull/1068][#1068]] +- Distributor and Conure configs. [[https://github.com/advthreat/tenzin-config/pull/1067][#1067]] +- Add base-url for incident export (and incident report). [[https://github.com/advthreat/tenzin-config/pull/1064][#1064]] +- Add playbook to conure configs. [[https://github.com/advthreat/tenzin-config/pull/1060][#1060]] +- Add ouath2 config for all regions. [[https://github.com/advthreat/tenzin-config/pull/1020][#1020]] +- Playbook automation config. [[https://github.com/advthreat/tenzin-config/pull/1037][#1037]] + +*** Yurii Ivanisenko [1] + +**** tenzin-config [1] + +- tactical-portal moved to vercel [[https://github.com/advthreat/tenzin-config/pull/1022][#1022]] + +*** James Brock [1] + +**** easy-purescript-nix [1] + +- purs: 0.15.10 -> 0.15.15 + +*** ryemelia [6] + +**** tenzin-config [6] + +- XDRSRE-1150: [TEST] Enable ES auth iroh/iroh-async [[https://github.com/advthreat/tenzin-config/pull/1128][#1128]] +- Enable ES auth private-ctia TEST [[https://github.com/advthreat/tenzin-config/pull/1126][#1126]] +- Enable es auth CTIA test [[https://github.com/advthreat/tenzin-config/pull/1127][#1127]] +- fix kafka connector ES AUTH for INT [[https://github.com/advthreat/tenzin-config/pull/1129][#1129]] +- Enable ES auth private-ctia INT [[https://github.com/advthreat/tenzin-config/pull/1125][#1125]] +- XDRSRE-1273: [INT] Enable ES auth for iroh iroh-async [[https://github.com/advthreat/tenzin-config/pull/1124][#1124]] diff --git a/reports/FY24Q4-tmp-report.html b/reports/FY24Q4-tmp-report.html new file mode 100644 index 00000000..1e573086 --- /dev/null +++ b/reports/FY24Q4-tmp-report.html @@ -0,0 +1,1940 @@ + + + + + + + + FY24Q4 Report + + + + +
+

FY24Q4 Report

+

logs goes 7 month back

+

2024-06-04

+
+ +

IROH

+

lead

+

Guillaume Buisson [13]

+

ctia [2]

+
    +
  • Properly filter Relationships to assemble a Feed View #1421
    • +
  • Filter out some infrastructure details from Error API Responses #1412
    • +
+

iroh [9]

+
    +
  • Logging improvements #9241
    • +
  • fix a flaky test in iroh-web #9250
    • +
  • Don't use pp-str to log the request in the rate limiter service #9249
    • +
  • Fix iroh-kafka* logs #9240
    • +
  • Update the json appender to rename the output level key #9187
    • +
  • update the logstash-v2 logging preset #9178
    • +
  • Don't fire disabled webhooks #8741
    • +
+

between 6 month and 7 month old

+
    +
  • upgrade ctia-investigate to use transit+json instead of edn #8623
    • +
  • A new script to update a record :created in ES #8574
    • +
+

tenzin-config [2]

+
    +
  • setup the IROH json logging appender
    • +
  • Re-apply the default rate limit for the NGFW Incident promotion +client #1063
    • +
+

data

+

Mario Aquino [40]

+

iroh [30]

+
    +
  • Constrain judgements included with threat hunt incident bundles #9279
    • +
  • Threat hunt integration tests #9218
    • +
  • Threat hunt module instance pagination #9200
    • +
  • iroh-async Telemetry Identity Data #9166
    • +
  • Xdr 1086/crud store fields filtering #9147
    • +
  • iroh-async task (metric) tag #9123
    • +
  • iroh-metrics in default bootstrap #9118
    • +
  • Metrics Service (micrometer) #9029
    • +
  • Disable color logging for test execution #9097
    • +
  • Carmine & Timbre upgrade v2 #9005
    • +
  • Loosen Risk Score Incident validation #9013
    • +
  • Apply risk score valid ranges to incident schemas #8976
    • +
  • Revert "Upgrade carmine version (#8888)" #9003
    • +
  • Log Tuning #8978
    • +
  • Upgrade carmine version #8888
    • +
  • Fix flaky test #8956
    • +
  • iroh-async high-traffic adjustments #8835
    • +
  • Fix disabled threat-hunt test #8814
    • +
  • Update incident_time when updating incident status #8801
    • +
  • incident enrichment activity diagram #8712
    • +
  • Separate Risk score & incident enrichment #8751
    • +
  • Improve safe-filtering #8731
    • +
  • iroh-async: Flatten Datadog context #8706
    • +
  • iroh-async logging & tracing context #8705
    • +
+

between 6 month and 7 month old

+
    +
  • Socket timeout milliseconds (not seconds) #8690
    • +
  • Risk Score socket-timeout #8687
    • +
  • Threat Hunt Module Exclusion #8646
    • +
  • Remove dead code #8626
    • +
  • Incident Summary migration re-run #8597
    • +
  • Notification request uses paginated user search #8606
    • +
+

tenzin-config [10]

+
    +
  • Fix auth parameters passed for calling ES #1139
    • +
  • Address thread exhaustion in conn mgrs during threat hunting #1130
    • +
  • Exclude CTIA modules from threat hunt execution #1122
    • +
  • Add iroh-async client-id to rate unlimited list #1053
    • +
  • Increase conn-manager thread count after PROD performance monitoring +#1042
    • +
  • Increase thread pool size for EU private intel conn mgr #1039
    • +
  • Increase connection mgr thread pool for NAM/EU/TEST #1030
    • +
+

between 6 month and 7 month old

+
    +
  • Increase thread pool size for engine connection manager #1012
    • +
  • Config for skipping Private Intel during investigation threat hunt +#1009
    • +
  • Rerun incident summary migration and update ES index #1001
    • +
+

Guillaume Erétéo [52]

+

ctia [11]

+
    +
  • remove ES5 support #1419
    • +
  • Optimize lucene searches #1420
    • +
  • bump ctim / remove status disposition #1417
    • +
  • ctim 1.3.15 #1415
    • +
  • silent this too noisy log #1414
    • +
  • ctim-1.3.14 #1413
    • +
  • remove un-store #1410
    • +
  • fix wait_for for delete search #1399
    • +
+

between 6 month and 7 month old

+
    +
  • incident meta #1391
    • +
  • Incident status disposition #1389
    • +
  • Update CODEOWNERS #1387
    • +
+

iroh [38]

+
    +
  • Enable auth on private intel es IOPS script #9275
    • +
  • Dump events with dump metrics script #9180
    • +
  • Sca clean phase 2 #9176
    • +
  • add backup clusters for delete #9173
    • +
  • Scripts for SCA issue cleaning #9161
    • +
  • simplify sorting in telemetry reports #9144
    • +
  • Add logs to better monitor reports #9142
    • +
  • Report service: consider missing user/org ids #9134
    • +
  • filter ids on search #9130
    • +
  • Generate statistics about modules #9108
    • +
  • Refactor iops report generation #9099
    • +
  • bump ctim / remove status disposition #9114
    • +
  • fix flaky ES test: wait some more #9089
    • +
  • telemetry report: fix search iteration for batch size 10000 #9082
    • +
  • reduce logs by adding user-scopes #9078
    • +
  • tk store: update ES index state #8664
    • +
  • Add admin maintenance route to load MITRE stix #8967
    • +
  • ctim 1.3.15 #9068
    • +
  • limit walk entities to the necessary exports #9039
    • +
  • ctim 1.3.14 #9016
    • +
  • Dump ES metrics telemetry events #8999
    • +
  • script to clean SE false positive incidents and sightings #8846
    • +
  • MITRE Matrix: dynamic components design #8973
    • +
  • fix Talos threat hunt #8969
    • +
  • update the design of static MITRE matrix rendering #8949
    • +
  • replace lazyseq by iteration in reports #8957
    • +
  • For Jeetu by G2 #8920
    • +
  • Some more incident stats #8861
    • +
  • import mitre matrix backbone #8899
    • +
  • Mitre coverage static matrix #8882
    • +
  • add created and modified to IROH CTIM entities #8810
    • +
  • bundle import activity diagrams #8708
    • +
  • scoring at bundle import #8694
    • +
+

between 6 month and 7 month old

+
    +
  • Meta incident field #8617
    • +
  • entitlement-enforcement-jobs-service in default #8612
    • +
  • incident status_disposition #8587
    • +
  • introduce admin common web service for cisco services #8573
    • +
  • speed up listing of entilements #8516
    • +
+

tenzin-config [3]

+
    +
  • configure / tune private intel proxy cm #1074
    • +
  • increase bundle-batch-size #1071
    • +
+

between 6 month and 7 month old

+
    +
  • fix config path in README.md #1000
    • +
+

Ambrose Bonnaire-Sergeant +[41]

+

ctia [13]

+
    +
  • Bump ring-swagger with proof of memory leak fix #1423
    • +
  • Clojure 1.11.1 -> 1.11.2 #1416
    • +
  • Revert patch bundle commits #1411
    • +
  • Fix 2XX response swagger/coercion, ban :return #1407
    • +
  • Remove asset properties/mapping merging during bundle patch #1408
    • +
  • Fix :body descriptions #1409
    • +
  • Fix POST /bulk schema checking #1406
    • +
  • Use prn instead of pprint for logs #1401
    • +
  • Eval routes and options given to context at +initialization time #1394
    • +
  • Use st/merge to merge schemas instead of +into #1398
    • +
  • Never match existing asset-* entities when patch-existing=false #1395
    • +
  • Re-enable incident tests #1393
    • +
+

between 6 month and 7 month old

+
    +
  • Add external_ids to investigation select fields #1392
    • +
+

iroh [24]

+
    +
  • Add support for JDK 21 #9251
    • +
  • Bump ring-swagger and prove it fixes the memory leak #9244
    • +
  • Fix typo in debug log #9228
    • +
  • Debug logs to investigate person assets not being imported #9227
    • +
  • Update status endpoint to keep conure updated #9209
    • +
  • Update test for new carmine non-FIFO queues: +queue-status-report-test #9103
    • +
  • Make generated tk meta easier to review using pprint #8805
    • +
  • Restrict possible values for updated asset properties #9022
    • +
  • Don't forward response headers from CTIA to IROH #9014
    • +
  • Only subscribe incidents with supported observables #9000
    • +
  • Fix flaky test #9001
    • +
  • Redis: Set NX / XX #8970
    • +
  • Bulk asset update + rescoring route #8963
    • +
  • Fix logf call #8925
    • +
  • Fix incident subscription args, and only subscribe incident if +observables/identities are non-empty #8921
    • +
  • Fix DI subscription URL #8914
    • +
  • Revert patch bundle commits #8903
    • +
  • Fix swagger description #8905
    • +
  • Asset properties update and incident rescoring route #8843
    • +
  • Rescoring task #8869
    • +
  • Generate valid DI auth tokens for incident subscriptions #8804
    • +
  • Fix (reset) #8799
    • +
  • Subscribe to incident asset rescoring via DI #8699
    • +
  • Only pass default patch-existing query params in bundle/import proxy +if patch-existing=true #8725
    • +
+

tenzin-config [4]

+
    +
  • Bulk asset update limits #1059
    • +
  • Add Conure url to Private intel config #1052
    • +
  • Add config for DI client in iroh-engine #1036
    • +
  • Add device insights url to iroh-engine config #1014
    • +
+

integrations

+

Matthieu Sprunck [20]

+

iroh [16]

+
    +
  • Adding and editing Automate notification types #9277
    • +
  • Rename automation_workflow_disabled to +automation_workflow_definition #9196
    • +
  • Revert "Update the json appender to rename the output level key +(#9187)" #9191
    • +
  • Change Incident Assignment Notification wording #9189
    • +
  • Add title and link to the incident in the incident assignment +notification #9188
    • +
  • Add a log when an unexpected status is returned from KafkaConnect #9153
    • +
  • IROH Proxy: Correct handling for path with spaces (%20) #9149
    • +
  • Build notification type name from notification type #9140
    • +
  • JMX metrics for clj-http connection manager #8765
    • +
  • Always decompress the body when status is not 2xx #8527
    • +
  • Restore default expiration (24h) for the local session token #8747
    • +
+

between 6 month and 7 month old

+
    +
  • Workflow event schema changes #8656
    • +
  • IROH Proxy: remove headers set by the reverse proxy #8655
    • +
  • More log context to investigate #8638 #8654
    • +
  • Add logging info to investigate #8638 #8653
    • +
  • StackOverflowError temporary fix #8607
    • +
+

tenzin-config [4]

+
    +
  • Configure XDR URL in the PrivateIntel service for the Assignment +notification #1116
    • +
  • Create a module record for Microsoft Graph API #1050
    • +
  • Fix settings names for JAMF auth upgrade #1048
    • +
  • Use Token Auth with the JAMF Classic API #1038
    • +
+

Kirill Chernyshov [42]

+

iroh [35]

+
    +
  • Draft design #9201
    • +
  • Format redirect url for email notification #9211
    • +
  • Use static string 'Cisco' as a subtitle #9210
    • +
  • Coerce incoming notification before email format #9204
    • +
  • [REFACTORING] Standardize trapperkeeper usage #9177
    • +
  • Use notify! to create notification via API call #9162
    • +
  • Fix copyright notice in email template #9159
    • +
  • Add simple template for notification email #9150
    • +
  • Allow nil as a correlation id #9143
    • +
  • Fix for EventService initialization #9141
    • +
  • Respect user notification preferences #9133
    • +
  • Add default config for NotificationInDelivery #9128
    • +
  • 8938 e8811 process email notification delivery #9127
    • +
  • Fix config key #9115
    • +
  • Fix dev config for NotificationInDeliveryService #9113
    • +
  • On recieving NotificationRequest notify users according to their +preference #9087
    • +
  • Upgrade clojure 1.11.1 -> 1.11.2 #9072
    • +
  • Remove maintenance notification type #9069
    • +
  • 8933 e8811 create notificationindeliveryservice persistence only #9025
    • +
  • "In App" -> "In-App" #9020
    • +
  • Add correct :name and :description to notification type meta #9012
    • +
  • NotificationPreference API real endpoint #8995
    • +
  • NotificationPreference Service #8982
    • +
  • Fixes for notification endpoint #8964
    • +
  • Add notification preference api endpoints #8947
    • +
  • Initial draft design of notifications delivery #8844
    • +
  • Refactor data streams service #8793
    • +
  • DRY'ed out client-creds-token namespace #8783
    • +
  • Kafka connect monitoring #8278
    • +
  • Handle undelivered records #8634
    • +
  • Events data retention enforcement job #8722
    • +
  • Iroh events data retention implementation #8666
    • +
  • Iroh events postgres data retention #8693
    • +
+

between 6 month and 7 month old

+
    +
  • Use timbre for logging #8651
    • +
  • Add draft design for IROH Events data retention #8585
    • +
+

tenzin-config [7]

+
    +
  • Add KafkaProducerService to all envs #1107
    • +
  • Add email kafka consumer to all envs #1106
    • +
  • Enable kafka consumer for email notifications #1099
    • +
  • Add new kafka topics for IROH notifications #1070
    • +
  • Add ES sink connector v2 to test full migration #1035
    • +
  • Fix broken data stream on TEST #1034
    • +
  • Config for DataStreams service #1033
    • +
+

Shafiq [33]

+

iroh [30]

+
    +
  • Return relevant proxy health check errors req auth fails #9290
    • +
  • Fix access-token url for rubrik and commvault auth #9287
    • +
  • Support Async remote requests in AutomateRemoteProxy #9264
    • +
  • Design Automation-Remote target for iroh-proxy #9190
    • +
  • Trim whitespace when interpolating pipe transforms #9121
    • +
  • Support for GoogleAPI Authorization #9106
    • +
  • Refactor proxy health check #9066
    • +
  • Data retention cleanup of notification services #9064
    • +
  • Apply data retention policy on iroh-notifications #9054
    • +
  • Add :remote type in configuration spec fields #9046
    • +
  • Refactor proxy-health-check #9033
    • +
  • Update proxy-health-check logging #9028
    • +
  • Update proxy health check logging #9024
    • +
  • Perform relay-api request based on observable-types #9017
    • +
  • Add selection of settings for configuration-token auth #9007
    • +
  • Support for dedicated url setting for iroh-proxy requests #8998
    • +
  • Route for patching module-type documentation #8981
    • +
  • Add filtering of notifications using multiple statuses #8974
    • +
  • Support for transforming interpolated strings. #8945
    • +
  • Construct token url from base-url setting #8923
    • +
  • [IROH Proxy] Support for Rubrik and Commvault API services #8902
    • +
  • [iroh-proxy] Include POST method for proxy health check #8878
    • +
  • Update relay-module schemas for Checkpoint auth #8875
    • +
  • [iroh-proxy] Implement Checkpoint Smart-1 authentication #8873
    • +
  • Fix schema of proxy health check #8827
    • +
  • Add string matching for health check #8815
    • +
  • Fallback to iroh-events store when kafka send fails #8786
    • +
  • Fix mapping for incident events #8703
    • +
+

between 6 month and 7 month old

+
    +
  • Update iroh-event developer doc #8596
    • +
  • Add x-sort header to support search_after pagination #8586
    • +
+

tenzin-config [3]

+
    +
  • Swtich to new sink-connector in INT #1024
    • +
  • Add updated sink connector for all envs #1021
    • +
  • Add sink connector for new iroh-event datastream #1019
    • +
+

auth

+

bartuka [54]

+

iroh [46]

+
    +
  • add :content-type :json explicitly to clj-http #9090
    • +
  • Brownfield Provisioning - make the region field +available for TEST purposes only #9079
    • +
  • Improve logs for Brownfield provisioning #9076
    • +
  • [IROH Auth] update QA routes for Universal Provisioning flow #9053
    • +
  • [IROH Auth] Fix access token brownfield provisioning #9049
    • +
  • [IROH Auth] bugfix - accept empty string as entitlement value for +universal provisioning #9021
    • +
  • [IROH Auth] FMC add re-token proxy request #9011
    • +
  • [IROH Auth] fix FMC redirect call to /device #8987
    • +
  • [IROH Auth] fix device verification redirection #8979
    • +
  • fix proxy requests to FMC #8972
    • +
  • [IROH Auth] FMC OAuth2 and SSE proxies #8840
    • +
  • [IROH Auth] Improvements to universal provisioning callback #8913
    • +
  • [IROH Auth] bugfix #4: add :content-type :json to +callback request #8909
    • +
  • [IROH Auth] fix payload sent to PIAM callback_url after provisioning +was complete #8900
    • +
  • [IROH Auth] bugfix Universal Provisioning created schema error #8892
    • +
  • [IROH Auth] bugfix parsing OKTA JWT scopes #8880
    • +
  • [IROH Auth] Brownfield provisioning - endpoint to attach existing +tenant to a SBG product #8806
    • +
  • [IROH Auth] Support FMC in the jwks service #8830
    • +
  • [IROH Auth] Fix DI onboarding in Universal Provisioning Flow #8813
    • +
  • Revert "[IROH Auth] support for FMC token in JWKS Service" #8816
    • +
  • [IROH Auth] support for FMC token in JWKS Service #8808
    • +
  • [IROH Auth] Check QA callback_url to complete +provisioning tests #8763
    • +
  • [IROH Auth] better swagger descriptions for Universal Provisioning +#8752
    • +
  • [IROH Auth] remove empty strings from client-id got +from Vault #8760
    • +
  • [IROH Auth] add missing scope to get OKTA JWT #8759
    • +
  • [IROH Auth] add logs to investigate get okta jwt #8758
    • +
  • [IROH Auth] bugfix - client/post should use +:form-params instead of :body #8753
    • +
  • [IROH Auth] bugfixes - arity exception, change +product-response datatype, change pmap to +map #8738
    • +
  • [IROH Auth] bugfix - fix urls in POST /tenants returned +value and payload field names #8733
    • +
  • [IROH Auth] Cache OKTA JWT used for provisioning callback #8727
    • +
  • [IROH Auth] Improvements on logs and error handling to +UniversalProvisioning and JWKSService #8707
    • +
  • [IROH Auth] Duplicate universal-provisioning web routes +to accept IROH JWTs #8675
    • +
  • [IROH Auth] Expose callbacks packages store to check +Universal Provisioning status #8702
    • +
  • [IROH Auth] Improve 202 Accepted response for +/universal-provisioning/create-tenants #8701
    • +
  • [IROH Auth] Fix name convention to callbacks route in Universal +Provisioning flow #8691
    • +
+

between 6 month and 7 month old

+
    +
  • [IROH Auth] Gen OKTA JWT to callback request in Universal +Provisioning flow #8673
    • +
  • bugfix - missing UniversalProvisioningCallbackService +to deploy IROH nodes #8680
    • +
  • [IROH Auth] Check pending provisions from time-to-time. Endpoint +that will be called by OPS tick #8674
    • +
  • [IROH Auth] Add callback handler to receive provisioning status from +downstream apps #8633
    • +
  • [IROH Auth] Add support to UserIdentity JWTs in +JWKSService #8647
    • +
  • [IROH Auth] Bugfix in JWKSService logic #8659
    • +
  • [IROH Auth] update docs for Universal Provisioning work #8640
    • +
  • [IROH Auth] Simplify IROH Web Core by leveraging +JWKSService for all webservices #8632
    • +
  • [IROH Auth] Add structure to keep track of onboardings to support +async flow in Universal Provisioning #8599
    • +
  • [IROH Auth] Add support to accept IROH Auth JWTs and External JWTs +in a WebService #8528
    • +
  • [IROH Auth] bump ring-jwt-middleware to +1.1.5 #8568
    • +
+

tenzin-config [8]

+
    +
  • add fmc client id for each env #1065
    • +
  • fix url for device verification #1058
    • +
  • Add FMC Proxy configuration #1056
    • +
  • fix okta links #1043
    • +
  • FMC base-urls to configure JWKS #1040
    • +
  • [IROH Auth] bugfix - add config to okta jwks #1017
    • +
  • [IROH Auth] add OKTA config for Universal Provisioning flow #1010 #1013
    • +
+

between 6 month and 7 month old

+
    +
  • add universal_provisioning_callbacks store #1011
    • +
+

Yann Esposito [118]

+

iroh [51]

+
    +
  • Scopes by app #9247
    • +
  • Disable SSE Proxy for XDR orgs #9280
    • +
  • improve Client credentials error message to help debug #9213
    • +
  • Attempt to provide a body to the onboarding with mustache #9151
    • +
  • provisioning API for Org apps #9195
    • +
  • Revert "add admin-ui to the gh-pages (#9222)" #9223
    • +
  • add admin-ui to the gh-pages #9222
    • +
  • Add sc-enabled? flag to profile API views #9192
    • +
  • [PIAM Brownfield Provisioning]: Provide a way to update link tenants +#9186
    • +
  • Add apps field to Orgs #9175
    • +
  • improve response when PIAM returns an error #9183
    • +
  • fix flaky test invite-test paging #9182
    • +
  • Support aero configurations #9170
    • +
  • Fix invites pagination #9138
    • +
  • Support FMC returning Bearer instead of bearer #9126
    • +
  • composable jwks test helper #9120
    • +
  • Sync user-name during SCSO login #9117
    • +
  • Another IPv6 in URL fix #9084
    • +
  • Support IPv6 in URL for inspect service #9083
    • +
  • Update of the login doc #9067
    • +
  • optimize search user given a list of ids #9018
    • +
  • Fix link tenant bug #8975
    • +
  • Upgrade Org to XDR on first entitlement update. #8881
    • +
  • [IROH-Auth]: Auth Code Grant Client that do not generate any refresh +token #8927
    • +
  • Specialize TAC routes access #8884
    • +
  • Remove legacy restriction of AO scopes #8890
    • +
  • Update deps to accept JWT without nbf claim #8872
    • +
  • New endpoint to ease impersonation usage #8855
    • +
  • Fix PIAM Universal Provisioning routes #8828
    • +
  • Should fix open impersonate flaky test #8809
    • +
  • Keep track of impersonators #8736
    • +
  • Restrict TAC routes to admins #8794
    • +
  • Remove with-tk #8779
    • +
  • Code/Test Improvements #8767
    • +
  • add a test for matching schema #8770
    • +
  • Custom Role Design doc #8497
    • +
  • Attempt to improve error message of match? #8769
    • +
  • Use cid for trace_id when present #8754
    • +
  • Support public client for custom routes #8749
    • +
  • Add playbook scope #8739
    • +
  • Fix webhook race condition risk #8728
    • +
  • Call get-org only once for org-virtual user #8724
    • +
  • Use a cache for entitlement summaries #8667
    • +
  • upgrade jetty version #8714
    • +
  • Remove a forgotten pretty printer #8713
    • +
+

between 6 month and 7 month old

+
    +
  • Fast Event Notifier dispatch using event-type #8650
    • +
  • Fix DI onboarding #8657
    • +
  • Generalize default indexes for data retention #8598
    • +
  • [Data Retention Policy]: Delete incident summaries along incident #8576
    • +
  • [Provisioning] Introduce product-instance-id #8577
    • +
  • Simply wait a lot more for ES to sync #8553
    • +
+

iroh-scripts [36]

+
    +
  • ai onboarding
    • +
  • fix a bug with trust client
    • +
  • fix resend-invite
    • +
  • script to remove flags
    • +
  • fix a bug in create-super-org
    • +
  • relink scc script
    • +
  • prevent id collision
    • +
  • cleaned-up get-org response
    • +
  • Added add-flag script here
    • +
  • CSE client and better patch
    • +
  • resend-invite
    • +
  • add SXP riles prod clients
    • +
  • improve client manipulations
    • +
  • Updated scripts
    • +
  • use include
    • +
  • use local clojure
    • +
  • Added a better alias for sxo clients
    • +
  • SXO rules
    • +
  • added ai client with script
    • +
  • Fix
    • +
  • A few new scripts
    • +
  • Super client should be part of XDR orgs
    • +
  • Super org should have the XDR flag
    • +
  • Add admin user
    • +
  • updated and added scripts
    • +
  • save and improve client aliases
    • +
  • save improvements
    • +
  • create dashboard clients
    • +
  • Support client aliases in get-client
    • +
  • Update client with client-aliases
    • +
  • many new scripts
    • +
+

between 6 month and 7 month old

+
    +
  • added a 1-time script
    • +
  • Add trusted to get-client
    • +
  • Improve search and error messages
    • +
  • Prepare TG to SCSO org migration
    • +
  • add scope to a client
    • +
+

oauth2-client-demo [3]

+
    +
  • pin packages
    • +
  • reuse authorized url
    • +
  • added Meraki client to the list
    • +
+

ring-jwt-middleware [3]

+
    +
  • Version 1.1.7-SNAPSHOT
    • +
  • Version 1.1.6
    • +
  • Support missing nbf JWT #30
    • +
+

scopula [6]

+
    +
  • Version 0.3.3-SNAPSHOT
    • +
  • Version 0.3.2
    • +
  • real cljs support
    • +
  • Version 0.3.2-SNAPSHOT
    • +
  • Version 0.3.1
    • +
  • support cljs
    • +
+

tenzin-config [14]

+
    +
  • Add applications URL in iroh conf #1146
    • +
  • Add AI Assistant automatic onboarding during Provisioning #1142
    • +
  • add iroh gh-pages to allowed login origin #1123
    • +
  • New SCA env for TEST/STAGING #1114
    • +
  • configure automatio rules clients to not be rate limited #1111
    • +
  • interpolation improvements #1112
    • +
  • Add support for interpolation and self ref #1110
    • +
  • Remove rate-limit for another SXO client on INT #1087
    • +
  • Disable rate-limit SXO client for rules #1084
    • +
  • Double threads dedicated for VirusTotal http calls #1051
    • +
  • fix vault tpl transformations and checks #1041
    • +
  • Remove rate-limit for automation #1044
    • +
  • Check vault templating error #1023
    • +
  • Add Universal Provisioning Services #1015
    • +
+

xdr-provisioning [5]

+
    +
  • added a few useful script + ai onboarding support
    • +
  • improved re-onboarding script
    • +
  • use local clojure
    • +
  • Manage entitlements add-ons
    • +
  • add a re-provisioning script that rerun onboardings
    • +
+

Olivier Barbeau [47]

+

iroh [31]

+
    +
  • Add number of incidents to each technique in the Mitre matrix #9157
    • +
  • Fix events and incidents ES stores for DEV #9154
    • +
  • E8851: XDR Native & detections #9122
    • +
  • E8851: Design of changes for XDR native detections #9110
    • +
  • E8851: Product ordering in the coverage of techniques #9100
    • +
  • E8851: Product ordering and SCA renaming #9086
    • +
  • E8851: Add Org's integrations to the Mitre matrix #8993
    • +
  • E8851: Sorting of Mitre elements #8992
    • +
  • E8851: Static matrix common to all Orgs #8939
    • +
  • E8851: Talos MITRE coverage files import #8876
    • +
  • Design of the Talos MITRE coverage files import #8856
    • +
  • 'iroh' node type and default services for all node types #8817
    • +
  • Check the list of services for a node type #8800
    • +
  • Fix merge error on PR 8784 #8797
    • +
  • [IROH configuration]: Move role-web-service config to default tk +files #8782
    • +
  • [IROH configuration]: Universal Provisioning Services config +refactor #8784
    • +
  • [IROH configuration]: explicit name for generated conf and meta #8785
    • +
  • Clean bootstrap.cfg; remove tmp file #8781
    • +
  • Add few additional tests to iroh services #8762
    • +
  • rewrite tests #8773
    • +
  • more info for debugging #8717
    • +
  • [IROH configuration]: general documentation #8764
    • +
  • update developer doc for api-gateway #8723
    • +
  • Some test clean-up #8716
    • +
+

between 6 month and 7 month old

+
    +
  • High volume of SQL queries for a single observe/deliberate call #8682
    • +
  • Remove the state of module instances in +obfuscate-module-instance #8670
    • +
  • E8388: update proxy-endpoints-metadata endpoint and metadata #8663
    • +
  • E8388: update x-proxy endpoint and IntService ACL filters #8608
    • +
  • E8388 : Simplifies upgrade/downgrade tests #8635
    • +
  • Implement Module Instance service event handler #8592
    • +
  • Updates to the design 'entitlement changes for integration modules' +#8541
    • +
+

tenzin-config [16]

+
    +
  • add XDR native module types for PROD #1115
    • +
  • add SCA module-type-id for XDR Native on TEST [temp UI fix] #1109
    • +
  • add SCA module-type-id for XDR Native [temp UI fix] #1108
    • +
  • Mitre: Add detections for XDR Native #1098
    • +
  • product ordering and SCA renaming #1079
    • +
  • Config for Mitre covering products #1072
    • +
  • Deep merge for vectors and sets with duplicates check #1032
    • +
  • Reduce configuration duplicates - config.edn part #1031
    • +
  • Reduce configuration duplicates - bootstrap.cfg part #1028
    • +
  • Move role-web-service config to IROH #1026
    • +
  • Move Universal Provisioning Services config to IROH #1027
    • +
  • Clean bootstrap cfg #1025
    • +
  • Remove the :registration flag in all environments #963
    • +
  • Remove the :merge-users-by-email flag in all +environments #962
    • +
  • Remove the :account-activation-optim flag in all +environments as it is now activated everywhere. #961
    • +
  • Remove the xdr-roles flag in all environments #964
    • +
+

(Yogsototh) [52]

+

iroh-scripts [36]

+
    +
  • ai onboarding
    • +
  • fix a bug with trust client
    • +
  • fix resend-invite
    • +
  • script to remove flags
    • +
  • fix a bug in create-super-org
    • +
  • relink scc script
    • +
  • prevent id collision
    • +
  • cleaned-up get-org response
    • +
  • Added add-flag script here
    • +
  • CSE client and better patch
    • +
  • resend-invite
    • +
  • add SXP riles prod clients
    • +
  • improve client manipulations
    • +
  • Updated scripts
    • +
  • use include
    • +
  • use local clojure
    • +
  • Added a better alias for sxo clients
    • +
  • SXO rules
    • +
  • added ai client with script
    • +
  • Fix
    • +
  • A few new scripts
    • +
  • Super client should be part of XDR orgs
    • +
  • Super org should have the XDR flag
    • +
  • Add admin user
    • +
  • updated and added scripts
    • +
  • save and improve client aliases
    • +
  • save improvements
    • +
  • create dashboard clients
    • +
  • Support client aliases in get-client
    • +
  • Update client with client-aliases
    • +
  • many new scripts
    • +
+

between 6 month and 7 month old

+
    +
  • added a 1-time script
    • +
  • Add trusted to get-client
    • +
  • Improve search and error messages
    • +
  • Prepare TG to SCSO org migration
    • +
  • add scope to a client
    • +
+

oauth2-client-demo [3]

+
    +
  • pin packages
    • +
  • reuse authorized url
    • +
  • added Meraki client to the list
    • +
+

ring-jwt-middleware [2]

+
    +
  • Version 1.1.7-SNAPSHOT
    • +
  • Version 1.1.6
    • +
+

scopula [6]

+
    +
  • Version 0.3.3-SNAPSHOT
    • +
  • Version 0.3.2
    • +
  • real cljs support
    • +
  • Version 0.3.2-SNAPSHOT
    • +
  • Version 0.3.1
    • +
  • support cljs
    • +
+

xdr-provisioning [5]

+
    +
  • added a few useful script + ai onboarding support
    • +
  • improved re-onboarding script
    • +
  • use local clojure
    • +
  • Manage entitlements add-ons
    • +
  • add a re-provisioning script that rerun onboardings
    • +
+

iroh-ops

+

Jerome Schneider [1]

+

tenzin-config [1]

+
    +
  • IROH migrate to new MSK SASL/SCRAM cluster!
    • +
+

Patrick Patat [1]

+

tenzin-config [1]

+
    +
  • refactor ops config with new ref system #1113
    • +
+

Other

+

Other

+

Robert Levy [7]

+

iroh [6]

+
    +
  • Inherit properties from type in hierarchical modules #9042
    • +
  • Format hierarchical modules invalid-parent-id error with context and +error type #8901
    • +
  • Update hardcoded source in Secure Endpoint module #8874
    • +
  • Expose pagination & search functionality in notifications api #8803
    • +
  • Fix bug in hierarchical module logic producing empty +settings/settings_effective map #8745
    • +
  • Issue 8158 hierarchical module #8469
    • +
+

tenzin-config [1]

+

between 6 month and 7 month old

+
    +
  • Revert "Adds cache configuration for CrowdStrike (#1002)" #1005
    • +
+

Eric Gierach [4]

+

iroh [1]

+
    +
  • update iroh-engine to 0.16.5 #9291
    • +
+

tenzin-config [3]

+
    +
  • removing duplicate entry #1078
    • +
  • Swap stg and test configs for reporting. #1077
    • +
  • Disabling reporting until Ops gets the infra set up. #1075
    • +
+

II [21]

+

iroh [17]

+
    +
  • Xdr 1281 Adds user agent to Umbrella requests #9292
    • +
  • Keeps Kondo from being run on dev start #9220
    • +
  • Xdr 1282 Adds new Umbrella service to default services #9214
    • +
  • Xdr 1282 add v 2 token cache to umbrella integration #9208
    • +
  • XDR-1411 Fixes inconsistent v1 v2 refer #9197
    • +
  • 9074 remove settings effective #9075
    • +
  • 8990 umbrella investigate v2 #9030
    • +
  • 8958 Adds Missing Umbrella v2 Sightings #8960
    • +
  • 8498 fix token cache #8911
    • +
  • 8798 create migration to add parents to existing microsoft defender +modules #8870
    • +
  • Throws exception in parent validation on non-existent parent #8850
    • +
  • Merges module type props on create and update health check #8845
    • +
  • Implements v2 threat hunting #8833
    • +
  • This should fix issue with parent settings not used on create-patch +#8822
    • +
+

between 6 month and 7 month old

+
    +
  • Adds insights scope to allowed Automation scopes in gen-ao-jwt #8678
    • +
  • 8496 token cache fix #8637
    • +
  • 8496 - relay module token cache #8580
    • +
+

tenzin-config [4]

+
    +
  • Disables Umbrella module auto load so service does it #1120
    • +
  • Enables Umbrella token caches #1119
    • +
+

between 6 month and 7 month old

+
    +
  • Revert "Revert "Adds cache configuration for CrowdStrike (#1002)" +(#1005)" #1008
    • +
  • Adds cache configuration for CrowdStrike #1002
    • +
+

Devin Walters [8]

+

tenzin-config [8]

+
    +
  • Configure s3-http-client connection pool size for PROD environments +#1105
    • +
  • Turn on reporting pipeline in TEST #1097
    • +
  • Up hikari pool size in INT for conure #1095
    • +
  • Configure incident import bucket per PROD env for iroh and +iroh-async #1092
    • +
  • Configure incident pipeline #1091
    • +
  • Fix bucket name #1083
    • +
  • Match s3 bucket key #1082
    • +
  • Add INT and TEST enrichment bucket names to relevant configs #1057
    • +
+

Mia [7]

+

iroh [7]

+
    +
  • new engine version #9273
    • +
  • Xdr 1918 no old assets #9267
    • +
  • create permanent logs to unobtrusively monitor bundle import results +#9242
    • +
  • New iroh event docs #9181
    • +
  • iroh-engine 0.16.2 #9125
    • +
  • Engine 0.16.1 #9116
    • +
  • Engine 0.16.0 #8997
    • +
+

Martin Bruchanov [3]

+

tenzin-config [3]

+
    +
  • XDRSRE-1158: Enabling ElasticSearch authentication for CTIA/PCTIA #1141
    • +
  • XDRSRE-1150: Retention enforcement authentication INT #1132
    • +
  • XDRSRE-64: Authentication for public CTIA in INT #1081
    • +
+

James Moser [1]

+

tenzin-config [1]

+
    +
  • added QA domain to idps email domain whitelists #1085
    • +
+

[21]

+

iroh [17]

+
    +
  • Xdr 1281 Adds user agent to Umbrella requests #9292
    • +
  • Keeps Kondo from being run on dev start #9220
    • +
  • Xdr 1282 Adds new Umbrella service to default services #9214
    • +
  • Xdr 1282 add v 2 token cache to umbrella integration #9208
    • +
  • XDR-1411 Fixes inconsistent v1 v2 refer #9197
    • +
  • 9074 remove settings effective #9075
    • +
  • 8990 umbrella investigate v2 #9030
    • +
  • 8958 Adds Missing Umbrella v2 Sightings #8960
    • +
  • 8498 fix token cache #8911
    • +
  • 8798 create migration to add parents to existing microsoft defender +modules #8870
    • +
  • Throws exception in parent validation on non-existent parent #8850
    • +
  • Merges module type props on create and update health check #8845
    • +
  • Implements v2 threat hunting #8833
    • +
  • This should fix issue with parent settings not used on create-patch +#8822
    • +
+

between 6 month and 7 month old

+
    +
  • Adds insights scope to allowed Automation scopes in gen-ao-jwt #8678
    • +
  • 8496 token cache fix #8637
    • +
  • 8496 - relay module token cache #8580
    • +
+

tenzin-config [4]

+
    +
  • Disables Umbrella module auto load so service does it #1120
    • +
  • Enables Umbrella token caches #1119
    • +
+

between 6 month and 7 month old

+
    +
  • Revert "Revert "Adds cache configuration for CrowdStrike (#1002)" +(#1005)" #1008
    • +
  • Adds cache configuration for CrowdStrike #1002
    • +
+

Martin Bruchanov [1]

+

iroh [1]

+
    +
  • XDR-1344: Final version of deletion script used for PROD change #9174
    • +
+

Ruslan Yemelianov [2]

+

tenzin-config [2]

+
    +
  • Revert "enable ES auth private-ctia INT"
    • +
  • enable ES auth private-ctia INT
    • +
+

Andrew Parisi [2]

+

tenzin-config [2]

+
    +
  • [data-retention/update-iroh-internal-for-prod] #1018
    • +
+

between 6 month and 7 month old

+
    +
  • [data-retention/update-entitlement-route-information] #1004
    • +
+

Scott McLeod [7]

+

iroh [6]

+
    +
  • Notification service timestamp filter #9252
    • +
  • Tk store half bounded intervals #9158
    • +
  • Extend tk search with range queries #8912
    • +
  • Resolves postgres driver sql-injection vulnerability #9091 #9092
    • +
  • Implement searching risk scores by score #8907
    • +
  • tk store: Add delete-search method #8213 #8692
    • +
+

tenzin-config [1]

+
    +
  • Increase ReportService batch size to ES maximum #1055
    • +
+

Sam Waggoner [3]

+

tenzin-config [3]

+
    +
  • Increase ctia.http.bulk.max-size in INT
    • +
  • Configure hydrant to use internal ES metrics api.
    • +
  • hydrant/912 add clean hashes importer.
    • +
+

t2sw [2]

+

ctia [1]

+

between 6 month and 7 month old

+
    +
  • Update CODEOWNERS #1390
    • +
+

iroh [1]

+
    +
  • add health endpoint to tac portal and update tests #9002
    • +
+

Brooke Swanson [24]

+

ctia [2]

+
    +
  • XDR-1769: bump CTIM to 1.3.17. #1422
    • +
  • Add brookeswanson to codeowners. #1396
    • +
+

iroh [8]

+
    +
  • Maintain behavior for existing events, but also notify s3 if an +incid… #9172
    • +
  • XDR-1769: bump CTIM to 1.3.17. #9226
    • +
  • Reformat bucket path #9102
    • +
  • Save to s3 on bundle import. #8977
    • +
  • Replace CTIA Crud with Conure Calls #8924
    • +
  • Limit risk score #8906
    • +
  • Set Limits around observe targets call #8910
    • +
  • Add no-doc true and prevent explosion due to mismatched types. #8548
    • +
+

tenzin-config [14]

+
    +
  • Failure to configure correct url. #1100
    • +
  • These were flipped in TEST and we would like to test reports. #1094
    • +
  • One more time see if the report tab will work. #1088
    • +
  • Toggle report feature until Infrastructure is stable. #1086
    • +
  • update config. #1080
    • +
  • Report in test. #1076
    • +
  • conure -> base-url. #1073
    • +
  • Temporary flip this to not spam logs. #1069
    • +
  • Output buckets. #1068
    • +
  • Distributor and Conure configs. #1067
    • +
  • Add base-url for incident export (and incident report). #1064
    • +
  • Add playbook to conure configs. #1060
    • +
  • Add ouath2 config for all regions. #1020
    • +
  • Playbook automation config. #1037
    • +
+

Yurii Ivanisenko [1]

+

tenzin-config [1]

+
    +
  • tactical-portal moved to vercel #1022
    • +
+

James Brock [1]

+

easy-purescript-nix [1]

+
    +
  • purs: 0.15.10 -> 0.15.15
    • +
+

ryemelia [9]

+

tenzin-config [9]

+
    +
  • XDRSRE-1370: Enable ES auth for staging-ctia service #1147
    • +
  • XDRSRE-1370: Enable ES auth for ctia and private-ctia #1145
    • +
  • XDRSRE-1155: Enable ES auth iroh/iroh-async all envs #1137
    • +
  • XDRSRE-1150: [TEST] Enable ES auth iroh/iroh-async #1128
    • +
  • Enable ES auth private-ctia TEST #1126
    • +
  • Enable es auth CTIA test #1127
    • +
  • fix kafka connector ES AUTH for INT #1129
    • +
  • Enable ES auth private-ctia INT #1125
    • +
  • XDRSRE-1273: [INT] Enable ES auth for iroh iroh-async #1124
    • +
+ + diff --git a/reports/FY24Q4-tmp-report.org b/reports/FY24Q4-tmp-report.org new file mode 100644 index 00000000..b8a2825f --- /dev/null +++ b/reports/FY24Q4-tmp-report.org @@ -0,0 +1,940 @@ +#+title: FY24Q4 Report +#+subtitle: logs goes 7 month back +#+date: 2024-06-04 +#+options: H:6 ^:nil +* IROH +** lead + + +*** Guillaume Buisson [13] + +**** ctia [2] + +- Properly filter Relationships to assemble a Feed View [[https://github.com/threatgrid/ctia/pull/1421][#1421]] +- Filter out some infrastructure details from Error API Responses [[https://github.com/threatgrid/ctia/pull/1412][#1412]] +**** iroh [9] + +- Logging improvements [[https://github.com/advthreat/iroh/pull/9241][#9241]] +- fix a flaky test in iroh-web [[https://github.com/advthreat/iroh/pull/9250][#9250]] +- Don't use pp-str to log the request in the rate limiter service [[https://github.com/advthreat/iroh/pull/9249][#9249]] +- Fix iroh-kafka* logs [[https://github.com/advthreat/iroh/pull/9240][#9240]] +- Update the json appender to rename the output level key [[https://github.com/advthreat/iroh/pull/9187][#9187]] +- update the logstash-v2 logging preset [[https://github.com/advthreat/iroh/pull/9178][#9178]] +- Don't fire disabled webhooks [[https://github.com/advthreat/iroh/pull/8741][#8741]] + +_between 6 month and 7 month old_ + +- upgrade ctia-investigate to use transit+json instead of edn [[https://github.com/advthreat/iroh/pull/8623][#8623]] +- A new script to update a record :created in ES [[https://github.com/advthreat/iroh/pull/8574][#8574]] +**** tenzin-config [2] + +- setup the IROH json logging appender +- Re-apply the default rate limit for the NGFW Incident promotion client [[https://github.com/advthreat/tenzin-config/pull/1063][#1063]] +** data + + +*** Mario Aquino [40] + +**** iroh [30] + +- Constrain judgements included with threat hunt incident bundles [[https://github.com/advthreat/iroh/pull/9279][#9279]] +- Threat hunt integration tests [[https://github.com/advthreat/iroh/pull/9218][#9218]] +- Threat hunt module instance pagination [[https://github.com/advthreat/iroh/pull/9200][#9200]] +- iroh-async Telemetry Identity Data [[https://github.com/advthreat/iroh/pull/9166][#9166]] +- Xdr 1086/crud store fields filtering [[https://github.com/advthreat/iroh/pull/9147][#9147]] +- iroh-async task (metric) tag [[https://github.com/advthreat/iroh/pull/9123][#9123]] +- iroh-metrics in default bootstrap [[https://github.com/advthreat/iroh/pull/9118][#9118]] +- Metrics Service (micrometer) [[https://github.com/advthreat/iroh/pull/9029][#9029]] +- Disable color logging for test execution [[https://github.com/advthreat/iroh/pull/9097][#9097]] +- Carmine & Timbre upgrade v2 [[https://github.com/advthreat/iroh/pull/9005][#9005]] +- Loosen Risk Score Incident validation [[https://github.com/advthreat/iroh/pull/9013][#9013]] +- Apply risk score valid ranges to incident schemas [[https://github.com/advthreat/iroh/pull/8976][#8976]] +- Revert "Upgrade carmine version (#8888)" [[https://github.com/advthreat/iroh/pull/9003][#9003]] +- Log Tuning [[https://github.com/advthreat/iroh/pull/8978][#8978]] +- Upgrade carmine version [[https://github.com/advthreat/iroh/pull/8888][#8888]] +- Fix flaky test [[https://github.com/advthreat/iroh/pull/8956][#8956]] +- iroh-async high-traffic adjustments [[https://github.com/advthreat/iroh/pull/8835][#8835]] +- Fix disabled threat-hunt test [[https://github.com/advthreat/iroh/pull/8814][#8814]] +- Update incident_time when updating incident status [[https://github.com/advthreat/iroh/pull/8801][#8801]] +- incident enrichment activity diagram [[https://github.com/advthreat/iroh/pull/8712][#8712]] +- Separate Risk score & incident enrichment [[https://github.com/advthreat/iroh/pull/8751][#8751]] +- Improve safe-filtering [[https://github.com/advthreat/iroh/pull/8731][#8731]] +- iroh-async: Flatten Datadog context [[https://github.com/advthreat/iroh/pull/8706][#8706]] +- iroh-async logging & tracing context [[https://github.com/advthreat/iroh/pull/8705][#8705]] + +_between 6 month and 7 month old_ + +- Socket timeout milliseconds (not seconds) [[https://github.com/advthreat/iroh/pull/8690][#8690]] +- Risk Score socket-timeout [[https://github.com/advthreat/iroh/pull/8687][#8687]] +- Threat Hunt Module Exclusion [[https://github.com/advthreat/iroh/pull/8646][#8646]] +- Remove dead code [[https://github.com/advthreat/iroh/pull/8626][#8626]] +- Incident Summary migration re-run [[https://github.com/advthreat/iroh/pull/8597][#8597]] +- Notification request uses paginated user search [[https://github.com/advthreat/iroh/pull/8606][#8606]] +**** tenzin-config [10] + +- Fix auth parameters passed for calling ES [[https://github.com/advthreat/tenzin-config/pull/1139][#1139]] +- Address thread exhaustion in conn mgrs during threat hunting [[https://github.com/advthreat/tenzin-config/pull/1130][#1130]] +- Exclude CTIA modules from threat hunt execution [[https://github.com/advthreat/tenzin-config/pull/1122][#1122]] +- Add iroh-async client-id to rate unlimited list [[https://github.com/advthreat/tenzin-config/pull/1053][#1053]] +- Increase conn-manager thread count after PROD performance monitoring [[https://github.com/advthreat/tenzin-config/pull/1042][#1042]] +- Increase thread pool size for EU private intel conn mgr [[https://github.com/advthreat/tenzin-config/pull/1039][#1039]] +- Increase connection mgr thread pool for NAM/EU/TEST [[https://github.com/advthreat/tenzin-config/pull/1030][#1030]] + +_between 6 month and 7 month old_ + +- Increase thread pool size for engine connection manager [[https://github.com/advthreat/tenzin-config/pull/1012][#1012]] +- Config for skipping Private Intel during investigation threat hunt [[https://github.com/advthreat/tenzin-config/pull/1009][#1009]] +- Rerun incident summary migration and update ES index [[https://github.com/advthreat/tenzin-config/pull/1001][#1001]] + +*** Guillaume Erétéo [52] + +**** ctia [11] + +- remove ES5 support [[https://github.com/threatgrid/ctia/pull/1419][#1419]] +- Optimize lucene searches [[https://github.com/threatgrid/ctia/pull/1420][#1420]] +- bump ctim / remove status disposition [[https://github.com/threatgrid/ctia/pull/1417][#1417]] +- ctim 1.3.15 [[https://github.com/threatgrid/ctia/pull/1415][#1415]] +- silent this too noisy log [[https://github.com/threatgrid/ctia/pull/1414][#1414]] +- ctim-1.3.14 [[https://github.com/threatgrid/ctia/pull/1413][#1413]] +- remove un-store [[https://github.com/threatgrid/ctia/pull/1410][#1410]] +- fix wait_for for delete search [[https://github.com/threatgrid/ctia/pull/1399][#1399]] + +_between 6 month and 7 month old_ + +- incident meta [[https://github.com/threatgrid/ctia/pull/1391][#1391]] +- Incident status disposition [[https://github.com/threatgrid/ctia/pull/1389][#1389]] +- Update CODEOWNERS [[https://github.com/threatgrid/ctia/pull/1387][#1387]] +**** iroh [38] + +- Enable auth on private intel es IOPS script [[https://github.com/advthreat/iroh/pull/9275][#9275]] +- Dump events with dump metrics script [[https://github.com/advthreat/iroh/pull/9180][#9180]] +- Sca clean phase 2 [[https://github.com/advthreat/iroh/pull/9176][#9176]] +- add backup clusters for delete [[https://github.com/advthreat/iroh/pull/9173][#9173]] +- Scripts for SCA issue cleaning [[https://github.com/advthreat/iroh/pull/9161][#9161]] +- simplify sorting in telemetry reports [[https://github.com/advthreat/iroh/pull/9144][#9144]] +- Add logs to better monitor reports [[https://github.com/advthreat/iroh/pull/9142][#9142]] +- Report service: consider missing user/org ids [[https://github.com/advthreat/iroh/pull/9134][#9134]] +- filter ids on search [[https://github.com/advthreat/iroh/pull/9130][#9130]] +- Generate statistics about modules [[https://github.com/advthreat/iroh/pull/9108][#9108]] +- Refactor iops report generation [[https://github.com/advthreat/iroh/pull/9099][#9099]] +- bump ctim / remove status disposition [[https://github.com/advthreat/iroh/pull/9114][#9114]] +- fix flaky ES test: wait some more [[https://github.com/advthreat/iroh/pull/9089][#9089]] +- telemetry report: fix search iteration for batch size 10000 [[https://github.com/advthreat/iroh/pull/9082][#9082]] +- reduce logs by adding user-scopes [[https://github.com/advthreat/iroh/pull/9078][#9078]] +- tk store: update ES index state [[https://github.com/advthreat/iroh/pull/8664][#8664]] +- Add admin maintenance route to load MITRE stix [[https://github.com/advthreat/iroh/pull/8967][#8967]] +- ctim 1.3.15 [[https://github.com/advthreat/iroh/pull/9068][#9068]] +- limit walk entities to the necessary exports [[https://github.com/advthreat/iroh/pull/9039][#9039]] +- ctim 1.3.14 [[https://github.com/advthreat/iroh/pull/9016][#9016]] +- Dump ES metrics telemetry events [[https://github.com/advthreat/iroh/pull/8999][#8999]] +- script to clean SE false positive incidents and sightings [[https://github.com/advthreat/iroh/pull/8846][#8846]] +- MITRE Matrix: dynamic components design [[https://github.com/advthreat/iroh/pull/8973][#8973]] +- fix Talos threat hunt [[https://github.com/advthreat/iroh/pull/8969][#8969]] +- update the design of static MITRE matrix rendering [[https://github.com/advthreat/iroh/pull/8949][#8949]] +- replace lazyseq by iteration in reports [[https://github.com/advthreat/iroh/pull/8957][#8957]] +- For Jeetu by G2 [[https://github.com/advthreat/iroh/pull/8920][#8920]] +- Some more incident stats [[https://github.com/advthreat/iroh/pull/8861][#8861]] +- import mitre matrix backbone [[https://github.com/advthreat/iroh/pull/8899][#8899]] +- Mitre coverage static matrix [[https://github.com/advthreat/iroh/pull/8882][#8882]] +- add created and modified to IROH CTIM entities [[https://github.com/advthreat/iroh/pull/8810][#8810]] +- bundle import activity diagrams [[https://github.com/advthreat/iroh/pull/8708][#8708]] +- scoring at bundle import [[https://github.com/advthreat/iroh/pull/8694][#8694]] + +_between 6 month and 7 month old_ + +- Meta incident field [[https://github.com/advthreat/iroh/pull/8617][#8617]] +- entitlement-enforcement-jobs-service in default [[https://github.com/advthreat/iroh/pull/8612][#8612]] +- incident status_disposition [[https://github.com/advthreat/iroh/pull/8587][#8587]] +- introduce admin common web service for cisco services [[https://github.com/advthreat/iroh/pull/8573][#8573]] +- speed up listing of entilements [[https://github.com/advthreat/iroh/pull/8516][#8516]] +**** tenzin-config [3] + +- configure / tune private intel proxy cm [[https://github.com/advthreat/tenzin-config/pull/1074][#1074]] +- increase bundle-batch-size [[https://github.com/advthreat/tenzin-config/pull/1071][#1071]] + +_between 6 month and 7 month old_ + +- fix config path in README.md [[https://github.com/advthreat/tenzin-config/pull/1000][#1000]] + +*** Ambrose Bonnaire-Sergeant [41] + +**** ctia [13] + +- Bump ring-swagger with proof of memory leak fix [[https://github.com/threatgrid/ctia/pull/1423][#1423]] +- Clojure 1.11.1 -> 1.11.2 [[https://github.com/threatgrid/ctia/pull/1416][#1416]] +- Revert patch bundle commits [[https://github.com/threatgrid/ctia/pull/1411][#1411]] +- Fix 2XX response swagger/coercion, ban ~:return~ [[https://github.com/threatgrid/ctia/pull/1407][#1407]] +- Remove asset properties/mapping merging during bundle patch [[https://github.com/threatgrid/ctia/pull/1408][#1408]] +- Fix :body descriptions [[https://github.com/threatgrid/ctia/pull/1409][#1409]] +- Fix POST /bulk schema checking [[https://github.com/threatgrid/ctia/pull/1406][#1406]] +- Use prn instead of pprint for logs [[https://github.com/threatgrid/ctia/pull/1401][#1401]] +- Eval routes and options given to ~context~ at initialization time [[https://github.com/threatgrid/ctia/pull/1394][#1394]] +- Use ~st/merge~ to merge schemas instead of ~into~ [[https://github.com/threatgrid/ctia/pull/1398][#1398]] +- Never match existing asset-* entities when patch-existing=false [[https://github.com/threatgrid/ctia/pull/1395][#1395]] +- Re-enable incident tests [[https://github.com/threatgrid/ctia/pull/1393][#1393]] + +_between 6 month and 7 month old_ + +- Add external_ids to investigation select fields [[https://github.com/threatgrid/ctia/pull/1392][#1392]] +**** iroh [24] + +- Add support for JDK 21 [[https://github.com/advthreat/iroh/pull/9251][#9251]] +- Bump ring-swagger and prove it fixes the memory leak [[https://github.com/advthreat/iroh/pull/9244][#9244]] +- Fix typo in debug log [[https://github.com/advthreat/iroh/pull/9228][#9228]] +- Debug logs to investigate person assets not being imported [[https://github.com/advthreat/iroh/pull/9227][#9227]] +- Update status endpoint to keep conure updated [[https://github.com/advthreat/iroh/pull/9209][#9209]] +- Update test for new carmine non-FIFO queues: ~queue-status-report-test~ [[https://github.com/advthreat/iroh/pull/9103][#9103]] +- Make generated tk meta easier to review using pprint [[https://github.com/advthreat/iroh/pull/8805][#8805]] +- Restrict possible values for updated asset properties [[https://github.com/advthreat/iroh/pull/9022][#9022]] +- Don't forward response headers from CTIA to IROH [[https://github.com/advthreat/iroh/pull/9014][#9014]] +- Only subscribe incidents with supported observables [[https://github.com/advthreat/iroh/pull/9000][#9000]] +- Fix flaky test [[https://github.com/advthreat/iroh/pull/9001][#9001]] +- Redis: Set NX / XX [[https://github.com/advthreat/iroh/pull/8970][#8970]] +- Bulk asset update + rescoring route [[https://github.com/advthreat/iroh/pull/8963][#8963]] +- Fix logf call [[https://github.com/advthreat/iroh/pull/8925][#8925]] +- Fix incident subscription args, and only subscribe incident if observables/identities are non-empty [[https://github.com/advthreat/iroh/pull/8921][#8921]] +- Fix DI subscription URL [[https://github.com/advthreat/iroh/pull/8914][#8914]] +- Revert patch bundle commits [[https://github.com/advthreat/iroh/pull/8903][#8903]] +- Fix swagger description [[https://github.com/advthreat/iroh/pull/8905][#8905]] +- Asset properties update and incident rescoring route [[https://github.com/advthreat/iroh/pull/8843][#8843]] +- Rescoring task [[https://github.com/advthreat/iroh/pull/8869][#8869]] +- Generate valid DI auth tokens for incident subscriptions [[https://github.com/advthreat/iroh/pull/8804][#8804]] +- Fix ~(reset)~ [[https://github.com/advthreat/iroh/pull/8799][#8799]] +- Subscribe to incident asset rescoring via DI [[https://github.com/advthreat/iroh/pull/8699][#8699]] +- Only pass default patch-existing query params in bundle/import proxy if patch-existing=true [[https://github.com/advthreat/iroh/pull/8725][#8725]] +**** tenzin-config [4] + +- Bulk asset update limits [[https://github.com/advthreat/tenzin-config/pull/1059][#1059]] +- Add Conure url to Private intel config [[https://github.com/advthreat/tenzin-config/pull/1052][#1052]] +- Add config for DI client in iroh-engine [[https://github.com/advthreat/tenzin-config/pull/1036][#1036]] +- Add device insights url to iroh-engine config [[https://github.com/advthreat/tenzin-config/pull/1014][#1014]] +** integrations + + +*** Matthieu Sprunck [20] + +**** iroh [16] + +- Adding and editing Automate notification types [[https://github.com/advthreat/iroh/pull/9277][#9277]] +- Rename automation_workflow_disabled to automation_workflow_definition [[https://github.com/advthreat/iroh/pull/9196][#9196]] +- Revert "Update the json appender to rename the output level key (#9187)" [[https://github.com/advthreat/iroh/pull/9191][#9191]] +- Change Incident Assignment Notification wording [[https://github.com/advthreat/iroh/pull/9189][#9189]] +- Add title and link to the incident in the incident assignment notification [[https://github.com/advthreat/iroh/pull/9188][#9188]] +- Add a log when an unexpected status is returned from KafkaConnect [[https://github.com/advthreat/iroh/pull/9153][#9153]] +- IROH Proxy: Correct handling for path with spaces (%20) [[https://github.com/advthreat/iroh/pull/9149][#9149]] +- Build notification type name from notification type [[https://github.com/advthreat/iroh/pull/9140][#9140]] +- JMX metrics for clj-http connection manager [[https://github.com/advthreat/iroh/pull/8765][#8765]] +- Always decompress the body when status is not 2xx [[https://github.com/advthreat/iroh/pull/8527][#8527]] +- Restore default expiration (24h) for the local session token [[https://github.com/advthreat/iroh/pull/8747][#8747]] + +_between 6 month and 7 month old_ + +- Workflow event schema changes [[https://github.com/advthreat/iroh/pull/8656][#8656]] +- IROH Proxy: remove headers set by the reverse proxy [[https://github.com/advthreat/iroh/pull/8655][#8655]] +- More log context to investigate #8638 [[https://github.com/advthreat/iroh/pull/8654][#8654]] +- Add logging info to investigate #8638 [[https://github.com/advthreat/iroh/pull/8653][#8653]] +- StackOverflowError temporary fix [[https://github.com/advthreat/iroh/pull/8607][#8607]] +**** tenzin-config [4] + +- Configure XDR URL in the PrivateIntel service for the Assignment notification [[https://github.com/advthreat/tenzin-config/pull/1116][#1116]] +- Create a module record for Microsoft Graph API [[https://github.com/advthreat/tenzin-config/pull/1050][#1050]] +- Fix settings names for JAMF auth upgrade [[https://github.com/advthreat/tenzin-config/pull/1048][#1048]] +- Use Token Auth with the JAMF Classic API [[https://github.com/advthreat/tenzin-config/pull/1038][#1038]] + +*** Kirill Chernyshov [42] + +**** iroh [35] + +- Draft design [[https://github.com/advthreat/iroh/pull/9201][#9201]] +- Format redirect url for email notification [[https://github.com/advthreat/iroh/pull/9211][#9211]] +- Use static string 'Cisco' as a subtitle [[https://github.com/advthreat/iroh/pull/9210][#9210]] +- Coerce incoming notification before email format [[https://github.com/advthreat/iroh/pull/9204][#9204]] +- [REFACTORING] Standardize trapperkeeper usage [[https://github.com/advthreat/iroh/pull/9177][#9177]] +- Use ~notify!~ to create notification via API call [[https://github.com/advthreat/iroh/pull/9162][#9162]] +- Fix copyright notice in email template [[https://github.com/advthreat/iroh/pull/9159][#9159]] +- Add simple template for notification email [[https://github.com/advthreat/iroh/pull/9150][#9150]] +- Allow nil as a correlation id [[https://github.com/advthreat/iroh/pull/9143][#9143]] +- Fix for EventService initialization [[https://github.com/advthreat/iroh/pull/9141][#9141]] +- Respect user notification preferences [[https://github.com/advthreat/iroh/pull/9133][#9133]] +- Add default config for NotificationInDelivery [[https://github.com/advthreat/iroh/pull/9128][#9128]] +- 8938 e8811 process email notification delivery [[https://github.com/advthreat/iroh/pull/9127][#9127]] +- Fix config key [[https://github.com/advthreat/iroh/pull/9115][#9115]] +- Fix dev config for NotificationInDeliveryService [[https://github.com/advthreat/iroh/pull/9113][#9113]] +- On recieving NotificationRequest notify users according to their preference [[https://github.com/advthreat/iroh/pull/9087][#9087]] +- Upgrade clojure 1.11.1 -> 1.11.2 [[https://github.com/advthreat/iroh/pull/9072][#9072]] +- Remove maintenance notification type [[https://github.com/advthreat/iroh/pull/9069][#9069]] +- 8933 e8811 create notificationindeliveryservice persistence only [[https://github.com/advthreat/iroh/pull/9025][#9025]] +- "In App" -> "In-App" [[https://github.com/advthreat/iroh/pull/9020][#9020]] +- Add correct :name and :description to notification type meta [[https://github.com/advthreat/iroh/pull/9012][#9012]] +- NotificationPreference API real endpoint [[https://github.com/advthreat/iroh/pull/8995][#8995]] +- NotificationPreference Service [[https://github.com/advthreat/iroh/pull/8982][#8982]] +- Fixes for notification endpoint [[https://github.com/advthreat/iroh/pull/8964][#8964]] +- Add notification preference api endpoints [[https://github.com/advthreat/iroh/pull/8947][#8947]] +- Initial draft design of notifications delivery [[https://github.com/advthreat/iroh/pull/8844][#8844]] +- Refactor data streams service [[https://github.com/advthreat/iroh/pull/8793][#8793]] +- DRY'ed out client-creds-token namespace [[https://github.com/advthreat/iroh/pull/8783][#8783]] +- Kafka connect monitoring [[https://github.com/advthreat/iroh/pull/8278][#8278]] +- Handle undelivered records [[https://github.com/advthreat/iroh/pull/8634][#8634]] +- Events data retention enforcement job [[https://github.com/advthreat/iroh/pull/8722][#8722]] +- Iroh events data retention implementation [[https://github.com/advthreat/iroh/pull/8666][#8666]] +- Iroh events postgres data retention [[https://github.com/advthreat/iroh/pull/8693][#8693]] + +_between 6 month and 7 month old_ + +- Use timbre for logging [[https://github.com/advthreat/iroh/pull/8651][#8651]] +- Add draft design for IROH Events data retention [[https://github.com/advthreat/iroh/pull/8585][#8585]] +**** tenzin-config [7] + +- Add KafkaProducerService to all envs [[https://github.com/advthreat/tenzin-config/pull/1107][#1107]] +- Add email kafka consumer to all envs [[https://github.com/advthreat/tenzin-config/pull/1106][#1106]] +- Enable kafka consumer for email notifications [[https://github.com/advthreat/tenzin-config/pull/1099][#1099]] +- Add new kafka topics for IROH notifications [[https://github.com/advthreat/tenzin-config/pull/1070][#1070]] +- Add ES sink connector v2 to test full migration [[https://github.com/advthreat/tenzin-config/pull/1035][#1035]] +- Fix broken data stream on TEST [[https://github.com/advthreat/tenzin-config/pull/1034][#1034]] +- Config for DataStreams service [[https://github.com/advthreat/tenzin-config/pull/1033][#1033]] + +*** Shafiq [33] + +**** iroh [30] + +- Return relevant proxy health check errors req auth fails [[https://github.com/advthreat/iroh/pull/9290][#9290]] +- Fix access-token url for rubrik and commvault auth [[https://github.com/advthreat/iroh/pull/9287][#9287]] +- Support Async remote requests in AutomateRemoteProxy [[https://github.com/advthreat/iroh/pull/9264][#9264]] +- Design Automation-Remote target for iroh-proxy [[https://github.com/advthreat/iroh/pull/9190][#9190]] +- Trim whitespace when interpolating pipe transforms [[https://github.com/advthreat/iroh/pull/9121][#9121]] +- Support for GoogleAPI Authorization [[https://github.com/advthreat/iroh/pull/9106][#9106]] +- Refactor proxy health check [[https://github.com/advthreat/iroh/pull/9066][#9066]] +- Data retention cleanup of notification services [[https://github.com/advthreat/iroh/pull/9064][#9064]] +- Apply data retention policy on iroh-notifications [[https://github.com/advthreat/iroh/pull/9054][#9054]] +- Add ~:remote~ type in configuration spec fields [[https://github.com/advthreat/iroh/pull/9046][#9046]] +- Refactor proxy-health-check [[https://github.com/advthreat/iroh/pull/9033][#9033]] +- Update proxy-health-check logging [[https://github.com/advthreat/iroh/pull/9028][#9028]] +- Update proxy health check logging [[https://github.com/advthreat/iroh/pull/9024][#9024]] +- Perform relay-api request based on observable-types [[https://github.com/advthreat/iroh/pull/9017][#9017]] +- Add selection of settings for configuration-token auth [[https://github.com/advthreat/iroh/pull/9007][#9007]] +- Support for dedicated url setting for iroh-proxy requests [[https://github.com/advthreat/iroh/pull/8998][#8998]] +- Route for patching module-type documentation [[https://github.com/advthreat/iroh/pull/8981][#8981]] +- Add filtering of notifications using multiple statuses [[https://github.com/advthreat/iroh/pull/8974][#8974]] +- Support for transforming interpolated strings. [[https://github.com/advthreat/iroh/pull/8945][#8945]] +- Construct token url from base-url setting [[https://github.com/advthreat/iroh/pull/8923][#8923]] +- [IROH Proxy] Support for Rubrik and Commvault API services [[https://github.com/advthreat/iroh/pull/8902][#8902]] +- [iroh-proxy] Include POST method for proxy health check [[https://github.com/advthreat/iroh/pull/8878][#8878]] +- Update relay-module schemas for Checkpoint auth [[https://github.com/advthreat/iroh/pull/8875][#8875]] +- [iroh-proxy] Implement Checkpoint Smart-1 authentication [[https://github.com/advthreat/iroh/pull/8873][#8873]] +- Fix schema of proxy health check [[https://github.com/advthreat/iroh/pull/8827][#8827]] +- Add string matching for health check [[https://github.com/advthreat/iroh/pull/8815][#8815]] +- Fallback to iroh-events store when kafka send fails [[https://github.com/advthreat/iroh/pull/8786][#8786]] +- Fix mapping for incident events [[https://github.com/advthreat/iroh/pull/8703][#8703]] + +_between 6 month and 7 month old_ + +- Update iroh-event developer doc [[https://github.com/advthreat/iroh/pull/8596][#8596]] +- Add x-sort header to support search_after pagination [[https://github.com/advthreat/iroh/pull/8586][#8586]] +**** tenzin-config [3] + +- Swtich to new sink-connector in INT [[https://github.com/advthreat/tenzin-config/pull/1024][#1024]] +- Add updated sink connector for all envs [[https://github.com/advthreat/tenzin-config/pull/1021][#1021]] +- Add sink connector for new iroh-event datastream [[https://github.com/advthreat/tenzin-config/pull/1019][#1019]] +** auth + + +*** bartuka [54] + +**** iroh [46] + +- add ~:content-type :json~ explicitly to clj-http [[https://github.com/advthreat/iroh/pull/9090][#9090]] +- Brownfield Provisioning - make the ~region~ field available for TEST purposes only [[https://github.com/advthreat/iroh/pull/9079][#9079]] +- Improve logs for Brownfield provisioning [[https://github.com/advthreat/iroh/pull/9076][#9076]] +- [IROH Auth] update QA routes for Universal Provisioning flow [[https://github.com/advthreat/iroh/pull/9053][#9053]] +- [IROH Auth] Fix access token brownfield provisioning [[https://github.com/advthreat/iroh/pull/9049][#9049]] +- [IROH Auth] bugfix - accept empty string as entitlement value for universal provisioning [[https://github.com/advthreat/iroh/pull/9021][#9021]] +- [IROH Auth] FMC add re-token proxy request [[https://github.com/advthreat/iroh/pull/9011][#9011]] +- [IROH Auth] fix FMC redirect call to ~/device~ [[https://github.com/advthreat/iroh/pull/8987][#8987]] +- [IROH Auth] fix device verification redirection [[https://github.com/advthreat/iroh/pull/8979][#8979]] +- fix proxy requests to FMC [[https://github.com/advthreat/iroh/pull/8972][#8972]] +- [IROH Auth] FMC OAuth2 and SSE proxies [[https://github.com/advthreat/iroh/pull/8840][#8840]] +- [IROH Auth] Improvements to universal provisioning callback [[https://github.com/advthreat/iroh/pull/8913][#8913]] +- [IROH Auth] bugfix #4: add ~:content-type :json~ to callback request [[https://github.com/advthreat/iroh/pull/8909][#8909]] +- [IROH Auth] fix payload sent to PIAM callback_url after provisioning was complete [[https://github.com/advthreat/iroh/pull/8900][#8900]] +- [IROH Auth] bugfix Universal Provisioning created schema error [[https://github.com/advthreat/iroh/pull/8892][#8892]] +- [IROH Auth] bugfix parsing OKTA JWT scopes [[https://github.com/advthreat/iroh/pull/8880][#8880]] +- [IROH Auth] Brownfield provisioning - endpoint to attach existing tenant to a SBG product [[https://github.com/advthreat/iroh/pull/8806][#8806]] +- [IROH Auth] Support FMC in the ~jwks~ service [[https://github.com/advthreat/iroh/pull/8830][#8830]] +- [IROH Auth] Fix DI onboarding in Universal Provisioning Flow [[https://github.com/advthreat/iroh/pull/8813][#8813]] +- Revert "[IROH Auth] support for FMC token in JWKS Service" [[https://github.com/advthreat/iroh/pull/8816][#8816]] +- [IROH Auth] support for FMC token in JWKS Service [[https://github.com/advthreat/iroh/pull/8808][#8808]] +- [IROH Auth] Check QA ~callback_url~ to complete provisioning tests [[https://github.com/advthreat/iroh/pull/8763][#8763]] +- [IROH Auth] better swagger descriptions for Universal Provisioning [[https://github.com/advthreat/iroh/pull/8752][#8752]] +- [IROH Auth] remove empty strings from ~client-id~ got from Vault [[https://github.com/advthreat/iroh/pull/8760][#8760]] +- [IROH Auth] add missing scope to get OKTA JWT [[https://github.com/advthreat/iroh/pull/8759][#8759]] +- [IROH Auth] add logs to investigate get okta jwt [[https://github.com/advthreat/iroh/pull/8758][#8758]] +- [IROH Auth] bugfix - ~client/post~ should use ~:form-params~ instead of ~:body~ [[https://github.com/advthreat/iroh/pull/8753][#8753]] +- [IROH Auth] bugfixes - arity exception, change ~product-response~ datatype, change ~pmap~ to ~map~ [[https://github.com/advthreat/iroh/pull/8738][#8738]] +- [IROH Auth] bugfix - fix urls in ~POST /tenants~ returned value and payload field names [[https://github.com/advthreat/iroh/pull/8733][#8733]] +- [IROH Auth] Cache OKTA JWT used for provisioning callback [[https://github.com/advthreat/iroh/pull/8727][#8727]] +- [IROH Auth] Improvements on logs and error handling to UniversalProvisioning and JWKSService [[https://github.com/advthreat/iroh/pull/8707][#8707]] +- [IROH Auth] Duplicate ~universal-provisioning~ web routes to accept IROH JWTs [[https://github.com/advthreat/iroh/pull/8675][#8675]] +- [IROH Auth] Expose ~callbacks packages~ store to check Universal Provisioning status [[https://github.com/advthreat/iroh/pull/8702][#8702]] +- [IROH Auth] Improve 202 Accepted response for ~/universal-provisioning/create-tenants~ [[https://github.com/advthreat/iroh/pull/8701][#8701]] +- [IROH Auth] Fix name convention to callbacks route in Universal Provisioning flow [[https://github.com/advthreat/iroh/pull/8691][#8691]] + +_between 6 month and 7 month old_ + +- [IROH Auth] Gen OKTA JWT to callback request in Universal Provisioning flow [[https://github.com/advthreat/iroh/pull/8673][#8673]] +- bugfix - missing ~UniversalProvisioningCallbackService~ to deploy IROH nodes [[https://github.com/advthreat/iroh/pull/8680][#8680]] +- [IROH Auth] Check pending provisions from time-to-time. Endpoint that will be called by OPS tick [[https://github.com/advthreat/iroh/pull/8674][#8674]] +- [IROH Auth] Add callback handler to receive provisioning status from downstream apps [[https://github.com/advthreat/iroh/pull/8633][#8633]] +- [IROH Auth] Add support to UserIdentity JWTs in ~JWKSService~ [[https://github.com/advthreat/iroh/pull/8647][#8647]] +- [IROH Auth] Bugfix in JWKSService logic [[https://github.com/advthreat/iroh/pull/8659][#8659]] +- [IROH Auth] update docs for Universal Provisioning work [[https://github.com/advthreat/iroh/pull/8640][#8640]] +- [IROH Auth] Simplify IROH Web Core by leveraging ~JWKSService~ for all webservices [[https://github.com/advthreat/iroh/pull/8632][#8632]] +- [IROH Auth] Add structure to keep track of onboardings to support async flow in Universal Provisioning [[https://github.com/advthreat/iroh/pull/8599][#8599]] +- [IROH Auth] Add support to accept IROH Auth JWTs and External JWTs in a WebService [[https://github.com/advthreat/iroh/pull/8528][#8528]] +- [IROH Auth] bump ~ring-jwt-middleware~ to ~1.1.5~ [[https://github.com/advthreat/iroh/pull/8568][#8568]] +**** tenzin-config [8] + +- add fmc client id for each env [[https://github.com/advthreat/tenzin-config/pull/1065][#1065]] +- fix url for device verification [[https://github.com/advthreat/tenzin-config/pull/1058][#1058]] +- Add FMC Proxy configuration [[https://github.com/advthreat/tenzin-config/pull/1056][#1056]] +- fix okta links [[https://github.com/advthreat/tenzin-config/pull/1043][#1043]] +- FMC base-urls to configure JWKS [[https://github.com/advthreat/tenzin-config/pull/1040][#1040]] +- [IROH Auth] bugfix - add config to okta jwks [[https://github.com/advthreat/tenzin-config/pull/1017][#1017]] +- [IROH Auth] add OKTA config for Universal Provisioning flow #1010 [[https://github.com/advthreat/tenzin-config/pull/1013][#1013]] + +_between 6 month and 7 month old_ + +- add universal_provisioning_callbacks store [[https://github.com/advthreat/tenzin-config/pull/1011][#1011]] + +*** Yann Esposito [118] + +**** iroh [51] + +- Scopes by app [[https://github.com/advthreat/iroh/pull/9247][#9247]] +- Disable SSE Proxy for XDR orgs [[https://github.com/advthreat/iroh/pull/9280][#9280]] +- improve Client credentials error message to help debug [[https://github.com/advthreat/iroh/pull/9213][#9213]] +- Attempt to provide a body to the onboarding with mustache [[https://github.com/advthreat/iroh/pull/9151][#9151]] +- provisioning API for Org apps [[https://github.com/advthreat/iroh/pull/9195][#9195]] +- Revert "add admin-ui to the gh-pages (#9222)" [[https://github.com/advthreat/iroh/pull/9223][#9223]] +- add admin-ui to the gh-pages [[https://github.com/advthreat/iroh/pull/9222][#9222]] +- Add sc-enabled? flag to profile API views [[https://github.com/advthreat/iroh/pull/9192][#9192]] +- [PIAM Brownfield Provisioning]: Provide a way to update link tenants [[https://github.com/advthreat/iroh/pull/9186][#9186]] +- Add apps field to Orgs [[https://github.com/advthreat/iroh/pull/9175][#9175]] +- improve response when PIAM returns an error [[https://github.com/advthreat/iroh/pull/9183][#9183]] +- fix flaky test invite-test paging [[https://github.com/advthreat/iroh/pull/9182][#9182]] +- Support aero configurations [[https://github.com/advthreat/iroh/pull/9170][#9170]] +- Fix invites pagination [[https://github.com/advthreat/iroh/pull/9138][#9138]] +- Support FMC returning Bearer instead of bearer [[https://github.com/advthreat/iroh/pull/9126][#9126]] +- composable jwks test helper [[https://github.com/advthreat/iroh/pull/9120][#9120]] +- Sync user-name during SCSO login [[https://github.com/advthreat/iroh/pull/9117][#9117]] +- Another IPv6 in URL fix [[https://github.com/advthreat/iroh/pull/9084][#9084]] +- Support IPv6 in URL for inspect service [[https://github.com/advthreat/iroh/pull/9083][#9083]] +- Update of the login doc [[https://github.com/advthreat/iroh/pull/9067][#9067]] +- optimize search user given a list of ids [[https://github.com/advthreat/iroh/pull/9018][#9018]] +- Fix link tenant bug [[https://github.com/advthreat/iroh/pull/8975][#8975]] +- Upgrade Org to XDR on first entitlement update. [[https://github.com/advthreat/iroh/pull/8881][#8881]] +- [IROH-Auth]: Auth Code Grant Client that do not generate any refresh token [[https://github.com/advthreat/iroh/pull/8927][#8927]] +- Specialize TAC routes access [[https://github.com/advthreat/iroh/pull/8884][#8884]] +- Remove legacy restriction of AO scopes [[https://github.com/advthreat/iroh/pull/8890][#8890]] +- Update deps to accept JWT without nbf claim [[https://github.com/advthreat/iroh/pull/8872][#8872]] +- New endpoint to ease impersonation usage [[https://github.com/advthreat/iroh/pull/8855][#8855]] +- Fix PIAM Universal Provisioning routes [[https://github.com/advthreat/iroh/pull/8828][#8828]] +- Should fix open impersonate flaky test [[https://github.com/advthreat/iroh/pull/8809][#8809]] +- Keep track of impersonators [[https://github.com/advthreat/iroh/pull/8736][#8736]] +- Restrict TAC routes to admins [[https://github.com/advthreat/iroh/pull/8794][#8794]] +- Remove with-tk [[https://github.com/advthreat/iroh/pull/8779][#8779]] +- Code/Test Improvements [[https://github.com/advthreat/iroh/pull/8767][#8767]] +- add a test for matching schema [[https://github.com/advthreat/iroh/pull/8770][#8770]] +- Custom Role Design doc [[https://github.com/advthreat/iroh/pull/8497][#8497]] +- Attempt to improve error message of match? [[https://github.com/advthreat/iroh/pull/8769][#8769]] +- Use ~cid~ for ~trace_id~ when present [[https://github.com/advthreat/iroh/pull/8754][#8754]] +- Support public client for custom routes [[https://github.com/advthreat/iroh/pull/8749][#8749]] +- Add playbook scope [[https://github.com/advthreat/iroh/pull/8739][#8739]] +- Fix webhook race condition risk [[https://github.com/advthreat/iroh/pull/8728][#8728]] +- Call get-org only once for org-virtual user [[https://github.com/advthreat/iroh/pull/8724][#8724]] +- Use a cache for entitlement summaries [[https://github.com/advthreat/iroh/pull/8667][#8667]] +- upgrade jetty version [[https://github.com/advthreat/iroh/pull/8714][#8714]] +- Remove a forgotten pretty printer [[https://github.com/advthreat/iroh/pull/8713][#8713]] + +_between 6 month and 7 month old_ + +- Fast Event Notifier dispatch using event-type [[https://github.com/advthreat/iroh/pull/8650][#8650]] +- Fix DI onboarding [[https://github.com/advthreat/iroh/pull/8657][#8657]] +- Generalize default indexes for data retention [[https://github.com/advthreat/iroh/pull/8598][#8598]] +- [Data Retention Policy]: Delete incident summaries along incident [[https://github.com/advthreat/iroh/pull/8576][#8576]] +- [Provisioning] Introduce ~product-instance-id~ [[https://github.com/advthreat/iroh/pull/8577][#8577]] +- Simply wait a lot more for ES to sync [[https://github.com/advthreat/iroh/pull/8553][#8553]] +**** iroh-scripts [36] + +- ai onboarding +- fix a bug with trust client +- fix resend-invite +- script to remove flags +- fix a bug in create-super-org +- relink scc script +- prevent id collision +- cleaned-up get-org response +- Added add-flag script here +- CSE client and better patch +- resend-invite +- add SXP riles prod clients +- improve client manipulations +- Updated scripts +- use include +- use local clojure +- Added a better alias for sxo clients +- SXO rules +- added ai client with script +- Fix +- A few new scripts +- Super client should be part of XDR orgs +- Super org should have the XDR flag +- Add admin user +- updated and added scripts +- save and improve client aliases +- save improvements +- create dashboard clients +- Support client aliases in get-client +- Update client with client-aliases +- many new scripts + +_between 6 month and 7 month old_ + +- added a 1-time script +- Add trusted to get-client +- Improve search and error messages +- Prepare TG to SCSO org migration +- add scope to a client +**** oauth2-client-demo [3] + +- pin packages +- reuse authorized url +- added Meraki client to the list +**** ring-jwt-middleware [3] + +- Version 1.1.7-SNAPSHOT +- Version 1.1.6 +- Support missing nbf JWT [[https://github.com/advthreat/ring-jwt-middleware/pull/30][#30]] +**** scopula [6] + +- Version 0.3.3-SNAPSHOT +- Version 0.3.2 +- real cljs support +- Version 0.3.2-SNAPSHOT +- Version 0.3.1 +- support cljs +**** tenzin-config [14] + +- Add applications URL in iroh conf [[https://github.com/advthreat/tenzin-config/pull/1146][#1146]] +- Add AI Assistant automatic onboarding during Provisioning [[https://github.com/advthreat/tenzin-config/pull/1142][#1142]] +- add iroh gh-pages to allowed login origin [[https://github.com/advthreat/tenzin-config/pull/1123][#1123]] +- New SCA env for TEST/STAGING [[https://github.com/advthreat/tenzin-config/pull/1114][#1114]] +- configure automatio rules clients to not be rate limited [[https://github.com/advthreat/tenzin-config/pull/1111][#1111]] +- interpolation improvements [[https://github.com/advthreat/tenzin-config/pull/1112][#1112]] +- Add support for interpolation and self ref [[https://github.com/advthreat/tenzin-config/pull/1110][#1110]] +- Remove rate-limit for another SXO client on INT [[https://github.com/advthreat/tenzin-config/pull/1087][#1087]] +- Disable rate-limit SXO client for rules [[https://github.com/advthreat/tenzin-config/pull/1084][#1084]] +- Double threads dedicated for VirusTotal http calls [[https://github.com/advthreat/tenzin-config/pull/1051][#1051]] +- fix vault tpl transformations and checks [[https://github.com/advthreat/tenzin-config/pull/1041][#1041]] +- Remove rate-limit for automation [[https://github.com/advthreat/tenzin-config/pull/1044][#1044]] +- Check vault templating error [[https://github.com/advthreat/tenzin-config/pull/1023][#1023]] +- Add Universal Provisioning Services [[https://github.com/advthreat/tenzin-config/pull/1015][#1015]] +**** xdr-provisioning [5] + +- added a few useful script + ai onboarding support +- improved re-onboarding script +- use local clojure +- Manage entitlements add-ons +- add a re-provisioning script that rerun onboardings + +*** Olivier Barbeau [47] + +**** iroh [31] + +- Add number of incidents to each technique in the Mitre matrix [[https://github.com/advthreat/iroh/pull/9157][#9157]] +- Fix events and incidents ES stores for DEV [[https://github.com/advthreat/iroh/pull/9154][#9154]] +- E8851: XDR Native & detections [[https://github.com/advthreat/iroh/pull/9122][#9122]] +- E8851: Design of changes for XDR native detections [[https://github.com/advthreat/iroh/pull/9110][#9110]] +- E8851: Product ordering in the coverage of techniques [[https://github.com/advthreat/iroh/pull/9100][#9100]] +- E8851: Product ordering and SCA renaming [[https://github.com/advthreat/iroh/pull/9086][#9086]] +- E8851: Add Org's integrations to the Mitre matrix [[https://github.com/advthreat/iroh/pull/8993][#8993]] +- E8851: Sorting of Mitre elements [[https://github.com/advthreat/iroh/pull/8992][#8992]] +- E8851: Static matrix common to all Orgs [[https://github.com/advthreat/iroh/pull/8939][#8939]] +- E8851: Talos MITRE coverage files import [[https://github.com/advthreat/iroh/pull/8876][#8876]] +- Design of the Talos MITRE coverage files import [[https://github.com/advthreat/iroh/pull/8856][#8856]] +- 'iroh' node type and default services for all node types [[https://github.com/advthreat/iroh/pull/8817][#8817]] +- Check the list of services for a node type [[https://github.com/advthreat/iroh/pull/8800][#8800]] +- Fix merge error on PR 8784 [[https://github.com/advthreat/iroh/pull/8797][#8797]] +- [IROH configuration]: Move role-web-service config to default tk files [[https://github.com/advthreat/iroh/pull/8782][#8782]] +- [IROH configuration]: Universal Provisioning Services config refactor [[https://github.com/advthreat/iroh/pull/8784][#8784]] +- [IROH configuration]: explicit name for generated conf and meta [[https://github.com/advthreat/iroh/pull/8785][#8785]] +- Clean bootstrap.cfg; remove tmp file [[https://github.com/advthreat/iroh/pull/8781][#8781]] +- Add few additional tests to iroh services [[https://github.com/advthreat/iroh/pull/8762][#8762]] +- rewrite tests [[https://github.com/advthreat/iroh/pull/8773][#8773]] +- more info for debugging [[https://github.com/advthreat/iroh/pull/8717][#8717]] +- [IROH configuration]: general documentation [[https://github.com/advthreat/iroh/pull/8764][#8764]] +- update developer doc for api-gateway [[https://github.com/advthreat/iroh/pull/8723][#8723]] +- Some test clean-up [[https://github.com/advthreat/iroh/pull/8716][#8716]] + +_between 6 month and 7 month old_ + +- High volume of SQL queries for a single observe/deliberate call [[https://github.com/advthreat/iroh/pull/8682][#8682]] +- Remove the state of module instances in ~obfuscate-module-instance~ [[https://github.com/advthreat/iroh/pull/8670][#8670]] +- E8388: update proxy-endpoints-metadata endpoint and metadata [[https://github.com/advthreat/iroh/pull/8663][#8663]] +- E8388: update x-proxy endpoint and IntService ACL filters [[https://github.com/advthreat/iroh/pull/8608][#8608]] +- E8388 : Simplifies upgrade/downgrade tests [[https://github.com/advthreat/iroh/pull/8635][#8635]] +- Implement ~Module Instance service~ event handler [[https://github.com/advthreat/iroh/pull/8592][#8592]] +- Updates to the design 'entitlement changes for integration modules' [[https://github.com/advthreat/iroh/pull/8541][#8541]] +**** tenzin-config [16] + +- add XDR native module types for PROD [[https://github.com/advthreat/tenzin-config/pull/1115][#1115]] +- add SCA module-type-id for XDR Native on TEST [temp UI fix] [[https://github.com/advthreat/tenzin-config/pull/1109][#1109]] +- add SCA module-type-id for XDR Native [temp UI fix] [[https://github.com/advthreat/tenzin-config/pull/1108][#1108]] +- Mitre: Add detections for XDR Native [[https://github.com/advthreat/tenzin-config/pull/1098][#1098]] +- product ordering and SCA renaming [[https://github.com/advthreat/tenzin-config/pull/1079][#1079]] +- Config for Mitre covering products [[https://github.com/advthreat/tenzin-config/pull/1072][#1072]] +- Deep merge for vectors and sets with duplicates check [[https://github.com/advthreat/tenzin-config/pull/1032][#1032]] +- Reduce configuration duplicates - config.edn part [[https://github.com/advthreat/tenzin-config/pull/1031][#1031]] +- Reduce configuration duplicates - bootstrap.cfg part [[https://github.com/advthreat/tenzin-config/pull/1028][#1028]] +- Move role-web-service config to IROH [[https://github.com/advthreat/tenzin-config/pull/1026][#1026]] +- Move Universal Provisioning Services config to IROH [[https://github.com/advthreat/tenzin-config/pull/1027][#1027]] +- Clean bootstrap cfg [[https://github.com/advthreat/tenzin-config/pull/1025][#1025]] +- Remove the ~:registration~ flag in all environments [[https://github.com/advthreat/tenzin-config/pull/963][#963]] +- Remove the ~:merge-users-by-email~ flag in all environments [[https://github.com/advthreat/tenzin-config/pull/962][#962]] +- Remove the ~:account-activation-optim~ flag in all environments as it is now activated everywhere. [[https://github.com/advthreat/tenzin-config/pull/961][#961]] +- Remove the ~xdr-roles~ flag in all environments [[https://github.com/advthreat/tenzin-config/pull/964][#964]] + +*** (Yogsototh) [52] + +**** iroh-scripts [36] + +- ai onboarding +- fix a bug with trust client +- fix resend-invite +- script to remove flags +- fix a bug in create-super-org +- relink scc script +- prevent id collision +- cleaned-up get-org response +- Added add-flag script here +- CSE client and better patch +- resend-invite +- add SXP riles prod clients +- improve client manipulations +- Updated scripts +- use include +- use local clojure +- Added a better alias for sxo clients +- SXO rules +- added ai client with script +- Fix +- A few new scripts +- Super client should be part of XDR orgs +- Super org should have the XDR flag +- Add admin user +- updated and added scripts +- save and improve client aliases +- save improvements +- create dashboard clients +- Support client aliases in get-client +- Update client with client-aliases +- many new scripts + +_between 6 month and 7 month old_ + +- added a 1-time script +- Add trusted to get-client +- Improve search and error messages +- Prepare TG to SCSO org migration +- add scope to a client +**** oauth2-client-demo [3] + +- pin packages +- reuse authorized url +- added Meraki client to the list +**** ring-jwt-middleware [2] + +- Version 1.1.7-SNAPSHOT +- Version 1.1.6 +**** scopula [6] + +- Version 0.3.3-SNAPSHOT +- Version 0.3.2 +- real cljs support +- Version 0.3.2-SNAPSHOT +- Version 0.3.1 +- support cljs +**** xdr-provisioning [5] + +- added a few useful script + ai onboarding support +- improved re-onboarding script +- use local clojure +- Manage entitlements add-ons +- add a re-provisioning script that rerun onboardings +** iroh-ops + + +*** Jerome Schneider [1] + +**** tenzin-config [1] + +- IROH migrate to new MSK SASL/SCRAM cluster! + +*** Patrick Patat [1] + +**** tenzin-config [1] + +- refactor ops config with new ref system [[https://github.com/advthreat/tenzin-config/pull/1113][#1113]] +* Other +** Other + + +*** Robert Levy [7] + +**** iroh [6] + +- Inherit properties from type in hierarchical modules [[https://github.com/advthreat/iroh/pull/9042][#9042]] +- Format hierarchical modules invalid-parent-id error with context and error type [[https://github.com/advthreat/iroh/pull/8901][#8901]] +- Update hardcoded source in Secure Endpoint module [[https://github.com/advthreat/iroh/pull/8874][#8874]] +- Expose pagination & search functionality in notifications api [[https://github.com/advthreat/iroh/pull/8803][#8803]] +- Fix bug in hierarchical module logic producing empty settings/settings_effective map [[https://github.com/advthreat/iroh/pull/8745][#8745]] +- Issue 8158 hierarchical module [[https://github.com/advthreat/iroh/pull/8469][#8469]] +**** tenzin-config [1] + + +_between 6 month and 7 month old_ + +- Revert "Adds cache configuration for CrowdStrike (#1002)" [[https://github.com/advthreat/tenzin-config/pull/1005][#1005]] + +*** Eric Gierach [4] + +**** iroh [1] + +- update iroh-engine to 0.16.5 [[https://github.com/advthreat/iroh/pull/9291][#9291]] +**** tenzin-config [3] + +- removing duplicate entry [[https://github.com/advthreat/tenzin-config/pull/1078][#1078]] +- Swap stg and test configs for reporting. [[https://github.com/advthreat/tenzin-config/pull/1077][#1077]] +- Disabling reporting until Ops gets the infra set up. [[https://github.com/advthreat/tenzin-config/pull/1075][#1075]] + +*** II [21] + +**** iroh [17] + +- Xdr 1281 Adds user agent to Umbrella requests [[https://github.com/advthreat/iroh/pull/9292][#9292]] +- Keeps Kondo from being run on dev start [[https://github.com/advthreat/iroh/pull/9220][#9220]] +- Xdr 1282 Adds new Umbrella service to default services [[https://github.com/advthreat/iroh/pull/9214][#9214]] +- Xdr 1282 add v 2 token cache to umbrella integration [[https://github.com/advthreat/iroh/pull/9208][#9208]] +- XDR-1411 Fixes inconsistent v1 v2 refer [[https://github.com/advthreat/iroh/pull/9197][#9197]] +- 9074 remove settings effective [[https://github.com/advthreat/iroh/pull/9075][#9075]] +- 8990 umbrella investigate v2 [[https://github.com/advthreat/iroh/pull/9030][#9030]] +- 8958 Adds Missing Umbrella v2 Sightings [[https://github.com/advthreat/iroh/pull/8960][#8960]] +- 8498 fix token cache [[https://github.com/advthreat/iroh/pull/8911][#8911]] +- 8798 create migration to add parents to existing microsoft defender modules [[https://github.com/advthreat/iroh/pull/8870][#8870]] +- Throws exception in parent validation on non-existent parent [[https://github.com/advthreat/iroh/pull/8850][#8850]] +- Merges module type props on create and update health check [[https://github.com/advthreat/iroh/pull/8845][#8845]] +- Implements v2 threat hunting [[https://github.com/advthreat/iroh/pull/8833][#8833]] +- This should fix issue with parent settings not used on create-patch [[https://github.com/advthreat/iroh/pull/8822][#8822]] + +_between 6 month and 7 month old_ + +- Adds insights scope to allowed Automation scopes in gen-ao-jwt [[https://github.com/advthreat/iroh/pull/8678][#8678]] +- 8496 token cache fix [[https://github.com/advthreat/iroh/pull/8637][#8637]] +- 8496 - relay module token cache [[https://github.com/advthreat/iroh/pull/8580][#8580]] +**** tenzin-config [4] + +- Disables Umbrella module auto load so service does it [[https://github.com/advthreat/tenzin-config/pull/1120][#1120]] +- Enables Umbrella token caches [[https://github.com/advthreat/tenzin-config/pull/1119][#1119]] + +_between 6 month and 7 month old_ + +- Revert "Revert "Adds cache configuration for CrowdStrike (#1002)" (#1005)" [[https://github.com/advthreat/tenzin-config/pull/1008][#1008]] +- Adds cache configuration for CrowdStrike [[https://github.com/advthreat/tenzin-config/pull/1002][#1002]] + +*** Devin Walters [8] + +**** tenzin-config [8] + +- Configure s3-http-client connection pool size for PROD environments [[https://github.com/advthreat/tenzin-config/pull/1105][#1105]] +- Turn on reporting pipeline in TEST [[https://github.com/advthreat/tenzin-config/pull/1097][#1097]] +- Up hikari pool size in INT for conure [[https://github.com/advthreat/tenzin-config/pull/1095][#1095]] +- Configure incident import bucket per PROD env for iroh and iroh-async [[https://github.com/advthreat/tenzin-config/pull/1092][#1092]] +- Configure incident pipeline [[https://github.com/advthreat/tenzin-config/pull/1091][#1091]] +- Fix bucket name [[https://github.com/advthreat/tenzin-config/pull/1083][#1083]] +- Match s3 bucket key [[https://github.com/advthreat/tenzin-config/pull/1082][#1082]] +- Add INT and TEST enrichment bucket names to relevant configs [[https://github.com/advthreat/tenzin-config/pull/1057][#1057]] + +*** Mia [7] + +**** iroh [7] + +- new engine version [[https://github.com/advthreat/iroh/pull/9273][#9273]] +- Xdr 1918 no old assets [[https://github.com/advthreat/iroh/pull/9267][#9267]] +- create permanent logs to unobtrusively monitor bundle import results [[https://github.com/advthreat/iroh/pull/9242][#9242]] +- New iroh event docs [[https://github.com/advthreat/iroh/pull/9181][#9181]] +- iroh-engine 0.16.2 [[https://github.com/advthreat/iroh/pull/9125][#9125]] +- Engine 0.16.1 [[https://github.com/advthreat/iroh/pull/9116][#9116]] +- Engine 0.16.0 [[https://github.com/advthreat/iroh/pull/8997][#8997]] + +*** Martin Bruchanov [3] + +**** tenzin-config [3] + +- XDRSRE-1158: Enabling ElasticSearch authentication for CTIA/PCTIA [[https://github.com/advthreat/tenzin-config/pull/1141][#1141]] +- XDRSRE-1150: Retention enforcement authentication INT [[https://github.com/advthreat/tenzin-config/pull/1132][#1132]] +- XDRSRE-64: Authentication for public CTIA in INT [[https://github.com/advthreat/tenzin-config/pull/1081][#1081]] + +*** James Moser [1] + +**** tenzin-config [1] + +- added QA domain to idps email domain whitelists [[https://github.com/advthreat/tenzin-config/pull/1085][#1085]] + +*** [21] + +**** iroh [17] + +- Xdr 1281 Adds user agent to Umbrella requests [[https://github.com/advthreat/iroh/pull/9292][#9292]] +- Keeps Kondo from being run on dev start [[https://github.com/advthreat/iroh/pull/9220][#9220]] +- Xdr 1282 Adds new Umbrella service to default services [[https://github.com/advthreat/iroh/pull/9214][#9214]] +- Xdr 1282 add v 2 token cache to umbrella integration [[https://github.com/advthreat/iroh/pull/9208][#9208]] +- XDR-1411 Fixes inconsistent v1 v2 refer [[https://github.com/advthreat/iroh/pull/9197][#9197]] +- 9074 remove settings effective [[https://github.com/advthreat/iroh/pull/9075][#9075]] +- 8990 umbrella investigate v2 [[https://github.com/advthreat/iroh/pull/9030][#9030]] +- 8958 Adds Missing Umbrella v2 Sightings [[https://github.com/advthreat/iroh/pull/8960][#8960]] +- 8498 fix token cache [[https://github.com/advthreat/iroh/pull/8911][#8911]] +- 8798 create migration to add parents to existing microsoft defender modules [[https://github.com/advthreat/iroh/pull/8870][#8870]] +- Throws exception in parent validation on non-existent parent [[https://github.com/advthreat/iroh/pull/8850][#8850]] +- Merges module type props on create and update health check [[https://github.com/advthreat/iroh/pull/8845][#8845]] +- Implements v2 threat hunting [[https://github.com/advthreat/iroh/pull/8833][#8833]] +- This should fix issue with parent settings not used on create-patch [[https://github.com/advthreat/iroh/pull/8822][#8822]] + +_between 6 month and 7 month old_ + +- Adds insights scope to allowed Automation scopes in gen-ao-jwt [[https://github.com/advthreat/iroh/pull/8678][#8678]] +- 8496 token cache fix [[https://github.com/advthreat/iroh/pull/8637][#8637]] +- 8496 - relay module token cache [[https://github.com/advthreat/iroh/pull/8580][#8580]] +**** tenzin-config [4] + +- Disables Umbrella module auto load so service does it [[https://github.com/advthreat/tenzin-config/pull/1120][#1120]] +- Enables Umbrella token caches [[https://github.com/advthreat/tenzin-config/pull/1119][#1119]] + +_between 6 month and 7 month old_ + +- Revert "Revert "Adds cache configuration for CrowdStrike (#1002)" (#1005)" [[https://github.com/advthreat/tenzin-config/pull/1008][#1008]] +- Adds cache configuration for CrowdStrike [[https://github.com/advthreat/tenzin-config/pull/1002][#1002]] + +*** Martin Bruchanov [1] + +**** iroh [1] + +- XDR-1344: Final version of deletion script used for PROD change [[https://github.com/advthreat/iroh/pull/9174][#9174]] + +*** Ruslan Yemelianov [2] + +**** tenzin-config [2] + +- Revert "enable ES auth private-ctia INT" +- enable ES auth private-ctia INT + +*** Andrew Parisi [2] + +**** tenzin-config [2] + +- [data-retention/update-iroh-internal-for-prod] [[https://github.com/advthreat/tenzin-config/pull/1018][#1018]] + +_between 6 month and 7 month old_ + +- [data-retention/update-entitlement-route-information] [[https://github.com/advthreat/tenzin-config/pull/1004][#1004]] + +*** Scott McLeod [7] + +**** iroh [6] + +- Notification service timestamp filter [[https://github.com/advthreat/iroh/pull/9252][#9252]] +- Tk store half bounded intervals [[https://github.com/advthreat/iroh/pull/9158][#9158]] +- Extend tk search with range queries [[https://github.com/advthreat/iroh/pull/8912][#8912]] +- Resolves postgres driver sql-injection vulnerability #9091 [[https://github.com/advthreat/iroh/pull/9092][#9092]] +- Implement searching risk scores by score [[https://github.com/advthreat/iroh/pull/8907][#8907]] +- tk store: Add delete-search method #8213 [[https://github.com/advthreat/iroh/pull/8692][#8692]] +**** tenzin-config [1] + +- Increase ReportService batch size to ES maximum [[https://github.com/advthreat/tenzin-config/pull/1055][#1055]] + +*** Sam Waggoner [3] + +**** tenzin-config [3] + +- Increase ctia.http.bulk.max-size in INT +- Configure hydrant to use internal ES metrics api. +- hydrant/912 add clean hashes importer. + +*** t2sw [2] + +**** ctia [1] + + +_between 6 month and 7 month old_ + +- Update CODEOWNERS [[https://github.com/threatgrid/ctia/pull/1390][#1390]] +**** iroh [1] + +- add health endpoint to tac portal and update tests [[https://github.com/advthreat/iroh/pull/9002][#9002]] + +*** Brooke Swanson [24] + +**** ctia [2] + +- XDR-1769: bump CTIM to 1.3.17. [[https://github.com/threatgrid/ctia/pull/1422][#1422]] +- Add brookeswanson to codeowners. [[https://github.com/threatgrid/ctia/pull/1396][#1396]] +**** iroh [8] + +- Maintain behavior for existing events, but also notify s3 if an incid… [[https://github.com/advthreat/iroh/pull/9172][#9172]] +- XDR-1769: bump CTIM to 1.3.17. [[https://github.com/advthreat/iroh/pull/9226][#9226]] +- Reformat bucket path [[https://github.com/advthreat/iroh/pull/9102][#9102]] +- Save to s3 on bundle import. [[https://github.com/advthreat/iroh/pull/8977][#8977]] +- Replace CTIA Crud with Conure Calls [[https://github.com/advthreat/iroh/pull/8924][#8924]] +- Limit risk score [[https://github.com/advthreat/iroh/pull/8906][#8906]] +- Set Limits around observe targets call [[https://github.com/advthreat/iroh/pull/8910][#8910]] +- Add no-doc true and prevent explosion due to mismatched types. [[https://github.com/advthreat/iroh/pull/8548][#8548]] +**** tenzin-config [14] + +- Failure to configure correct url. [[https://github.com/advthreat/tenzin-config/pull/1100][#1100]] +- These were flipped in TEST and we would like to test reports. [[https://github.com/advthreat/tenzin-config/pull/1094][#1094]] +- One more time see if the report tab will work. [[https://github.com/advthreat/tenzin-config/pull/1088][#1088]] +- Toggle report feature until Infrastructure is stable. [[https://github.com/advthreat/tenzin-config/pull/1086][#1086]] +- update config. [[https://github.com/advthreat/tenzin-config/pull/1080][#1080]] +- Report in test. [[https://github.com/advthreat/tenzin-config/pull/1076][#1076]] +- conure -> base-url. [[https://github.com/advthreat/tenzin-config/pull/1073][#1073]] +- Temporary flip this to not spam logs. [[https://github.com/advthreat/tenzin-config/pull/1069][#1069]] +- Output buckets. [[https://github.com/advthreat/tenzin-config/pull/1068][#1068]] +- Distributor and Conure configs. [[https://github.com/advthreat/tenzin-config/pull/1067][#1067]] +- Add base-url for incident export (and incident report). [[https://github.com/advthreat/tenzin-config/pull/1064][#1064]] +- Add playbook to conure configs. [[https://github.com/advthreat/tenzin-config/pull/1060][#1060]] +- Add ouath2 config for all regions. [[https://github.com/advthreat/tenzin-config/pull/1020][#1020]] +- Playbook automation config. [[https://github.com/advthreat/tenzin-config/pull/1037][#1037]] + +*** Yurii Ivanisenko [1] + +**** tenzin-config [1] + +- tactical-portal moved to vercel [[https://github.com/advthreat/tenzin-config/pull/1022][#1022]] + +*** James Brock [1] + +**** easy-purescript-nix [1] + +- purs: 0.15.10 -> 0.15.15 + +*** ryemelia [9] + +**** tenzin-config [9] + +- XDRSRE-1370: Enable ES auth for staging-ctia service [[https://github.com/advthreat/tenzin-config/pull/1147][#1147]] +- XDRSRE-1370: Enable ES auth for ctia and private-ctia [[https://github.com/advthreat/tenzin-config/pull/1145][#1145]] +- XDRSRE-1155: Enable ES auth iroh/iroh-async all envs [[https://github.com/advthreat/tenzin-config/pull/1137][#1137]] +- XDRSRE-1150: [TEST] Enable ES auth iroh/iroh-async [[https://github.com/advthreat/tenzin-config/pull/1128][#1128]] +- Enable ES auth private-ctia TEST [[https://github.com/advthreat/tenzin-config/pull/1126][#1126]] +- Enable es auth CTIA test [[https://github.com/advthreat/tenzin-config/pull/1127][#1127]] +- fix kafka connector ES AUTH for INT [[https://github.com/advthreat/tenzin-config/pull/1129][#1129]] +- Enable ES auth private-ctia INT [[https://github.com/advthreat/tenzin-config/pull/1125][#1125]] +- XDRSRE-1273: [INT] Enable ES auth for iroh iroh-async [[https://github.com/advthreat/tenzin-config/pull/1124][#1124]] diff --git a/reports/latest-weekly.html b/reports/latest-weekly.html index f2d53663..98b69631 100644 --- a/reports/latest-weekly.html +++ b/reports/latest-weekly.html @@ -4,8 +4,8 @@ - - Code Weekly Report 24 + + Code Weekly Report 10 + + + + +
+

Code Weekly Report 10

+

logs goes 2 weeks back

+

2024-03-12

+
+ +

IROH

+

lead

+

Guillaume Buisson [1]

+

ctia [1]

+
+

>1w

+
    +
  • [Tue Feb 27 11:10:21 2024 +0100] Filter out some infrastructure +details from Error API Responses #1412
    • +
+
+

data

+

Mario Aquino [2]

+

iroh [2]

+
+

>1w

+
    +
  • [Tue Feb 27 12:09:26 2024 -0600] Carmine & Timbre upgrade v2 #9005
    • +
  • [Tue Feb 27 11:40:01 2024 -0600] Loosen Risk Score Incident +validation #9013
    • +
+
+

Guillaume Erétéo [11]

+

ctia [3]

+
    +
  • [Mon Mar 11 11:11:26 2024 +0100] ctim 1.3.15 #1415
    • +
+
+

>1w

+
    +
  • [Fri Mar 1 12:51:13 2024 +0100] silent this too noisy log #1414
    • +
  • [Wed Feb 28 11:27:13 2024 +0100] ctim-1.3.14 #1413
    • +
+
+

iroh [6]

+
    +
  • [Mon Mar 11 17:59:02 2024 +0100] Add admin maintenance route to load +MITRE stix #8967
    • +
  • [Mon Mar 11 11:11:38 2024 +0100] ctim 1.3.15 #9068
    • +
+
+

>1w

+
    +
  • [Mon Mar 4 15:32:25 2024 +0100] limit walk entities to the necessary +exports #9039
    • +
  • [Wed Feb 28 11:27:18 2024 +0100] ctim 1.3.14 #9016
    • +
  • [Tue Feb 27 16:26:14 2024 +0100] Dump ES metrics telemetry events #8999
    • +
  • [Tue Feb 27 15:38:10 2024 +0100] script to clean SE false positive +incidents and sightings #8846
    • +
+
+

tenzin-config [2]

+
    +
  • [Wed Mar 6 14:56:11 2024 +0100] configure / tune private intel proxy +cm #1074
    • +
+
+

>1w

+
    +
  • [Mon Mar 4 13:12:02 2024 +0100] increase bundle-batch-size #1071
    • +
+
+

Ambrose Bonnaire-Sergeant [2]

+

iroh [2]

+
+

>1w

+
    +
  • [Thu Feb 29 15:08:33 2024 -0600] Restrict possible values for +updated asset properties #9022
    • +
  • [Tue Feb 27 12:57:41 2024 -0600] Don't forward response headers from +CTIA to IROH #9014
    • +
+
+

integrations

+

[0]

+

Kirill Chernyshov [6]

+

iroh [5]

+
    +
  • [Mon Mar 11 16:06:53 2024 +0100] Upgrade clojure 1.11.1 -> 1.11.2 +#9072
    • +
  • [Mon Mar 11 15:49:06 2024 +0100] Remove maintenance notification +type #9069
    • +
+
+

>1w

+
    +
  • [Thu Feb 29 18:38:25 2024 +0100] 8933 e8811 create +notificationindeliveryservice persistence only #9025
    • +
  • [Wed Feb 28 08:42:32 2024 -0800] "In App" -> "In-App" #9020
    • +
  • [Tue Feb 27 08:26:32 2024 -0800] Add correct :name and :description +to notification type meta #9012
    • +
+
+

tenzin-config [1]

+
+

>1w

+
    +
  • [Fri Mar 1 02:16:05 2024 -0800] Add new kafka topics for IROH +notifications #1070
    • +
+
+

Shafiq [7]

+

iroh [7]

+
    +
  • [Mon Mar 11 14:31:53 2024 +0100] Data retention cleanup of +notification services #9064
    • +
  • [Thu Mar 7 09:44:42 2024 +0100] Apply data retention policy on +iroh-notifications #9054
    • +
+
+

>1w

+
    +
  • [Mon Mar 4 18:19:59 2024 +0100] Add :remote type in +configuration spec fields #9046
    • +
  • [Fri Mar 1 14:05:52 2024 +0100] Refactor proxy-health-check #9033
    • +
  • [Thu Feb 29 17:24:20 2024 +0100] Update proxy-health-check logging +#9028
    • +
  • [Thu Feb 29 13:26:40 2024 +0100] Update proxy health check logging +#9024
    • +
  • [Thu Feb 29 10:50:00 2024 +0100] Perform relay-api request based on +observable-types #9017
    • +
+
+

auth

+

bartuka [4]

+

iroh [3]

+
    +
  • [Wed Mar 6 05:32:37 2024 -0300] [IROH Auth] update QA routes for +Universal Provisioning flow #9053
    • +
  • [Tue Mar 5 12:57:32 2024 -0300] [IROH Auth] Fix access token +brownfield provisioning #9049
    • +
+
+

>1w

+
    +
  • [Thu Feb 29 06:01:22 2024 -0300] [IROH Auth] bugfix - accept empty +string as entitlement value for universal provisioning #9021
    • +
+
+

tenzin-config [1]

+
+

>1w

+
    +
  • [Tue Feb 27 12:16:08 2024 -0300] add fmc client id for each env #1065
    • +
+
+

Yann Esposito [4]

+

iroh [2]

+
    +
  • [Tue Mar 12 07:43:49 2024 +0100] Update of the login doc #9067
    • +
+
+

>1w

+
    +
  • [Fri Mar 1 15:29:16 2024 +0100] optimize search user given a list of +ids #9018
    • +
+
+

iroh-scripts [1]

+
+

>1w

+
    +
  • [Mon Mar 4 18:27:15 2024 +0100] Updated scripts
    • +
+
+

xdr-provisioning [1]

+
    +
  • [Fri Mar 8 19:50:36 2024 +0100] improved re-onboarding script
    • +
+

[0]

+

(Yogsototh) [2]

+

iroh-scripts [1]

+
+

>1w

+
    +
  • [Mon Mar 4 18:27:15 2024 +0100] Updated scripts
    • +
+
+

xdr-provisioning [1]

+
    +
  • [Fri Mar 8 19:50:36 2024 +0100] improved re-onboarding script
    • +
+

iroh-ops

+

[0]

+

[0]

+

[0]

+

[0]

+

Other

+

Other

+

Robert Levy [1]

+

iroh [1]

+
+

>1w

+
    +
  • [Mon Mar 4 17:01:03 2024 -0800] Inherit properties from type in +hierarchical modules #9042
    • +
+
+

Eric Gierach [1]

+

tenzin-config [1]

+
    +
  • [Wed Mar 6 14:41:09 2024 -0600] Disabling reporting until Ops gets +the infra set up. #1075
    • +
+

II [2]

+

iroh [2]

+
    +
  • [Mon Mar 11 14:36:08 2024 -0500] 9074 remove settings effective #9075
    • +
  • [Tue Mar 5 08:08:24 2024 -0600] 8990 umbrella investigate v2 #9030
    • +
+

[2]

+

iroh [2]

+
    +
  • [Mon Mar 11 14:36:08 2024 -0500] 9074 remove settings effective #9075
    • +
  • [Tue Mar 5 08:08:24 2024 -0600] 8990 umbrella investigate v2 #9030
    • +
+

Sam Waggoner [1]

+

tenzin-config [1]

+
+

>1w

+
    +
  • [Thu Feb 29 10:19:20 2024 -0600] hydrant/912 add clean hashes +importer.
    • +
+
+

t2sw [1]

+

iroh [1]

+
+

>1w

+
    +
  • [Mon Mar 4 22:22:19 2024 -0800] add health endpoint to tac portal +and update tests #9002
    • +
+
+

Brooke Swanson [5]

+

tenzin-config [5]

+
    +
  • [Fri Mar 8 12:27:52 2024 -0600] Report in test. #1076
    • +
  • [Tue Mar 5 09:16:15 2024 -0600] conure -> base-url. #1073
    • +
+
+

>1w

+
    +
  • [Thu Feb 29 17:26:28 2024 -0600] Temporary flip this to not spam +logs. #1069
    • +
  • [Thu Feb 29 16:07:03 2024 -0600] Output buckets. #1068
    • +
  • [Thu Feb 29 15:28:53 2024 -0600] Distributor and Conure configs. #1067
    • +
+
+

James Brock [1]

+

easy-purescript-nix [1]

+
    +
  • [Mon Mar 11 21:52:49 2024 +0900] purs: 0.15.10 -> 0.15.15
    • +
+ + diff --git a/reports/weekly-10.org b/reports/weekly-10.org new file mode 100644 index 00000000..67bf9446 --- /dev/null +++ b/reports/weekly-10.org @@ -0,0 +1,278 @@ +#+title: Code Weekly Report 10 +#+subtitle: logs goes 2 weeks back +#+date: 2024-03-12 +#+options: H:6 +* IROH +** lead + + +*** Guillaume Buisson [1] + +**** ctia [1] + +#+BEGIN_QUOTE + +_>1w_ + +- [Tue Feb 27 11:10:21 2024 +0100] Filter out some infrastructure details from Error API Responses [[https://github.com/advthreat/ctia/pull/1412][#1412]] +#+END_QUOTE +** data + + +*** Mario Aquino [2] + +**** iroh [2] + +#+BEGIN_QUOTE + +_>1w_ + +- [Tue Feb 27 12:09:26 2024 -0600] Carmine & Timbre upgrade v2 [[https://github.com/advthreat/iroh/pull/9005][#9005]] +- [Tue Feb 27 11:40:01 2024 -0600] Loosen Risk Score Incident validation [[https://github.com/advthreat/iroh/pull/9013][#9013]] +#+END_QUOTE + +*** Guillaume Erétéo [11] + +**** ctia [3] + +- [Mon Mar 11 11:11:26 2024 +0100] ctim 1.3.15 [[https://github.com/advthreat/ctia/pull/1415][#1415]] +#+BEGIN_QUOTE + +_>1w_ + +- [Fri Mar 1 12:51:13 2024 +0100] silent this too noisy log [[https://github.com/advthreat/ctia/pull/1414][#1414]] +- [Wed Feb 28 11:27:13 2024 +0100] ctim-1.3.14 [[https://github.com/advthreat/ctia/pull/1413][#1413]] +#+END_QUOTE +**** iroh [6] + +- [Mon Mar 11 17:59:02 2024 +0100] Add admin maintenance route to load MITRE stix [[https://github.com/advthreat/iroh/pull/8967][#8967]] +- [Mon Mar 11 11:11:38 2024 +0100] ctim 1.3.15 [[https://github.com/advthreat/iroh/pull/9068][#9068]] +#+BEGIN_QUOTE + +_>1w_ + +- [Mon Mar 4 15:32:25 2024 +0100] limit walk entities to the necessary exports [[https://github.com/advthreat/iroh/pull/9039][#9039]] +- [Wed Feb 28 11:27:18 2024 +0100] ctim 1.3.14 [[https://github.com/advthreat/iroh/pull/9016][#9016]] +- [Tue Feb 27 16:26:14 2024 +0100] Dump ES metrics telemetry events [[https://github.com/advthreat/iroh/pull/8999][#8999]] +- [Tue Feb 27 15:38:10 2024 +0100] script to clean SE false positive incidents and sightings [[https://github.com/advthreat/iroh/pull/8846][#8846]] +#+END_QUOTE +**** tenzin-config [2] + +- [Wed Mar 6 14:56:11 2024 +0100] configure / tune private intel proxy cm [[https://github.com/advthreat/tenzin-config/pull/1074][#1074]] +#+BEGIN_QUOTE + +_>1w_ + +- [Mon Mar 4 13:12:02 2024 +0100] increase bundle-batch-size [[https://github.com/advthreat/tenzin-config/pull/1071][#1071]] +#+END_QUOTE + +*** Ambrose Bonnaire-Sergeant [2] + +**** iroh [2] + +#+BEGIN_QUOTE + +_>1w_ + +- [Thu Feb 29 15:08:33 2024 -0600] Restrict possible values for updated asset properties [[https://github.com/advthreat/iroh/pull/9022][#9022]] +- [Tue Feb 27 12:57:41 2024 -0600] Don't forward response headers from CTIA to IROH [[https://github.com/advthreat/iroh/pull/9014][#9014]] +#+END_QUOTE +** integrations + + +*** [0] + + +*** Kirill Chernyshov [6] + +**** iroh [5] + +- [Mon Mar 11 16:06:53 2024 +0100] Upgrade clojure 1.11.1 -> 1.11.2 [[https://github.com/advthreat/iroh/pull/9072][#9072]] +- [Mon Mar 11 15:49:06 2024 +0100] Remove maintenance notification type [[https://github.com/advthreat/iroh/pull/9069][#9069]] +#+BEGIN_QUOTE + +_>1w_ + +- [Thu Feb 29 18:38:25 2024 +0100] 8933 e8811 create notificationindeliveryservice persistence only [[https://github.com/advthreat/iroh/pull/9025][#9025]] +- [Wed Feb 28 08:42:32 2024 -0800] "In App" -> "In-App" [[https://github.com/advthreat/iroh/pull/9020][#9020]] +- [Tue Feb 27 08:26:32 2024 -0800] Add correct :name and :description to notification type meta [[https://github.com/advthreat/iroh/pull/9012][#9012]] +#+END_QUOTE +**** tenzin-config [1] + +#+BEGIN_QUOTE + +_>1w_ + +- [Fri Mar 1 02:16:05 2024 -0800] Add new kafka topics for IROH notifications [[https://github.com/advthreat/tenzin-config/pull/1070][#1070]] +#+END_QUOTE + +*** Shafiq [7] + +**** iroh [7] + +- [Mon Mar 11 14:31:53 2024 +0100] Data retention cleanup of notification services [[https://github.com/advthreat/iroh/pull/9064][#9064]] +- [Thu Mar 7 09:44:42 2024 +0100] Apply data retention policy on iroh-notifications [[https://github.com/advthreat/iroh/pull/9054][#9054]] +#+BEGIN_QUOTE + +_>1w_ + +- [Mon Mar 4 18:19:59 2024 +0100] Add ~:remote~ type in configuration spec fields [[https://github.com/advthreat/iroh/pull/9046][#9046]] +- [Fri Mar 1 14:05:52 2024 +0100] Refactor proxy-health-check [[https://github.com/advthreat/iroh/pull/9033][#9033]] +- [Thu Feb 29 17:24:20 2024 +0100] Update proxy-health-check logging [[https://github.com/advthreat/iroh/pull/9028][#9028]] +- [Thu Feb 29 13:26:40 2024 +0100] Update proxy health check logging [[https://github.com/advthreat/iroh/pull/9024][#9024]] +- [Thu Feb 29 10:50:00 2024 +0100] Perform relay-api request based on observable-types [[https://github.com/advthreat/iroh/pull/9017][#9017]] +#+END_QUOTE +** auth + + +*** bartuka [4] + +**** iroh [3] + +- [Wed Mar 6 05:32:37 2024 -0300] [IROH Auth] update QA routes for Universal Provisioning flow [[https://github.com/advthreat/iroh/pull/9053][#9053]] +- [Tue Mar 5 12:57:32 2024 -0300] [IROH Auth] Fix access token brownfield provisioning [[https://github.com/advthreat/iroh/pull/9049][#9049]] +#+BEGIN_QUOTE + +_>1w_ + +- [Thu Feb 29 06:01:22 2024 -0300] [IROH Auth] bugfix - accept empty string as entitlement value for universal provisioning [[https://github.com/advthreat/iroh/pull/9021][#9021]] +#+END_QUOTE +**** tenzin-config [1] + +#+BEGIN_QUOTE + +_>1w_ + +- [Tue Feb 27 12:16:08 2024 -0300] add fmc client id for each env [[https://github.com/advthreat/tenzin-config/pull/1065][#1065]] +#+END_QUOTE + +*** Yann Esposito [4] + +**** iroh [2] + +- [Tue Mar 12 07:43:49 2024 +0100] Update of the login doc [[https://github.com/advthreat/iroh/pull/9067][#9067]] +#+BEGIN_QUOTE + +_>1w_ + +- [Fri Mar 1 15:29:16 2024 +0100] optimize search user given a list of ids [[https://github.com/advthreat/iroh/pull/9018][#9018]] +#+END_QUOTE +**** iroh-scripts [1] + +#+BEGIN_QUOTE + +_>1w_ + +- [Mon Mar 4 18:27:15 2024 +0100] Updated scripts +#+END_QUOTE +**** xdr-provisioning [1] + +- [Fri Mar 8 19:50:36 2024 +0100] improved re-onboarding script + +*** [0] + + +*** (Yogsototh) [2] + +**** iroh-scripts [1] + +#+BEGIN_QUOTE + +_>1w_ + +- [Mon Mar 4 18:27:15 2024 +0100] Updated scripts +#+END_QUOTE +**** xdr-provisioning [1] + +- [Fri Mar 8 19:50:36 2024 +0100] improved re-onboarding script +** iroh-ops + + +*** [0] + + +*** [0] + + +*** [0] + + +*** [0] + +* Other +** Other + + +*** Robert Levy [1] + +**** iroh [1] + +#+BEGIN_QUOTE + +_>1w_ + +- [Mon Mar 4 17:01:03 2024 -0800] Inherit properties from type in hierarchical modules [[https://github.com/advthreat/iroh/pull/9042][#9042]] +#+END_QUOTE + +*** Eric Gierach [1] + +**** tenzin-config [1] + +- [Wed Mar 6 14:41:09 2024 -0600] Disabling reporting until Ops gets the infra set up. [[https://github.com/advthreat/tenzin-config/pull/1075][#1075]] + +*** II [2] + +**** iroh [2] + +- [Mon Mar 11 14:36:08 2024 -0500] 9074 remove settings effective [[https://github.com/advthreat/iroh/pull/9075][#9075]] +- [Tue Mar 5 08:08:24 2024 -0600] 8990 umbrella investigate v2 [[https://github.com/advthreat/iroh/pull/9030][#9030]] + +*** [2] + +**** iroh [2] + +- [Mon Mar 11 14:36:08 2024 -0500] 9074 remove settings effective [[https://github.com/advthreat/iroh/pull/9075][#9075]] +- [Tue Mar 5 08:08:24 2024 -0600] 8990 umbrella investigate v2 [[https://github.com/advthreat/iroh/pull/9030][#9030]] + +*** Sam Waggoner [1] + +**** tenzin-config [1] + +#+BEGIN_QUOTE + +_>1w_ + +- [Thu Feb 29 10:19:20 2024 -0600] hydrant/912 add clean hashes importer. +#+END_QUOTE + +*** t2sw [1] + +**** iroh [1] + +#+BEGIN_QUOTE + +_>1w_ + +- [Mon Mar 4 22:22:19 2024 -0800] add health endpoint to tac portal and update tests [[https://github.com/advthreat/iroh/pull/9002][#9002]] +#+END_QUOTE + +*** Brooke Swanson [5] + +**** tenzin-config [5] + +- [Fri Mar 8 12:27:52 2024 -0600] Report in test. [[https://github.com/advthreat/tenzin-config/pull/1076][#1076]] +- [Tue Mar 5 09:16:15 2024 -0600] conure -> base-url. [[https://github.com/advthreat/tenzin-config/pull/1073][#1073]] +#+BEGIN_QUOTE + +_>1w_ + +- [Thu Feb 29 17:26:28 2024 -0600] Temporary flip this to not spam logs. [[https://github.com/advthreat/tenzin-config/pull/1069][#1069]] +- [Thu Feb 29 16:07:03 2024 -0600] Output buckets. [[https://github.com/advthreat/tenzin-config/pull/1068][#1068]] +- [Thu Feb 29 15:28:53 2024 -0600] Distributor and Conure configs. [[https://github.com/advthreat/tenzin-config/pull/1067][#1067]] +#+END_QUOTE + +*** James Brock [1] + +**** easy-purescript-nix [1] + +- [Mon Mar 11 21:52:49 2024 +0900] purs: 0.15.10 -> 0.15.15 diff --git a/roam/org-roam 2.db-journal b/roam/org-roam 2.db-journal deleted file mode 100644 index 419ef6cd..00000000 Binary files a/roam/org-roam 2.db-journal and /dev/null differ diff --git a/roam/org-roam 3.db-journal b/roam/org-roam 3.db-journal deleted file mode 100644 index 72e63613..00000000 Binary files a/roam/org-roam 3.db-journal and /dev/null differ diff --git a/roam/org-roam 4.db-journal b/roam/org-roam 4.db-journal deleted file mode 100644 index 7ea9d5eb..00000000 Binary files a/roam/org-roam 4.db-journal and /dev/null differ diff --git a/roam/org-roam 5.db-journal b/roam/org-roam 5.db-journal deleted file mode 100644 index 7d89b82e..00000000 Binary files a/roam/org-roam 5.db-journal and /dev/null differ diff --git a/roam/org-roam 6.db-journal b/roam/org-roam 6.db-journal deleted file mode 100644 index 9908cb28..00000000 Binary files a/roam/org-roam 6.db-journal and /dev/null differ diff --git a/roam/org-roam 7.db-journal b/roam/org-roam 7.db-journal deleted file mode 100644 index 7db592a7..00000000 Binary files a/roam/org-roam 7.db-journal and /dev/null differ diff --git a/roam/org-roam 8.db-journal b/roam/org-roam 8.db-journal deleted file mode 100644 index 5c57c521..00000000 Binary files a/roam/org-roam 8.db-journal and /dev/null differ diff --git a/tracker.org b/tracker.org index a13645a0..fa22396c 100644 --- a/tracker.org +++ b/tracker.org @@ -1,1734 +1,10 @@ - -* 2023 -** 2023-W26 -*** 2023-06-29 Thursday -**** CANCELED Investigate invite bug :work: -SCHEDULED: <2023-07-03 Mon 11:00> -:LOGBOOK: -- State "CANCELED" from "TODO" [2023-07-11 Tue 10:51] \\ - Whatever -:END: -[2023-06-29 Thu 11:06] - -https://github.com/advthreat/response/issues/1888 - -Deleted user-id c59db89d-212a-4a0c-92d0-ff1a2c7de25b -** 2023-W27 -*** 2023-07-04 Tuesday -**** MEETING 1-1 Wanderson :work:meeting: -:LOGBOOK: -CLOCK: [2023-07-04 Tue 16:04]--[2023-07-04 Tue 16:33] => 0:29 -:END: -[2023-07-04 Tue 16:04] -***** Agenda (to discuss about) -- Provisioning - - PIAM status - - Orbital/Single SE status -- RBAC status -- offsite -***** Notes -***** Actions -- create a backlog of technical work to do -*** 2023-07-05 Wednesday -**** DONE Cleanup all "TO DELETE" entities :work: -SCHEDULED: <2023-07-28 Fri 11:00> -[2023-07-05 Wed 19:51] -*** 2023-07-06 Thursday -**** CANCELED Remove ability to create new Org :work: -SCHEDULED: <2023-07-06 Thu> -:LOGBOOK: -- State "CANCELED" from "TODO" [2023-07-11 Tue 10:52] \\ - Whatever -:END: -[2023-07-06 Thu 16:19] -** 2023-W28 -*** 2023-07-11 Tuesday -**** DONE IROH Sync :work: -SCHEDULED: <2023-07-11 Tue 17:00> -[2023-07-11 Tue 10:49] -**** DONE IROH-Auth weekly :work: -SCHEDULED: <2023-07-11 Tue 16:35> -[2023-07-11 Tue 10:49] -**** DONE 1-1 Wanderson :work: -SCHEDULED: <2023-07-11 Tue 16:05> -[2023-07-11 Tue 10:49] -**** DONE 1-1 Olivier :work: -SCHEDULED: <2023-07-11 Tue 15:35> -[2023-07-11 Tue 10:48] -**** DONE Lead Weekly :work: -SCHEDULED: <2023-07-11 Tue 15:00> -[2023-07-11 Tue 10:48] -**** DONE Provide doc to Guy Mackenzy :work: -SCHEDULED: <2023-07-11 Tue 11:30> -[2023-07-11 Tue 10:13] -**** DONE Create Entitlement Presentation :work: -SCHEDULED: <2023-07-11 Tue 10:30> DEADLINE: <2023-07-12 Wed 15:00> -[2023-07-11 Tue 10:12] -*** 2023-07-12 Wednesday -**** DONE Make enterprise_id mandatory field for PIAM endpoints :work: -DEADLINE: <2023-07-12 Wed 18:00> SCHEDULED: <2023-07-12 Wed> -[2023-07-12 Wed 17:14] -**** MEETING Monetization first meeting :work:meeting: -:LOGBOOK: -CLOCK: [2023-07-12 Wed 16:07]--[2023-07-12 Wed 17:07] => 1:00 -:END: -[2023-07-12 Wed 16:07] -***** Notes - -tier -*** 2023-07-13 Thursday -**** DONE Review [[https://github.com/advthreat/iroh/pull/8043][[Olivier PR] Check IROH node start in test]] :work: -SCHEDULED: <2023-07-13 Thu> -[2023-07-13 Thu 12:11] -**** DONE Add enterprise_id to many orgs [[https://github.com/advthreat/securex-ui-shell/issues/297#issuecomment-1633099674][list here]] :work: -SCHEDULED: <2023-07-13 Thu 14:30> -[2023-07-13 Thu 12:06] -**** DONE Provide Q1 technical items :work: -DEADLINE: <2023-07-13 Thu 16:00> SCHEDULED: <2023-07-13 Thu> -[2023-07-13 Thu 11:57] - - -1. *IROH-Auth Testing Framework-Refactor*: - IROH-Auth passed through many different evolution phases and different refactor - tentatives. Most of them failed to achieve. - One of the result is that the tests are scattered, some should be removed - entirely. - Some test are very complex to understand, and still not - entirely migrated to the new better norm. - We reclaim some official time to fix that discrepancy in the code, because it - could either hide some bugs, or make development of certain features a lot - harder longer than expected. - - Main concrete ideas: - - improve DBFixture service, - - try to regroup tests details into the same test-file so a reader will not be - forced to dig between different files to understand what is going on. -2. *Developer Targeted documentation*. - Currently the descriptions of the APIs in Swagger UI lack of precision. - We could greatly improve the understanding of developer facing it by - adding examples, and cleaner content in swagger UI. -3. *IROH-Auth isolation* - A potential effort to think how we could improve the reliability and security - of IROH by isolating IROH-Auth from the rest of IROH. This question - was raised multiple times, but we do not have yet a definitive answer about what - would be an ideal solution. - - potentially, this could mean improving building time, and development time - by decoupling Auth from the more feature-oriented work. - - potentially, open new unexpected integration solution by having - iroh-auth-only specific nodes, and perhaps even, removing the IROH-Auth - service from other nodes entirely - - Seems like a natural "next-step" related to the work related to specific nodes. - -This one is more feature oriented as we know we will need this soon: - -4. *Token Exchange Service* - We need to produce a service that could provide the ability for an entity to - get access to other tokens. - To make this safe and useful, we need to go beyond the Token Exchange RFC and - consider how to build an access rule system, logging, and keep track of the - token chain. - So first take the time to have a clear understanding of the feature needed, - search and find a technical solution, and design the work to be done. - - We have a current working first example with the Account Switching. - We should extend this to improve Impersonation (for TAC and some Devs), - future work with PIAM, and open the door to other integration mechanisms. - -**** DONE Sustaining items for Q1 :work: -SCHEDULED: <2023-07-13 Thu 17:00> -[2023-07-13 Thu 11:56] - -** 2023-W29 -*** 2023-07-17 Monday -**** MEETING Deep dive XDR Monetization :work:meeting: -:LOGBOOK: -CLOCK: [2023-07-17 Mon 16:31]--[2023-07-17 Mon 17:31] => 1:00 -:END: -[2023-07-17 Mon 16:31] -***** Agenda (to discuss about) -***** Notes -- hide 3rd party modules to "Essentials" users -***** Actions -- Restrict via the API too -**** DONE Add scopes to Scott Burnettes orgs/clients? :work: -SCHEDULED: <2023-07-17 Mon 11:00> -[2023-07-17 Mon 08:58] -*** 2023-07-19 Wednesday -**** MEETING API Design Meeting :work:meeting: -:LOGBOOK: -CLOCK: [2023-07-19 Wed 18:47]--[2023-07-19 Wed 19:42] => 0:55 -:END: -[2023-07-19 Wed 18:47] -***** Agenda (to discuss about) -***** Notes -****** Data Retention - -How to delete private-intel events older than 90 days? -How to delete orgs data? - -Private Intel. - -Incidents related to other entities. -If we delete data older than 90 days? - -@Jyoti: if an incident is closed you can clear it. - -****** Deleting all data from an Org - -If no one logs for 90 days. We can delete it. -All users, modules, OAuth2 clients, etc… - -@Matthieu: do we send a warning email? - -@Jyoti: how to delete data in other components. -Send a notification. - -IROH Events for deletion. -Keep the main topic, and create sub-filtered topics. - -Order of deletion is important. - -1. Mark the Org as archived state (no login, only accessible through Cisco clients) -2. send notifications to all cisco components that need to cleanup -3. wait 1 week -4. real deletion - -Design doc. - -****** Monetization - -Lot of cases for upgrading. -In all these case, we do not have Entitlement. So no enforcement. - -****** Playbook retrieval API - -Read entities from public-intel, and UI call that API instead of a static file. -We had a design doc where we talked about this API. - -***** Actions -**** DONE API Design Meeting :work: -SCHEDULED: <2023-07-19 Wed 18:30> -[2023-07-19 Wed 14:36] -** 2023-W30 -*** 2023-07-25 Tuesday -**** DONE Retrieve the list of entities from IROH Auth :work: -SCHEDULED: <2023-07-25 Tue> -[2023-07-25 Tue 17:38] - -#+begin_src clojure -IROH-Auth - no entities dbs - "auth-codes" - "auth-requests" - "auth-responses" - "auth-login-filters" - "oauth-client-presets" - "oauth-code" - "oauth-csrf" - "oauth-device-grant-user-auth" - "oauth-grants" - "oauth-trusted-clients" - "revoked-jwt" - "revoked-entities" - -For Mark - "ao-bootstrap" - -For Matt: - - "amp-user-credentials" - "archived-module-instances" - "iroh-events" - "module-cache" - "module-instances" - "module-type-patches" - "module-types" - "notifications" - "sse-tenants" - "sse-users" - "tiles-cache" - "webhook-results" - "webhooks" - -Used By UI: - "iroh-registry" - -For GE: - - "ctia-investigate-talos-hunt" - "enrichment-status" - "feedback" - "incident-summary" - "iroh-async-sessions" - "private-intel-cache" - "risk-score" - "threat-hunt-status" -#+end_src - -**** DONE Ask Paul Cichonski about the quantity values :work: -SCHEDULED: <2023-07-25 Tue 19:00> -See data retention, should be 90, 180, 365. -What would be the value, how should I compute? - -SCHEDULED: <2023-07-25 Tue> -[2023-07-25 Tue 17:36] -**** MEETING XDR Monetization: XDR data retention :work:meeting: -:LOGBOOK: -CLOCK: [2023-07-25 Tue 16:31]--[2023-07-25 Tue 17:51] => 1:20 -:END: -[2023-07-25 Tue 16:31] -***** Agenda (to discuss about) - -- https://github.com/advthreat/iroh/issues/8135 -- https://ciscosecurity.aha.io/epics/SECUREX-E-897 - -Discuss Uses cases #1. - -***** Notes - -What happens when this user goes. -Clearing data in 90 days. - -Notion about when to delete data. - -- Create or update for device. -- Create for incident, sightings, relationships. -- Comment on Incident recent, can we delete the incident? - -***** Actions - -****** Ask @Paul about the add-on quantity value for data retention - -Data Retention is 90 days by default, add-on to go 180, or 365. -Need to sync with PIAM because these are not the values in the first doc. - -**** MEETING 1-1 Wanderson :work:meeting: -[2023-07-25 Tue 16:04] -***** Agenda (to discuss about) - -****** Things to handle during my vacations. -:LOGBOOK: -CLOCK: [2023-07-25 Tue 16:04]--[2023-07-25 Tue 16:31] => 0:27 -:END: - -1. P1: fix XDR bugs, quick improvements -2. Add ~insights~ scope for DI (take care of updating the client, perhaps fix the - issue with non existing root scope. Could potentially be a real improvement). -3. Add event on Entitlement change. Optionally configure a webhook for this - event, depend on the need. Check with Matt and Guy. -4. Perhaps: - - Disable Org creation if SX EOL is officially announced. - - [NO] improve provisioning script. Check if module exist before invoking /onboard - - work related to short tokens (expose a token-exchange route not the RFC - one, a simpler to use one). - -5. Think about exposed data structure to make every type of org explicit and - centralize the business logic to help the UI. - - Retrieve a full list of Org case: - - created via PIAM or not - - XDR-enabled? - - SX-enabled? - - Entitlements/no-Entitlement - - We should be able to give a field to the UI (and other teams) - so they know how to react. - - For example for Orbital-only or SE-only orgs, not sure if we will use SX or - XDR UI. - - Should we add an Org field like ~external-product-only-org? s/Bool~ - And if true, affect the scopes accordingly to ensure they could not use - neither SX nor XDR paid features. - -***** Notes - -****** Work on the Events for the Entitlements - -update problem. - -***** Actions -**** MEETING 1-1 Olivier :work:meeting: -:LOGBOOK: -CLOCK: [2023-07-25 Tue 15:05]--[2023-07-25 Tue 16:04] => 0:59 -:END: -[2023-07-25 Tue 15:05] -***** Agenda (to discuss about) - -****** Things to handle during my vacations. - -1. P1: fix XDR bugs, quick improvements -2. Add ~insights~ scope for DI (take care of updating the client, perhaps fix the - issue with non existing root scope. Could potentially be a real improvement). -3. Add event on Entitlement change. Optionally configure a webhook for this - event, depend on the need. Check with Matt and Guy. -4. Perhaps: - - Disable Org creation if SX EOL is officially announced. - - improve provisioning script. Check if module exist before invoking /onboard - - work related to short tokens (expose a token-exchange route not the RFC - one, a simpler to use one). - -5. Think about exposed data structure to make every type of org explicit and - centralize the business logic to help the UI. - - Retrieve a full list of Org case: - - created via PIAM or not - - XDR-enabled? - - SX-enabled? - - Entitlements/no-Entitlement - - We should be able to give a field to the UI (and other teams) - so they know how to react. - - For example for Orbital-only or SE-only orgs, not sure if we will use SX or - XDR UI. - - Should we add an Org field like ~external-product-only-org? s/Bool~ - And if true, affect the scopes accordingly to ensure they could not use - neither SX nor XDR paid features. - -***** Notes -***** Actions -**** DONE XDR Data Retention Policy Implementation Discussion :work: -SCHEDULED: <2023-07-25 Tue 16:30> -[2023-07-25 Tue 11:07] -**** DONE 1-1 Wanderson :work: -SCHEDULED: <2023-07-25 Tue 16:05> -[2023-07-25 Tue 11:06] -**** DONE 1-1 Olivier :work: -SCHEDULED: <2023-07-25 Tue 15:35> -[2023-07-25 Tue 11:00] -*** 2023-07-27 Thursday -**** DONE Message Equipe :work: -SCHEDULED: <2023-07-26 Wed 14:00> -[2023-07-27 Thu 11:45] - -- P1. (prob. 30%) XDR Bug fixes -- P1. (prob. 20%) Scott Burnette issue with the Provisioning API / OAuth2 clients -- P2. (prob. 10%) Help Jyoti with ~xdr-provisioning~ script -- P2. FY24Q1 Monetization: Prepare the PR for Disable Org Creation. -- P3. FY24Q1 Monetization: Entitlements Events; - Check with Matthieu before configuring a webhook for /Automation/ - (previously Orchestration, previously SXO, previsouly AO) as it - might not be necessary. -- P4. Dashboard https://github.com/orgs/advthreat/projects/7/views/9 - - [RBAC] ~insights~ scope + sync with DI team (Roman Eremin) - - (prob. 10%) [RBAC] if asked to prevent non-admin to create clients, - add ~admin~ to the scopes in the routes of the IROH Auth client web service. - - Config Simplification + Presentation for the team -- P4. *Universal Provisioning Flow* (PIAM want to rename themselve "Security Cloud"). -- P4. Designs - + New Org concepts that need to be exposed: - List the concepts we want to be exposed for each org. - - ~:xdr-enabled?/sx-enable?~ perhaps a single ~:enabled-products [:xdr :sx]~. - - ~piam-managed?~ etc… - - Notion of Product (XDR, SX, but also, visibility, Orbital, SE). - Effects on configuration, init of nodes, etc… - + Token Exchange (not the RFC). - We want to: - - Give the ability for someone with a JWT to generate another one with some - restrictions and complete tracking. - Restrictions by default: - - do not extend the :exp - - do not change user - - do not change org - Tracking: - - should be an ~act~ claim that could be recursive and we should take great - care of not making that grow. - It is ok not to have ~act~ in some cases like: - - Org switching - - format switching - because the real owner is always the same. - It is not ok to forget ~act~ if there is an impersonation involved. - Typically during provisioning, real impersonation, etc… - - Main difficulty; what is the correct data structure to represent rules of - allowed JWT exchanges. - -- Take care of asks that could leak internal abstractions: - - do not return the full list of allowed modules, IROH-Int will take care of - the filtering business rule. - - use scopes, not role to filter for permissions -- Sync with Matt with everything related to modules for Monetization. Not just - directly with Guy, Matt needs to know. - -**** CANCELED XDR-flag [[https://github.com/advthreat/response/issues/1906#issuecomment-1652405093][1906]] :work: -SCHEDULED: <2023-07-27 Thu 11:45> -:LOGBOOK: -- State "CANCELED" from "TODO" [2023-07-28 Fri 13:23] -:END: -[2023-07-27 Thu 11:30] - -*** 2023-07-28 Friday -**** MEETING Monthly Engineering :work:meeting: -:LOGBOOK: -CLOCK: [2023-07-28 Fri 18:01]--[2023-07-28 Fri 19:04] => 1:03 -:END: -[2023-07-28 Fri 18:01] -***** Agenda (to discuss about) -***** Notes -****** Operation - -@Gayan -Good release. -Pass it to John. Metrics. - -New hires: - -- @Vidun_Jayakody Automation -- @Geaog-Nokila_Pavlov - -@John: upgrade platform, thanks to @Adam - -****** QA - -@Houman: XDR finally in production. Thanks for the fixes. -Everything went pretty well. -Performance testing, everything went pretty well in TEST. -Documented in a wiki page. - -@Pujan_Trivedi: Thanks everyone for answering that quickly and efficiently. - -****** Service - -@GB People deliver XDR in my absence. - -****** Engine - -@Eric - -****** Integration - -@Mark - -****** UI Dar - -@Dar, thanks for @Jilian and ... -@Rekah refactoring. Lots of bug fixes. - -****** UI Sabrina - -- Congrats everyone. -- Code freeze for a while, so lot of bug fixes. -- Features been worked on. -- Search for relation. -- Configurable layout. -- Performance improvements. -- Lucas, bunch of telementry -- Miroslav, incident breadcrumb. -- Advance table. - -****** Documentation @Mary - - -****** Demos - -@Scott_McLeod incident report - -@Mike next time. - -@Sam_Waggoner - - -***** Actions -**** DONE Monthly Engineering Meeting :work: -SCHEDULED: <2023-07-28 Fri 18:00> -[2023-07-28 Fri 11:34] -**** DONE Answer Namrata :work: -SCHEDULED: <2023-07-28 Fri> -[2023-07-28 Fri 10:20] - -I am not sure about the amount of money. -But, if this is Clojurist Together, I can give more precise answer. -Looking here: https://www.clojuriststogether.org/projects/ - -I can attest that our team intensively uses: - -- Bozhidar work (he develop cider, and most of us use it everyday, and I know he - maintain and update the work) -- Michiel Borkent (he develop babashka which we also use daily to write scripts - that are easier to write. And he is also very active) -- Tommi Reiman, our API uses compojure-api and lot of his related libraries. - Even if this is very stable, he continues to work on libraries that we could - potentially use to improve part of our internal system, like provide a better - documentation for developer about the expectation of our routing. -- Peter Taoussanis, we use his redis and timber lib (so DB access + logs) - -And looking at funded projects here are the one we use every day: - -- cider (daily in our editor) -- clj-kondo (in our editor for writing code + used in our CI) -- clj-http (this is an essential lib we use to call other APIs) -- babashka / SCI (daily + used in our CI + used for admin tasks) -- clojure-lsp (used daily in our editor) -- dependabot (used daily in our CI) - -To me it seems we have interrest in contributing back to the open source Clojure community. -Not only it improve the maintenance quality of essential libs to our -architecture but it also helps during hiring. -Now, regarding how much we should give, this probably depend a lot of our -current budget. -** 2023-W33 -*** 2023-08-16 Wednesday -**** MEETING Data Deletion for Privacy :work:meeting: -:LOGBOOK: -CLOCK: [2023-08-16 Wed 18:02]--[2023-08-17 Thu 17:59] => 23:57 -:END: -[2023-08-16 Wed 18:02] -***** Agenda (to discuss about) -??? -***** Notes -@Prerna: XDR Data Deletion spreadsheet still in progress. -@Petr: start without X -background standardize for deletion policy. -When do we remove the registration info. -45 days post licence expiration. -storage archive. -We need to make some solid statement on deletion. -Review what we have for SCA, and do the same for XDR. - -@Jake_Wyzgoski: I don't know what we do -@Derrell_Winder: Let me check -@Jake: describe to see if it align? -@Chris_Duane: it is product by product. I haven't seen anything implementing -that would stop a user to use after their license expires. - -@Yann: we don't even have a clear idea about what occurs after license expires. -Current state, you can still use XDR with reduced access. - -@Chris_Duane: not aware to any plan. - -@Peter: this is the first discussion about it. -Data retention, etc… Is there any establish best practice policy to follow? -License has expires. - -@Jake: we need to check if 45 days is the right time or something better. - -@Y: we should probably centralize this question to PIAM. - -@Chris: I feel finding a standard retention. - -@Peter: deletion when we want, we say, during the year. - -@Prerna: default for inactivity. nobody login for 90 days then delete. - -@Y: Legal? I think it's delete on demand, and for sale, you can recover your -account for N days, after that, you are not guaranteed to have your previous data back. - -@Peter: word the think with, either the user ask for deletion or no real policy. - -@Michael_Schultz: SCA keep lot of data beyond retention policy. So it cost money. - -@Chris_Duane: Talk about exceptions. - -@Petr: from a legal what is our obligation what should we say? - -@Derrell_Winder: not a concern for me. -- On-request mandatory -- 45 days? - -@Petr: What do you keep? Or is it about everyting? -Took a wording from SCA back to start from scratch. - -@Chris: PIAM not sure what the plan is. - -@Derrell_Winder: what does this 14 month refers to? (in the Data sheet) - -@Petr: regroup back to finalize the PDS and - -***** Actions -??? -**** DONE Answer to Brandon :work: -SCHEDULED: <2023-08-16 Wed> -[2023-08-16 Wed 10:10] -*** 2023-08-17 Thursday -**** MEETING PIAM Universal API (SCIM) :work:meeting: -:LOGBOOK: -CLOCK: [2023-08-17 Thu 17:59]--[2023-08-18 Fri 12:16] => 18:17 -:END: -[2023-08-17 Thu 17:59] -***** Agenda (to discuss about) -How is it helping us to do this. -***** Notes - -@Paul: UI flow. We can do that for XDR. -2nd part, Universal Flow, standardize the flow. -Suite became a thing, some more than just XDR. - -Existing tenants. Unrelated. - -@Prerna: Brianna expect that universal does not support brown field customers. - -@Paul: she talked to Travis. We have this notion to provide any kind of meta-data. -We can collect answers to the XDR API. - -@Yann: risk about the body to send. - -@Prerna: what about adding values from customer questions. -Does this working. - -@Paul: Developing right now. - -@Prerna: we probably need the UI... Enforcing - -@Paul: Offer basis, XDR is sold right now is to an offer called "XDR SSE" hidden -flow. Suite is a completely different offer and pids. Suite is using our UI base flow. -They'll see XDR as one of the thing they could buy. Only for NAM. - -@Prerna: US only right now for PIAM. - -@Paul: Brit Suite from XDR side nothing change. - -@Prerna: For the brit suite, the universal PIAM API is what is sending info to IROH. - -***** Actions - -*** 2023-08-18 Friday -**** IN-PROGRESS Fix SE Clients :interruption:work: -:LOGBOOK: -CLOCK: [2023-08-18 Fri 12:16]--[2023-08-18 Fri 23:47] => 11:31 -:END: -[2023-08-18 Fri 12:16] -** 2023-W34 -*** 2023-08-21 Monday -**** MEETING Monetization :work:meeting: -:LOGBOOK: -CLOCK: [2023-08-21 Mon 16:06]--[2023-08-21 Mon 16:36] => 0:30 -:END: -[2023-08-21 Mon 16:06] -***** Agenda (to discuss about) -***** Notes -***** Actions - -- [ ] Provide a doc about the new APIs for entitlements for devs. -*** 2023-08-23 Wednesday -**** MEETING API Design Meeting :work:meeting: -:LOGBOOK: -CLOCK: [2023-08-23 Wed 18:34]--[2023-08-24 Thu 16:02] => 21:28 -:END: -[2023-08-23 Wed 18:33] -***** Agenda (to discuss about) -***** Notes - -****** 3rd party integrations (Ian's team) - -@Jyoti: - Jyoti preview problem with data quality. - PIAM want to go full speed, with 3rd party integrations they are going to support. - Ian not very diligent, just copy/pasting rolling new integrations. - Don't go with the logic. - Finally, peer-review. - - QA does not know what to test. - Configuration issues with the modules. - - Whatever we do, we should have a check-list for review. - What data included, proper targets, relations. - Tactics as we need, etc… - -@Guillaume: we gave advise but we never reviewed the code -@Matt: no process to review the content of 3rd party modules. -Documentation is a bit messy. Nothing is currently in place. - -@Jyoti: I've been asking Namarata to add this process to check integration quality. - -***** Actions - - -**** MEETING Data Retention bi-weekly :work:meeting: -:LOGBOOK -CLOCK: [2023-08-23 Wed 18:00]--[2023-08-23 Wed 18:34] => 0:34 -:END: -[2023-08-23 Wed 18:00] -***** Agenda (to discuss about) -***** Notes - -- doc from Yann -- discussion about 365 vs 90 for deletion. - -XDR going back to SX - -***** Actions -**** CHAT Help Prerna answer question for SE :work:chat: -[2023-08-23 Wed 17:56] -**** CHAT Give master perm to Wanderson :work:chat: -[2023-08-23 Wed 17:56] -**** CHAT Help Rekha call /token :work:chat: -:LOGBOOK: -CLOCK: [2023-08-23 Wed 17:46]--[2023-08-23 Wed 18:00] => 0:14 -:END: -[2023-08-23 Wed 17:55] -**** CANCELED Nominate Recognitions :work: -SCHEDULED: <2023-08-24 Thu 10:00> -:LOGBOOK: -- State "CANCELED" from "TODO" [2023-09-06 Wed 18:21] -:END: -[2023-08-23 Wed 17:49] -**** DONE Write Issue for SE :work: -SCHEDULED: <2023-08-23 Wed 16:30> -[2023-08-23 Wed 16:01] -*** 2023-08-24 Thursday -**** MEETING Team meeting :work:meeting: -[2023-08-24 Thu 16:34] -***** Agenda (to discuss about) -***** Notes -***** Actions -**** MEETING Monetization :work:meeting: -:LOGBOOK: -CLOCK: [2023-08-24 Thu 16:02]--[2023-08-24 Thu 21:33] => 5:31 -:END: -[2023-08-24 Thu 16:02] -***** Notes -@Guillaume: tour of the team. -@Matt: -@Y: - -- Made a Doc to help devs using the Entitlements -- Asked to support an SCIM-like API to help provision from PIAM. - I consider this as low-priority for now. - - We will need that API to support external tokens (from PIAM) - - We will need to support asynchronous call - - We also need to adapt the data structure, update the users data and - potentially meta datas to apply to external onboardings. -- Asked to create many Orgs for dev purposes, so created a few personal scripts. -- Olivier discovered a potential bug with the webhook JWT generated. -- Webhooks needs to be configured by Wanderson -- Jillian asked to improve one profile endpoint to support more metas infos -- I am in a conversation to help UI support neverending session for dashboards - via refresh tokens. -- Yuri from DI asked to be able to support client creation via UI with - read-only. I feel we should probably provide an improved API with the full - tree-structure of the exhaustive scopes. But UX should be involved in my opinion. -- Olivier worked on a very promissing API to simplify how we create svc-helpers. - -@Mario: - -- Ambrose memory fix. in Schema creating a memory leak. -- Ambrose merge a patch endpoint for bundle update -- Mario merged a PR that fix a feature -- Mario yesterday message from Brian Mallony, high impact incident, Threat - hunting, Talos blog post weekly. And we create indicators. - Brian created sightings, that weren't yield. - Reach out to Michael Simonson. - Something has changed in Talos team post. The sighting didn't yield incident. - Not sure why the incident hadn't been created. - Discovery; one and only one incident created specificly for Talos since July - the 10th. - There is something with the Talos Threat Hunt. - Only for Talos Blogpost Hunt. - -@Patrick: - -Datadog check, false error. Google returns 500 error. - -Questions: - -@Olivier: is the Ambrose fix in PROD? -I have concern about the timber logs. - -@Matt: Mario, work of Ambrose, with the Patch bundle. -Kirill added some event when an incident is updated. -Ambrose did not query the same in the patch bundle. -@Mario: I will mention that to him today. - -***** Actions -:LOGBOOK: -:END: - -** 2023-W36 -#+BEGIN: clocktable :scope subtree :maxlevel 4 :timestamp nil :link nil :tags t :narrow 36! :match "work" -#+CAPTION: Clock summary at [2023-09-11 Mon 10:51] -| Tags | Headline | Time | | | | -|---------------+----------------------------+----------+----------+----------+----------| -| | *Total time* | *1d 22:17* | | | | -|---------------+----------------------------+----------+----------+----------+----------| -| | \_ 2023-W36 | | 1d 22:17 | | | -| | \_ 2023-09-05 Tuesday | | | 3:06 | | -| work, meeting | \_ Weekly Team | | | | 1:32 | -| work, meeting | \_ Weekly Leads | | | | 1:34 | -| | \_ 2023-09-06 Wednesday | | | 1d 19:11 | | -| work, meeting | \_ API Design Meeting | | | | 1d 17:11 | -| work, meeting | \_ FMC Plan with Paul | | | | 2:00 | -#+END: - -*** 2023-09-05 Tuesday -:LOGBOOK: -:END: -**** MEETING Weekly Team :work:meeting: -:LOGBOOK: -CLOCK: [2023-09-05 Tue 17:03]--[2023-09-05 Tue 18:35] => 1:32 -:END: -[2023-09-05 Tue 17:03] -***** Agenda (to discuss about) -***** Notes -***** Actions -**** MEETING Weekly Leads :work:meeting: -:LOGBOOK: -CLOCK: [2023-09-05 Tue 15:16]--[2023-09-05 Tue 16:50] => 1:34 -:END: -[2023-09-05 Tue 15:16] -***** Agenda (to discuss about) -****** Offsite -Semaine du 9 octobre. -***** Notes -***** Actions -**** DONE Leads Meeting :work: -SCHEDULED: <2023-09-05 Tue 15:00> -:PROPERTIES: -:Effort: 1:00 -:END: -[2023-09-05 Tue 10:36] -*** 2023-09-06 Wednesday -**** MEETING API Design Meeting :work:meeting: -:LOGBOOK: -CLOCK: [2023-09-06 Wed 18:31]--[2023-09-08 Fri 11:42] => 41:11 -:END: -[2023-09-06 Wed 18:31] -***** Agenda (to discuss about) -IROH as a common service - -CSC, and DI will move in Secure Cloud access. - -How to reuse the UI, how to continu to make this function. -CSC. -They also need to talk to SE, other cisco integrations. - -DI need to talk to all other integrations. - -What happens to our modules. - -Thinking about IROH and a few of its services, IROH headless. - -See proposal: - -https://github.com/advthreat/response/pull/2026 - - - -***** Notes -***** Actions -**** MEETING FMC Plan with Paul :work:meeting: -:LOGBOOK: -CLOCK: [2023-09-06 Wed 16:31]--[2023-09-06 Wed 18:31] => 2:00 -:END: -[2023-09-06 Wed 16:31] -***** Agenda (to discuss about) -***** Notes -***** Actions -*** 2023-09-08 Friday -**** DONE Check Client [[webexteams://im?space=b5136a40-6687-11ed-9679-4b10798d7c1a&message=722b1960-4dc4-11ee-9508-fba85c9bfccf][Webex]] :work: -SCHEDULED: <2023-09-08 Fri 14:00> -:LOGBOOK: -CLOCK: [2023-09-08 Fri 11:42]--[2023-09-08 Fri 13:12] => 1:30 -:END: -[2023-09-08 Fri 11:42] -** 2023-W37 -*** 2023-09-11 Monday -**** DONE Avance on Org Level Clients :work: -SCHEDULED: <2023-09-12 Tue 14:00> -[2023-09-11 Mon 20:57] -**** MEETING 1-1 Jyoti Yann :work:meeting: -:LOGBOOK: -CLOCK: [2023-09-11 Mon 19:28]--[2023-09-12 Tue 00:36] => 5:08 -:END: -[2023-09-11 Mon 19:28] -***** Agenda (to discuss about) -??? -***** Notes -Didi discussion, another discussion source. -Need to figure out, DI, etc… - -Sequence Diagrams. - -To talk: - signing keys from OKTA - -***** Actions - -- Advance on Org leve clients. - - fix https://github.com/advthreat/iroh/issues/7582 - - plan to update the client to use virtual -**** DONE Envoyer une liste d'amin par org [[https://github.com/Cisco-PosaaS/oak/issues/8664][Issue]] [[webexteams://im?space=b5136a40-6687-11ed-9679-4b10798d7c1a&message=11a76c20-5098-11ee-9e49-49fc7799be2b][Yuri]] :work: -SCHEDULED: <2023-09-12 Tue 11:00> -[2023-09-11 Mon 19:00] -**** DONE Envoyer les org-id à conserver (OAuth2 clients, master users) à Petr :work: -SCHEDULED: <2023-09-12 Tue 10:30> -[2023-09-11 Mon 18:59] -**** DONE Answer to [[webexteams://im?space=b5136a40-6687-11ed-9679-4b10798d7c1a&message=2298ba80-507e-11ee-a39b-619063280a9c][Yuri]] :work: -SCHEDULED: <2023-09-11 Mon 11:30> -:LOGBOOK: -CLOCK: [2023-09-11 Mon 11:02]--[2023-09-11 Mon 19:00] => 7:58 -:END: -[2023-09-11 Mon 11:02] -*** 2023-09-12 Tuesday -**** MEETING 1-1 Wanderson meeting :work:meeting: -:LOGBOOK: -CLOCK: [2023-09-12 Tue 16:34]--[2023-09-13 Wed 08:20] => 15:46 -:END: -[2023-09-12 Tue 16:34] -***** Agenda (to discuss about) -Reviewing -https://github.com/advthreat/iroh/pull/8300/files?short_path=fd98974#diff-fd98974c31ef730c3067abab7684e51eb6be875ee368a148d1ab660d832e5abc -***** Notes -***** Actions -****** TODO Create a new full description about JWKSService. - - - ~cache-jwks~: - - perform the call to the JWKS server and if successful update PG (if needed) - - the PG should contain: - - details about JWKS payload - - prepare a RAM (service context) public key from the JWKS payload - - ~get-jwks~: you only check the RAM service context - Returns a hashmap indiced with ~kid~ and values should be public keys. - If fails: ~(log/WARN )~ : either an attack or the JWKS updated For OPS Please - RESTART THE NODES!!!!. - - ~check-jwt-signature~: - 1. decode JWT - 2. get kid - 3. retrieve kid from ~(get (get-jwts) kid)~ - 4. Check signature - - ~validate-claims~: - 1. decode JWT - 2. check ~aud~ and ~exp~ - -****** TODO The doc does not say if fields are mandatory or not. -Which one are mandatory? - -Example: https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/provisioning/common-provisioning/apireference/Models/Entitlement.md - -And more precisely: - -https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/provisioning/common-provisioning/apireference/Models/Tenant.md - -*** 2023-09-13 Wednesday -**** MEETING Monetization :work:meeting: -:LOGBOOK: -CLOCK: [2023-09-13 Wed 19:30]--[2023-09-13 Wed 21:15] => 1:45 -:END: -[2023-09-13 Wed 19:30] -***** Agenda (to discuss about) -***** Notes -***** Actions -*** 2023-09-14 Thursday -**** MEETING Monetization Demo :work:meeting: -:LOGBOOK: -CLOCK: [2023-09-14 Thu 16:31]--[2023-09-14 Thu 17:25] => 0:54 -:END: -[2023-09-14 Thu 16:31] -***** Agenda (to discuss about) -***** Notes -***** Actions -** 2023-W38 -*** 2023-09-19 Tuesday -**** MEETING Weekly Team Meeting :work:meeting: -[2023-09-19 Tue 17:02] -***** IROH-Auth -- Talk about DI virtual users -- Progress on Universal Provisioning API (interesting Engineering challenges) -- Talk with Automation about Org virtual users -***** Notes -- Offsite - -**** MEETING 1-1 Wanderson :work:meeting: -:LOGBOOK: -CLOCK: [2023-09-19 Tue 16:13]--[2023-09-19 Tue 17:54] => 1:41 -:END: -[2023-09-19 Tue 16:13] -***** Agenda (to discuss about) -***** Notes -***** Actions -****** Questions for PIAM -******* TODO Do you send a different URL for every provisioning call? Or is the URL fixed and should be configured? - -**** DONE Prepare Automation Meeting (Org virtual user) :work: -SCHEDULED: <2023-09-19 Tue> -[2023-09-19 Tue 10:05] - -Why Org Virtual User? -https://github.com/Cisco-PosaaS/oak/issues/8664#issuecomment-1717653336 - -Why not "main Admin" of the Org? -Some admin could individually have different permissions and properties that -might not be something we'd like to provide the to clients. - -Changes? - -None, nothing changed. The email could be filled with something that was not an -email for very old accounts, but this claim was never mandatory. -You just got lucky every JWT had an email. -See: https://visibility.amp.cisco.com/iroh/doc/iroh-auth/index.html -Where ~email~ is explicitly marked as "optional". - -Short Tokens? - -Where ~email~ are removed from the claims. -We keep only: - -- "iss" -- "iat" -- "exp" -- "nbf" -- "jti" -- "aud" -- "sub" -- "https://schemas.cisco.com/iroh/identity/claims/format" -- "https://schemas.cisco.com/iroh/identity/claims/user/id" -- "https://schemas.cisco.com/iroh/identity/claims/org/id" -- "https://schemas.cisco.com/iroh/identity/claims/oauth/refresh-token-jti" -- "https://schemas.cisco.com/iroh/identity/claims/oauth/client/id" -- "https://schemas.cisco.com/iroh/identity/claims/oauth/user/id" -- "https://schemas.cisco.com/iroh/identity/claims/oauth/client/owner/id" -- "https://schemas.cisco.com/iroh/identity/claims/oauth/grant" -- "https://schemas.cisco.com/iroh/identity/claims/oauth/kind" - -In particular, no ~scope~, no ~email~, no ~user name~, etc… - -*** 2023-09-20 Wednesday -**** MEETING API Design Meeting :work:meeting: -:LOGBOOK: -CLOCK: [2023-09-20 Wed 18:29]--[2023-09-20 Wed 21:09] => 2:40 -:END: -[2023-09-20 Wed 18:29] - -Offsite: - -@Jyoti: - High level vision, XDR: - - AI team on top of the incident manager. - - MDR requirements - - Wednesday afternoon - -***** G2 - -Telemetry. -@Gbuisson: give them access to data. - -***** Yann status update - -- lot of work related to the design of Universal Provisioning API with Wanderson. - - Planned a new meeting next week with PIAM and SCA to check the design. - - New design implies many changes, (expect at least 4 release cycles): - - support PIAM tokens but also understand how to check them securely (for - now this is not clear) - - support worker run on constant interval that would run on a single instance. - - support lock. -- SE, SX-only provisioning with 0-click module setup support (https://github.com/advthreat/iroh/issues/8266) - blocked work related to SE provisioning, waiting for PR approval. Still no - ping from SE team yet. (https://github.com/advthreat/iroh/pull/8275) - - talked with Automation about the Org-level users yesterday, I think we are on - track with Murali. I think Santosh probably feels better about it. - They will need another client and they could automatically - get the tokens for the client generating Org-level tokens using tokens of the - first client because their client has ~oauth~ scope. -- still many small tasks related to fixing provision related bugs. - - Yesterday, and today asked by Danny to create an SX-only Org for Arizona - University directly asked by Brianna. - - Today, pinged by Matthew Franks because CSC onboarding is failing on EU. - - QA team asking to create SX-only orgs (Hissan yesterday) -- Heard about plan for custom roles, should be part with Petr planning. Just to - check if PMs expectations are easy to reach. For example a notion that an user - could have multiple roles. I don't think it would be difficult to do that in - IROH, but this might become a potential breaking change if external - integration looking at the ~role~ claim in JWT or in the ~whoami~ endpoint. -- Still keep track that Olivier feels good working on modules with Matt. - I think he appreciate to be exposed to other part of IROH he is used to. -**** MEETING Prepare Universal API Meeting :work:meeting: -:LOGBOOK: -CLOCK: [2023-09-20 Wed 16:32]--[2023-09-20 Wed 18:29] => 1:57 -CLOCK: [2023-09-20 Wed 14:47]--[2023-09-20 Wed 14:50] => 0:03 -:END: -[2023-09-20 Wed 14:47] -***** Actions - -***** Questions for PIAM: - -****** TODO Optional Fields in PIAM doc - -The doc does not say if fields are mandatory or not. -Which one are mandatory? - -Example: https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/provisioning/common-provisioning/apireference/Models/Entitlement.md - -And more precisely: - - -https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/provisioning/common-provisioning/apireference/Models/Tenant.md - -****** TODO How to check for PIAM ownership of the PIAM token - -I guess verifying the signature will not be enough. -Should we check a specific ~sub~ claim? -etc… - -****** TODO Do you send a different callback URL for every provisioning call? Or is the URL fixed and should be configured? - -*** 2023-09-21 Thursday -**** MEETING VPN Swagger :work:meeting: -:LOGBOOK: -CLOCK: [2023-09-21 Thu 16:02]--[2023-09-22 Fri 17:39] => 25:37 -:END: -[2023-09-21 Thu 16:02] - -SBG CTO is looking accross access. -*** 2023-09-22 Friday -**** DONE Do Data Retention Policy [[https://github.com/advthreat/iroh/pull/8384/files][ISSUE]] :work: -SCHEDULED: <2023-09-25 Mon 10:00> -:LOGBOOK: -CLOCK: [2023-09-22 Fri 17:39]--[2023-09-22 Fri 20:59] => 3:20 -:END: -[2023-09-22 Fri 17:39] -** 2023-W39 -*** 2023-09-27 Wednesday -**** DONE Advisory Lock Service [[https://shiroyasha.io/advisory-locks-and-how-to-use-them.html][Article]] :work: -SCHEDULED: <2023-09-27 Wed 11:00> -[2023-09-27 Wed 09:25] -** 2023-W39 -*** 2023-09-25 Monday -**** DONE Préparer Rewards Olivier :work: -SCHEDULED: <2023-09-25 Mon 14:30> -[2023-09-25 Mon 11:15] - -***** Big things you did between Juyly 2022/August 2023: - -****** XDR -- *RBAC -- Expose Entitlements -- [Provisioning] Update Entitlements -****** Generic -- Org Virtual User, very big win. - - Org Level Authorization in clients -- Public but hidden APIs -****** Devs -- IROH Configs and service graph discovery -- Public dev doc (template, deploy, etc…) -- Changelog -- Code coverage -***** Rewards - -Great throughput, Generic and Quality. -Not much I can ask for on my end. - -**** DONE Préparer Rewards 1-1 Wanderson :work: -SCHEDULED: <2023-09-25 Mon 14:00> -[2023-09-25 Mon 11:14] - -***** Big things you did between July 2022 / August 2023: - -****** XDR -- Expose Entitlements -- scopes/permissions endpoints - -****** Generic -- Short Tokens, not in use yet, but Automation wants them. -- Many code maintenance + bugfix/support - -****** Devs -- some code fixes/refactos - -***** Rewards - -Compare to other members, very good but sometime you had some lack of -consistence I affect to many of your life challenges. -Last few months this totally changed, so this will probably change. -Even like this you still are a very strong contributor. -I will probably be able to negociate for more next year. - -**** DONE Créer template offsite :work: -SCHEDULED: <2023-09-25 Mon 12:00> -[2023-09-25 Mon 11:13] - -** 2023-W40 -*** 2023-10-02 Monday -**** IN-PROGRESS Presentation Custom Roles :work: -:LOGBOOK: -CLOCK: [2023-10-02 Mon 18:11]--[2023-10-03 Tue 18:49] => 24:38 -:END: -[2023-10-02 Mon 18:11] -**** DONE Ecrire Presentation/Document custom roles :work: -SCHEDULED: <2023-10-02 Mon 16:00> -[2023-10-02 Mon 15:38] -*** 2023-10-05 Thursday -**** DONE Finaliser personal presentation :work: -SCHEDULED: <2023-10-09 Mon 10:00> -[2023-10-05 Thu 21:13] -**** DONE Préparer présentation IROH 2.0 :work: -SCHEDULED: <2023-10-09 Mon 09:00> -[2023-10-05 Thu 21:13] -** 2023-W42 -#+BEGIN: clocktable :scope subtree :maxlevel 4 :timestamp nil :link nil :tags t :narrow 36! :match "work" -#+CAPTION: Clock summary at [2023-10-23 Mon 11:20] -| Tags | Headline | Time | | | | -|---------------+-------------------------------+----------+----------+---------+---------| -| | *Total time* | *1d 12:26* | | | | -|---------------+-------------------------------+----------+----------+---------+---------| -| | \_ 2023-W42 | | 1d 12:26 | | | -| | \_ 2023-10-16 Monday | | | 1d 3:56 | | -| work, meeting | \_ Monetization | | | | 1d 3:56 | -| | \_ 2023-10-18 Wednesday | | | 3:02 | | -| work, meeting | \_ Custom Roles with Guy | | | | 3:02 | -| | \_ 2023-10-20 Friday | | | 5:28 | | -| work, meeting | \_ Detect Unused Orgs | | | | 5:28 | -#+END: - -*** 2023-10-16 Monday -**** DONE Reserver Ecran :work: -SCHEDULED: <2023-10-24 Tue 10:40> -[2023-10-16 Mon 17:42] -**** DONE Factures offsite :work: -SCHEDULED: <2023-10-17 Tue 10:00> -[2023-10-16 Mon 17:41] -**** MEETING Monetization :work:meeting: -:LOGBOOK: -CLOCK: [2023-10-16 Mon 16:02]--[2023-10-17 Tue 19:58] => 27:56 -:END: -[2023-10-16 Mon 16:02] -***** Agenda (to discuss about) -***** Notes -***** Actions -- Add discussion about upgrade/downgrade session [[webexteams://im?space=27f93cd0-5190-11ee-bd8d-35c3d6dd9f2f][Channel]] -**** DONE Create clients [[webexteams://im?space=fc0e4f90-527d-11ee-98f2-0faa9801585c][SSE]] :work: -SCHEDULED: <2023-10-16 Mon 15:00> -[2023-10-16 Mon 11:11] -*** 2023-10-18 Wednesday -**** MEETING Meraki OAuth2 discussion :work:meeting: -[2023-10-18 Wed 17:09] -***** Agenda (to discuss about) -***** Notes -***** Actions -**** MEETING JWT and Entitlements :work:meeting: -[2023-10-18 Wed 16:31] -***** Agenda (to discuss about) -***** Notes -***** Actions -**** MEETING Custom Roles with Guy :work:meeting: -:LOGBOOK: -CLOCK: [2023-10-18 Wed 16:01]--[2023-10-18 Wed 19:03] => 3:02 -:END: -[2023-10-18 Wed 16:01] -***** Agenda (to discuss about) -How to get JWTs -How to retrieve Entitlements -***** Notes - -@Andrew_Parisi -Data retention for conure. - - - -***** Actions - -*** 2023-10-20 Friday -**** MEETING Detect Unused Orgs :work:meeting: -:LOGBOOK: -CLOCK: [2023-10-20 Fri 16:01]--[2023-10-20 Fri 21:29] => 5:28 -:END: -[2023-10-20 Fri 16:01] -***** Agenda (to discuss about) -***** Notes -***** Actions -** 2023-W43 -*** 2023-10-23 Monday -**** MEETING FMC delegate OAuth2 Device Grant :work:meeting: -:LOGBOOK: -CLOCK: [2023-10-23 Mon 16:31]--[2023-10-23 Mon 17:59] => 1:28 -:END: -[2023-10-23 Mon 16:31] -***** Agenda (to discuss about) -***** Notes -***** Actions -*** 2023-10-24 Tuesday -**** MEETING Staging decision :work:meeting: -:LOGBOOK: -CLOCK: [2023-10-24 Tue 20:06]--[2023-10-24 Tue 21:26] => 1:20 -:END: -[2023-10-24 Tue 20:06] -***** Agenda (to discuss about) -***** Notes -***** Actions -*** 2023-10-26 Thursday -**** MEETING XDR Data Retention Sync :work:meeting: -:LOGBOOK: -CLOCK: [2023-10-26 Thu 17:31]--[2023-10-26 Thu 18:01] => 0:30 -:END: -[2023-10-26 Thu 17:30] -***** Agenda (to discuss about) -***** Notes -***** Actions -** 2023-W44 -*** 2023-10-30 Monday -**** DONE Delete PIAM clients created by me :interruption:work: -:LOGBOOK: -CLOCK: [2023-10-30 Mon 17:13]--[2023-10-30 Mon 18:16] => 1:03 -:END: -[2023-10-30 Mon 17:13] - -#+begin_src -./get-client -e test --client-id 'client-092cc2a4-4a91-41d5-a153-caf2304f64a6' -{:env :test, - :client - {:name "PIAM-Provisioning-TEST", - :availability "org", - :scopes ["cisco/platform"], - :grants ["client-creds"]}, - :owner - {:user-id "cbab92a3-d606-4c74-895c-0c8921dce6ef", - :user-name "Yann (MASTER)", - :user-email "yaesposi@cisco.com", - :additional-scopes - ["iroh-admin" "cognitive" "iroh-master" "cisco" "global-intel"]}, - :org - {:id "33b2cdbf-0d67-42f3-8a20-ca96fac4e20c", - :name "Y ORG (master-user)"}} -#+end_src -** 2023-W45 -*** 2023-11-06 Monday -**** DONE undo upgrade on enterprise-id :work: -SCHEDULED: <2023-11-07 Tue 10:00> -[2023-11-06 Mon 18:39] -**** DONE Planifier visite médicale :work: -SCHEDULED: <2023-11-06 Mon 14:00> -[2023-11-06 Mon 10:42] -*** 2023-11-07 Tuesday -**** MEETING Weekly Lead Meeting :work:meeting: -:LOGBOOK: -CLOCK: [2023-11-07 Tue 15:07]--[2023-11-07 Tue 16:37] => 1:30 -:END: -[2023-11-07 Tue 15:07] -***** Agenda (to discuss about) -***** Notes - -Mario on centralizing CTIA/private-intel - -***** Actions - -** 2023-W46 -*** 2023-11-14 Tuesday -**** MEETING User + Breach Suite Priority :work:meeting: -:LOGBOOK: -CLOCK: [2023-11-14 Tue 17:35]--[2023-11-14 Tue 18:17] => 0:42 -:END: -[2023-11-14 Tue 17:35] -***** Agenda (to discuss about) - -Our current customer experience isn’t great – we rely on personal contact to the -admin to provision the products in a very specific order, and then a manual -correction on the back end. -This is because both XDR and Secure Access set up a Secure X org, which is -necessary for Breach and User Suites, respectively – but in the Combo Suite -there’s currently no way for them to coordinate and only set up one org. -Align on the priority of fixing this issue Proposed resolution, is this the -right path forward - -Please forward the meeting if I have not included all the right representatives. - -XDR: Briana, Jyoti -Secure Access: Nirmal, Justin (Sangeeta, Matt optional) -Secure Endpoint: Ivlana, Alain -E2E Test: JJ, April -PMO: Sukanthi -PM Ops: Mandy - -***** Notes -***** Actions -*** 2023-11-15 Wednesday -**** MEETING API Design Meeting :work:meeting: -:LOGBOOK: -CLOCK: [2023-11-15 Wed 19:15]--[2023-11-15 Wed 22:14] => 2:59 -:END: -[2023-11-15 Wed 19:15] -***** Agenda (to discuss about) -***** Notes -***** Actions - -****** DONE Add a check for the module. -SCHEDULED: <2023-11-16 Thu 14:00> - -*** 2023-11-16 Thursday -**** MEETING Universal PIAM flow check-in :work:meeting: -:LOGBOOK: -CLOCK: [2023-11-16 Thu 16:29]--[2023-11-17 Fri 18:02] => 25:33 -:END: -[2023-11-16 Thu 16:29] -***** Agenda (to discuss about) -***** Notes -***** Actions - -Open work: - -Admin work: - - Have an OAuth2 client credentials to answer back to PIAM - - Have a reasonable value for waiting time of failure (I would say 24h) - - Potentially add a mechanism to send an error email to an internal TAC support - team about a problem for some customer during the provisioning that need - manual intervention - - -*** 2023-11-17 Friday -**** MEETING Monthly Engineer Meeting :work:meeting: -:LOGBOOK: -CLOCK: [2023-11-17 Fri 18:02]--[2023-11-17 Fri 20:10] => 2:08 -:END: -[2023-11-17 Fri 18:02] -***** Agenda (to discuss about) -***** Notes -***** Actions -** 2023-W47 -*** 2023-11-21 Tuesday -**** MEETING XDR / PIAM common provisioning api coordination :work:meeting: -:LOGBOOK: -CLOCK: [2023-11-21 Tue 18:05]--[2023-11-21 Tue 21:27] => 3:22 -:END: -[2023-11-21 Tue 18:05] -***** Agenda (to discuss about) -Checks work to be done. -What the timeline is looking like? - - -***** Notes -***** Actions -** 2023-W48 -*** 2023-11-28 Tuesday -**** DONE org-level-auth for DI clients :work: -SCHEDULED: <2023-11-28 Tue 14:00> -[2023-11-28 Tue 09:56] -*** 2023-11-29 Wednesday -**** MEETING API Design Meeting :work:meeting: -:LOGBOOK: -CLOCK: [2023-11-29 Wed 18:45]--[2023-11-29 Wed 21:21] => 2:36 -:END: -[2023-11-29 Wed 18:45] -***** Agenda (to discuss about) -***** Actions -***** Notes -****** Common Org - -Have a common org for SE and other internal products. - -- CDO effort piece stopped. PIAM will take that. - -@Jyoti: Staging - -Ask from PM. Nobody from the Engineering team wants to do this. - -Asked to us explain why it would take 1 year. -So created a document, started with Murali. - -Ops came back on estimation. -Couple of hours. - -PM came back, what for a brand new region. -Ops let's use the same script. -PM why was that one year. - -Be very clear of the steps after it was setup. -All the configurations we need. -Number of steps, clearly call out assumptions and dependencies. -Etc… Add up all the work for all integrations. - -PIAM -**** MEETING SCC Script (brownfield provisioning) :work:meeting: -:LOGBOOK: -CLOCK: [2023-11-29 Wed 17:55]--[2023-11-29 Wed 18:44] => 0:49 -:END: -[2023-11-29 Wed 17:55] -***** Agenda (to discuss about) -***** Notes - -Danny will run a script to trigger user-email+org-id => start flow to attach to -enterprise-id & entitlements - -***** Actions - -** 2023-W49 -*** 2023-12-04 Monday -**** MEETING Scoring Escalation Devs Sync :work:meeting: -:LOGBOOK: -CLOCK: [2023-12-04 Mon 15:20]--[2023-12-04 Mon 21:56] => 6:36 -:END: -[2023-12-04 Mon 15:20] -***** Agenda (to discuss about) -***** Notes -***** Actions - -- monitor failed pushed incidents -- improve robustness of incidents scoring by having default quick score + harder score -*** 2023-12-08 Friday -**** MEETING IROH Sync :work:meeting: -:LOGBOOK: -CLOCK: [2023-12-08 Fri 17:08]--[2023-12-09 Sat 09:31] => 16:23 -:END: -[2023-12-08 Fri 17:08] -***** Agenda (to discuss about) -- Retrospective - -***** Notes -****** Guillaume (4/5) -- Communication Quality: 4/5 -- Well: -- Badly: - - CRITICAL ESCALATION INCIDENT. - Went undetected. - Too confident in monitoring. -****** Yann (4/5) ... -****** Matt (4/5) -+ positive: data dog -+ negative: -+ suggestions: - + put name into anonymous function -****** Mario (4/5) -+ positive: - - people are implicated - - many patches that improved the situation -+ negative: - - lot of people impacted - - accounting for every task -+ Suggestion: - - keep track of successful/failed jobs -****** Olivier (4/5) -+ positive: -+ negative: - - nb of PG queries -+ suggestions: - - could have tried to help -****** Jerôme (?/5) -+ positive - - we will improve our monitoring -+ negative: - - monitoring -+ suggestion: - - we could have been helpful to retrieve logs for example. - - work on monitoring - - add sentry to get all trace back -****** Ambrose (?/5) -+ postive: - - great resume from GB -+ negative: - - incident and CPU, cut corners -+ suggestion: - - ... -****** Kirill (4/5) -+ positive: - - great to see how people collaborating -+ negative: - - ns, db functionality, relation logic, - - process to introduce big architecture changes. - - not actively collaborating on PR -+ suggestion - - look more to other's PRs - - big architecture changes -****** Shafiq (?/5) -+ positive: - - identified the mapping issue in the iroh-event feature -+ negative: - - ... -+ suggestion: -***** Actions -** 2023-W50 -*** 2023-12-14 Thursday -**** MEETING Refresh tokens :work:meeting: -:LOGBOOK: -CLOCK: [2023-12-14 Thu 19:06]--[2023-12-15 Fri 15:51] => 20:45 -:END: -[2023-12-14 Thu 19:06] -***** Agenda (to discuss about) -***** Notes - -- Create Trusted clients (read only) with longer refresh tokens -- Write the doc for the UI team -***** Actions -**** DONE Refresh tokens (doc + create read-only clients) :work: -SCHEDULED: <2023-12-15 Fri 11:00> -[2023-12-14 Thu 19:06] -*** 2023-12-15 Friday -**** DISC Sync with team :work:discussion: -:LOGBOOK: -CLOCK: [2023-12-15 Fri 15:51]--[2023-12-15 Fri 17:21] => 1:30 -:END: -[2023-12-15 Fri 15:51] - -** Initial - - -For the end of the week, I feel I didn't sync'd enough with both of you. - -So let me give a short update about what is going on. - -1. I started working on finally provide a correct impersonating mechanism. - It will use the same JWT generation as the login mechanism. Providing not - only an access token but also a refresh token. - - - If you impersonate, your user details are saved in an ~act~ claim that will - contain an user identity. - - If you use an impersonated JWT to switch account, the new JWT will keep the - same ~act~ claim as the first impersonated claim. - - I don't think we need to go down up to the point of tracking OAuth2 - clients, but this is a possibility. -2. I will have a meeting with Danny an Prerna to provide a script that will make - customer responsible for connecting their PIAM account to their XDR account. - The script looks like something very easy to write and provide. - We'll see. -3. I started a discussion with the UI team because I was pinged by Piotr to have - a long living dashboard (so very long session to show an XDR dashboard). - Here is what I proposed: - - 1. create a few specific trusted clients (with dummy password...) for which - refresh tokens expires only after 1 month. - 2. When the user want to display a long living dashboard, the UI could switch - the tokens used from the session token to the token retrieved from this - client by using the `/iroh/oauth2/custom/tokens` route. - - 4. A similar discussion spawned with Chris Duane about providing a safer - mechanism to hand JWT to the AI component. And I proposed the exact same - solution. - Create a specific client and hand over these new token we can control more - easily than a user session token. - 5. The priority is still Universal Provisioning fixes and improvements. This is - why I didn't started to talk about the rest of the work yet - 6. After looking at the fiasco that was trying to use events to create a cache - for Entitlement Summary. Not much a fiasco, but a clear reminder that - concurrent (or even worse distributed) event systems are a nightmare to - internalize and understand. - We could have a longer discussion about this if you feel inclined. - 7. Last but not least in anyway, we might finally start a new big chunck of work - to support multi-region/sub-region. We worked with GB on a new design that - would provide the ability to our customer to select their prefered AWS - deployment region while minimizing the impact on the ops, development teams - and other integrated teams. For now, this is just a proposal that we bubbled - up to the PMs. We will see if this is accepted or if there is another plan to - support more geos. - -** ChatGPT English corrected - -As the end of the week approaches, I feel like I haven't synced enough with both of you. To provide a brief update on my progress, here are some key points: - -1. I have been working on implementing an impersonating mechanism that uses JWT generation similar to the login process. This will not only generate an access token but also a refresh token. If you use an impersonated JWT to switch accounts, the new JWT will retain the same ~act~ claim as the first impersonated claim. While it may be possible to track OAuth2 clients, I don't think we need to go that far. -2. I have a meeting scheduled with Danny and Prerna to provide them with a script that will enable customers to connect their PIAM account to their XDR account. The script should be relatively easy to write and implement. We'll see how it goes. -3. I recently had a discussion with the UI team because Piotr pinged me about creating a long-living dashboard. To achieve this, I proposed the following solution: - * Create a few trusted clients (with dummy passwords) for which refresh tokens expire only after one month. - * When the user wants to display a long-living dashboard, the UI can switch from using the session token to retrieving a token from this client by using the `/iroh/oauth2/custom/tokens` route. -4. A similar discussion took place with Chris Duane about providing a safer mechanism for handing JWTs to the AI component. I suggested creating a specific client and controlling these new tokens more easily than user session tokens. -5. The priority remains fixing and improving Universal Provisioning, which is why I haven't started discussing other work yet. -6. After attempting to use events to create an Entitlement Summary cache, I was reminded of the challenges associated with concurrent (or even distributed) event systems. We could have a longer discussion about this if you're interested. -7. Lastly, we might finally begin working on a new project to support multi-region/sub-region deployment options. Our team has proposed a design that would allow customers to select their preferred AWS deployment region while minimizing the impact on ops, development teams, and other integrated teams. This is currently being reviewed by PMs, and we'll see if it's accepted or if there are alternative plans in place. - -** 2023-W51 -*** 2023-12-19 Tuesday -**** MEETING 1-1 Olivier :work:meeting: -:LOGBOOK: -CLOCK: [2023-12-19 Tue 15:32]--[2023-12-19 Tue 22:00] => 6:28 -:END: -[2023-12-19 Tue 15:32] -***** Agenda (to discuss about) -***** Notes -***** Actions -*** 2023-12-20 Wednesday -**** IN-PROGRESS Investigate org-not-found for DI :work: -:LOGBOOK: -CLOCK: [2023-12-20 Wed 09:48]--[2023-12-20 Wed 22:42] => 12:54 -:END: -[2023-12-20 Wed 09:48] * 2024 ** 2024-W02 *** 2024-01-08 Monday -**** DONE Upgrade/Downgrade meeting :work:meeting: +**** DONE Upgrade/Downgrade meeting :work:meeting: :LOGBOOK: *** 2024-01-10 Wednesday -**** MEETING Q3 Quadrant Slides Readout :work:meeting: +**** MEETING Q3 Quadrant Slides Readout :work:meeting: :LOGBOOK: CLOCK: [2024-01-10 Wed 16:06]--[2024-01-12 Fri 09:46] => 41:40 :END: @@ -1740,7 +16,7 @@ CLOCK: [2024-01-10 Wed 16:06]--[2024-01-12 Fri 09:46] => 41:40 ***** Actions ** 2024-W03 *** 2024-01-16 Tuesday -**** DONE Perform brownfield Superbowl :work: +**** DONE Perform brownfield Superbowl :work: SCHEDULED: <2024-01-16 Tue> [2024-01-16 Tue 19:07] **** MEETING XDR Platform / Automation / Insights / Analytics Planning Session :work:meeting: @@ -1752,7 +28,7 @@ CLOCK: [2024-01-16 Tue 18:16]--[2024-01-16 Tue 21:45] => 3:29 ***** Notes ***** Actions *** 2024-01-17 Wednesday -**** MEETING API Design Meeting :work:meeting: +**** MEETING API Design Meeting :work:meeting: [2024-01-17 Wed 18:10] ***** Agenda (to discuss about) ****** Yann Topics @@ -1764,7 +40,6 @@ CLOCK: [2024-01-16 Tue 18:16]--[2024-01-16 Tue 21:45] => 3:29 d. Migrate to some GraphDB 3. Super Bowl 4. Demo - ***** Notes ****** @Jyoti: Things to do ******* Hierarchical Modules @@ -1772,7 +47,6 @@ CLOCK: [2024-01-16 Tue 18:16]--[2024-01-16 Tue 21:45] => 3:29 Hierarchical Modules First Microsoft endpoint, then Defender. Jyoti takes notes. - ******* JAMF To @Matt Use the client creds. @@ -1781,34 +55,30 @@ For new user, they enter user and password, then we get a token and use to request the classic API. @Matt: to know if there is an issue within JAMF UI, you should contact Aaron. - ******* Integration that need a session (Checkpoint) @Matt: discussion between Matt Van Der Host and GB and did not see this -integration in the Airtable. +integration in the Airtable. @Jyoti: asking for the github ticket. Assign Shafiq to this ticket, but also keep Mark in the loop. - ******* How can we handle On-Prem products? (Design Item) Doing via SSX, AO Remote, and also Cisco Telemetry. Something we need to figure out maybe with CDO. Which one should be standardized? Design item. - ******* CDO Firewall Proxy Tentative 2 releases (mid-Feb) - @Jyoti: ping me if we have something else. - ***** Actions -**** MEETING Superbowl link :work:meeting: +**** MEETING Superbowl link :work:meeting: [2024-01-17 Wed 17:17] ***** Agenda (to discuss about) ***** Notes ***** Actions -**** MEETING Discussion GE quarter :work:meeting: +**** MEETING Discussion GE quarter :work:meeting: [2024-01-17 Wed 14:39] ***** Agenda (to discuss about) - XDR Incident Correlation ; Planning Blocker @@ -1817,9 +87,8 @@ Tentative 2 releases (mid-Feb) - ES XDR-only store plan ; ***** Notes - depasser les IOPS - ***** Actions -**** IN-PROGRESS Attempt to trigger XDR/SCC connection :work: +**** IN-PROGRESS Attempt to trigger XDR/SCC connection :work: :LOGBOOK: CLOCK: [2024-01-17 Wed 14:28]--[2024-01-18 Thu 18:09] => 27:41 :END: @@ -1846,7 +115,7 @@ curl -XPOST "$OKTA_URL/v1/productInstanceInvitation" \ #+end_src ** 2024-W04 *** 2024-01-24 Wednesday -**** MEETING API Design Meeting :work:meeting: +**** MEETING API Design Meeting :work:meeting: [2024-01-24 Wed 19:05] - What was discussed - What was decided @@ -1859,10 +128,8 @@ curl -XPOST "$OKTA_URL/v1/productInstanceInvitation" \ We need to proxy to them. The AI service will be core service. for Q3 SOC assistant. - ***** TODO Add to Q3: SOC Assistant create iroh-ai module to proxy to AI backend; assign Mark or maybe Tiffany - -**** MEETING All Hands :work:meeting: +**** MEETING All Hands :work:meeting: :LOGBOOK: CLOCK: [2024-01-24 Wed 18:33]--[2024-01-25 Thu 21:58] => 27:25 :END: @@ -1870,16 +137,15 @@ CLOCK: [2024-01-24 Wed 18:33]--[2024-01-25 Thu 21:58] => 27:25 ***** Agenda (to discuss about) ***** Notes -Some internal AI/ML spaces for collaboration: -- networkGPT | Join: https://eurl.io/#gHbta7lro -- Generative AI Explorers | Join: https://eurl.io/#Z4vekB6ph -- AI_ChatGPT | Join: https://eurl.io/#nbJWbnj12 -- GAI Engineering Forum | Join: https://eurl.io/#k9dt-XxWv -- Artificial Intelligence and Machine Learning | Join: https://eurl.io/#Bk7grXKuV +Some internal AI/ML spaces for collaboration: +- networkGPT | Join: https://eurl.io/#gHbta7lro +- Generative AI Explorers | Join: https://eurl.io/#Z4vekB6ph +- AI_ChatGPT | Join: https://eurl.io/#nbJWbnj12 +- GAI Engineering Forum | Join: https://eurl.io/#k9dt-XxWv +- Artificial Intelligence and Machine Learning | Join: https://eurl.io/#Bk7grXKuV - Cisco Enterprise Chat AI - Support - https://eurl.io/#cVPv-NLF7 - ***** Actions -**** MEETING MITRE Meeting :work:meeting: +**** MEETING MITRE Meeting :work:meeting: :LOGBOOK: CLOCK: [2024-01-24 Wed 16:05]--[2024-01-24 Wed 16:08] => 0:03 :END: @@ -1892,19 +158,16 @@ CLOCK: [2024-01-24 Wed 16:05]--[2024-01-24 Wed 16:08] => 0:03 Going Forward: -- probably dynamic product coverage from Talos -- Recommendations (which product to add) -- perhaps Scores (from Kenna) - +- probably dynamic product coverage from Talos +- Recommendations (which product to add) +- perhaps Scores (from Kenna) **** Questions - ***** Sub-techniques? Not visible, every things goes in the biggest bucket. At least for phase 1. - *** 2024-01-26 Friday -**** MEETING Monthly Engineering :work:meeting: +**** MEETING Monthly Engineering :work:meeting: :LOGBOOK: CLOCK: [2024-01-26 Fri 17:24]--[2024-01-26 Fri 19:17] => 1:53 :END: @@ -1912,7 +175,6 @@ CLOCK: [2024-01-26 Fri 17:24]--[2024-01-26 Fri 19:17] => 1:53 ***** Agenda (to discuss about) ***** Notes ****** IROH Services Team - ******* Performances - New Datadog Monitoring, Visualizations & Alerts (thanks to Jerome and Patrick) Really improved visibility of our work and the impact on performance. @@ -1924,11 +186,9 @@ CLOCK: [2024-01-26 Fri 17:24]--[2024-01-26 Fri 19:17] => 1:53 - We improved many aspect of our platform, in particular in iroh-async, but not only, we also improved some PG requests. - ******* Quality - Improved our system to declare error statuses with schemas. Thanks Ambrose! - Ongoing node configuration improvements. - ******* Features - Ambrose worked on asset rescoring. @@ -1937,19 +197,16 @@ CLOCK: [2024-01-26 Fri 17:24]--[2024-01-26 Fri 19:17] => 1:53 - Part of it Support External JWT, from Okta, but also FMC. - Brownfield customer, ability to upgrade existing SecureX users to XDR - Impersonator tracking which if delivered should help TAC and quality teams. - ******* Bonus Great work and dedication to discover, and resolve production issues. Thanks to everyone involved! Still Planning Many improvements learned from these events. - ***** Actions - ** 2024-W05 *** 2024-01-29 Monday -**** MEETING Impersonate Meeting :work:meeting: +**** MEETING Impersonate Meeting :work:meeting: :LOGBOOK: CLOCK: [2024-01-29 Mon 15:59]--[2024-01-29 Mon 22:28] => 6:29 :END: @@ -1962,18 +219,15 @@ I would like to have a chat with this group regarding this epic https://ciscosec We have a separate ask from the XDR TAC team to enable user impersonation for the TAC engineering for troubleshooting purposes, which is a discovery only effort for Q3. @Petr Cernohorsky (pcernoho) does this epic relate to user impersonation as well? Or is this something specific to incidents, that does not involve Yann and the team to develop user impersonation infrastructure? - ***** Notes New Portal, with read-only impersonation + stats per org (nb of incident, selection, sort, etc…) - ***** Actions Wait for UX to design - *** 2024-01-31 Wednesday -**** MEETING SCA Integration :work:meeting: +**** MEETING SCA Integration :work:meeting: [2024-01-31 Wed 17:09] ***** Agenda (to discuss about) @@ -1988,7 +242,6 @@ Technical side of things, plan to implement the things to support the convergenc On both teams. This is the intent of the conversation. - ***** Notes - @Crystal (Crystal Storar) low hanging fruit from the customer. @@ -2017,10 +270,9 @@ This is the intent of the conversation. - @Derrick the Device view you mentioned is evaluated this quarter. - @Namrata Top Priorities: Integration UX, Device leverage, Investigate and User Management. - ***** Actions -**** IN-PROGRESS Create AO Clients :work: -SCHEDULED: <2024-01-31 Wed 20:00> +**** DONE Create AO Clients :work: +SCHEDULED: <2024-02-09 Fri 11:00> :LOGBOOK: CLOCK: [2024-01-31 Wed 16:11]--[2024-01-31 Wed 20:53] => 4:42 :END: @@ -2029,19 +281,45 @@ CLOCK: [2024-01-31 Wed 16:11]--[2024-01-31 Wed 20:53] => 4:42 - Remove rate-limit of client 1 - Put rate-limit back of client 0 - Create new client with org-level-authorization -**** DONE ask cherry-pick :work: +**** DONE ask cherry-pick :work: SCHEDULED: <2024-01-31 Wed 15:00> [2024-01-31 Wed 14:16] *** 2024-02-01 Thursday -**** Prepare Meeting PIAM work :work: +**** CHAT Guy doc :work:chat: +:LOGBOOK: +CLOCK: [2024-02-01 Thu 17:02]--[2024-02-01 Thu 20:51] => 3:49 +:END: +[2024-02-01 Thu 17:02] +SXO is a consumer of the high impact incidents. +Current schema: +```json +{"event_type":"private-intel/incident/high-impact/created", + "incident_id": String} +``` +To receive status updates of these incident we propose to make SXO also a consumer of all +status update of every incident being high impact or not. +The expectation is that there will not be too many update events. +For this we will change the configuration of the webhook to also match on events of type +"private-intel/note/updated". +The schema of these events will be: +```clojure +(s/defschema UpdatedField + {:field s/Keyword + :action (s/enum "modified" "added" "deleted") + :value (st/optional-keys + {:before s/Any + :after s/Any})}) +(s/defschema PrivateIntelIncidentData + {:event_type (s/enum "private-intel/incident/updated") + :incident_id s/Str + :updated_fields [UpdatedField]}) +``` +**** DONE Prepare Meeting PIAM work :work: SCHEDULED: <2024-02-01 Thu> :LOGBOOK: -CLOCK: [2024-02-01 Thu 08:49] +CLOCK: [2024-02-01 Thu 08:49]--[2024-02-01 Thu 17:02] => 8:13 :END: [2024-02-01 Thu 08:48] - - - ***** Jyoti Option 2: Having a Common IROH per enterprise that’s converted to XDR when XDR is purchased @@ -2088,10 +366,7 @@ Integrations Open Question: - If a common tenant existed and the XDR tenant was brought in later to be attached to the Enterprise, how is the common iroh tenant handled? - If the attach operation happens before the common iroh tenant exists, this will not be a problem - - ****** Remarks/Questions - ******* PIAM ↔ IROH Token Exchange On: "IROH will have an API to exchange a PIAM token with an IROH token" @@ -2128,7 +403,6 @@ IROH => Client: Here it is Client => IROH: I have this PIAM token, give me an IROH token for my Org org-1 IROH => Client: Here it is #+end_src - ******* modules and PIAM token #+begin_quote @@ -2158,7 +432,6 @@ scopes/authorizations/capabilities than the IROH token. Case 2: The module/relay is unchanged, we need to retrieve the IROH token from the PIAM token. See previous section. - ******* SSX called from IROH #+begin_quote @@ -2174,10 +447,8 @@ There are many different PIAM tokens. So: - Could we get a PIAM token from an IROH token without privilege escalation? - Would the PIAM token could be retrieved from an XDR org, or from the special Enterprise Org? - ******* New API in iroh-int for SCC Integration UI? not sure what is needed there. - ******* Open questions The way I envisionned it: @@ -2188,3 +459,2622 @@ the real XDR org). If the customer also need XDR, then we create another XDR org, again with potential bridges such that the XDR Org could be affected by the Enterprise Org. +****** Remarks / Question +******* 1 XDR org per PIAM Enterprise-id + +This would make a LOT of things trivial. +In particular: + +Exchanging PIAM and IROH token. +Except perhaps org-level IROH token (depending on current PIAM ability to have +enterprise-level tokens) +And thus will simplify everything related to selecting a tenant. In particular +SSX, Module instances, etc… + +Work involved: + +1. Add a constraint mechanism to prevent duplicate enterprise_id (in the same Region). +2. (optional) Add a constraint to prevent duplicate cross region (to enforce 1 + enterprise on all XDR instances (Region & geo)) +3. Add a flag to know if this Org is PIAM without XDR enabled or if it also + include an active XDR account. + So discussion about what would users in this special org would be allowed to + do on a PIAM created Org without XDR product attached. + Could they still add/remove modules, etc… +4. Change our code so most field will be sync'ed from SCSO to XDR during user login. + This way, if a user change his name, email, in SCSO, it will affect XDR on + next login. + a. Perhaps there is another sync mechanism we could use to sync even if the + user does not login into XDR. +******** Risks + +- Upgrade existing tenant without enterprise-id but should be manageable with + TAC IMO. +- Some modules are restricted to have at most 1 module instance (by the product) + which might change. For example if this single Enterprise-id (XDR org) buy + multiple time the same product. Still should not be that difficult to change + by other teams. +******* 1 IROH org per PIAM Enterprise-id + 1 attached XDR orgs + +I am not sure it would be possible without a huge amount of work as all our +APIs (external web apis as well as internal code API) expect a specific ~org-id~. +I wouldn't explore this possibility to "share" data from one Org to another One. +It would not only make the code to write this very difficult to write, but also +open a lot more potential security issues. +**** Guy Response + +Current status: + +SXO is a consummer of high impact incident creation event. +Current schema: +** 2024-W06 +*** 2024-02-05 Monday +**** MEETING Jyoti Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2024-02-05 Mon 19:49]--[2024-02-05 Mon 21:44] => 1:55 +:END: +[2024-02-05 Mon 19:49] +***** Agenda (to discuss about) +***** Notes + +PIAM Auth team. + +Then need S2S tokens. +***** Actions +**** MEETING Trigger Aut rules on status update. :work:meeting: +:LOGBOOK: +CLOCK: [2024-02-05 Mon 16:01]--[2024-02-05 Mon 16:30] => 0:29 +:END: +[2024-02-05 Mon 16:01] +***** Agenda (to discuss about) +***** Notes +***** Actions +*** 2024-02-06 Tuesday +**** MEETING SX EOL bi-Weekly :work:meeting: +[2024-02-06 Tue 20:28] +***** Agenda (to discuss about) +- Review Action Items List +- Review current quarter commitments +- Status against milestones +- Discuss Issues, Risks, Blockers +- Dependencies status +- Review features ready for next release +***** Notes +@Maribell impact when SX EOL end. +Date very high at risk of customer not being impacted. +Pb with PIAM alignment. + +Supporting the product teams to makes those EOL. + +@Prerna: +Make a checklist for SX itself. +We need to understand if things moved to XDR for the EOL, Navigation, URLs, etc… + +Inventory of all these things. + +Planing phase in Q3, Q4 execution which ends with SX EOL on July 31th. + +1-click setup, SSE, SSX, through SecureX. + +Couple of things we have done, and what we want to do going forward. + +- Make a list of SX mention in XDR. +- List of mentions from IROH and ops too. The domains. +- Check the XDR URLs. +- ops: redirect security.cisco.com to xdr.security.cisco.com +- most questions about *REBRANDING* + +@Michelle searching for SecureX mentions. +@Dar / @Michelle: search in 3rd parties. + +Ribbon + +@Robert: we could make a message asking them to upgrade to the Ribbon. +@Prerna: build some kind of flow to build that. +@Derrick: upgrade button maybe? +@Robert: depend on UX/UI/Doc + +@Hisan: a single doc? +@Prerna: no + +@Maribell: Native modules. SE, Umbrella +***** Actions +****** DONE Find all SecureX mention in IROH +SCHEDULED: <2024-02-20 Tue 13:00> +****** DONE Check with Jyoti about moving visibility.* URLs +SCHEDULED: <2024-02-27 Tue 18:00> +**** MEETING XDR Platform (Admin & Management) Core Team :work:meeting: +[2024-02-06 Tue 18:06] +***** Agenda (to discuss about) +***** Notes +@Derek: plan +@Sukanthi: plan +@Namrata: Focus on Core team updates. +Meant to focus on our Q3 delivery. +We will have Q4 things. +@Sukanthi: have a single place to see everything when we cannot attend the meeting. +@Derek: I'll go ahead and go to Aha release (v2.12.0 and v6.12.0) +@Carlos_Diaz: Carlos and Paul, are here for TD&R colleagues to advocate support. +Tech leads necessitate in their project. Architecture confirmation. +@Prerna: PO of feature and management. RBAC, Provisioning, Multi-Tenancy, Admin page. +In Design phase. +@Derek: keep sharing with us. +***** Actions +**** MEETING Weekly :work:meeting: +:LOGBOOK: +CLOCK: [2024-02-06 Tue 17:04]--[2024-02-07 Wed 18:37] => 25:33 +:END: +[2024-02-06 Tue 17:04] +***** Agenda (to discuss about) +***** Notes +****** Yann +- DONE AO Rules issue help +- DONE Support PIAM token (no nbf) +- DONE PIAM trigger onboarding on PIAM (SCC) Attach +- DONE Sync with AO to help Rules (trigger on incident status update) +- DONE removed AO client rate-limit +- DONE Help PIAM Design Proposal +- DONE Help with SCC Attach +- DONE Help with Impersonation via TAC Portal +- DONE Helped SE Team with Legacy Provisioning +- DOING Create New AO Client to reduce rate-limit + org-level clients +- ON HOLD/NEED HELP: IOPS Report Failure +- TOPIC nb of real paid customer in prod? +***** Actions +*** 2024-02-08 Thursday +**** MEETING Notifications Discussions :work:meeting: +:LOGBOOK: +CLOCK: [2024-02-08 Thu 14:29]--[2024-02-08 Thu 15:29] => 1:00 +:END: +[2024-02-08 Thu 14:29] +***** Agenda (to discuss about) +- +***** Notes +@Matt: Kirill wanted to use one topic for output? And each implementation would +consume this topic and deliver notifs for this topic. + +@Kirill: save status in DB + +@Kirill: do we need it. + +@Yann: rate limit, +***** Actions +**** DONE Respond to [[webexteams://im?space=ad5dc9f0-c5ed-11ee-a4c5-fb1787add317][SCA]] :work: +SCHEDULED: <2024-02-08 Thu 14:00> +[2024-02-08 Thu 08:31] +*** 2024-02-09 Friday +**** DONE Create AI Clients :work: +:LOGBOOK: +CLOCK: [2024-02-09 Fri 09:47]--[2024-02-09 Fri 15:26] => 5:39 +:END: +[2024-02-09 Fri 09:47] +**** DONE Create AI Clients complete [[https://github.com/advthreat/securex-ui-shell/issues/514#issuecomment-1932496690][comment]] :work: +SCHEDULED: <2024-02-09 Fri 12:00> +[2024-02-09 Fri 09:12] +** 2024-W07 +*** 2024-02-12 Monday +**** MEETING Breach Suite - Brownfield Exposure :work:meeting: +:LOGBOOK: +CLOCK: [2024-02-12 Mon 19:50]--[2024-02-12 Mon 21:27] => 1:37 +:END: +[2024-02-12 Mon 19:50] + +@Kelli: previous discussion about Brownfield exposure +Is is something dangerous that need immediate action. +Pb with region. +Let's talk about the brownfield. + +- rec started and summarized + +@Kelli: in our previous conversation, Travis one of the thing we discussed +update updating people. What is the process? +@Travis: yes we'll share doc and this is not complication. +For every product we have a Business and Technical decision maker. +Rotating of OAuth creds go to technical decision maker. +We let prodcut team choose by themselve. +We've gone back to be director of Engineering for both. +Going forward should be approved to at least Directory level. + +We are consider asking approved has been approved, including Suites. + +@Kelli: Brownfield Discussion +Where we need to go. +My understanding is that for the implementation for a Brownfield flow due to +SecureX EOL Migration. What happens is a cases created in TAC and someone help +customer to migrate. And then go to in SCC connect. +Which is different for other products. +This is a SecureX flow, it opens the possibility to a standalone customer to +attach that to a Breach Suite, Breach Brownfield scenario that I don't know we support. + +@Travis: two different things. +1. being able to bring a tenant provisioning outside of SCC inside SCC (unrelated + to product paid), done by team, XDR, SE, etc… + @Kelli who is initiating + @Danny I will be the one initiating + @Kelli just XDR or SE? + @Travis they are working on it (@Simon_Seibaa confirm) + @Travis they can have manual process. + @Kelli ok I understand but it can affect a suite when a product does that. + We haven't suite e2e testing. +2. @Travis, product into SCC it opens different workflows. + one of the, apply a License or Subscription to a Tenant. + For example add a Suite. + Multiple examples of this, a modification call for that tenant. + Having a SCC will also provide the ability to purge data or other features. + +@Jyoti: you need an entitlement. +@Travis: when you attach the API there is no subscription to it. The customer +still needs to apply the entitlement. +@Jyoti: 2nd thing, how does a product know it is part of a Suite? +@Travis: ask the question of what is different? The way suite started this is +just this tier in this product. Same as bought separately. The entitlements +provided to products is the same to XDR standalone. +@Kelli: XDR specifically has add-ons what if you are bringing that into a suite. +@Travis: you cannot. +@Kelli: SCC will recognize that situation so the attach it knows which work with +that and which don't. +@Travis: We transform everything as Entitlements. If you have a subscription +applied to it. And apply a different subscription to it and it will push the new entitlements. +@Jyoti: no entitlement at first, so no entitlements. +@Travis: First need to link and attach the Suite license. +@Jyoti: if they have asked for add-ons it will be erased? +@Travis: it will not be erased, the existing subscription, will be replaced +because we have two subscriptions. +It simply an update of the entitlements. +The UI about history of entitlement does not exist yet, shoud be done in Q4. +@Jyoti: The customer might be confused. How to choose. +@Travis: most of the case should be ok. Would have better UI in Q4. +Ask do you want to use the existing XDR or create a new one? +@Jyoti: they could be applied separately. +@Travis: yes it is possible. They don't need to terminate old subscription. +@Jess_Munos: if I'm a SE customer and I don't have any Suite product. But I have +Orbital already deployed. And I buy a Suite. And I provision XDR, those +provisioning would create a new IROH account. So something is happening in the +backend. +Is there something to prevent duplication? +Then using the new ones instead of the correct old one. +@Jyoti: Two separate XDR tenants, with two separate IROH accounts. +I don't know if this a use case we ever heard for our PMs. +@Travis: That is not something that is true today. They could have a trial and +have a new paid XDR tenant. They want to buy a higher tier + a suite with lower tier. +They bought both of them and could choose. +@Jyoti: expected nothing is shared. +Then there two separate things? +@Kieran: looks like a greenfield not a brownfield scenario. If they do that, +they will loose the add-ons by doing that. +@Travis: ah yes, they will loose them. +@Jesse: we don't have the solution yet to manage these issues. What do we thing +timeline will be to have the solution in place? Or do we need to fix that on the +fly. +@Travis: can you be more specific? +@Jesse: Having effectively multiple tenant for customer with existing product deployement? +We have currently deployed products. +Now we have duplicates all over the place. +@Travis: we will provide a kafka notification for attach subscriptions. When +they onboard they need to subscribe to that, they'll gonna have to go and search +if an existing exist. They can kind of migrate from the platform tenant. But +this is highly contextual of the service. This is cannot be done generically. + +@April_Luk: Another question, for a user perspective I am not aware there is an +XDR org provisionned. I purchased another product what occurs to this account. +@Jyoti: It is like a shared service IROH, with a new provisioning it will +generate something separately. +@Kelli: can you explain it again to me. If a customer does bring in an existing +XDR and attach to the suite, we're assuming these common services will not be +part of? +@Jyoti: in a suite, if XDR does not exist, the tenant is used as the shared. If +they set up before then it is separate. +@Kelli: what will be different for a customer greenfield breach suite vs +brownfield scenario. +What would be different. +@Jyoti: If this is new, it will not have its own set of integration. When you go +to that XDR, SE and DI UI, it can appear completly different because the +integration will be entirely different. +@Kelli: is the customer will be expecting this. +@Travis: we must talk before and after platform. +XDR have multiple. Some of these formely products shoudl migrate to reconcile duplication. +We don't have platform services, in two quarter to go to that process to get +everything converge. +@Kelli: I hear you Travis, I'm glad we are planning the future. +But what about user expectation. We are pruning use cases that the user will not +have because we put in a new account and information will be destroyed. Is that +not the only thing that will be different. +I'd like to pose some questions. +In term customer expectation. +Do you have any though Olga? +For the a user could attach a XDR tenant to a suite, in a greenfield scenario +every product communication but this will break with brownfield scenario. +@Travis: it is broken because the it's not the same login. It goes far broader. +@Kelli: I'm glad you broad that up. It impacts other things as well. +@Olga: we don't want they have a worse experience if they bought instead of not +buying it. +@Kelli: is the current situation is not ideal. With this Brownfield scenario. +we've got one of two path. Let it go with subpar experience, or we are specific +not allowed attaching of these things untile we solve this. +@Anthony_Brandelli: let me jump here. Let's talk just about the attach function. +That shouldn't change the current state. It's going to be no different. We would +prefer to get better. We should try as a customer. We keep jumping different +concept between different calls. +@Kelli: What I'm hearing you don't see it's a problem. +@Anthony this is a problem, but not where this is a problem. I am looking to be +more specific. The problem, is not in this first step doing the attach. +@Kelli: link to SCC I don't think there is a problem there. +"Product Instance Invitation Flow" should be fine. +But when it is broad in a Suite, this is where ther is a problem. +@Anthony: Have we tried common scenario? +@Kelli: no +@Jyoti: A question is, if there is a suite, should a user could be allowed to +bring an XDR org into this one? +They have everything is working. Later they want bring in XDR. +@Travis: example about different tier. +@Travis: if a customer buy somthing from us they should have the right to use it. +@Kelli: I can propose to share a miro board to building out the cases. +We want this to work, and this case we need to talk about it. +@April: I did reach out to the UX team, Brian Mallone. +They are working on Suite UX. Only Greenfield only for now. +They already have a miro board. +I'm not sure it will be in timeline for brownfield. +They are still on greenfield. +I think we should brought Brian to see what they already have. +@Prerna: we are good for XDR customer but for Breach Suite we need to make a call. +@Kelli: I am not sure what that means between alocard and Suite. +@Prerna: Danny and the group are working on that list. +@Kelli: check conversion request has also purshached a suite. +@Alain_Soucie: In the miro board make ti clear about area where a manual fix is not available. +**** MEETING AI sync :work:meeting: +[2024-02-12 Mon 17:05] +@Derek: doing the PGM stuff +@Prena: PO of this work. Q3 and longer. +Added Derek as PGM and Michelle and Houman. +with docs and QA effort. +Our feature team, doc, QA. +Glad everybody was able to join. + +Project board: https://github.com/orgs/advthreat/projects/44/views/1 + +Question about the structure of the meeting? + +@Sabrina: would be useful to have people from the AI team. +Because the backend will be working with the AI, but not really for us the UI. + +@Brook: whoever is going consuming the endpoint we'll building make sense here. + +@Prerna: Setup connection. Enabled XDR UI, Vercel and AWS VPC (AI UI) +API Gateway or not? +@Trent: worked on a gateway for INT. Direct VPC communication route is not able yet. +@Sabrina: who to talk to. +@Masaki: a name? +@Prerna: let's follow up with Jyoti. AI Ops team offline. +@Brooke: have you done Server Side Events (SSE). +@Sabrina: would you talk with them? +@Prerna: Jyoti talking about it. +@Yann: we could create an API Gateway, but it will not support SSE. + +@Prerna: look at the toast. Access token. +@Yann: doc provided +@Trent: looks good, need to take a closer look. +@Prerna: Sabrina question? +@Sabrina: onboarding work? Doing the toast, they are onboarded? +@Trent: onboarding done. You just click a little thing and got the 3 modals. +It is in localStorage. + +@Prerna: looking latest Figma links. +**** MEETING Revoke Token Design :work:meeting: +:LOGBOOK: +CLOCK: [2024-02-12 Mon 18:00]--[2024-02-12 Mon 18:50] => 0:50 +CLOCK: [2024-02-12 Mon 17:03]--[2024-02-12 Mon 17:54] => 0:51 +:END: +[2024-02-12 Mon 17:03] + +We have access and refresh tokens. (There are also session token, kind of access +token but can only be created during login, login is not an OAuth2 flow, this is +like a custom OAuth2 Authorization flow). + +Goal: + +- Expose an endpoint to revoke tokens + - refresh token: an application has been authorized by a user. They get a + refresh token. That user authorized this application multiple times + (potentially on different devices). The user would like to prevent this + application to use this refresh token again. + - access token: we would like to prevent this access token to work again (max + age 24h on server, cannot be changed). For this the current revocation + mechanism is ok. + +Other missing but important aspect of revocation. +During OAuth2 flow. +**** MEETING Brownfield Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2024-02-12 Mon 16:30]--[2024-02-12 Mon 17:03] => 0:33 +:END: +[2024-02-12 Mon 16:30] +@Prerna: Questions about Brownfields +How many customers we have provisioned so far. + +@Danny: only Superball, but not finished the script. + +@Prerna: concern with PIAM PGM. +@Danny: Kelly, concerned about the Breach Suite. +It's done from us to remove geo restriction of the suite. +We cannot link EU XDR while paying on NAM-only Breach Suite. + +@Danny: EA (Enterprise Agreements) 3 years come with other stuff. +*** 2024-02-13 Tuesday +**** MEETING Q4F24 Priorities :work:meeting: +:LOGBOOK: +CLOCK: [2024-02-13 Tue 17:06]--[2024-02-14 Wed 14:08] => 21:02 +:END: +[2024-02-13 Tue 17:06] +- Agenda (to discuss about) + + https://ciscosecurity.aha.io/bookmarks/epic_priority_lists/7327660358823831258/7335125708892975084 + +- Notes + - INFRA-Expand Cisco XDR geo + - @Crystal need to discuss with Engineering. After the SX EOL it would be a + lot easier to accomplish that. + - @Gayan staging env. + - @Namrata, Engineering taking a deeper look right now knowing this is a priority on next quarter. + Automation, modernizing some infra. + - @Brianna, more business operation oriented, we need a certain state for Q1. + - Reduce false positive incidents + - MITRE phase 2 +- Actions +*** 2024-02-14 Wednesday +**** MEETING Option 1 of PIAM using IROH :work:discussion: +:LOGBOOK: +CLOCK: [2024-02-14 Wed 14:08]--[2024-02-14 Wed 19:34] => 5:26 +:END: +[2024-02-14 Wed 14:08] +***** Option1 - A minimal headless IROH tenant to serve other common services and UI + +1 SCC account <=> 1 IROH headless account. Same as an unactivated org but has an +~enterprise_id~ and no Entitlement. +Onboard: CSC and DI during provisioning. + +#+begin_comment +What about SXO and SCA? +Without SXO/SCA it will imply a change in the UI to have a specific UI +for these "headless XDR Orgs" +#+end_comment + + +User PIAM token can be exchanged for a User IROH token in this headless Org. + +Working services: + - iroh-auth + - iroh-int + - iroh-sse + - iroh-api-gateway + - iroh-webhooks +****** Scenario - Common IROH without XDR +******* Integrations + - There will be a new scope for integrations called 'enterprise'. This scope will imply that the integration can only be configured via the SCC UI and will show up as read-only in the XDR UI. + #+begin_comment + What is an "integration" in this context and how XDR UI could be able to show one? + #+end_comment + + - Once the integration is configured, interactions with it can be supported via the IROH API gateway/IROH proxy from the common iroh tenant. DI will use the iroh proxy to communicate with its sources. + #+begin_comment + If an integration is like a common module. Currently SCC do not use the + onboarding directly. + We only support onboarding for: CSC, DI, SCA and SXO. + It would mean DI could not use any other module until other team support the + onboarding process and SCC is able to use it. + #+end_comment +****** Scenario - Separate XDR tenant in the enterprise + +#+begin_comment +What about Org switching? Should we hide the headless Orgs in the org selector +in XDR UI? +#+end_comment + + +#+begin_src +With the actual system, DI can already keep refresh tokens for all tenant. +And using the ~enterprise_id~ as indicator can know which XDR tenants are related together. + +So I am not sure we need an exchange mechanism as DI can, at any time, have a token for any XDR org or headless org. +#+end_src + +As the user purchases XDR, a new iroh tenant will be spun up for XDR in the enterprise +******* Provisioning +The XDR IROH tenant will be provisioned by PIAM when a license is acquired for XDR. This will be a fully functional IROH tenant will all XDR services being available +******* Suite Applications +The services this IROH tenant spins up upon being provisioned are the XDR specific service: + - SXO - Orchestration/Automate + - SCA - Analytics + - DAP - Data lake +******* Integrations + - The XDR Integrations UI will show the available and configured integrations using existing mechanisms. + - The integrations in the XDR tenant will NOT be used by DI. They will only be used by SXO, enrichment and DAP (Engineering ask to PM) + - The iroh-proxy service will only serve XDR components + - This will ensure that DI in the common iroh tenant doesn't need to be notified of the XDR integration sources + - The common integrations will not be used by XDR components (Engineering ask to PM). This will ensure the separation of iroh-proxy services to their own tenants. + +TBD: There might be a need in the future to show integrations from the common iroh tenant as read-only +******* Common DI-XDR communication +The DI module is used for enrichment and DI sends updates to XDR when assets are updated. In order to continue using this functionlity, + - The DI module will need to be used with the IROH-auth token for the common iroh tenant. In the future when the PIAM auth is available, it will use that as the module auth-type. The XDR tenant will need a client to talk to the common iroh tenant for this purpose. + - As there are asset updates in DI, the XDR tenant will need to be notified. For this, DI will need to be able to call the XDR tenant API using an iroh-auth token that will work. +******* iroh to iroh communication +Since there is a need for both the common iroh and the XDR iroh to talk to each other for the shared DI, there will need to be an oauth handshake when the XDR iroh tenant is provisioned with the common iroh tenant. This will result in both backends having iroh-auth tokens to talk to each other. + +As more XDR tenants are added to the enterprise, they will also go through the handshake with common iroh similar to above. +****** Pros + - Closer to the platform model where the common services are separated from XDR services + - Data retention policies can be applied to XDR independent of common iroh + - Telemetry for XDR not mixed with common iroh + - Allows for a model for common integrations for the shared services +****** Cons + - Need to establish communication between 2 iroh tenants + - Need to maintain separate iroh-auth tokens in the browser for common and XDR UIs or build a mechanism to get these tokens at run-time for the UI +*** 2024-02-15 Thursday +**** MEETING SCA Meeting for fixing tenants :work:meeting: +:LOGBOOK: +CLOCK: [2024-02-15 Thu 18:29]--[2024-02-15 Thu 22:14] => 3:45 +:END: +[2024-02-15 Thu 18:29] +- Agenda (to discuss about) +- Notes +- Actions +**** MEETING XDR v2 instant demo :work:meeting: +:LOGBOOK: +CLOCK: [2024-02-15 Thu 16:00]--[2024-02-15 Thu 17:14] => 1:14 +:END: +[2024-02-15 Thu 16:00] +- Agenda (to discuss about) +- Notes +- Actions +** 2024-W08 +*** 2024-02-20 Tuesday +**** CANCELED [#B] Estimate Common Org Option 1 :work: +SCHEDULED: <2024-02-26 Mon 10:00> +:LOGBOOK: +- State "CANCELED" from "IN-PROGRESS" [2024-02-29 Thu 18:53] \\ + we'll go with option 2 +:END: +[2024-02-20 Tue 20:45] +**** MEETING SX EOL :work:meeting: +:LOGBOOK: +CLOCK: [2024-02-20 Tue 20:22]--[2024-02-20 Tue 21:01] => 0:39 +:END: +[2024-02-20 Tue 20:22] +- Agenda (to discuss about) +*** 2024-02-21 Wednesday +**** MEETING SCA Convergence to XDR :work:meeting: +:LOGBOOK: +CLOCK: [2024-02-21 Wed 17:06]--[2024-02-21 Wed 17:57] => 0:51 +:END: +[2024-02-21 Wed 17:06] +- Agenda (to discuss about) + - We develop an execution plan. + - Establish and build Epics. + - Then commiting for Q4 and beyond. +- Notes +- Actions +** 2024-W09 +*** 2024-02-26 Monday +**** MEETING Meraki Geo :work:meeting: +:LOGBOOK: +CLOCK: [2024-02-26 Mon 20:01]--[2024-02-28 Wed 18:57] => 46:56 +:END: +[2024-02-26 Mon 20:01] +- Agenda (to discuss about) + +Hello Team, + +Sorry for the Friday meeting, we still have a few items that came up in our discussion today. I am adding Jyoti and Yann to discuss further. @Yann, I know it’s late for you so we can record the meeting and follow up async. + +Possible discussion points: +How should we map a region from Meraki Dashboard to XDR? +Is there a way to pull this via API or during OAUTH exchange? +Do the URLs vary between regions or are they proxied? +Are clients specific to a region? Could the client belong to multiple region? + +- Notes + + Waiting for @Jyoti. + + Andy Yong. Global client. + + +- Actions + + Return URLs per region. +*** 2024-02-28 Wednesday +**** MEETING API DEsign Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2024-02-28 Wed 18:57]--[2024-02-28 Wed 21:15] => 2:18 +:END: +[2024-02-28 Wed 18:57] +- Agenda (to discuss about) +- Notes +***** Status Updates + +@Mark +spin up multpile http proxies to have multiple IPs + +@Matt +Kafka vs SQS discussion. +Should end up with kafka probably shared with Automation. + +@Yann Status update + +- Brownfield blocked by PIAM currently. +- from DI: dump XDR vs SX orgs for data usage +- FMC proxy: Wanderson put a lot of effort to make this work, currently blocked + due to FMC lack of confidence, need more testing. +- New Clients with Meraki (I will create them, I do not have a list of scopes + yet I will probably use the ribbon one) +- New Clients for Automation (Santosh) +- request to remove XDR flag? +- request to re-provision SCA for TMEs +- AI confusion why not use modules? + @Jyoti, need to use the same session token. + @Jyoti, add a flag +- option-1 sizing: in progress + @Jyoti, go to option 2 only. + everything is shared. + Common IROH tenant. + + Question: will DI be external, like no XDR tier. + +@Jyoti to @Guillaume add new statuses. +***** Actions + +- prevent different tenant with the same enterprise. +*** 2024-03-01 Friday +**** DONE Meraki Clients [[webexteams://im?space=b5844a30-2e19-11ee-b0bb-8575ace105f3&message=5c5d9830-d666-11ee-96f8-cded4ea1ae28][discussion]] :work: +SCHEDULED: <2024-03-01 Fri 11:00> +[2024-03-01 Fri 09:47] +** 2024-W10 +*** 2024-03-04 Monday +**** MEETING Meraki OAuth Effort :work:meeting: +:LOGBOOK: +CLOCK: [2024-03-04 Mon 18:37]--[2024-03-04 Mon 20:47] => 2:10 +:END: +[2024-03-04 Mon 18:37] +- Agenda (to discuss about) +- Notes + - @Evan_Johnson; effort private beta with OAuth Effort. + - Vasundra PM. + - Familiar from Ken Mayer. + + - @Ken + - We're building a OAuth2 server. + Integration testing between Meraki Auth et Meraki API for 3rd parties. For + now XDR to start with. + No UI, no UX. + Vanilla OAuth. + + We just have API key. + Only two per person. + + Two way OAuth authorization. + RFC 6749. + + Could not use PIAM because the user base is too different. + + - @Jyoti talk to Sindhu Gopi, for PIAM team, because they don't want us to + do that. + + @Questions: + - server 2 server ? + - access token format ? JWT ? + - scopes in the JWT? + - refresh token format ? JWT / something else ? + +- Actions +*** 2024-03-05 Tuesday +**** MEETING XDR Admin & Management Core Team :work:meeting: +:LOGBOOK: +CLOCK: [2024-03-05 Tue 18:05]--[2024-03-05 Tue 19:08] => 1:03 +:END: +[2024-03-05 Tue 18:05] +- Agenda (to discuss about) +- Notes +- Actions +** 2024-W11 +*** 2024-03-11 Monday +**** MEETING JIRA Handoff :work:meeting: +[2024-03-11 Mon 19:59] +**** DONE Prepare a SCC MFE deep-dive presentation :work: +SCHEDULED: <2024-03-11 Mon 12:00> +[2024-03-11 Mon 19:59] +**** CHAT Shams Jamal to ask for revert and test :work:chat: +[2024-03-11 Mon 18:52] +**** CHAT Pujan to revert webhook change (as warned) :work:chat: +[2024-03-11 Mon 18:48] +**** DONE Updated IROH-Auth doc on login :work: +[2024-03-11 Mon 18:24] +**** CHAT Help Jeff Markey on entitlement API :work:chat: +[2024-03-11 Mon 18:23] +**** DONE Appeler Sundesk pour la RFID :work: +SCHEDULED: <2024-03-12 Tue 10:00> +[2024-03-11 Mon 18:18] +**** CHAT Provided TAC Portal ro access to Roman Eremin :work:chat: +[2024-03-11 Mon 18:17] +**** CHAT Told Constantin Deleanu to call Murali if SXO onboarding fails :work:chat: +[2024-03-11 Mon 18:17] +**** CHAT Explain re-onboarding script update to Danny :work:chat: +[2024-03-11 Mon 18:16] +**** CHAT Changed the SXO webhook for Pujan Trivedi :work:chat: +[2024-03-11 Mon 18:16] +**** MEETING Jerome & Patrick discussion :work:meeting: +[2024-03-11 Mon 18:55] +**** CHAT Put XDR Flag on 2 XDR org for Soumya :work:chat: +:LOGBOOK: +CLOCK: [2024-03-11 Mon 18:15]--[2024-03-11 Mon 20:01] => 1:46 +:END: +[2024-03-11 Mon 18:15] +**** DONE Repondre a [[https://github.com/advthreat/incident-manager/issues/2408][SXO webhook]] :work: +SCHEDULED: <2024-03-11 Mon 17:30> +[2024-03-11 Mon 16:42] +**** IN-PROGRESS Morning tour :work: +:LOGBOOK: +CLOCK: [2024-03-11 Mon 08:02]--[2024-03-11 Mon 08:37] => 0:35 +:END: +[2024-03-11 Mon 08:02] +*** 2024-03-13 Wednesday +**** CANCELED Talk to Kirill about the hackaton idea :work: +SCHEDULED: <2024-03-14 Thu 11:00> +:LOGBOOK: +- State "CANCELED" from "TODO" [2024-03-15 Fri 10:24] +:END: +[2024-03-13 Wed 18:38] +**** MEETING API Design Meeting :work:meeting: +[2024-03-13 Wed 18:24] +- Agenda (to discuss about) +- Notes + - PIAM & SCC + - Ops modernization + - AO boostraping OOM issue + - Telemetry missing events +- Actions +**** DONE Prepare new steps for Provisioning :work: +SCHEDULED: <2024-03-14 Thu 11:00> +[2024-03-13 Wed 18:01] + +Headless: DI & CSC +XDR: DI, CSC, SXO, SMA +Update: add SXO & SMA +**** HOLD Produire le PIAM Token Exchange endpoint :work: +SCHEDULED: <2024-03-18 Mon 11:00> +:LOGBOOK: +- State "HOLD" from "HOLD" [2024-03-27 Wed 18:16] \\ + on hold +- State "HOLD" from "IN-PROGRESS" [2024-03-27 Wed 18:16] \\ + on hold +CLOCK: [2024-03-13 Wed 17:57]--[2024-03-13 Wed 18:41] => 0:44 +:END: +[2024-03-13 Wed 17:57] +**** MEETING PIAM Ryan Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2024-03-13 Wed 16:15]--[2024-03-13 Wed 17:57] => 1:42 +:END: +[2024-03-13 Wed 16:15] +- Agenda (to discuss about) + + Can a token have: + + - multiple headless tenant (1 per region, multiple per region?) + who would be in charge of preventing this? + - multiple XDR tenant? (I think the answer is yes) + + Two "Token Exchanges" usage: + + 1. User uses SCC UI, they get a PIAM token, we need to select and show them an + IROH Org (headless tenant) + + 2. DI has a PIAM Token, they use this PIAM token directly or we need to + provide some IROH Access Token to continue to use a working mechanism with modules. + + +For case 1. +How can we ensure to select a single Org? + +For case 2. +My guess is that we can: + a. Create an API asking for a specific tenant and provide the token for it + b. Create an API that returns all tokens for all valid tenants (XDR & Headless). + +- Notes + +1 Platform Service Group. + + +Enterprise + -> Region + -> PlatformGroup + -> IROH Org + -> SSX Tenant + + +Keep track of the ~product-tenant-id~ inside the Org. + +Add a query param to the UNIVERSAL PROVISION API to distinguish between Headless/XDR. + +- Actions +**** CHAT SXO webhook conf change [[*webexteams://im?space=47c17620-e148-11ee-bb7f-b544af00ee33][room]] :work:chat: +[2024-03-13 Wed 15:55] +**** CHAT Blocker, SXO onboarding failing discussion [[webexteams://im?space=5ea12da0-e13d-11ee-a581-b9ddc7f36159][room]] :work:chat: +[2024-03-13 Wed 15:55] +**** CHAT Brownfield using NAM instead of PREVIEW for TEST [[webexteams://im?space=06fcf5e0-9dca-11ee-baad-23b6ab543fdf][room]] :work:chat: +:LOGBOOK: +CLOCK: [2024-03-13 Wed 15:54]--[2024-03-13 Wed 16:15] => 0:21 +:END: +[2024-03-13 Wed 15:54] +*** 2024-03-14 Thursday +**** HOLD Write Token Exchange API Issue :work: +SCHEDULED: <2024-03-18 Mon 10:00> +:LOGBOOK: +- State "HOLD" from "IN-PROGRESS" [2024-03-28 Thu 18:31] \\ + asked to hold this work +:END: +[2024-03-14 Thu 16:35] +*** 2024-03-15 Friday +**** DONE Disable rate-limit for client-8d4dc846-0424-4aeb-a3fa-b93b5f76cc3c (Santosh) :work: +SCHEDULED: <2024-03-15 Fri 16:00> +:LOGBOOK: +:END: +[2024-03-15 Fri 15:33] +**** DONE Add XDR flag for Josh Tompkins (webex DM) :work:chat: +SCHEDULED: <2024-03-15 Fri 14:00> +[2024-03-15 Fri 14:25] +**** DONE Open new emails for James Moser Org [[webexteams://im?space=331b38f0-6218-11e9-9aae-c5b8cb291b23&message=97c18840-e22e-11ee-b9e1-e78ab649c17a][webex-msg]] :work: +SCHEDULED: <2024-03-15 Fri 16:00> +[2024-03-15 Fri 09:30] +**** DONE Promote two SXO client org-level-auth + everyone + trusted :work: +SCHEDULED: <2024-03-15 Fri 10:00> +[2024-03-15 Fri 09:16] +**** DONE Add XDR flag to org for SXO :work: +SCHEDULED: <2024-03-15 Fri 10:00> +[2024-03-15 Fri 09:16] +** 2024-W12 +*** 2024-03-18 Monday +**** MEETING Brownfield check meeting :work:meeting: +[2024-03-18 Mon 17:36] +- Agenda (to discuss about) +- Notes +- Actions +**** MEETING SX EOL, support Secure Client UI on top of the rest :work:meeting: +[2024-03-18 Mon 17:36] +- Agenda (to discuss about) +- Notes +- Actions +**** CHAT Add SXO clients to trusted, rate-limit removed :work:chat: +:LOGBOOK: +CLOCK: [2024-03-18 Mon 17:35]--[2024-03-18 Mon 21:43] => 4:08 +:END: +[2024-03-18 Mon 17:35] +*** 2024-03-19 Tuesday +**** MEETING SX EOL bi-weekly :work:meeting: +:LOGBOOK: +CLOCK: [2024-03-19 Tue 19:36]--[2024-03-19 Tue 23:22] => 3:46 +:END: +[2024-03-19 Tue 19:36] +- Agenda (to discuss about) +- Notes + @Maribell phase 1 meeting yesterday with Dario. + Dario will create a phase 2 Epic. + The existing Epic will be phase 1. + + @Prerna: you all attended SX EOL last week, discussed with external product. + IROH Tenant creation for Secure Client, Umbrella, etc… + There will be a "common" IROH tenant that will work like SecureX. + If there is no XDR Entitlement it remains in the background. + + We will give them an /Interim UI/, trimmed down version of XDR UI. + - only My Account Page + - Integrations + - Users Management + + Just Secure Client Devices, and some admin pages. + + Users should not be able to perform the following actions with this UI: + - Any incident activity + - Incident investigation + - Automation workflow and response action + +For existing orgs, in SX supporting Secure Client. We need a list of those orgs +from our PM team. +We will add that flag to those orgs there will be a differentiation between XDR +and Trimmed down UI. +There will be a visual indication in the Registration UI. + +@Jyoti: Do we want to show the ribbon in the interim UI? +@Robert, @Dar, @Jyoti: no, easier, not really useful. + +@Prerna: + +Role Management. + +- Error pages + +- Actions +**** DONE Answer for SXO webhooks [[webexteams://im?space=47c17620-e148-11ee-bb7f-b544af00ee33&message=2b747830-e57d-11ee-9595-cf0ffe963bb2][msg]] :work: +SCHEDULED: <2024-03-19 Tue 10:00> +[2024-03-19 Tue 09:10] +*** 2024-03-20 Wednesday +**** MEETING API Design Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2024-03-20 Wed 17:31]--[2024-03-20 Wed 22:16] => 4:45 +:END: +[2024-03-20 Wed 17:31] +- Agenda (to discuss about) +- Notes +- Actions +*** 2024-03-21 Thursday +**** DONE Revert webhook conf for SXO :work: +SCHEDULED: <2024-03-21 Thu 14:00> +[2024-03-21 Thu 09:33] +*** 2024-03-22 Friday +**** CHAT Proposal for impersonation [[webexteams://im?space=a950c770-e7be-11ee-a86d-41e6b0cb7428][room]] :work:chat: +:LOGBOOK: +CLOCK: [2024-03-22 Fri 09:11]--[2024-03-22 Fri 09:25] => 0:14 +:END: +[2024-03-22 Fri 09:11] + +Good morning! + +I think in regards to the meeting we had yesterday I can propose the following: + +- keep the impersonation UI inserted inside XDR only in INT and TEST as this is + great for UI dev (and probably also backend devs) but might be a risk in PROD + just to make it discoverable from the UI js code. +- create another impersonate endpoint that will generate a session token for the + Org Virtual user which will be read-only. + And use the "impersonate with a link" method, which mean it would be easy to + deploy a UI behind the VPN (similar the TAC Portal) that could use this for + PMs need of just taking a look without affecting the telemetry (for the + telementry to be used, the token should have ~telemetry:write~ scope, which will + be removed from this specific token) +- For TAC I think the blocker is related to the user aknownledge and approval of + being impersonated. And for that, I don't think we have a technical solution + yet so I will keep the impersonate endpoint hidden out of the TAC API until + the UX is clearly defined. +** 2024-W13 +*** 2024-03-25 Monday +**** MEETING Brownfield :work:meeting: +[2024-03-25 Mon 15:31] + +How things are going Danny? + +Looks ok. + +@Houman: nothing rest to be done on our side +@Danny: Simon did mention a similar API for batch update +**** CHAT Fix wrong ff on TEST org :work:chat: +[2024-03-25 Mon 14:14] + +T.J. Busch + +Hi Yann, Not sure if you can help with this / fix it easily but it looks like on Friday one of our Teams XDR accounts had the xdr feature flag remvoed and replaced with cisco/feature-flag/xdr-ai-assistant. Are you able to quickly add back cisco/feature-flag/xdr or should the xdr-ai-assistant cover the XDR flag as well and would need to be investigated further by whatever team added it to our acct? + + +Test Env, Org:755757aa-5a62-4938-b9dc-1d57b301d6cc +**** CHAT Answered to AI Onboarding :work:chat: +:LOGBOOK: +CLOCK: [2024-03-25 Mon 10:08]--[2024-03-26 Tue 08:47] => 22:39 +:END: +[2024-03-25 Mon 10:08] +*** 2024-03-26 Tuesday +**** DONE Provide Sizing of XDR-E-164 Aha :work: +SCHEDULED: <2024-03-28 Thu 14:00> +[2024-03-26 Tue 19:47] +**** MEETING SX EOL Phase 1 Planning :work:meeting: +[2024-03-26 Tue 19:05] +***** Agenda + +- Any questions for PM? + - Decision on landing page? + +- Engineering Questions + - Yann - do we need to set-up INT and TEST domains or just the PROD URLs will suffice + I think it makes more sense to use the same pattern for a new domains + and have a specific domain for INT, TEST and all 3 PROD region. + - Jyoti - domain name for the SCC interim UI. Does the PIAM team have a preference? + - Dar/Derrick – Error pages update + - Murali - We have a couple of MDR tenants listed below, who are heavy users of the Automation workflows today. This morning, I asked Briana to check if they have already shifted from SecureX to XDR. If not, have they been informed or is it being taken care of? I brought up this concern to prevent any unexpected surprises for the MDR folks after SecureX EOL. It would also be beneficial to ascertain if they have shifted all their current organizations to XDR, or to understand their strategy concerning this EOL efforts. + - Current MDR Tenants (NAM) + - tenant=42ac91b9-d9df-48d8-a1d0-8c76988d0a9f / tenant_name=MDR-Stage-RTP12 + - tenant=e26d4c89-5942-48b3-89de-95495537b012 / tenant_name=[DEV] Cisco Managed Services -Operate, Cisco Systems + - tenant=c87b61da-dd8a-4aac-8ccb-4ef4329e1bfe / tenant_name="Cisco Managed Services - Operate, Cisco Systems + +Any other open questions for Phase 1? + +Prerna - Feature estimation and release planning +***** Notes +****** Landing Page + + + @Maribell: 1st question, landing page? + @Dar: Use the landing page of Secure Client UI + @Prerna: first question for landing page. We don't need MFE and just a landing page. +****** URLs ok +****** Domain preferences (Jyoti to check) +****** Error Page + +- @Derrick, add some message, contact. +- @Yann, still possible to see error page from both XDR and Interim UI. +- @Prerna: see where these error are appearing. Be sure there is no XDR mention. + Branded to Cisco and not XDR, nor SX. + So not a must have. +- @Maribell: nice to have +****** other notes + +release target? +- Dar, impact on Q3? + + @Prerna: ops work on new domains + Interim UI Dev. + + @Maribell: when is your team starting? + Rough estimate? @Dar not yet, this week. + +@Jyoti: we shouldn't add XDR flag automatically for internal orgs. + + - @Yann Ask Question: what is the behavior for SX-only, disabled, data deletion, etc…? + @Jyoti: yes + @Prerna: we will see with PM, we cannot take the decision ourselve + - @Prerna: invitation links to update +***** Actions + + - @Yann: add SC flag or XDR flag for orgs with clients with availability everyone. + - Use two roles for Interim UI (Secure Client) + - Update invite URLs + + Provide Sizing + + 2 releases in April, rest for Q4. + +XDR-E-164 +**** CHAT Provisioning tokens [[webexteams://im?space=5daec1a0-d7c0-11ed-92fa-6d628c54e741&message=c8df0740-eb98-11ee-9472-bff1df65375b][msg]] :work:chat: +[2024-03-26 Tue 18:57] +**** CHAT Discuss about AI provisioning :work:chat: +:LOGBOOK: +CLOCK: [2024-03-26 Tue 08:47]--[2024-03-26 Tue 20:09] => 11:22 +:END: +[2024-03-26 Tue 08:47] +**** DONE Update Meraki clients (redirects) :work: +[2024-03-26 Tue 08:47] +*** 2024-03-27 Wednesday +**** DONE Check AI API onboarding if it is difficult :work: +SCHEDULED: <2024-03-28 Thu 10:00> +[2024-03-27 Wed 18:51] +**** MEETING AI Provisioning meeting :work:meeting: +[2024-03-27 Wed 18:31] +Check if this would be difficult to use the actual API +**** MEETING API Design Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2024-03-27 Wed 17:31]--[2024-03-27 Wed 18:51] => 1:20 +:END: +[2024-03-27 Wed 17:31] + +- CII Auth? (Dar is here) +- Going CAP for a customer +- Discussion about the product + https://app.vidcast.io/share/80d99919-ee01-4592-95dc-f404d3ef3673 +- @Eric discuss about verdict and caching +- @Jyoti TTP +**** DONE Repondre au FMC proxy [[webexteams://im?space=721f8dc0-cd12-11ee-a899-374931ff16ab][room]] :work: +**** DONE Help Meraki [[webexteams://im?space=b5844a30-2e19-11ee-b0bb-8575ace105f3&message=17b44eb0-ebb3-11ee-92d3-d133b7376b1b][msg]] :work: +**** DONE Create Dashboard UI Clients in TEST and PROD +**** DONE Fix FMC Proxy issue with Bearer +**** DONE PR to add :r and :w to the scopes +*** 2024-03-28 Thursday +**** CHAT fix Meraki redirects in TEST :work:chat: +:LOGBOOK: +CLOCK: [2024-03-28 Thu 12:15]--[2024-03-28 Thu 18:32] => 6:17 +:END: +[2024-03-28 Thu 12:15] +*** 2024-03-29 Friday +**** CHAT Search for user without any user-name :work:chat: +:LOGBOOK: +CLOCK: [2024-03-29 Fri 19:17]--[2024-03-29 Fri 22:14] => 2:57 +:END: +[2024-03-29 Fri 19:17] + +#+begin_src +["not",{"like-match":["_%"],"search-in-paths":[["user-name"]]}] +#+end_src +**** DONE Answer to Engine [[webexteams://im?space=a1c4c7c0-ed3d-11ee-8f4b-23ee1d8b63f9][room]] :work: +SCHEDULED: <2024-03-29 Fri 10:00> +[2024-03-29 Fri 09:12] +**** DONE Take a look at doc [[webexteams://im?space=ff60e0b0-8d3b-11ee-a677-3d6eefa66fd9&message=b4945060-ed41-11ee-babd-c99a359c3dac][msg]] :work: +SCHEDULED: <2024-03-29 Fri 10:00> +[2024-03-29 Fri 09:10] +**** DONE Answer to Meraki [[webexteams://im?space=b5844a30-2e19-11ee-b0bb-8575ace105f3&message=d7b48fe0-ed52-11ee-ba18-2782508ab6e6][msg]] :work: +SCHEDULED: <2024-03-29 Fri 10:00> +[2024-03-29 Fri 09:10] +**** DONE Retrieve SCSO name field [[webexteams://im?space=76c797f0-ed51-11ee-a701-6dfa1ca0626f&message=922e7e10-ed6e-11ee-88e4-61f35a45a3c1][msg]] :work: +SCHEDULED: <2024-03-29 Fri 10:00> +[2024-03-29 Fri 08:48] + +1. PIAM Provisioning does not provide any user name (search for issue) +2. SCSO should provide a user name +3. user-name is not a mandatory field for a user, due to these specific + temporary case where the user is created and need to be used before the name + field exists + + +Good morning everyone, + +First things first: + +1. the only fields that are guaranteed to exist for a User are: + - user-id + - org-id + - role + - scopes + - enabled? + - create-at + + This is visible from the public User schema visible via Swagger UI for + example. (can be found here https://visibility.amp.cisco.com/iroh/profile/index.html#/Profile/get_iroh_profile_accounts) + + See screenshot too where mandatory fields are marked by a red asterix. + +2. When and why a User might not have a user-name field? + + a. We recently introduced PIAM universal provisioning. This new mechanism + does not provide any user name. So a user is created in our DB with only a user-email. + Until the user login via SCSO, the User will not have any user-name. + b. If SCSO does not provide any User name during the login step. While this + is technically possible for SCSO not to provide this field I doubt that + SCSO do not enforce the user name to be mandatory. + More technically, we use the `name` claim from the `id_token` returned by + PIAM during the OpenID Connect login flow. + c. SPECIAL CASE; in particular for playbook, Automation generate tokens for + Org Virtual Users. Such virtual users are a Virtual ADMIN user. The + user-name (as well as user-nick) for these virtual user exists and is set + to the Org Name (which is guaranteed to exists). + For obvious reason these virtual users do not have any user-email field. + + We use these virtual users to ensure that any admin of an org can be + disabled without breaking an OAuth2 integration. +** 2024-W14 +*** 2024-04-02 Tuesday +**** DONE Check search-users optimization :work: +SCHEDULED: <2024-04-02 Tue 10:00> +[2024-04-02 Tue 12:10] +**** DONE Check FMC bug [[webexteams://im?space=721f8dc0-cd12-11ee-a899-374931ff16ab&message=996530f0-f036-11ee-9037-211a83a01eed][msg]] :work: +SCHEDULED: <2024-04-02 Tue 10:00> +[2024-04-02 Tue 10:45] +**** DONE Answer Olympics invitation issues [[https://cisco-sbg.atlassian.net/browse/XDR-990][jira]] :work: +SCHEDULED: <2024-04-02 Tue 10:00> +[2024-04-02 Tue 10:37] +*** 2024-04-03 Wednesday +**** DONE XDR Threat Response Workshop :work: +SCHEDULED: <2024-04-03 Wed 10:00> +[2024-04-03 Wed 18:18] +**** DONE Answer to FMC for deploying in TEST :work: +SCHEDULED: <2024-04-03 Wed 10:00> +[2024-04-03 Wed 18:17] +**** DONE Fix invitation bug, renew a few customer invites :work: +SCHEDULED: <2024-04-03 Wed 10:00> +[2024-04-03 Wed 18:16] +**** MEETING Threat Hunting Workshop :work:meeting: +:LOGBOOK: +CLOCK: [2024-04-03 Wed 11:03]--[2024-04-03 Wed 21:47] => 10:44 +:END: +[2024-04-03 Wed 11:03] + +Build a lab that replicate a real life attack. + +Presentation: + +I am Yann Esposito, I am a software engineer specialized in authentication and +authorization. I built the XDR authentication and authorization engine which is +an OAuth2 and OpenID Connect Provider. + + +Favorite number, 42 because this is the answer to Life the Universe and +Everyting, second favorite number is the 5th tower of power of 2 + +Least favorite password, the DUO ones, that are only 4 numbers. + +What would you like to get out of this? + +I which to understand what our customer are experiencing and perhaps find +inspiration for new features I could push. + +SOC: +*** 2024-04-05 Friday +**** DONE Provide github tickets to Prerna [[webexteams://im?space=de666fe0-e85a-11ee-b2be-31ed59f4a874&message=746f8370-f2bd-11ee-8848-d956ec5eff8d][msg]] :work: +SCHEDULED: <2024-04-05 Fri 10:00> +[2024-04-05 Fri 10:17] +**** DONE Config les Client Automation Rules cs DM Santosh :work: +SCHEDULED: <2024-04-05 Fri 10:00> +[2024-04-05 Fri 09:50] + +Santosh Kumar Aitha • Below are Prod Clients to be marked as org virtual user and mark to as "everyone" along with ratelimits + + APJC: + +client-1b94b23c-e61d-4d2f-9455-9a1dd222c338 —> disable rate limit +client-443ae2d6-b440-4b5a-a2d4-e2a605181e8f + +EU: + +client-ef005243-4a5e-41ad-8e9e-0cc6e487d8e7 —> disable rate limit +client-05b641cc-d596-4ad7-bc63-b63522b41ef3 + +NAM: + +client-4ad2d3dc-038d-4f9e-acbf-68a047277526 —> disable rate limit +client-ad4e2af1-c790-4457-bdd3-1a0e66f52506 +** 2024-W15 +*** 2024-04-09 Tuesday +**** IN-PROGRESS Think about idle time mechanism :work: +[2024-04-09 Tue 17:54] +**** MEETING Suites QA test suite :work:meeting: +:LOGBOOK: +CLOCK: [2024-04-09 Tue 16:03]--[2024-04-10 Wed 14:46] => 22:43 +:END: +[2024-04-09 Tue 16:03] + +Requirements solidified +*** 2024-04-11 Thursday +**** MEETING RBAC Custom Roles :work:meeting: +:LOGBOOK: +CLOCK: [2024-04-11 Thu 15:03]--[2024-04-14 Sun 21:33] => 78:30 +:END: +[2024-04-11 Thu 15:03] +- Notes +Provide scopes to PIAM, +- from @Jyoti: too granular +- @Arun this is almost custom roles. +- @RobGresham: how do we sync the authorizations to PIAM. + - Enterprise want to understand between asset and casebook, enrich and event, etc… + - Presets should be in PIAM +- @RobGresham: SCC: +- Actions + Write down technical spec + 1. Create a new "Almost Empty Role" (~telemtry:write~, ~vault/...~ ) + 2. Create an API with a set of scopes for PIAM (all but the one in the Almost + Empty Role) + 3. Check with PIAM that the role + scopes will be provided in the ~id_token~ + during login + 4. Update IROH-Auth login to use the role and scopes from SCSO + - if scope is ~admin~, ~user~ or ~sat~ use it, otherwise use the new almost empty + role and add the scopes to the ~additional-scopes~ of this user. +*** 2024-04-12 Friday +**** DONE Update OAuth2 clients [[webexteams://im?space=db149a90-e8b4-11eb-9fdb-3b8d98a2bf4d&message=276f5bd0-f822-11ee-8915-41040ecb3969][msg]] :work: +SCHEDULED: <2024-04-12 Fri 10:00> +[2024-04-12 Fri 09:54] +** 2024-W16 +*** 2024-04-15 Monday +**** DONE Add sc flag to legacy provisioning API for SE :work: +SCHEDULED: <2024-04-15 Mon 10:00> +[2024-04-15 Mon 17:55] +**** IN-PROGRESS Dev apps in Org :work: +:LOGBOOK: +CLOCK: [2024-04-15 Mon 16:55]--[2024-04-16 Tue 00:47] => 7:52 +:END: +[2024-04-15 Mon 16:55] +**** CHAT Santosh (add asset scope to clients) :work:chat: +[2024-04-15 Mon 16:45] +**** MEETING Brownfield disabled :work:meeting: +:LOGBOOK: +CLOCK: [2024-04-15 Mon 16:31]--[2024-04-15 Mon 16:45] => 0:14 +:END: +[2024-04-15 Mon 16:31] + +@Danny; +POV moting other to STC in Q4, their going to start with PIAM. + +1. Entitlement removed +2. User with XDR-only roles + +@Danny; + +@Patricia: +On XDR disabled. Make all admin, read-only. Disable non-admin. +*** 2024-04-16 Tuesday +**** DONE Prepare a presentation about all use cases for SX EOL Phase 1 :work: +SCHEDULED: <2024-04-23 Tue 10:00> +[2024-04-16 Tue 17:07] + +- What occurs during downgrade +- What occurs for an XDR admin +- What occurs for an SX admin when they go XDR after 31th July +- What occurs to Sat user in XDR if they downgrade to SC? +- What should be the roles +**** MEETING Core team SX EOL :work:meeting: +:LOGBOOK: +CLOCK: [2024-04-16 Tue 16:35]--[2024-04-16 Tue 18:30] => 1:55 +:END: +[2024-04-16 Tue 16:35] +- Agenda (to discuss about) +- Notes +- Actions +**** DONE Merge apps in Org :work: +SCHEDULED: <2024-04-16 Tue 10:00> +[2024-04-16 Tue 16:31] +**** DONE Fix invite flaky test :work: +SCHEDULED: <2024-04-16 Tue 10:00> +[2024-04-16 Tue 16:30] +**** DONE Update PIAM link tenants :work: +SCHEDULED: <2024-04-16 Tue 10:00> +[2024-04-16 Tue 16:30] +**** DONE Talk with Austin Haas :work: +SCHEDULED: <2024-04-16 Tue 10:00> +[2024-04-16 Tue 11:44] +**** DONE Attach script for Danny :work: +SCHEDULED: <2024-04-16 Tue 10:00> +[2024-04-16 Tue 10:41] +**** DONE Answer to Brooke about JWT with audiences :work: +SCHEDULED: <2024-04-16 Tue 10:00> +[2024-04-16 Tue 10:41] +*** 2024-04-18 Thursday +**** MEETING Meraki onboarding :work:meeting: +:LOGBOOK: +CLOCK: [2024-04-18 Thu 16:32]--[2024-04-18 Thu 19:47] => 3:15 +:END: +[2024-04-18 Thu 16:32] +- Agenda (to discuss about) +- Notes +- Actions +*** 2024-04-19 Friday +**** DONE Create a Test Org for Dan sc-only :work: +SCHEDULED: <2024-04-19 Fri 10:00> +[2024-04-19 Fri 09:11] +** 2024-W17 +*** 2024-04-22 Monday +**** MEETING Brownfield :work:meeting: +:LOGBOOK: +CLOCK: [2024-04-22 Mon 16:30]--[2024-04-23 Tue 10:15] => 17:45 +:END: +[2024-04-22 Mon 16:30] + +relink. + +Reversion of XDR account. +Check with roles. +*** 2024-04-23 Tuesday +**** IN-PROGRESS Engine client on INT deactivated :work: +:LOGBOOK: +CLOCK: [2024-04-23 Tue 14:32]--[2024-04-24 Wed 20:06] => 29:34 +:END: +[2024-04-23 Tue 14:32] +**** DONE UI for feature-flags :work: +SCHEDULED: <2024-04-25 Thu 10:00> +[2024-04-23 Tue 09:04] +**** DONE Review Mark PR [[https://github.com/advthreat/iroh/pull/9208][token cache]] :work: +SCHEDULED: <2024-04-23 Tue 10:00> +:LOGBOOK: +CLOCK: [2024-04-23 Tue 10:15]--[2024-04-23 Tue 14:32] => 4:17 +:END: +[2024-04-23 Tue 09:03] +*** 2024-04-24 Wednesday +**** DONE Write a comment about redirection with SC and XDR :work: +SCHEDULED: <2024-04-24 Wed 19:00> +[2024-04-24 Wed 18:59] +**** DONE Check JIRA ticket [[https://cisco-sbg.atlassian.net/browse/XDR-1598][ticket]] :work: +SCHEDULED: <2024-04-24 Wed 10:00> +[2024-04-24 Wed 10:19] +*** 2024-04-25 Thursday +**** MEETING Custom Roles RBAC :work:meeting: +:LOGBOOK: +CLOCK: [2024-04-25 Thu 18:02]--[2024-04-26 Fri 01:59] => 7:57 +:END: +[2024-04-25 Thu 18:02] +- Agenda (to discuss about) +- Notes +- Actions +**** MEETING Didi CII provisioning/integration with XDR :work:meeting: +:LOGBOOK: +CLOCK: [2024-04-25 Thu 15:03]--[2024-04-25 Thu 16:06] => 1:03 +:END: +[2024-04-25 Thu 15:03] + +Customer need to define roles in their own IdPs. + +- Product does not support IdP initiated login. +- @Didi: Okta is not enough to support Orgs +- @Ryan: we will continu with Okta +- @Didi: we must support customer RBAC from their IdP + +- Use docs + + https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/access-control/index.md + +- @Ryan: Focus technical discussion. + +- @Didi: 2% of DUO customer use private IdP, 50% of the logins +*** 2024-04-26 Friday +**** MEETING Monthly :work:meeting: +:LOGBOOK: +CLOCK: [2024-04-26 Fri 17:58]--[2024-04-29 Mon 17:01] => 71:03 +:END: +[2024-04-26 Fri 17:58] + +Pres: + +- Ops team moved toward using JSON. Still work in proress. +- GE managed to cleanup the problem with SCA while still progressing on MITRE +- Mario worked on adding a metric lib to improve our ability to understand the code +- Kirill worked on notifications, worked on email format, notification + preferences, automatic link to assigned incident, +- Myself on SX EOL phase 1 +- Preparing for Q4 + + +***** @Jyoti intro + +Some escalation. +Great to see how we resolved those issues. +No blaming just great collaboration. + + +***** Updates +****** Ops +- 2 releases, and 100% up-time +- disaster recovery gaps tests +- SX EOL we are working on +****** Release status +- 2 releases, nothing surprised. +- many patches in prod. +- one patch today, and probably next week before RSA + May 6, no prod Env. +- Working checking everything is good before RSA. +- Moved to JIRA, please reach out to Patricia + +****** Engine +- triage + +****** Simonson +- + ... + +***** @Jyoti + +- Phase 1 SX EOL - July 31 + Brand new UI for customer that did not upgrade to XDR but have Secure Client. + SC has deps on DI. + +**** CANCELED Check module [[webexteams://im?space=b5136a40-6687-11ed-9679-4b10798d7c1a&message=2525a150-0343-11ef-9fc2-2d92d0fafd0a][msg]] :work: +SCHEDULED: <2024-04-26 Fri 10:00> +:LOGBOOK: +- State "CANCELED" from "TODO" [2024-04-30 Tue 18:16] +:END: +[2024-04-26 Fri 09:06] + +** 2024-W18 +*** 2024-04-29 Monday +**** MEETING But Santosh :work:meeting: +:LOGBOOK: +CLOCK: [2024-04-29 Mon 17:01]--[2024-04-29 Mon 21:48] => 4:47 +:END: +[2024-04-29 Mon 17:01] +- Agenda (to discuss about) +- Notes +- Actions +**** DONE James Moser chat :work: +SCHEDULED: <2024-04-29 Mon 10:00> +[2024-04-29 Mon 10:36] +**** DONE Hisan Mitre flag :work: +SCHEDULED: <2024-04-29 Mon 10:00> +[2024-04-29 Mon 10:36] +*** 2024-04-30 Tuesday +**** DONE AI Assistant Provisioning :work: +SCHEDULED: <2024-04-30 Tue 10:00> +[2024-04-30 Tue 10:46] +**** DONE Ask Adam URLs for AI assistant provisioning :work: +SCHEDULED: <2024-05-01 Wed 10:00> +[2024-04-30 Tue 18:15] +** 2024-W20 +*** 2024-05-13 Monday +**** DONE Lead Performance Reflections :work: +SCHEDULED: <2024-05-13 Mon 10:00> +[2024-05-13 Mon 10:04] + +Over the past six months, our team has delivered several significant +accomplishments that have met and exceeded expectations based on each member's +role: + +1. Olivier: + - Added support for XDR Tier module filtering: This accomplishment has + allowed the support of the monetization of our product. + + - Delivered MITRE Matrix: By delivering this feature, Olivier helped improve + the security posture of our clients by enabling them to align their + security controls with industry-standard frameworks like MITRE ATT&CK. This + has contributed significantly to our product's value proposition and market + competitiveness. + + - Improved node configuration mechanism: The improved node configuration + mechanism has streamlined the setup process for our developers, reducing the + time it takes for them to configure and deploy our product and opening a + way to improve multi region support. + + +2. Wanderson: + - CDO Integration: This integration allowed us to continue to support SSE + integration even after the planned SX EOL. + + - PIAM Universal Provisioning: By adding support for PIAM universal + provisioning, Wanderson built an essential part of the system to provision + new XDR account for our customers. + + - Added PIAM Brownfield account linking: This feature allowed our clients to + integrate existing SecureX accounts with the PIAM platform, ensuring a smooth + onboarding process and reducing the time required to adopt our product + fully. + + - To achieve these tasks, Wanderson also added JWKS support for external API + providers like PIAM (Okta), FMC, and any other type of JWT provider: This addition + has made it easier for us to integrate with third-party services, + improving overall interoperability and flexibility. + +3. Myself (Additional Contributions): + + - Added the API and UI to manage feature flags: By providing a dedicated + interface for managing feature flags, I have empowered other teams like + UI developers, QA, POs, and PMs to make changes independently without + relying on your team, thus improving overall efficiency. + + - Helped architecture and plan detailed technical details for features: My + involvement in the planning process has ensured that our product's + development is well-coordinated and aligned with business objectives, + leading to more successful feature launches. + + - Helped other teams integrate with XDR/IROH (particularly SCA, Meraki, AI + Assistant team): My efforts have facilitated collaboration between + different teams within the organization, fostering a culture of + cross-functional cooperation and driving innovation across various + products. + + - Started planning for providing long-running dashboard: This initiative will + enable users to monitor their security posture over an extended period, + improving overall visibility and decision-making capabilities. + This will also improve our ability to make demos of our product. + + - Technical Design to Improve XDR session security: My contribution has + ensured that our product remains secure by implementing improvements in + session security, thus protecting client data and maintaining trust with + our user base. + + - Assisted SXO with their new integration: By supporting the successful + integration of another team's work into your own, I have demonstrated a + commitment to collaboration and ensuring seamless experiences for all users + across different products. + + - Prepare the work for future PIAM integration into XDR: My proactive + planning has set the stage for a smooth integration between our two + platforms in the future, enabling us to deliver even more value to clients + as we continue to grow and evolve. +*** 2024-05-14 Tuesday +**** MEETING Core Team: SX EOL +:LOGBOOK: +CLOCK: [2024-05-14 Tue 16:35]--[2024-05-14 Tue 22:26] => 5:51 +:END: +[2024-05-14 Tue 16:35] +- Agenda (to discuss about) +- Notes +- Actions +**** DONE Write up the bomb SX EOL date issue :work: +SCHEDULED: <2024-05-15 Wed 10:00> +[2024-05-14 Tue 16:57] + +I feel there might be some confusion about the mechanism introduced to change +the SX EOL technical date from the backend. + +The SX EOL works will need a mechanism different from the usual release process. + +Instead of having a change of behavior occuring after a realease we need instead +to release a product that contains two different behaviors (see later for details) +in the same release but will change after some date. + +This put two difficulties: + +1. testing before the date +2. rollback to previous behavior after the date + +More technically: + +After SX EOL, the business logic will change in the backend for SX-only users. +From the discussion we had yesterday: + +- before SX EOL: + - most org works as of today + - for Org manually flagged to be "SC-only": + - the scopes of their user will be different. These users will not be able + to use SX nor XDR, they will be forced to use SC UI. And users in theses + orgs will not be able to perform Automation actions, Response action or + access private intel (manage incident in particular). + - the modules will be filtered to only accept a few, I think only DI, CSC + and SE (orbital does not use a module). + +- after SX EOL: + - XDR org => nothing change + - all SX orgs will be considered as if they had the SC-only flag (changed from + our discussion yesterday) + +In the UI the logic will also change: + - before SX EOL: + - for XDR org reaching any UI (SX, SC, XDR) => redirect them to XDR + - for SX org (withouth the SC flag) reaching any UI => redirect to SX + - for SC-only org reaching any UI => redirect to SC Interim UI + - after SX EOL: + - for XDR org reaching any UI => redirect to XDR + - for SX or SC org => redirect to SC UI + +As consequence, for both the backend and the frontend code we need a place where +we need to check if we reached SX EOL. And depending on that check, the code +behaves differently. + +Now, we face two issues: + +1. testing both the before and after SX EOL behavior before the SX EOL date for + QA in the TEST environment. +2. In case of major bug (any kind) be able to rollback to the behavior of before + SX EOL. + +A technical solution to this problem is to have the API to returns a boolean +with "we've reached SX EOL". +So both the backend and the UI could sync and know which behavior they should use. + +And add an endpoint that QA could use to change the date of SX EOL in TEST, so +QA could test both scenario in TEST. + +Also, it is necessary to have the backend return the “we’ve reached SX EOL date” +and not separate this check from the backend and the frontend to prevent UI bugs +(due for example to browser date being wrong). + +So I hope this clarify why we need this work and this is not due to SX EOL date +change risk. This is necessary to handle a non standard release. + +Best, +Yann. +*** 2024-05-15 Wednesday +**** MEETING API Design Meeting :work:meeting: +[2024-05-15 Wed 18:34] +- Agenda (to discuss about) + - @Yann: priorities: + - SX EOL Phase 1, in progress + - AI Provisionning (not sure what the status is, need to contact Adam) + - AI/MITRE feature flags + - Meraki Integration (add webhook on SCA module creation) + - Browfield requests maintenance (looks ok) + - Added work with Orbital / SE provisioning (part of SX EOL Phase 1 anyway) +- Notes +- Actions +**** MEETING SX EOL Orbital :work:meeting: +[2024-05-15 Wed 16:37] +- Agenda (to discuss about) +- Notes +- Actions +**** MEETING Integration Oort (CII) :work:meeting: +:LOGBOOK: +CLOCK: [2024-05-15 Wed 15:00]--[2024-05-15 Wed 19:24] => 4:24 +:END: +[2024-05-15 Wed 15:00] +- Notes + - Andy and CII + - Yana: + + 1st: POC that Nico done on MFE auth strategy + 2nd: CII Integration in General + + 1st: @Nico_Batalla + micro-frontend, +- Actions + - someone to send back the demo and video of the PoC +*** 2024-05-17 Friday +**** IN-PROGRESS Ping Adam for URLs of onboarding :work: +:LOGBOOK: +CLOCK: [2024-05-17 Fri 10:39]--[2024-05-17 Fri 11:37] => 0:58 +:END: +[2024-05-17 Fri 10:39] +**** DONE Answer Ihor :work: +SCHEDULED: <2024-05-17 Fri 10:00> +[2024-05-17 Fri 09:54] +**** DONE Answer Austin Haas :work: +SCHEDULED: <2024-05-17 Fri 10:00> +[2024-05-17 Fri 09:54] +** 2024-W21 +*** 2024-05-22 Wednesday +**** MEETING API Design Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2024-05-22 Wed 18:03]--[2024-05-22 Wed 22:03] => 4:00 +:END: +[2024-05-22 Wed 18:03] + +Data Analytics Platform. + +Platform Team reach out to us to help. +Sighting context. +Incident Bundle. + +Remote module, +Yanis, and folks on our team that can work in python that can help out. + +I need to identify in our team. +Send someone from our team to them. +Give me some names for people that will be candidate for that work. + +They are making a lot of assumption on the data and mapping. + +GE would be perfect. + +***** Actions + +- Need names to work with SCA to work in Python. + +**** DONE onboarding AI etc… [[webexteams://im?space=de666fe0-e85a-11ee-b2be-31ed59f4a874&message=1d03acc0-1774-11ef-83c0-7fc37d118b0f][webex]] :work: +SCHEDULED: <2024-05-22 Wed 10:00> +[2024-05-22 Wed 09:06] + +*** 2024-05-23 Thursday +**** MEETING Redirection for SX EOL :work:meeting: +[2024-05-23 Thu 17:37] + +Logic for the new UI for SC before and after SX EOL. + +@Jyoti: my understanding. + +Before sx. + +SX org should be redirected to SC UI. +XDR should be redirected to XDR +**** IN-PROGRESS AI onboarding :work: +:LOGBOOK: +CLOCK: [2024-05-23 Thu 16:53]--[2024-05-23 Thu 18:26] => 1:33 +:END: +[2024-05-23 Thu 16:53] + + +./ai-direct-onboard -e nam --org-id '8a64aced-2299-41be-9faa-5caf7a16043e' +:nam,8a64aced-2299-41be-9faa-5caf7a16043e,aalishah@xentaurs.com,{:id "8a64aced-2299-41be-9faa-5caf7a16043e", :name "Xentaurs", :taskId "8a64aced-2299-41be-9faa-5caf7a16043e"} +https://xdr-ai-api.us.security.cisco.com/api/v1/tenants +{:cached nil, + :request-time 926, + :repeatable? false, + :protocol-version {:name "HTTP", :major 1, :minor 1}, + :streaming? true, + :http-client + #object[org.apache.http.impl.client.InternalHttpClient 0x73e25780 "org.apache.http.impl.client.InternalHttpClient@73e25780"], + :chunked? false, + :reason-phrase "OK", + :headers + {"x-amzn-RequestId" "875c80c9-2209-4612-8e28-d2900d6080bc", + "Content-Type" "application/json", + "Content-Length" "49", + "X-Ratelimit-Limit" "0", + "X-Ratelimit-Remaining" "0", + "x-amzn-Remapped-Content-Length" "49", + "X-Ratelimit-Reset" "0", + "Connection" "close", + "x-amz-apigw-id" "YOrAuGLOIAMEblQ=", + "x-amzn-Remapped-Date" "Thu, 23 May 2024 14:53:30 GMT", + "Date" "Thu, 23 May 2024 14:53:31 GMT", + "Vary" "Origin"}, + :orig-content-encoding nil, + :status 200, + :length 49, + :body {:taskId "8a64aced-2299-41be-9faa-5caf7a16043e"}, + :trace-redirects []} + +for o in 'a39fb3c0-47af-4b82-9a56-b4998f154217' '794047a5-b023-489e-b5ee-6407fcdf0daa' '674c5065-9567-4e71-808d-75cb4e8b5520' 'e44139d5-63bd-42dc-a548-62b3f4f5c749'; ./ai-direct-onboard -e nam --org-id "$o"; end +:nam,a39fb3c0-47af-4b82-9a56-b4998f154217,mnaranjo@chla.usc.edu,{:id "a39fb3c0-47af-4b82-9a56-b4998f154217", :name "Childrens Hospital Los Angeles", :taskId "a39fb3c0-47af-4b82-9a56-b4998f154217"} +https://xdr-ai-api.us.security.cisco.com/api/v1/tenants +{:cached nil, + :request-time 1404, + :repeatable? false, + :protocol-version {:name "HTTP", :major 1, :minor 1}, + :streaming? true, + :http-client + #object[org.apache.http.impl.client.InternalHttpClient 0x36cdcae0 "org.apache.http.impl.client.InternalHttpClient@36cdcae0"], + :chunked? false, + :reason-phrase "OK", + :headers + {"x-amzn-RequestId" "6a3df1e2-b9ca-4baf-9b14-836ef39cf44f", + "Content-Type" "application/json", + "Content-Length" "49", + "X-Ratelimit-Limit" "0", + "X-Ratelimit-Remaining" "0", + "x-amzn-Remapped-Content-Length" "49", + "X-Ratelimit-Reset" "0", + "Connection" "close", + "x-amz-apigw-id" "YOrQRGkdoAMEhCw=", + "x-amzn-Remapped-Date" "Thu, 23 May 2024 14:55:11 GMT", + "Date" "Thu, 23 May 2024 14:55:11 GMT", + "Vary" "Origin"}, + :orig-content-encoding nil, + :status 200, + :length 49, + :body {:taskId "a39fb3c0-47af-4b82-9a56-b4998f154217"}, + :trace-redirects []} +nil +:nam,794047a5-b023-489e-b5ee-6407fcdf0daa,mrodrigue@roomandboard.com,{:id "794047a5-b023-489e-b5ee-6407fcdf0daa", :name "Room & Board", :taskId "794047a5-b023-489e-b5ee-6407fcdf0daa"} +https://xdr-ai-api.us.security.cisco.com/api/v1/tenants +{:cached nil, + :request-time 697, + :repeatable? false, + :protocol-version {:name "HTTP", :major 1, :minor 1}, + :streaming? true, + :http-client + #object[org.apache.http.impl.client.InternalHttpClient 0x7aca299e "org.apache.http.impl.client.InternalHttpClient@7aca299e"], + :chunked? false, + :reason-phrase "OK", + :headers + {"x-amzn-RequestId" "e704a69c-5e08-4c61-96fa-93c7b0ef1c93", + "Content-Type" "application/json", + "Content-Length" "49", + "X-Ratelimit-Limit" "0", + "X-Ratelimit-Remaining" "0", + "x-amzn-Remapped-Content-Length" "49", + "X-Ratelimit-Reset" "0", + "Connection" "close", + "x-amz-apigw-id" "YOrRBFKNIAMEbeg=", + "x-amzn-Remapped-Date" "Thu, 23 May 2024 14:55:15 GMT", + "Date" "Thu, 23 May 2024 14:55:15 GMT", + "Vary" "Origin"}, + :orig-content-encoding nil, + :status 200, + :length 49, + :body {:taskId "794047a5-b023-489e-b5ee-6407fcdf0daa"}, + :trace-redirects []} +nil +:nam,674c5065-9567-4e71-808d-75cb4e8b5520,richard.tippett@corebridgefinancial.com,{:id "674c5065-9567-4e71-808d-75cb4e8b5520", :name "Corebridge Financial", :taskId "674c5065-9567-4e71-808d-75cb4e8b5520"} +https://xdr-ai-api.us.security.cisco.com/api/v1/tenants +{:cached nil, + :request-time 990, + :repeatable? false, + :protocol-version {:name "HTTP", :major 1, :minor 1}, + :streaming? true, + :http-client + #object[org.apache.http.impl.client.InternalHttpClient 0x7aca299e "org.apache.http.impl.client.InternalHttpClient@7aca299e"], + :chunked? false, + :reason-phrase "OK", + :headers + {"x-amzn-RequestId" "c5142478-75cb-4416-a9bb-47d490ba4447", + "Content-Type" "application/json", + "Content-Length" "49", + "X-Ratelimit-Limit" "0", + "X-Ratelimit-Remaining" "0", + "x-amzn-Remapped-Content-Length" "49", + "X-Ratelimit-Reset" "0", + "Connection" "close", + "x-amz-apigw-id" "YOrRrE80IAMEBqA=", + "x-amzn-Remapped-Date" "Thu, 23 May 2024 14:55:19 GMT", + "Date" "Thu, 23 May 2024 14:55:19 GMT", + "Vary" "Origin"}, + :orig-content-encoding nil, + :status 200, + :length 49, + :body {:taskId "674c5065-9567-4e71-808d-75cb4e8b5520"}, + :trace-redirects []} +nil +:nam,e44139d5-63bd-42dc-a548-62b3f4f5c749,omar@xentaurs.com,{:id "e44139d5-63bd-42dc-a548-62b3f4f5c749", :name "ATSG PROD", :taskId "e44139d5-63bd-42dc-a548-62b3f4f5c749"} +https://xdr-ai-api.us.security.cisco.com/api/v1/tenants +{:cached nil, + :request-time 704, + :repeatable? false, + :protocol-version {:name "HTTP", :major 1, :minor 1}, + :streaming? true, + :http-client + #object[org.apache.http.impl.client.InternalHttpClient 0x280099a0 "org.apache.http.impl.client.InternalHttpClient@280099a0"], + :chunked? false, + :reason-phrase "OK", + :headers + {"x-amzn-RequestId" "ce1e9cc2-c2d2-4c36-b86a-349c1b074ea5", + "Content-Type" "application/json", + "Content-Length" "49", + "X-Ratelimit-Limit" "0", + "X-Ratelimit-Remaining" "0", + "x-amzn-Remapped-Content-Length" "49", + "X-Ratelimit-Reset" "0", + "Connection" "close", + "x-amz-apigw-id" "YOrSYHiiIAMEOQg=", + "x-amzn-Remapped-Date" "Thu, 23 May 2024 14:55:23 GMT", + "Date" "Thu, 23 May 2024 14:55:24 GMT", + "Vary" "Origin"}, + :orig-content-encoding nil, + :status 200, + :length 49, + :body {:taskId "e44139d5-63bd-42dc-a548-62b3f4f5c749"}, + :trace-redirects []} +nil +**** DONE [[webexteams://im?space=b8c12c60-18dd-11ed-8af1-af2bd6a6c8a4&message=109752c0-1869-11ef-8d9f-95e173807070][bad-module]] :work: +SCHEDULED: <2024-05-23 Thu 10:00> +[2024-05-23 Thu 08:17] +**** DONE Robert Harris redirect bug? [[https://cisco-sbg.atlassian.net/browse/XDR-3194][jira ticket]] :work: +SCHEDULED: <2024-05-23 Thu 10:00> +[2024-05-23 Thu 08:19] +**** DONE Remove manual flag https://ciscosecurity.aha.io/features/XDR-698 :work: +SCHEDULED: <2024-05-23 Thu 10:00> +[2024-05-23 Thu 08:22] +**** DONE Test AI onboarding headers INT and TEST :work: +SCHEDULED: <2024-05-23 Thu 10:00> +[2024-05-23 Thu 08:22] +**** DONE Ask Prerna about NAM Beta customer and who did it :work: +SCHEDULED: <2024-05-23 Thu 10:00> +[2024-05-23 Thu 08:23] +**** DONE Poser et/ou vendre les congés 12j non pris. :work: +SCHEDULED: <2024-05-23 Thu 10:00> +[2024-05-23 Thu 11:05] +**** DONE Write down redirect logic :work: +SCHEDULED: <2024-05-23 Thu 10:00> +[2024-05-23 Thu 18:05] + +***** The logic in the UI: + +1. the UI will call the ~/whoami~ endpoint + This will contain: + + #+begin_src js +{"org" {"main-app" APP} + "metas" {"apps" {APP {"url" "URL of APP"}}} + #+end_src + +2. Then the logic BEFORE AND AFTER SX EOL will be exactly the same: + + #+begin_src js + let app = whoami.org["main-app"]; + let expectedURL = whoami.metas.apps[app].url; + if (currentURL does not match expectedURL) { + redirectTo(expectedURL); + } + #+end_src + +***** The logic in the backend + +Before SX EOL: + +- orgs with the XDR Flag => will have main app XDR +- orgs without the XDR Flag, without the SC Flag => will have main app SX +- orgs without the XDR Flag but with the SC Flag => will have the main app SC + +After SX EOL: + +- orgs with the XDR Flag => will have main app XDR +- orgs without the XDR Flag => will have main app SC +- no org will have their main app be SX + + +***** Configuration in the backend + +For every deployed environment (INT, TEST, PROD NAM, PROD EU, PROD APJC), +in the ~config.edn~ we will have a mapping looking like (example for PROD NAM): + +#+begin_src clojure +{... + :apps {:xdr {:url "https://xdr.us.security.cisco.com"} + :sx {:url "https://securex.us.security.cisco.com"} + :sc {:url "https://secure-client.us.security.cisco.com"}} + ...} +#+end_src + +** 2024-W22 +*** 2024-05-27 Monday +**** CHAT Answer to Dan :work:chat: +:LOGBOOK: +CLOCK: [2024-05-27 Mon 10:58]--[2024-05-27 Mon 15:46] => 4:48 +:END: +[2024-05-27 Mon 10:58] + +#+begin_src js +const me = await irohClient.get("/profile/whoami"); +const mainApp = me?.data?.org?["mainApp"]; +const applicationLoaded = getApplicationLoaded(); + +if (mainApp != applicationLoaded) { + // ERROR CASE + // THE USER IS ON AN APP HE IS NOT AUTHORIZED TO USE + switch (mainApp) { + case "xdr": + // Let's console.warn this for debugging purposes when log preservation is on + console.warn("You do not have access to " + applicationLoaded + "." + + " You will be redirected to XDR"); + clearSession(); + // Send you to Secure Client + window.location = `https://${XDRMap.get(eitherHostname())}`; + break; + case "sc": + // Let's console.warn this for debugging purposes when log preservation is on + console.warn("You do not have access to " + applicationLoaded + "." + + " You will be redirected to Secure Client UI"); + clearSession(); + // Send you to XDR ;; I invented here + window.location = `https://${secureClientXDRMap.get(eitherHostname())}`; + break; + case "sx": + // Let's console.warn this for debugging purposes when log preservation is on + console.warn("You do not have access to " + applicationLoaded + "." + + " You will be redirected to SecureX"); + clearSession(); + window.location = `https://${newAndOldUrlMap.get(eitherHostname())}`; + break; + default: + } +} +#+end_src + + +#+begin_src js +const me = await irohClient.get("/profile/whoami"); +const mainApp = me?.data?.org?["mainApp"]; +const applicationLoaded = getApplicationLoaded(); + +function redirectTo(app) { + console.warn("You do not have access to " + applicationLoaded + "." + + " You will be redirected to " + app); + clearSession(); + // Send you to app + let mapping = null; + switch(app) { + case "xdr": mapping = XDRMap; break; + case "sc": mapping = SecureClientXDRMap; break; + case "sx": mapping = newAndOldUrlMap; break; + } + window.location = `https://${mapping.get(eitherHostname())}`; +} + +if (mainApp != applicationLoaded) { + redirectTo(mainApp) +} +#+end_src +**** DONE Keep link to history comment [[webexteams://im?space=b62bf8f0-6062-11ed-9564-a57f2c094899&message=8862d630-142c-11ef-b965-7f09fb9de79f][should I revert it?]] :work: +SCHEDULED: <2024-05-27 Mon 10:00> +[2024-05-27 Mon 11:17] +*** 2024-05-28 Tuesday +**** MEETING XDR Ribbon Auth :work:meeting: +:LOGBOOK: +CLOCK: [2024-05-28 Tue 16:32]--[2024-05-28 Tue 17:32] => 1:00 +:END: +[2024-05-28 Tue 16:32] + +Auth we need to go to SX portal, create the client-id and secret and register that. + +But for the plugin will work with SSO auth. +The user is just log in. + +User create the client, but new. + + +Currently SWA are using Client Creds. +Tell them this will continu to work. + +Proposed to use Device Grant instead as this is the recommended way to do it. +*** 2024-05-29 Wednesday +**** MEETING Core Team SX EOL :work:meeting: +:LOGBOOK: +CLOCK: [2024-05-29 Wed 16:01]--[2024-05-29 Wed 23:58] => 7:57 +:END: +[2024-05-29 Wed 16:01] + +CTR and visibility URL: Talk about visibility UI and other endpoints. +** 2024-W23 +*** 2024-06-03 Monday +**** DONE Check if we could use stored procedure for delete table [[https://github.com/advthreat/iroh/blob/77b700a7793db56c55aea8816ca030c4a90edb59/services/tk-stores/src/tk_stores/crud_store/postgres.clj#L114][iroh line]] :work: +SCHEDULED: <2024-06-03 Mon 10:00> +[2024-06-03 Mon 09:38] +**** DONE Answer to Christian Saunders :work: +SCHEDULED: <2024-06-03 Mon 10:00> +[2024-06-03 Mon 09:39] +**** DONE Check chat with Eugene Chan :work: +SCHEDULED: <2024-06-03 Mon 10:00> +[2024-06-03 Mon 09:45] +**** DONE Create an issue for /onboard_meraki webhook, check that in JIRA :work: +SCHEDULED: <2024-06-03 Mon 10:00> +[2024-06-03 Mon 17:38] + +https://cisco-sbg.atlassian.net/issues/XDR-3988?filter=-1 + +Meraki +INT: 80a909ec-99ab-4cbc-9d42-b59bb9ef669b +TEST: 43829fec-75a0-4c76-b9ec-f2b22c469589 +NAM: 43829fec-75a0-4c76-b9ec-f2b22c469589 +EU: 43829fec-75a0-4c76-b9ec-f2b22c469589 +APJC: 43829fec-75a0-4c76-b9ec-f2b22c469589 + +**** DONE Update orgs with sc flag :work: +SCHEDULED: <2024-06-03 Mon 10:00> +[2024-06-03 Mon 17:46] + + +INT: +047a89bf-5d2e-4392-b770-ad4821a82acf +d5e7a415-85ca-4be8-8773-e35d03f889d0 + +TEST: +5c2abff3-4257-45d8-b923-55e51008e4ef +77e1a03b-db53-5d6a-8f7d-26dfedb45ff8 +c395f3c8-723b-4d15-b8b7-e17bec459c6b +e3d94782-47cf-4145-9db3-092bb1db2b6a +*** 2024-06-04 Tuesday +**** MEETING SX EOL :work:meeting: +[2024-06-04 Tue 17:19] +- Agenda (to discuss about) +- Notes +- Actions + + Remove even more scopes: casebook, playbook, enrich +**** MEETING SX EOL Core Team :work:meeting: +[2024-06-04 Tue 16:35] +- Agenda (to discuss about) +- Notes +- Actions +**** MEETING Olivier 1-1 :work:meeting: +:LOGBOOK: +CLOCK: [2024-06-04 Tue 15:34]--[2024-06-04 Tue 21:47] => 6:13 +:END: +[2024-06-04 Tue 15:34] + +Part en islande. +*** 2024-06-05 Wednesday +**** DONE Comment on Orbital 1-click/0-click [[webexteams://im?space=68f439c0-7a5c-11ee-9e3c-6f3b2158786b&message=946af9d0-22d2-11ef-b3fd-d1b4af0c75a8][webex]] :work: +SCHEDULED: <2024-06-05 Wed 10:00> +[2024-06-05 Wed 08:04] +**** CANCELED Add semi-public docs for Entitlement recommendations :work: +SCHEDULED: <2024-06-24 Mon 10:00> +:LOGBOOK: +- State "CANCELED" from "TODO" [2024-06-24 Mon 09:17] \\ + Forgot what I meant, probably onboarding and not entitlemetn +:END: +[2024-06-05 Wed 10:33] +**** DONE Create webhooks for SCA on Meraki module change :work: +SCHEDULED: <2024-06-05 Wed 10:00> +:LOGBOOK: +CLOCK: [2024-06-05 Wed 15:03]--[2024-06-05 Wed 19:11] => 4:08 +:END: +[2024-06-05 Wed 15:03] + + +#+begin_src js +const m = {"sca":{"int" :"client-e1fa7b2c-95a0-4a1a-bd89-489fc5eba225", + "test" :"client-0f13385b-68b6-48e4-be7d-93d68add97b5", + "nam" :"client-71bf9096-dc08-4bb2-b837-e5fe5c4652bc", + "eu" :"client-1a44e201-ffe4-439d-bf74-9e95dc2ac1a1", + "apjc" :"client-a37b0daa-50b8-492b-8fb3-337c6bfb5bad"}, + "sca_url":{"int" :"https://tr-relay-dev-srv2.dev-srv.dev.obsrvbl.com/onboard_meraki", + "test":"https://tr-relay-staging1.staging.obsrvbl.com/onboard_meraki", + "nam" :"https://tr-relay-production.obsrvbl.obsrvbl.com/onboard_meraki", + "eu" :"https://tr-relay-eu-prod1.eu-prod.obsrvbl.com/onboard_meraki", + "apjc":"https://tr-relay-anz-prod1.anz-prod.obsrvbl.com/onboard_meraki"}, + "meraki": {"int" :"80a909ec-99ab-4cbc-9d42-b59bb9ef669b", + "test" :"43829fec-75a0-4c76-b9ec-f2b22c469589", + "nam" :"43829fec-75a0-4c76-b9ec-f2b22c469589", + "eu" :"43829fec-75a0-4c76-b9ec-f2b22c469589", + "apjc" :"43829fec-75a0-4c76-b9ec-f2b22c469589"}}; + +{ + "webhook_type": "url", + "name": "SCA Meraki Change", + "org_id": "system", + "source": "iroh-events", + "auth": { + "type": "iroh-jwt", + "conf": { + "client_id": m["sca"][region] + } + }, + "event_filter_map": { + "module_instance_visibility": "org", + "module_type_id": m["meraki"][region] + }, + "url": m["sca_url"][region] + "user_id": "system", + "client_id": "system", + "event_type_filter": [ + "module-instance/restricted", + "module-instance/reactivated", + "module-instance/updated", + "module-instance/created", + "module-instance/deleted" + ], + "authenticate-as-emitter?": true, + "visibility": "global", +} +#+end_src + + +***** INT + +#+begin_src js :var region="int" +const m = {"sca":{"int" :"client-e1fa7b2c-95a0-4a1a-bd89-489fc5eba225", + "test" :"client-0f13385b-68b6-48e4-be7d-93d68add97b5", + "nam" :"client-71bf9096-dc08-4bb2-b837-e5fe5c4652bc", + "eu" :"client-1a44e201-ffe4-439d-bf74-9e95dc2ac1a1", + "apjc" :"client-a37b0daa-50b8-492b-8fb3-337c6bfb5bad"}, + "sca_url":{"int" :"https://tr-relay-dev-srv2.dev-srv.dev.obsrvbl.com/onboard_meraki", + "test":"https://tr-relay-staging1.staging.obsrvbl.com/onboard_meraki", + "nam" :"https://tr-relay-production.obsrvbl.obsrvbl.com/onboard_meraki", + "eu" :"https://tr-relay-eu-prod1.eu-prod.obsrvbl.com/onboard_meraki", + "apjc":"https://tr-relay-anz-prod1.anz-prod.obsrvbl.com/onboard_meraki"}, + "meraki": {"int" :"80a909ec-99ab-4cbc-9d42-b59bb9ef669b", + "test" :"43829fec-75a0-4c76-b9ec-f2b22c469589", + "nam" :"43829fec-75a0-4c76-b9ec-f2b22c469589", + "eu" :"43829fec-75a0-4c76-b9ec-f2b22c469589", + "apjc" :"43829fec-75a0-4c76-b9ec-f2b22c469589"}}; + +{ + "webhook_type": "url", + "name": "SCA Meraki Change", + "org_id": "system", + "source": "iroh-events", + "auth": { + "type": "iroh-jwt", + "conf": { + "client_id": CLIENT_ID + } + }, + "event_filter_map": { + "module_instance_visibility": "org", + "module_type_id": MODULE_TYPE_ID + }, + "url": SCA_URL, + "user_id": "system", + "client_id": "system", + "event_type_filter": [ + "module-instance/restricted", + "module-instance/reactivated", + "module-instance/updated", + "module-instance/created", + "module-instance/deleted" + ], + "authenticate-as-emitter?": true, + "visibility": "global" +} +#+end_src + +#+RESULTS: + +** 2024-W24 +*** 2024-06-10 Monday +**** IN-PROGRESS Diagram for tomorrow :work: +[2024-06-10 Mon 18:39] + +#+begin_src plantuml :file SE_Orbital_provisioning.png +skinparam handwritten false +skinparam shadowing false + +skinparam sequence { +ParticipantFontName Chalkboard; +ParticipantBackgroundColor white; +ParticipantBorderColor #37C +GroupBorderColor #888 +ArrowColor #37C +LifeLineBorderColor #37C +} + +participant PIAM as piam +participant "Secure Endpoint" as se +participant "IROH" as iroh +participant "Orbital" as orbital + + +group Provisionning + +piam->se: Provisioning Request +se->iroh: POST /iroh/oauth2/token (client_id,client_secret) +iroh->se: 200 OK (Bearer JWT) +se->iroh: POST /iroh/provisioning/platform/org +iroh->se: org-id (and full Org) +se->iroh: POST /iroh/provisioning/platform/user +iroh->se: user-id (and full User) +se->iroh: POST /iroh/provisioning/platform/onboard/{user-id}/orbital +iroh->orbital: POST {orbital}/onboarding (admin user JWT) +orbital->orbital: provision using Org-id/User-id in the JWT +orbital->iroh: POST /iroh/iroh-int/module-instance (with JWT Create module) +iroh->orbital: 201 OK (Created module) +orbital->orbital: Any internal work for finalizing the provisioning +orbital->iroh: 200 OK (+ any body) +iroh->se: 200 OK (+ body returned by orbital) +end +#+end_src + +#+RESULTS: +[[file:SE_Orbital_provisioning.png]] + +**** IN-PROGRESS Change webhook for SXO in test :work: +[2024-06-10 Mon 18:29] + + +**** MEETING Prototype XDR integration :work:meeting: +:LOGBOOK: +CLOCK: [2024-06-10 Mon 16:35]--[2024-06-10 Mon 21:31] => 4:56 +:END: +[2024-06-10 Mon 16:35] + + X +**** HOLD Change AI Assistant onboarding conf [[webexteams://im?space=de666fe0-e85a-11ee-b2be-31ed59f4a874&message=0fa75120-2364-11ef-905f-f3038d0b970a][webex]] :work: +SCHEDULED: <2024-06-10 Mon 10:00> +:LOGBOOK: +- State "HOLD" from "IN-PROGRESS" [2024-06-10 Mon 15:57] \\ + Waiting for answer from Abhiram. +CLOCK: [2024-06-10 Mon 15:51]--[2024-06-10 Mon 15:57] => 0:06 +:END: +[2024-06-10 Mon 09:20] +**** DONE Check non-admin login discussion [[webexteams://im?space=ff60e0b0-8d3b-11ee-a677-3d6eefa66fd9&message=4d06df10-2434-11ef-acbc-1da1c6b70925][webex]] :work: +SCHEDULED: <2024-06-10 Mon 10:00> +[2024-06-10 Mon 09:23] +**** HOLD Check scopes for Rekha [[webexteams://im?space=b8c12c60-18dd-11ed-8af1-af2bd6a6c8a4&message=b4112a10-241d-11ef-a6d8-0b2d4f62e498][webex]] :work: +SCHEDULED: <2024-06-10 Mon 10:00> +:LOGBOOK: +- State "HOLD" from "TODO" [2024-06-10 Mon 15:58] \\ + Tiffany Russell is taking care of it. +:END: +[2024-06-10 Mon 09:31] + +jira ticket https://cisco-sbg.atlassian.net/browse/XDR-4186 + +**** DONE Enable ai-assistant for 1ffd5ddc-025a-42c0-9219-8844f6f4335b [prerna dm] :work: +SCHEDULED: <2024-06-10 Mon 10:00> +[2024-06-10 Mon 09:34] +**** DONE PR scopes :work: +SCHEDULED: <2024-06-10 Mon 10:00> +[2024-06-10 Mon 15:50] +**** CANCELED Check Live Demo of Secure Client Management UI (SX EOL) :work: +SCHEDULED: <2024-06-11 Tue 10:00> +:LOGBOOK: +- State "CANCELED" from "TODO" [2024-06-17 Mon 16:33] \\ + Yolo +:END: +[2024-06-10 Mon 16:36] +*** 2024-06-11 Tuesday +**** MEETING Test Plan :work:meeting: +:LOGBOOK: +CLOCK: [2024-06-11 Tue 16:39]--[2024-06-12 Wed 09:58] => 17:19 +:END: +[2024-06-11 Tue 16:39] + +SX Only Org: + +No login for some swagger UI (point 4?) +point 8. shoudl list XDR and SC instead +point 10. Visibility + +XDR Only Org: + +SCC Org: + +Account switcher only SCC org + +No mention to SecureX or XDR in error messages during the flow. +*** 2024-06-12 Wednesday +**** IN-PROGRESS Create SXSO bookmark for SC :work: +:LOGBOOK: +CLOCK: [2024-06-12 Wed 09:58]--[2024-06-12 Wed 21:36] => 11:38 +:END: +[2024-06-12 Wed 09:58] +**** DONE Register onboarding endpoint (see ihor dm) :work: +SCHEDULED: <2024-06-12 Wed 10:00> +[2024-06-12 Wed 09:21] + +Hi Yann, could you please register the onboarding service for secure endpoint +test env, here is our onboarding url +- https://console.qa1.immunet.com/securex_modules/onboarding +**** DONE Another AI Assistant (dm Prerna) :work: +SCHEDULED: <2024-06-12 Wed 10:00> +[2024-06-12 Wed 09:22] + +Hi Yann, another org id for Ai Assistant Private Preview. +Org ID (NA), a2232e2c-a8c4-4044-a8ae-9fdeadda0dc9 +**** DONE Check invitation redirects [[https://cisco-sbg.atlassian.net/browse/XDR-4425][jira ticket]] :work: +SCHEDULED: <2024-06-12 Wed 10:00> +[2024-06-12 Wed 09:44] +** 2024-W25 +*** 2024-06-17 Monday +**** MEETING Brownfield with Prerna :work:meeting: +:LOGBOOK: +CLOCK: [2024-06-17 Mon 15:30]--[2024-06-18 Tue 16:35] => 25:05 +:END: +[2024-06-17 Mon 15:30] +- Agenda (to discuss about) +- Notes +- Actions + batch AI onboarding script for all XDR orgs +*** 2024-06-18 Tuesday +**** MEETING Core Team SX EOL :work:meeting: +:LOGBOOK: +CLOCK: [2024-06-18 Tue 16:35]--[2024-06-18 Tue 21:26] => 4:51 +:END: +[2024-06-18 Tue 16:35] + +- Notes +- Actions + - Contact SE/Orbital about creating a module. + To prepare the future. +**** DONE Re-check onboarding v2 for AI :work: +SCHEDULED: <2024-06-24 Mon 10:00> +[2024-06-18 Tue 08:34] +**** DONE Ecrire issue pour Olivier rewrite URL :work: +SCHEDULED: <2024-06-24 Mon 10:00> +[2024-06-18 Tue 17:22] + +Objectif: Eviter les redirections. + +Nous avons plusieurs URL chacune avec une UI/App différente. + +XDR, SX et SC. + +Lorsque quelqu'un va sur l'URL d'un des produits sans avoir de session. +L'UI redirige l'User vers l'URL suivante: + +/iroh/iroh-auth/login/sxso?origin= + +L'user est redirigé, il s'authentifie via l'IdP SXSO. +Si l'user a plusieurs comptes, il est redirigé vers la registration UI pour +choisir son compte et il est redirigé vers . +S'il n'a qu'un seul compte, on le redirige directement vers . + +Nous voudrions intercepter juste avant que le serveur ne renvoie une 302 mais +après que l'user ait selectionné son compte pour remplacer, si besoin la valeur d'ORIGIN. +Attention, beaucoup de valeurs différentes d'ORIGIN peuvent être données, pas +seulement celle des 3 App officielles. +Nous voudrions donc avoir l'algorithme suivant: + +#+begin_src clojure +(defn rewrite-origin + [{:keys [sc sx xdr] :as ctx} + main-app + url] + (let [app-urls (set (map :url [sc sx xdr])) + origin (url/origin url)] + (if (contains? app-urls origin) + (let [main-app-url (case main-app + :sc (:url sc) + :sx (:url sx) + :xdr (:url xdr))] + ;; replace the origin of URL by main-app-url + (replace-origin url main-app-url)) + ;; if the origin of the redirect URL is not one of the known app + ;; we do not rewrite the origin URL + url))) +#+end_src + +En utilisant cet algorihtme nous aidons l'UI et nos customer a ne pas subir de +redirections inutiles. +Si un user qui n'a pas accès à XDR est redirigé vers XDR alors nous remplaçons +l'URL de XDR par l'URL de SecureClient (ou SX avant SX EOL) ce qui permet +d'éviter à l'UI de rediriger l'user de nouveau. +De plus celà permet d'éviter des "boucles manuelles" de login potentielles. +Imaginons le cas suivant: + +1. User va sur l'URL d'XDR +2. Il choisit son compte SC-only +3. Il va vers XDR +4. l'UI d'XDR le redirige vers l'URL de SC +5. l'User est redirigé vers l'account selection +6. L'User selectionne son compte XDR +7. L'user va vers SC UI +8. L'UI de SC redirige l'user vers l'URL de XDR +9. GOTO 2 + +L'UI a les moyen de force login le bon user account. Mais il est preferrable +d'intervenir à l'étape 2 et de réécrire l'URL de redirection pour envoyer cet +utilisateur vers l'UI de SC directement après qu'il ait sélectionné son +compte SC-only et pas XDR. + +Plus techniquement, les emplacements: + +- Dans IROH Auth la route de login. +- Dans IROH Auth UI l'API de redirection lors de la selection de compte +***** English translation + +Objective: Prevent Redirections. + +We have multiple URLs, each with a different UI/App (XDR, SX, and SC). + +When someone accesses one of these product URLs without having an existing session, the UI redirects them to the following URL: + +/iroh/iroh-auth/login/sxso?origin= + +The user is redirected, authenticates via SXSO IDP, and if they have multiple accounts, they are directed to a registration UI to select their account. If they only have one account, they are directly sent back to . + +We want to intercept just before the server returns a 302 response after the user has selected their account, replacing the origin value as needed. + +Note that many different values of ORIGIN can be provided, not just those from the three official Apps. We would like an algorithm that follows this: + +#+begin_src clojure +(defn rewrite-origin + [ctx main-app url] + (let [app-urls (set (map :url [sc sx xdr])) + origin (url/origin url)] + (if (contains? app-urls origin) + (let [main-app-url (case main-app + :sc (:url sc) + :sx (:url sx) + :xdr (:url xdr))] + ; replace the origin of URL by main-app-url + (replace-origin url main-app-url)) + ; if the origin of the redirect URL is not one of the known app + ; we do not rewrite the origin URL + url))) + +#+end_src + +Using this algorithm, we can help our UI and customers avoid unnecessary redirections. If a user without access to XDR is redirected to XDR, we replace the XDR URL with the SecureClient (or SX before SX EOL) URL, which allows us to prevent further manual login loops. + +Imagine the following scenario: + +1. User accesses an XDR URL. +2. They select their SC-only account. +3. They go to the XDR UI. +4. The XDR UI redirects them back to the SC URL. +5. The user is redirected to the account selection page. +6. The user selects their XDR account. +7. The user goes to the SC UI. +8. The SC UI redirects them back to the XDR URL. +9. GOTO 2 + +The UI has the means to force login with the correct user account, but it is preferable to intervene at step 2 and rewrite the redirect URL to send this user directly to the SC UI after they have selected their SC-only account. + +Technically speaking: + +- In IROH Auth, the route for login. +- In IROH Auth UI, the API for redirection during account selection. +** 2024-W25 +*** 2024-06-17 Monday +**** DONE Create a JIRA ticket for PIAM bookmark & clients creation :work: +SCHEDULED: <2024-06-17 Mon 10:00> +[2024-06-17 Mon 07:41] +**** DONE Check Mario Design +SCHEDULED: <2024-06-24 Mon 10:00> +**** DONE Check SXSO Migration webexteams://im?space=331b38f0-6218-11e9-9aae-c5b8cb291b23&message=c60913e0-2f44-11ef-b4aa-312c6fa65a31 +SCHEDULED: <2024-06-24 Mon 10:00> +**** DONE Inject wisdom webexteams://im?space=b5844a30-2e19-11ee-b0bb-8575ace105f3&message=91aadea0-2fe7-11ef-a989-b39fcd216ef7 +SCHEDULED: <2024-06-24 Mon 10:00> +**** DONE Revert ORG (Danny messages) +SCHEDULED: <2024-06-24 Mon 10:00> +**** DONE Answer Andrew webexteams://im?space=2c456ef0-3e7f-11ed-9e26-35248da09ee2&message=30b37c20-2f46-11ef-895a-b5cc6fe75295 +SCHEDULED: <2024-06-24 Mon 10:00> +**** DONE Answer Yuri webexteams://im?space=fd803b50-e2cb-11eb-a044-cb6978877ae3&message=881ef7c0-2ef9-11ef-8199-2718148ea2ff +SCHEDULED: <2024-06-24 Mon 10:00> +**** DONE Answer to Jilian +SCHEDULED: <2024-06-24 Mon 10:00> +**** DONE Check orbital webexteams://im?space=68f439c0-7a5c-11ee-9e3c-6f3b2158786b&message=b03ffe50-2f14-11ef-b812-337b71447fc0 +SCHEDULED: <2024-06-24 Mon 10:00> +**** DONE Check avec Guillaume multiple webhook [[webexteams://im?space=b5844a30-2e19-11ee-b0bb-8575ace105f3&message=91faa760-2a78-11ef-8adc-eb6b680c3fe6][webex]] :work: +SCHEDULED: <2024-06-17 Mon 10:00> +[2024-06-17 Mon 08:10] +** 2024-W26 +*** 2024-06-24 Monday +**** DONE Add SC flag in PROD :work: +SCHEDULED: <2024-06-24 Mon 10:00> +[2024-06-24 Mon 15:56] + + +NAM +User Advantage +tjbusch+se0603u01@cisco.com +E2E-User-ADV-NAM +tjbusch+se0603u01@cisco.com +EU +User Essentials +tjbusch+se0603u02@cisco.com +E2E-User-ESS-EU +tjbusch+se0603u02@cisco.com +APJC +User Advantage +tjbusch+se0603u03@cisco.com +E2E-User-ADV-APJC +tjbusch+se0603u03@cisco.com +*** 2024-06-25 Tuesday +**** MEETING Orbital / SE :work:meeting: +:LOGBOOK: +CLOCK: [2024-06-25 Tue 16:36]--[2024-06-25 Tue 22:34] => 5:58 +:END: +[2024-06-25 Tue 16:36] + +@Melvin_Wiens +@Eugene_Chan + +Act on it. + +@Ihor +Finding the clients to add new. +Find IP Addresses. + +Share doc for de-onboarding Orbital to Eugene. +**** DONE Check Mario work :work: +SCHEDULED: <2024-06-25 Tue 10:00> +[2024-06-25 Tue 10:01] +**** DONE Make all OAuth2 trusted client XDR org :work: +SCHEDULED: <2024-06-25 Tue 10:00> +[2024-06-25 Tue 10:51] diff --git a/tracker.org_archive b/tracker.org_archive index 740835c1..98a94510 100644 --- a/tracker.org_archive +++ b/tracker.org_archive @@ -2768,3 +2768,1649 @@ https://github.com/advthreat/iroh/pull/7394 - Trigger SXO event, decide if there is any automated workflow to trigger. Design for the Rule System. + +* 2023 +:PROPERTIES: +:ARCHIVE_TIME: 2024-02-01 Thu 23:06 +:ARCHIVE_FILE: ~/Library/Mobile Documents/iCloud~com~appsonthemove~beorg/Documents/org/tracker.org +:ARCHIVE_CATEGORY: tracker +:END: +:LOGBOOK: +:END: +** 2023-W26 +*** 2023-06-29 Thursday +**** CANCELED Investigate invite bug :work: +SCHEDULED: <2023-07-03 Mon 11:00> +:LOGBOOK: +- State "CANCELED" from "TODO" [2023-07-11 Tue 10:51] \\ + Whatever +:END: +[2023-06-29 Thu 11:06] + +https://github.com/advthreat/response/issues/1888 + +Deleted user-id c59db89d-212a-4a0c-92d0-ff1a2c7de25b +** 2023-W27 +*** 2023-07-04 Tuesday +**** MEETING 1-1 Wanderson :work:meeting: +:LOGBOOK: +CLOCK: [2023-07-04 Tue 16:04]--[2023-07-04 Tue 16:33] => 0:29 +:END: +[2023-07-04 Tue 16:04] +***** Agenda (to discuss about) +- Provisioning + - PIAM status + - Orbital/Single SE status +- RBAC status +- offsite +***** Notes +***** Actions +- create a backlog of technical work to do +*** 2023-07-05 Wednesday +**** DONE Cleanup all "TO DELETE" entities :work: +SCHEDULED: <2023-07-28 Fri 11:00> +[2023-07-05 Wed 19:51] +*** 2023-07-06 Thursday +**** CANCELED Remove ability to create new Org :work: +SCHEDULED: <2023-07-06 Thu> +:LOGBOOK: +- State "CANCELED" from "TODO" [2023-07-11 Tue 10:52] \\ + Whatever +:END: +[2023-07-06 Thu 16:19] +** 2023-W28 +*** 2023-07-11 Tuesday +**** DONE IROH Sync :work: +SCHEDULED: <2023-07-11 Tue 17:00> +[2023-07-11 Tue 10:49] +**** DONE IROH-Auth weekly :work: +SCHEDULED: <2023-07-11 Tue 16:35> +[2023-07-11 Tue 10:49] +**** DONE 1-1 Wanderson :work: +SCHEDULED: <2023-07-11 Tue 16:05> +[2023-07-11 Tue 10:49] +**** DONE 1-1 Olivier :work: +SCHEDULED: <2023-07-11 Tue 15:35> +[2023-07-11 Tue 10:48] +**** DONE Lead Weekly :work: +SCHEDULED: <2023-07-11 Tue 15:00> +[2023-07-11 Tue 10:48] +**** DONE Provide doc to Guy Mackenzy :work: +SCHEDULED: <2023-07-11 Tue 11:30> +[2023-07-11 Tue 10:13] +**** DONE Create Entitlement Presentation :work: +SCHEDULED: <2023-07-11 Tue 10:30> DEADLINE: <2023-07-12 Wed 15:00> +[2023-07-11 Tue 10:12] +*** 2023-07-12 Wednesday +**** DONE Make enterprise_id mandatory field for PIAM endpoints :work: +DEADLINE: <2023-07-12 Wed 18:00> SCHEDULED: <2023-07-12 Wed> +[2023-07-12 Wed 17:14] +**** MEETING Monetization first meeting :work:meeting: +:LOGBOOK: +CLOCK: [2023-07-12 Wed 16:07]--[2023-07-12 Wed 17:07] => 1:00 +:END: +[2023-07-12 Wed 16:07] +***** Notes + +tier +*** 2023-07-13 Thursday +**** DONE Review [[https://github.com/advthreat/iroh/pull/8043][[Olivier PR] Check IROH node start in test]] :work: +SCHEDULED: <2023-07-13 Thu> +[2023-07-13 Thu 12:11] +**** DONE Add enterprise_id to many orgs [[https://github.com/advthreat/securex-ui-shell/issues/297#issuecomment-1633099674][list here]] :work: +SCHEDULED: <2023-07-13 Thu 14:30> +[2023-07-13 Thu 12:06] +**** DONE Provide Q1 technical items :work: +DEADLINE: <2023-07-13 Thu 16:00> SCHEDULED: <2023-07-13 Thu> +[2023-07-13 Thu 11:57] + + +1. *IROH-Auth Testing Framework-Refactor*: + IROH-Auth passed through many different evolution phases and different refactor + tentatives. Most of them failed to achieve. + One of the result is that the tests are scattered, some should be removed + entirely. + Some test are very complex to understand, and still not + entirely migrated to the new better norm. + We reclaim some official time to fix that discrepancy in the code, because it + could either hide some bugs, or make development of certain features a lot + harder longer than expected. + + Main concrete ideas: + - improve DBFixture service, + - try to regroup tests details into the same test-file so a reader will not be + forced to dig between different files to understand what is going on. +2. *Developer Targeted documentation*. + Currently the descriptions of the APIs in Swagger UI lack of precision. + We could greatly improve the understanding of developer facing it by + adding examples, and cleaner content in swagger UI. +3. *IROH-Auth isolation* + A potential effort to think how we could improve the reliability and security + of IROH by isolating IROH-Auth from the rest of IROH. This question + was raised multiple times, but we do not have yet a definitive answer about what + would be an ideal solution. + - potentially, this could mean improving building time, and development time + by decoupling Auth from the more feature-oriented work. + - potentially, open new unexpected integration solution by having + iroh-auth-only specific nodes, and perhaps even, removing the IROH-Auth + service from other nodes entirely + - Seems like a natural "next-step" related to the work related to specific nodes. + +This one is more feature oriented as we know we will need this soon: + +4. *Token Exchange Service* + We need to produce a service that could provide the ability for an entity to + get access to other tokens. + To make this safe and useful, we need to go beyond the Token Exchange RFC and + consider how to build an access rule system, logging, and keep track of the + token chain. + So first take the time to have a clear understanding of the feature needed, + search and find a technical solution, and design the work to be done. + + We have a current working first example with the Account Switching. + We should extend this to improve Impersonation (for TAC and some Devs), + future work with PIAM, and open the door to other integration mechanisms. +**** DONE Sustaining items for Q1 :work: +SCHEDULED: <2023-07-13 Thu 17:00> +[2023-07-13 Thu 11:56] +** 2023-W29 +*** 2023-07-17 Monday +**** MEETING Deep dive XDR Monetization :work:meeting: +:LOGBOOK: +CLOCK: [2023-07-17 Mon 16:31]--[2023-07-17 Mon 17:31] => 1:00 +:END: +[2023-07-17 Mon 16:31] +***** Agenda (to discuss about) +***** Notes +- hide 3rd party modules to "Essentials" users +***** Actions +- Restrict via the API too +**** DONE Add scopes to Scott Burnettes orgs/clients? :work: +SCHEDULED: <2023-07-17 Mon 11:00> +[2023-07-17 Mon 08:58] +*** 2023-07-19 Wednesday +**** MEETING API Design Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2023-07-19 Wed 18:47]--[2023-07-19 Wed 19:42] => 0:55 +:END: +[2023-07-19 Wed 18:47] +***** Agenda (to discuss about) +***** Notes +****** Data Retention + +How to delete private-intel events older than 90 days? +How to delete orgs data? + +Private Intel. + +Incidents related to other entities. +If we delete data older than 90 days? + +@Jyoti: if an incident is closed you can clear it. +****** Deleting all data from an Org + +If no one logs for 90 days. We can delete it. +All users, modules, OAuth2 clients, etc… + +@Matthieu: do we send a warning email? + +@Jyoti: how to delete data in other components. +Send a notification. + +IROH Events for deletion. +Keep the main topic, and create sub-filtered topics. + +Order of deletion is important. + +1. Mark the Org as archived state (no login, only accessible through Cisco clients) +2. send notifications to all cisco components that need to cleanup +3. wait 1 week +4. real deletion + +Design doc. +****** Monetization + +Lot of cases for upgrading. +In all these case, we do not have Entitlement. So no enforcement. +****** Playbook retrieval API + +Read entities from public-intel, and UI call that API instead of a static file. +We had a design doc where we talked about this API. +***** Actions +**** DONE API Design Meeting :work: +SCHEDULED: <2023-07-19 Wed 18:30> +[2023-07-19 Wed 14:36] +** 2023-W30 +*** 2023-07-25 Tuesday +**** DONE Retrieve the list of entities from IROH Auth :work: +SCHEDULED: <2023-07-25 Tue> +[2023-07-25 Tue 17:38] + +#+begin_src clojure +IROH-Auth + no entities dbs + "auth-codes" + "auth-requests" + "auth-responses" + "auth-login-filters" + "oauth-client-presets" + "oauth-code" + "oauth-csrf" + "oauth-device-grant-user-auth" + "oauth-grants" + "oauth-trusted-clients" + "revoked-jwt" + "revoked-entities" + +For Mark + "ao-bootstrap" + +For Matt: + + "amp-user-credentials" + "archived-module-instances" + "iroh-events" + "module-cache" + "module-instances" + "module-type-patches" + "module-types" + "notifications" + "sse-tenants" + "sse-users" + "tiles-cache" + "webhook-results" + "webhooks" + +Used By UI: + "iroh-registry" + +For GE: + + "ctia-investigate-talos-hunt" + "enrichment-status" + "feedback" + "incident-summary" + "iroh-async-sessions" + "private-intel-cache" + "risk-score" + "threat-hunt-status" +#+end_src +**** DONE Ask Paul Cichonski about the quantity values :work: +SCHEDULED: <2023-07-25 Tue 19:00> +See data retention, should be 90, 180, 365. +What would be the value, how should I compute? + +SCHEDULED: <2023-07-25 Tue> +[2023-07-25 Tue 17:36] +**** MEETING XDR Monetization: XDR data retention :work:meeting: +:LOGBOOK: +CLOCK: [2023-07-25 Tue 16:31]--[2023-07-25 Tue 17:51] => 1:20 +:END: +[2023-07-25 Tue 16:31] +***** Agenda (to discuss about) + +- https://github.com/advthreat/iroh/issues/8135 +- https://ciscosecurity.aha.io/epics/SECUREX-E-897 + +Discuss Uses cases #1. +***** Notes + +What happens when this user goes. +Clearing data in 90 days. + +Notion about when to delete data. + +- Create or update for device. +- Create for incident, sightings, relationships. +- Comment on Incident recent, can we delete the incident? +***** Actions +****** Ask @Paul about the add-on quantity value for data retention + +Data Retention is 90 days by default, add-on to go 180, or 365. +Need to sync with PIAM because these are not the values in the first doc. +**** MEETING 1-1 Wanderson :work:meeting: +[2023-07-25 Tue 16:04] +***** Agenda (to discuss about) +****** Things to handle during my vacations. +:LOGBOOK: +CLOCK: [2023-07-25 Tue 16:04]--[2023-07-25 Tue 16:31] => 0:27 +:END: + +1. P1: fix XDR bugs, quick improvements +2. Add ~insights~ scope for DI (take care of updating the client, perhaps fix the + issue with non existing root scope. Could potentially be a real improvement). +3. Add event on Entitlement change. Optionally configure a webhook for this + event, depend on the need. Check with Matt and Guy. +4. Perhaps: + - Disable Org creation if SX EOL is officially announced. + - [NO] improve provisioning script. Check if module exist before invoking /onboard + - work related to short tokens (expose a token-exchange route not the RFC + one, a simpler to use one). + +5. Think about exposed data structure to make every type of org explicit and + centralize the business logic to help the UI. + - Retrieve a full list of Org case: + - created via PIAM or not + - XDR-enabled? + - SX-enabled? + - Entitlements/no-Entitlement + + We should be able to give a field to the UI (and other teams) + so they know how to react. + + For example for Orbital-only or SE-only orgs, not sure if we will use SX or + XDR UI. + + Should we add an Org field like ~external-product-only-org? s/Bool~ + And if true, affect the scopes accordingly to ensure they could not use + neither SX nor XDR paid features. +***** Notes +****** Work on the Events for the Entitlements + +update problem. +***** Actions +**** MEETING 1-1 Olivier :work:meeting: +:LOGBOOK: +CLOCK: [2023-07-25 Tue 15:05]--[2023-07-25 Tue 16:04] => 0:59 +:END: +[2023-07-25 Tue 15:05] +***** Agenda (to discuss about) +****** Things to handle during my vacations. + +1. P1: fix XDR bugs, quick improvements +2. Add ~insights~ scope for DI (take care of updating the client, perhaps fix the + issue with non existing root scope. Could potentially be a real improvement). +3. Add event on Entitlement change. Optionally configure a webhook for this + event, depend on the need. Check with Matt and Guy. +4. Perhaps: + - Disable Org creation if SX EOL is officially announced. + - improve provisioning script. Check if module exist before invoking /onboard + - work related to short tokens (expose a token-exchange route not the RFC + one, a simpler to use one). + +5. Think about exposed data structure to make every type of org explicit and + centralize the business logic to help the UI. + - Retrieve a full list of Org case: + - created via PIAM or not + - XDR-enabled? + - SX-enabled? + - Entitlements/no-Entitlement + + We should be able to give a field to the UI (and other teams) + so they know how to react. + + For example for Orbital-only or SE-only orgs, not sure if we will use SX or + XDR UI. + + Should we add an Org field like ~external-product-only-org? s/Bool~ + And if true, affect the scopes accordingly to ensure they could not use + neither SX nor XDR paid features. +***** Notes +***** Actions +**** DONE XDR Data Retention Policy Implementation Discussion :work: +SCHEDULED: <2023-07-25 Tue 16:30> +[2023-07-25 Tue 11:07] +**** DONE 1-1 Wanderson :work: +SCHEDULED: <2023-07-25 Tue 16:05> +[2023-07-25 Tue 11:06] +**** DONE 1-1 Olivier :work: +SCHEDULED: <2023-07-25 Tue 15:35> +[2023-07-25 Tue 11:00] +*** 2023-07-27 Thursday +**** DONE Message Equipe :work: +SCHEDULED: <2023-07-26 Wed 14:00> +[2023-07-27 Thu 11:45] + +- P1. (prob. 30%) XDR Bug fixes +- P1. (prob. 20%) Scott Burnette issue with the Provisioning API / OAuth2 clients +- P2. (prob. 10%) Help Jyoti with ~xdr-provisioning~ script +- P2. FY24Q1 Monetization: Prepare the PR for Disable Org Creation. +- P3. FY24Q1 Monetization: Entitlements Events; + Check with Matthieu before configuring a webhook for /Automation/ + (previously Orchestration, previously SXO, previsouly AO) as it + might not be necessary. +- P4. Dashboard https://github.com/orgs/advthreat/projects/7/views/9 + - [RBAC] ~insights~ scope + sync with DI team (Roman Eremin) + - (prob. 10%) [RBAC] if asked to prevent non-admin to create clients, + add ~admin~ to the scopes in the routes of the IROH Auth client web service. + - Config Simplification + Presentation for the team +- P4. *Universal Provisioning Flow* (PIAM want to rename themselve "Security Cloud"). +- P4. Designs + + New Org concepts that need to be exposed: + List the concepts we want to be exposed for each org. + - ~:xdr-enabled?/sx-enable?~ perhaps a single ~:enabled-products [:xdr :sx]~. + - ~piam-managed?~ etc… + - Notion of Product (XDR, SX, but also, visibility, Orbital, SE). + Effects on configuration, init of nodes, etc… + + Token Exchange (not the RFC). + We want to: + - Give the ability for someone with a JWT to generate another one with some + restrictions and complete tracking. + Restrictions by default: + - do not extend the :exp + - do not change user + - do not change org + Tracking: + - should be an ~act~ claim that could be recursive and we should take great + care of not making that grow. + It is ok not to have ~act~ in some cases like: + - Org switching + - format switching + because the real owner is always the same. + It is not ok to forget ~act~ if there is an impersonation involved. + Typically during provisioning, real impersonation, etc… + - Main difficulty; what is the correct data structure to represent rules of + allowed JWT exchanges. + +- Take care of asks that could leak internal abstractions: + - do not return the full list of allowed modules, IROH-Int will take care of + the filtering business rule. + - use scopes, not role to filter for permissions +- Sync with Matt with everything related to modules for Monetization. Not just + directly with Guy, Matt needs to know. +**** CANCELED XDR-flag [[https://github.com/advthreat/response/issues/1906#issuecomment-1652405093][1906]] :work: +SCHEDULED: <2023-07-27 Thu 11:45> +:LOGBOOK: +- State "CANCELED" from "TODO" [2023-07-28 Fri 13:23] +:END: +[2023-07-27 Thu 11:30] +*** 2023-07-28 Friday +**** MEETING Monthly Engineering :work:meeting: +:LOGBOOK: +CLOCK: [2023-07-28 Fri 18:01]--[2023-07-28 Fri 19:04] => 1:03 +:END: +[2023-07-28 Fri 18:01] +***** Agenda (to discuss about) +***** Notes +****** Operation + +@Gayan +Good release. +Pass it to John. Metrics. + +New hires: + +- @Vidun_Jayakody Automation +- @Geaog-Nokila_Pavlov + +@John: upgrade platform, thanks to @Adam +****** QA + +@Houman: XDR finally in production. Thanks for the fixes. +Everything went pretty well. +Performance testing, everything went pretty well in TEST. +Documented in a wiki page. + +@Pujan_Trivedi: Thanks everyone for answering that quickly and efficiently. +****** Service + +@GB People deliver XDR in my absence. +****** Engine + +@Eric +****** Integration + +@Mark +****** UI Dar + +@Dar, thanks for @Jilian and ... +@Rekah refactoring. Lots of bug fixes. +****** UI Sabrina + +- Congrats everyone. +- Code freeze for a while, so lot of bug fixes. +- Features been worked on. +- Search for relation. +- Configurable layout. +- Performance improvements. +- Lucas, bunch of telementry +- Miroslav, incident breadcrumb. +- Advance table. +****** Documentation @Mary +****** Demos + +@Scott_McLeod incident report + +@Mike next time. + +@Sam_Waggoner +***** Actions +**** DONE Monthly Engineering Meeting :work: +SCHEDULED: <2023-07-28 Fri 18:00> +[2023-07-28 Fri 11:34] +**** DONE Answer Namrata :work: +SCHEDULED: <2023-07-28 Fri> +[2023-07-28 Fri 10:20] + +I am not sure about the amount of money. +But, if this is Clojurist Together, I can give more precise answer. +Looking here: https://www.clojuriststogether.org/projects/ + +I can attest that our team intensively uses: + +- Bozhidar work (he develop cider, and most of us use it everyday, and I know he + maintain and update the work) +- Michiel Borkent (he develop babashka which we also use daily to write scripts + that are easier to write. And he is also very active) +- Tommi Reiman, our API uses compojure-api and lot of his related libraries. + Even if this is very stable, he continues to work on libraries that we could + potentially use to improve part of our internal system, like provide a better + documentation for developer about the expectation of our routing. +- Peter Taoussanis, we use his redis and timber lib (so DB access + logs) + +And looking at funded projects here are the one we use every day: + +- cider (daily in our editor) +- clj-kondo (in our editor for writing code + used in our CI) +- clj-http (this is an essential lib we use to call other APIs) +- babashka / SCI (daily + used in our CI + used for admin tasks) +- clojure-lsp (used daily in our editor) +- dependabot (used daily in our CI) + +To me it seems we have interrest in contributing back to the open source Clojure community. +Not only it improve the maintenance quality of essential libs to our +architecture but it also helps during hiring. +Now, regarding how much we should give, this probably depend a lot of our +current budget. +** 2023-W33 +*** 2023-08-16 Wednesday +**** MEETING Data Deletion for Privacy :work:meeting: +:LOGBOOK: +CLOCK: [2023-08-16 Wed 18:02]--[2023-08-17 Thu 17:59] => 23:57 +:END: +[2023-08-16 Wed 18:02] +***** Agenda (to discuss about) +??? +***** Notes +@Prerna: XDR Data Deletion spreadsheet still in progress. +@Petr: start without X +background standardize for deletion policy. +When do we remove the registration info. +45 days post licence expiration. +storage archive. +We need to make some solid statement on deletion. +Review what we have for SCA, and do the same for XDR. + +@Jake_Wyzgoski: I don't know what we do +@Derrell_Winder: Let me check +@Jake: describe to see if it align? +@Chris_Duane: it is product by product. I haven't seen anything implementing +that would stop a user to use after their license expires. + +@Yann: we don't even have a clear idea about what occurs after license expires. +Current state, you can still use XDR with reduced access. + +@Chris_Duane: not aware to any plan. + +@Peter: this is the first discussion about it. +Data retention, etc… Is there any establish best practice policy to follow? +License has expires. + +@Jake: we need to check if 45 days is the right time or something better. + +@Y: we should probably centralize this question to PIAM. + +@Chris: I feel finding a standard retention. + +@Peter: deletion when we want, we say, during the year. + +@Prerna: default for inactivity. nobody login for 90 days then delete. + +@Y: Legal? I think it's delete on demand, and for sale, you can recover your +account for N days, after that, you are not guaranteed to have your previous data back. + +@Peter: word the think with, either the user ask for deletion or no real policy. + +@Michael_Schultz: SCA keep lot of data beyond retention policy. So it cost money. + +@Chris_Duane: Talk about exceptions. + +@Petr: from a legal what is our obligation what should we say? + +@Derrell_Winder: not a concern for me. +- On-request mandatory +- 45 days? + +@Petr: What do you keep? Or is it about everyting? +Took a wording from SCA back to start from scratch. + +@Chris: PIAM not sure what the plan is. + +@Derrell_Winder: what does this 14 month refers to? (in the Data sheet) + +@Petr: regroup back to finalize the PDS and +***** Actions +??? +**** DONE Answer to Brandon :work: +SCHEDULED: <2023-08-16 Wed> +[2023-08-16 Wed 10:10] +*** 2023-08-17 Thursday +**** MEETING PIAM Universal API (SCIM) :work:meeting: +:LOGBOOK: +CLOCK: [2023-08-17 Thu 17:59]--[2023-08-18 Fri 12:16] => 18:17 +:END: +[2023-08-17 Thu 17:59] +***** Agenda (to discuss about) +How is it helping us to do this. +***** Notes + +@Paul: UI flow. We can do that for XDR. +2nd part, Universal Flow, standardize the flow. +Suite became a thing, some more than just XDR. + +Existing tenants. Unrelated. + +@Prerna: Brianna expect that universal does not support brown field customers. + +@Paul: she talked to Travis. We have this notion to provide any kind of meta-data. +We can collect answers to the XDR API. + +@Yann: risk about the body to send. + +@Prerna: what about adding values from customer questions. +Does this working. + +@Paul: Developing right now. + +@Prerna: we probably need the UI... Enforcing + +@Paul: Offer basis, XDR is sold right now is to an offer called "XDR SSE" hidden +flow. Suite is a completely different offer and pids. Suite is using our UI base flow. +They'll see XDR as one of the thing they could buy. Only for NAM. + +@Prerna: US only right now for PIAM. + +@Paul: Brit Suite from XDR side nothing change. + +@Prerna: For the brit suite, the universal PIAM API is what is sending info to IROH. +***** Actions +*** 2023-08-18 Friday +**** IN-PROGRESS Fix SE Clients :interruption:work: +:LOGBOOK: +CLOCK: [2023-08-18 Fri 12:16]--[2023-08-18 Fri 23:47] => 11:31 +:END: +[2023-08-18 Fri 12:16] +** 2023-W34 +*** 2023-08-21 Monday +**** MEETING Monetization :work:meeting: +:LOGBOOK: +CLOCK: [2023-08-21 Mon 16:06]--[2023-08-21 Mon 16:36] => 0:30 +:END: +[2023-08-21 Mon 16:06] +***** Agenda (to discuss about) +***** Notes +***** Actions + +- [ ] Provide a doc about the new APIs for entitlements for devs. +*** 2023-08-23 Wednesday +**** MEETING API Design Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2023-08-23 Wed 18:34]--[2023-08-24 Thu 16:02] => 21:28 +:END: +[2023-08-23 Wed 18:33] +***** Agenda (to discuss about) +***** Notes +****** 3rd party integrations (Ian's team) + +@Jyoti: + Jyoti preview problem with data quality. + PIAM want to go full speed, with 3rd party integrations they are going to support. + Ian not very diligent, just copy/pasting rolling new integrations. + Don't go with the logic. + Finally, peer-review. + + QA does not know what to test. + Configuration issues with the modules. + + Whatever we do, we should have a check-list for review. + What data included, proper targets, relations. + Tactics as we need, etc… + +@Guillaume: we gave advise but we never reviewed the code +@Matt: no process to review the content of 3rd party modules. +Documentation is a bit messy. Nothing is currently in place. + +@Jyoti: I've been asking Namarata to add this process to check integration quality. +***** Actions +**** MEETING Data Retention bi-weekly :work:meeting: +:LOGBOOK +CLOCK: [2023-08-23 Wed 18:00]--[2023-08-23 Wed 18:34] => 0:34 +:END: +[2023-08-23 Wed 18:00] +***** Agenda (to discuss about) +***** Notes + +- doc from Yann +- discussion about 365 vs 90 for deletion. + +XDR going back to SX +***** Actions +**** CHAT Help Prerna answer question for SE :work:chat: +[2023-08-23 Wed 17:56] +**** CHAT Give master perm to Wanderson :work:chat: +[2023-08-23 Wed 17:56] +**** CHAT Help Rekha call /token :work:chat: +:LOGBOOK: +CLOCK: [2023-08-23 Wed 17:46]--[2023-08-23 Wed 18:00] => 0:14 +:END: +[2023-08-23 Wed 17:55] +**** CANCELED Nominate Recognitions :work: +SCHEDULED: <2023-08-24 Thu 10:00> +:LOGBOOK: +- State "CANCELED" from "TODO" [2023-09-06 Wed 18:21] +:END: +[2023-08-23 Wed 17:49] +**** DONE Write Issue for SE :work: +SCHEDULED: <2023-08-23 Wed 16:30> +[2023-08-23 Wed 16:01] +*** 2023-08-24 Thursday +**** MEETING Team meeting :work:meeting: +[2023-08-24 Thu 16:34] +***** Agenda (to discuss about) +***** Notes +***** Actions +**** MEETING Monetization :work:meeting: +:LOGBOOK: +CLOCK: [2023-08-24 Thu 16:02]--[2023-08-24 Thu 21:33] => 5:31 +:END: +[2023-08-24 Thu 16:02] +***** Notes +@Guillaume: tour of the team. +@Matt: +@Y: + +- Made a Doc to help devs using the Entitlements +- Asked to support an SCIM-like API to help provision from PIAM. + I consider this as low-priority for now. + - We will need that API to support external tokens (from PIAM) + - We will need to support asynchronous call + - We also need to adapt the data structure, update the users data and + potentially meta datas to apply to external onboardings. +- Asked to create many Orgs for dev purposes, so created a few personal scripts. +- Olivier discovered a potential bug with the webhook JWT generated. +- Webhooks needs to be configured by Wanderson +- Jillian asked to improve one profile endpoint to support more metas infos +- I am in a conversation to help UI support neverending session for dashboards + via refresh tokens. +- Yuri from DI asked to be able to support client creation via UI with + read-only. I feel we should probably provide an improved API with the full + tree-structure of the exhaustive scopes. But UX should be involved in my opinion. +- Olivier worked on a very promissing API to simplify how we create svc-helpers. + +@Mario: + +- Ambrose memory fix. in Schema creating a memory leak. +- Ambrose merge a patch endpoint for bundle update +- Mario merged a PR that fix a feature +- Mario yesterday message from Brian Mallony, high impact incident, Threat + hunting, Talos blog post weekly. And we create indicators. + Brian created sightings, that weren't yield. + Reach out to Michael Simonson. + Something has changed in Talos team post. The sighting didn't yield incident. + Not sure why the incident hadn't been created. + Discovery; one and only one incident created specificly for Talos since July + the 10th. + There is something with the Talos Threat Hunt. + Only for Talos Blogpost Hunt. + +@Patrick: + +Datadog check, false error. Google returns 500 error. + +Questions: + +@Olivier: is the Ambrose fix in PROD? +I have concern about the timber logs. + +@Matt: Mario, work of Ambrose, with the Patch bundle. +Kirill added some event when an incident is updated. +Ambrose did not query the same in the patch bundle. +@Mario: I will mention that to him today. +***** Actions +:LOGBOOK: +:END: +** 2023-W36 +#+BEGIN: clocktable :scope subtree :maxlevel 4 :timestamp nil :link nil :tags t :narrow 36! :match "work" +#+CAPTION: Clock summary at [2023-09-11 Mon 10:51] +| Tags | Headline | Time | | | | +|---------------+----------------------------+----------+----------+----------+----------| +| | *Total time* | *1d 22:17* | | | | +|---------------+----------------------------+----------+----------+----------+----------| +| | \_ 2023-W36 | | 1d 22:17 | | | +| | \_ 2023-09-05 Tuesday | | | 3:06 | | +| work, meeting | \_ Weekly Team | | | | 1:32 | +| work, meeting | \_ Weekly Leads | | | | 1:34 | +| | \_ 2023-09-06 Wednesday | | | 1d 19:11 | | +| work, meeting | \_ API Design Meeting | | | | 1d 17:11 | +| work, meeting | \_ FMC Plan with Paul | | | | 2:00 | +#+END: +*** 2023-09-05 Tuesday +:LOGBOOK: +:END: +**** MEETING Weekly Team :work:meeting: +:LOGBOOK: +CLOCK: [2023-09-05 Tue 17:03]--[2023-09-05 Tue 18:35] => 1:32 +:END: +[2023-09-05 Tue 17:03] +***** Agenda (to discuss about) +***** Notes +***** Actions +**** MEETING Weekly Leads :work:meeting: +:LOGBOOK: +CLOCK: [2023-09-05 Tue 15:16]--[2023-09-05 Tue 16:50] => 1:34 +:END: +[2023-09-05 Tue 15:16] +***** Agenda (to discuss about) +****** Offsite +Semaine du 9 octobre. +***** Notes +***** Actions +**** DONE Leads Meeting :work: +SCHEDULED: <2023-09-05 Tue 15:00> +:PROPERTIES: +:Effort: 1:00 +:END: +[2023-09-05 Tue 10:36] +*** 2023-09-06 Wednesday +**** MEETING API Design Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2023-09-06 Wed 18:31]--[2023-09-08 Fri 11:42] => 41:11 +:END: +[2023-09-06 Wed 18:31] +***** Agenda (to discuss about) +IROH as a common service + +CSC, and DI will move in Secure Cloud access. + +How to reuse the UI, how to continu to make this function. +CSC. +They also need to talk to SE, other cisco integrations. + +DI need to talk to all other integrations. + +What happens to our modules. + +Thinking about IROH and a few of its services, IROH headless. + +See proposal: + +https://github.com/advthreat/response/pull/2026 +***** Notes +***** Actions +**** MEETING FMC Plan with Paul :work:meeting: +:LOGBOOK: +CLOCK: [2023-09-06 Wed 16:31]--[2023-09-06 Wed 18:31] => 2:00 +:END: +[2023-09-06 Wed 16:31] +***** Agenda (to discuss about) +***** Notes +***** Actions +*** 2023-09-08 Friday +**** DONE Check Client [[webexteams://im?space=b5136a40-6687-11ed-9679-4b10798d7c1a&message=722b1960-4dc4-11ee-9508-fba85c9bfccf][Webex]] :work: +SCHEDULED: <2023-09-08 Fri 14:00> +:LOGBOOK: +CLOCK: [2023-09-08 Fri 11:42]--[2023-09-08 Fri 13:12] => 1:30 +:END: +[2023-09-08 Fri 11:42] +** 2023-W37 +*** 2023-09-11 Monday +**** DONE Avance on Org Level Clients :work: +SCHEDULED: <2023-09-12 Tue 14:00> +[2023-09-11 Mon 20:57] +**** MEETING 1-1 Jyoti Yann :work:meeting: +:LOGBOOK: +CLOCK: [2023-09-11 Mon 19:28]--[2023-09-12 Tue 00:36] => 5:08 +:END: +[2023-09-11 Mon 19:28] +***** Agenda (to discuss about) +??? +***** Notes +Didi discussion, another discussion source. +Need to figure out, DI, etc… + +Sequence Diagrams. + +To talk: - signing keys from OKTA +***** Actions + +- Advance on Org leve clients. + - fix https://github.com/advthreat/iroh/issues/7582 + - plan to update the client to use virtual +**** DONE Envoyer une liste d'amin par org [[https://github.com/Cisco-PosaaS/oak/issues/8664][Issue]] [[webexteams://im?space=b5136a40-6687-11ed-9679-4b10798d7c1a&message=11a76c20-5098-11ee-9e49-49fc7799be2b][Yuri]] :work: +SCHEDULED: <2023-09-12 Tue 11:00> +[2023-09-11 Mon 19:00] +**** DONE Envoyer les org-id à conserver (OAuth2 clients, master users) à Petr :work: +SCHEDULED: <2023-09-12 Tue 10:30> +[2023-09-11 Mon 18:59] +**** DONE Answer to [[webexteams://im?space=b5136a40-6687-11ed-9679-4b10798d7c1a&message=2298ba80-507e-11ee-a39b-619063280a9c][Yuri]] :work: +SCHEDULED: <2023-09-11 Mon 11:30> +:LOGBOOK: +CLOCK: [2023-09-11 Mon 11:02]--[2023-09-11 Mon 19:00] => 7:58 +:END: +[2023-09-11 Mon 11:02] +*** 2023-09-12 Tuesday +**** MEETING 1-1 Wanderson meeting :work:meeting: +:LOGBOOK: +CLOCK: [2023-09-12 Tue 16:34]--[2023-09-13 Wed 08:20] => 15:46 +:END: +[2023-09-12 Tue 16:34] +***** Agenda (to discuss about) +Reviewing +https://github.com/advthreat/iroh/pull/8300/files?short_path=fd98974#diff-fd98974c31ef730c3067abab7684e51eb6be875ee368a148d1ab660d832e5abc +***** Notes +***** Actions +****** TODO Create a new full description about JWKSService. + + - ~cache-jwks~: + - perform the call to the JWKS server and if successful update PG (if needed) + - the PG should contain: + - details about JWKS payload + - prepare a RAM (service context) public key from the JWKS payload + - ~get-jwks~: you only check the RAM service context + Returns a hashmap indiced with ~kid~ and values should be public keys. + If fails: ~(log/WARN )~ : either an attack or the JWKS updated For OPS Please + RESTART THE NODES!!!!. + - ~check-jwt-signature~: + 1. decode JWT + 2. get kid + 3. retrieve kid from ~(get (get-jwts) kid)~ + 4. Check signature + - ~validate-claims~: + 1. decode JWT + 2. check ~aud~ and ~exp~ +****** TODO The doc does not say if fields are mandatory or not. +Which one are mandatory? + +Example: https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/provisioning/common-provisioning/apireference/Models/Entitlement.md + +And more precisely: + +https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/provisioning/common-provisioning/apireference/Models/Tenant.md +*** 2023-09-13 Wednesday +**** MEETING Monetization :work:meeting: +:LOGBOOK: +CLOCK: [2023-09-13 Wed 19:30]--[2023-09-13 Wed 21:15] => 1:45 +:END: +[2023-09-13 Wed 19:30] +***** Agenda (to discuss about) +***** Notes +***** Actions +*** 2023-09-14 Thursday +**** MEETING Monetization Demo :work:meeting: +:LOGBOOK: +CLOCK: [2023-09-14 Thu 16:31]--[2023-09-14 Thu 17:25] => 0:54 +:END: +[2023-09-14 Thu 16:31] +***** Agenda (to discuss about) +***** Notes +***** Actions +** 2023-W38 +*** 2023-09-19 Tuesday +**** MEETING Weekly Team Meeting :work:meeting: +[2023-09-19 Tue 17:02] +***** IROH-Auth +- Talk about DI virtual users +- Progress on Universal Provisioning API (interesting Engineering challenges) +- Talk with Automation about Org virtual users +***** Notes +- Offsite +**** MEETING 1-1 Wanderson :work:meeting: +:LOGBOOK: +CLOCK: [2023-09-19 Tue 16:13]--[2023-09-19 Tue 17:54] => 1:41 +:END: +[2023-09-19 Tue 16:13] +***** Agenda (to discuss about) +***** Notes +***** Actions +****** Questions for PIAM +******* TODO Do you send a different URL for every provisioning call? Or is the URL fixed and should be configured? +**** DONE Prepare Automation Meeting (Org virtual user) :work: +SCHEDULED: <2023-09-19 Tue> +[2023-09-19 Tue 10:05] + +Why Org Virtual User? +https://github.com/Cisco-PosaaS/oak/issues/8664#issuecomment-1717653336 + +Why not "main Admin" of the Org? +Some admin could individually have different permissions and properties that +might not be something we'd like to provide the to clients. + +Changes? + +None, nothing changed. The email could be filled with something that was not an +email for very old accounts, but this claim was never mandatory. +You just got lucky every JWT had an email. +See: https://visibility.amp.cisco.com/iroh/doc/iroh-auth/index.html +Where ~email~ is explicitly marked as "optional". + +Short Tokens? + +Where ~email~ are removed from the claims. +We keep only: + +- "iss" +- "iat" +- "exp" +- "nbf" +- "jti" +- "aud" +- "sub" +- "https://schemas.cisco.com/iroh/identity/claims/format" +- "https://schemas.cisco.com/iroh/identity/claims/user/id" +- "https://schemas.cisco.com/iroh/identity/claims/org/id" +- "https://schemas.cisco.com/iroh/identity/claims/oauth/refresh-token-jti" +- "https://schemas.cisco.com/iroh/identity/claims/oauth/client/id" +- "https://schemas.cisco.com/iroh/identity/claims/oauth/user/id" +- "https://schemas.cisco.com/iroh/identity/claims/oauth/client/owner/id" +- "https://schemas.cisco.com/iroh/identity/claims/oauth/grant" +- "https://schemas.cisco.com/iroh/identity/claims/oauth/kind" + +In particular, no ~scope~, no ~email~, no ~user name~, etc… +*** 2023-09-20 Wednesday +**** MEETING API Design Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2023-09-20 Wed 18:29]--[2023-09-20 Wed 21:09] => 2:40 +:END: +[2023-09-20 Wed 18:29] + +Offsite: + +@Jyoti: + High level vision, XDR: + - AI team on top of the incident manager. + - MDR requirements + - Wednesday afternoon +***** G2 + +Telemetry. +@Gbuisson: give them access to data. +***** Yann status update + +- lot of work related to the design of Universal Provisioning API with Wanderson. + - Planned a new meeting next week with PIAM and SCA to check the design. + - New design implies many changes, (expect at least 4 release cycles): + - support PIAM tokens but also understand how to check them securely (for + now this is not clear) + - support worker run on constant interval that would run on a single instance. + - support lock. +- SE, SX-only provisioning with 0-click module setup support (https://github.com/advthreat/iroh/issues/8266) + blocked work related to SE provisioning, waiting for PR approval. Still no + ping from SE team yet. (https://github.com/advthreat/iroh/pull/8275) + - talked with Automation about the Org-level users yesterday, I think we are on + track with Murali. I think Santosh probably feels better about it. + They will need another client and they could automatically + get the tokens for the client generating Org-level tokens using tokens of the + first client because their client has ~oauth~ scope. +- still many small tasks related to fixing provision related bugs. + - Yesterday, and today asked by Danny to create an SX-only Org for Arizona + University directly asked by Brianna. + - Today, pinged by Matthew Franks because CSC onboarding is failing on EU. + - QA team asking to create SX-only orgs (Hissan yesterday) +- Heard about plan for custom roles, should be part with Petr planning. Just to + check if PMs expectations are easy to reach. For example a notion that an user + could have multiple roles. I don't think it would be difficult to do that in + IROH, but this might become a potential breaking change if external + integration looking at the ~role~ claim in JWT or in the ~whoami~ endpoint. +- Still keep track that Olivier feels good working on modules with Matt. + I think he appreciate to be exposed to other part of IROH he is used to. +**** MEETING Prepare Universal API Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2023-09-20 Wed 16:32]--[2023-09-20 Wed 18:29] => 1:57 +CLOCK: [2023-09-20 Wed 14:47]--[2023-09-20 Wed 14:50] => 0:03 +:END: +[2023-09-20 Wed 14:47] +***** Actions +***** Questions for PIAM: +****** TODO Optional Fields in PIAM doc + +The doc does not say if fields are mandatory or not. +Which one are mandatory? + +Example: https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/provisioning/common-provisioning/apireference/Models/Entitlement.md + +And more precisely: + + +https://wwwin-github.cisco.com/cisco-sbgidm/docs/blob/master/provisioning/common-provisioning/apireference/Models/Tenant.md +****** TODO How to check for PIAM ownership of the PIAM token + +I guess verifying the signature will not be enough. +Should we check a specific ~sub~ claim? +etc… +****** TODO Do you send a different callback URL for every provisioning call? Or is the URL fixed and should be configured? +*** 2023-09-21 Thursday +**** MEETING VPN Swagger :work:meeting: +:LOGBOOK: +CLOCK: [2023-09-21 Thu 16:02]--[2023-09-22 Fri 17:39] => 25:37 +:END: +[2023-09-21 Thu 16:02] + +SBG CTO is looking accross access. +*** 2023-09-22 Friday +**** DONE Do Data Retention Policy [[https://github.com/advthreat/iroh/pull/8384/files][ISSUE]] :work: +SCHEDULED: <2023-09-25 Mon 10:00> +:LOGBOOK: +CLOCK: [2023-09-22 Fri 17:39]--[2023-09-22 Fri 20:59] => 3:20 +:END: +[2023-09-22 Fri 17:39] +** 2023-W39 +*** 2023-09-27 Wednesday +**** DONE Advisory Lock Service [[https://shiroyasha.io/advisory-locks-and-how-to-use-them.html][Article]] :work: +SCHEDULED: <2023-09-27 Wed 11:00> +[2023-09-27 Wed 09:25] +** 2023-W39 +*** 2023-09-25 Monday +**** DONE Préparer Rewards Olivier :work: +SCHEDULED: <2023-09-25 Mon 14:30> +[2023-09-25 Mon 11:15] +***** Big things you did between Juyly 2022/August 2023: +****** XDR +- *RBAC +- Expose Entitlements +- [Provisioning] Update Entitlements +****** Generic +- Org Virtual User, very big win. + - Org Level Authorization in clients +- Public but hidden APIs +****** Devs +- IROH Configs and service graph discovery +- Public dev doc (template, deploy, etc…) +- Changelog +- Code coverage +***** Rewards + +Great throughput, Generic and Quality. +Not much I can ask for on my end. +**** DONE Préparer Rewards 1-1 Wanderson :work: +SCHEDULED: <2023-09-25 Mon 14:00> +[2023-09-25 Mon 11:14] +***** Big things you did between July 2022 / August 2023: +****** XDR +- Expose Entitlements +- scopes/permissions endpoints +****** Generic +- Short Tokens, not in use yet, but Automation wants them. +- Many code maintenance + bugfix/support +****** Devs +- some code fixes/refactos +***** Rewards + +Compare to other members, very good but sometime you had some lack of +consistence I affect to many of your life challenges. +Last few months this totally changed, so this will probably change. +Even like this you still are a very strong contributor. +I will probably be able to negociate for more next year. +**** DONE Créer template offsite :work: +SCHEDULED: <2023-09-25 Mon 12:00> +[2023-09-25 Mon 11:13] +** 2023-W40 +*** 2023-10-02 Monday +**** IN-PROGRESS Presentation Custom Roles :work: +:LOGBOOK: +CLOCK: [2023-10-02 Mon 18:11]--[2023-10-03 Tue 18:49] => 24:38 +:END: +[2023-10-02 Mon 18:11] +**** DONE Ecrire Presentation/Document custom roles :work: +SCHEDULED: <2023-10-02 Mon 16:00> +[2023-10-02 Mon 15:38] +*** 2023-10-05 Thursday +**** DONE Finaliser personal presentation :work: +SCHEDULED: <2023-10-09 Mon 10:00> +[2023-10-05 Thu 21:13] +**** DONE Préparer présentation IROH 2.0 :work: +SCHEDULED: <2023-10-09 Mon 09:00> +[2023-10-05 Thu 21:13] +** 2023-W42 +#+BEGIN: clocktable :scope subtree :maxlevel 4 :timestamp nil :link nil :tags t :narrow 36! :match "work" +#+CAPTION: Clock summary at [2023-10-23 Mon 11:20] +| Tags | Headline | Time | | | | +|---------------+-------------------------------+----------+----------+---------+---------| +| | *Total time* | *1d 12:26* | | | | +|---------------+-------------------------------+----------+----------+---------+---------| +| | \_ 2023-W42 | | 1d 12:26 | | | +| | \_ 2023-10-16 Monday | | | 1d 3:56 | | +| work, meeting | \_ Monetization | | | | 1d 3:56 | +| | \_ 2023-10-18 Wednesday | | | 3:02 | | +| work, meeting | \_ Custom Roles with Guy | | | | 3:02 | +| | \_ 2023-10-20 Friday | | | 5:28 | | +| work, meeting | \_ Detect Unused Orgs | | | | 5:28 | +#+END: +*** 2023-10-16 Monday +**** DONE Reserver Ecran :work: +SCHEDULED: <2023-10-24 Tue 10:40> +[2023-10-16 Mon 17:42] +**** DONE Factures offsite :work: +SCHEDULED: <2023-10-17 Tue 10:00> +[2023-10-16 Mon 17:41] +**** MEETING Monetization :work:meeting: +:LOGBOOK: +CLOCK: [2023-10-16 Mon 16:02]--[2023-10-17 Tue 19:58] => 27:56 +:END: +[2023-10-16 Mon 16:02] +***** Agenda (to discuss about) +***** Notes +***** Actions +- Add discussion about upgrade/downgrade session [[webexteams://im?space=27f93cd0-5190-11ee-bd8d-35c3d6dd9f2f][Channel]] +**** DONE Create clients [[webexteams://im?space=fc0e4f90-527d-11ee-98f2-0faa9801585c][SSE]] :work: +SCHEDULED: <2023-10-16 Mon 15:00> +[2023-10-16 Mon 11:11] +*** 2023-10-18 Wednesday +**** MEETING Meraki OAuth2 discussion :work:meeting: +[2023-10-18 Wed 17:09] +***** Agenda (to discuss about) +***** Notes +***** Actions +**** MEETING JWT and Entitlements :work:meeting: +[2023-10-18 Wed 16:31] +***** Agenda (to discuss about) +***** Notes +***** Actions +**** MEETING Custom Roles with Guy :work:meeting: +:LOGBOOK: +CLOCK: [2023-10-18 Wed 16:01]--[2023-10-18 Wed 19:03] => 3:02 +:END: +[2023-10-18 Wed 16:01] +***** Agenda (to discuss about) +How to get JWTs +How to retrieve Entitlements +***** Notes + +@Andrew_Parisi +Data retention for conure. +***** Actions +*** 2023-10-20 Friday +**** MEETING Detect Unused Orgs :work:meeting: +:LOGBOOK: +CLOCK: [2023-10-20 Fri 16:01]--[2023-10-20 Fri 21:29] => 5:28 +:END: +[2023-10-20 Fri 16:01] +***** Agenda (to discuss about) +***** Notes +***** Actions +** 2023-W43 +*** 2023-10-23 Monday +**** MEETING FMC delegate OAuth2 Device Grant :work:meeting: +:LOGBOOK: +CLOCK: [2023-10-23 Mon 16:31]--[2023-10-23 Mon 17:59] => 1:28 +:END: +[2023-10-23 Mon 16:31] +***** Agenda (to discuss about) +***** Notes +***** Actions +*** 2023-10-24 Tuesday +**** MEETING Staging decision :work:meeting: +:LOGBOOK: +CLOCK: [2023-10-24 Tue 20:06]--[2023-10-24 Tue 21:26] => 1:20 +:END: +[2023-10-24 Tue 20:06] +***** Agenda (to discuss about) +***** Notes +***** Actions +*** 2023-10-26 Thursday +**** MEETING XDR Data Retention Sync :work:meeting: +:LOGBOOK: +CLOCK: [2023-10-26 Thu 17:31]--[2023-10-26 Thu 18:01] => 0:30 +:END: +[2023-10-26 Thu 17:30] +***** Agenda (to discuss about) +***** Notes +***** Actions +** 2023-W44 +*** 2023-10-30 Monday +**** DONE Delete PIAM clients created by me :interruption:work: +:LOGBOOK: +CLOCK: [2023-10-30 Mon 17:13]--[2023-10-30 Mon 18:16] => 1:03 +:END: +[2023-10-30 Mon 17:13] + +#+begin_src +./get-client -e test --client-id 'client-092cc2a4-4a91-41d5-a153-caf2304f64a6' +{:env :test, + :client + {:name "PIAM-Provisioning-TEST", + :availability "org", + :scopes ["cisco/platform"], + :grants ["client-creds"]}, + :owner + {:user-id "cbab92a3-d606-4c74-895c-0c8921dce6ef", + :user-name "Yann (MASTER)", + :user-email "yaesposi@cisco.com", + :additional-scopes + ["iroh-admin" "cognitive" "iroh-master" "cisco" "global-intel"]}, + :org + {:id "33b2cdbf-0d67-42f3-8a20-ca96fac4e20c", + :name "Y ORG (master-user)"}} +#+end_src +** 2023-W45 +*** 2023-11-06 Monday +**** DONE undo upgrade on enterprise-id :work: +SCHEDULED: <2023-11-07 Tue 10:00> +[2023-11-06 Mon 18:39] +**** DONE Planifier visite médicale :work: +SCHEDULED: <2023-11-06 Mon 14:00> +[2023-11-06 Mon 10:42] +*** 2023-11-07 Tuesday +**** MEETING Weekly Lead Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2023-11-07 Tue 15:07]--[2023-11-07 Tue 16:37] => 1:30 +:END: +[2023-11-07 Tue 15:07] +***** Agenda (to discuss about) +***** Notes + +Mario on centralizing CTIA/private-intel +***** Actions +** 2023-W46 +*** 2023-11-14 Tuesday +**** MEETING User + Breach Suite Priority :work:meeting: +:LOGBOOK: +CLOCK: [2023-11-14 Tue 17:35]--[2023-11-14 Tue 18:17] => 0:42 +:END: +[2023-11-14 Tue 17:35] +***** Agenda (to discuss about) + +Our current customer experience isn’t great – we rely on personal contact to the +admin to provision the products in a very specific order, and then a manual +correction on the back end. +This is because both XDR and Secure Access set up a Secure X org, which is +necessary for Breach and User Suites, respectively – but in the Combo Suite +there’s currently no way for them to coordinate and only set up one org. +Align on the priority of fixing this issue Proposed resolution, is this the +right path forward + +Please forward the meeting if I have not included all the right representatives. + +XDR: Briana, Jyoti +Secure Access: Nirmal, Justin (Sangeeta, Matt optional) +Secure Endpoint: Ivlana, Alain +E2E Test: JJ, April +PMO: Sukanthi +PM Ops: Mandy +***** Notes +***** Actions +*** 2023-11-15 Wednesday +**** MEETING API Design Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2023-11-15 Wed 19:15]--[2023-11-15 Wed 22:14] => 2:59 +:END: +[2023-11-15 Wed 19:15] +***** Agenda (to discuss about) +***** Notes +***** Actions +****** DONE Add a check for the module. +SCHEDULED: <2023-11-16 Thu 14:00> +*** 2023-11-16 Thursday +**** MEETING Universal PIAM flow check-in :work:meeting: +:LOGBOOK: +CLOCK: [2023-11-16 Thu 16:29]--[2023-11-17 Fri 18:02] => 25:33 +:END: +[2023-11-16 Thu 16:29] +***** Agenda (to discuss about) +***** Notes +***** Actions + +Open work: + +Admin work: + - Have an OAuth2 client credentials to answer back to PIAM + - Have a reasonable value for waiting time of failure (I would say 24h) + - Potentially add a mechanism to send an error email to an internal TAC support + team about a problem for some customer during the provisioning that need + manual intervention + - +*** 2023-11-17 Friday +**** MEETING Monthly Engineer Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2023-11-17 Fri 18:02]--[2023-11-17 Fri 20:10] => 2:08 +:END: +[2023-11-17 Fri 18:02] +***** Agenda (to discuss about) +***** Notes +***** Actions +** 2023-W47 +*** 2023-11-21 Tuesday +**** MEETING XDR / PIAM common provisioning api coordination :work:meeting: +:LOGBOOK: +CLOCK: [2023-11-21 Tue 18:05]--[2023-11-21 Tue 21:27] => 3:22 +:END: +[2023-11-21 Tue 18:05] +***** Agenda (to discuss about) +Checks work to be done. +What the timeline is looking like? +***** Notes +***** Actions +** 2023-W48 +*** 2023-11-28 Tuesday +**** DONE org-level-auth for DI clients :work: +SCHEDULED: <2023-11-28 Tue 14:00> +[2023-11-28 Tue 09:56] +*** 2023-11-29 Wednesday +**** MEETING API Design Meeting :work:meeting: +:LOGBOOK: +CLOCK: [2023-11-29 Wed 18:45]--[2023-11-29 Wed 21:21] => 2:36 +:END: +[2023-11-29 Wed 18:45] +***** Agenda (to discuss about) +***** Actions +***** Notes +****** Common Org + +Have a common org for SE and other internal products. + +- CDO effort piece stopped. PIAM will take that. + +@Jyoti: Staging + +Ask from PM. Nobody from the Engineering team wants to do this. + +Asked to us explain why it would take 1 year. +So created a document, started with Murali. + +Ops came back on estimation. +Couple of hours. + +PM came back, what for a brand new region. +Ops let's use the same script. +PM why was that one year. + +Be very clear of the steps after it was setup. +All the configurations we need. +Number of steps, clearly call out assumptions and dependencies. +Etc… Add up all the work for all integrations. + +PIAM +**** MEETING SCC Script (brownfield provisioning) :work:meeting: +:LOGBOOK: +CLOCK: [2023-11-29 Wed 17:55]--[2023-11-29 Wed 18:44] => 0:49 +:END: +[2023-11-29 Wed 17:55] +***** Agenda (to discuss about) +***** Notes + +Danny will run a script to trigger user-email+org-id => start flow to attach to +enterprise-id & entitlements +***** Actions +** 2023-W49 +*** 2023-12-04 Monday +**** MEETING Scoring Escalation Devs Sync :work:meeting: +:LOGBOOK: +CLOCK: [2023-12-04 Mon 15:20]--[2023-12-04 Mon 21:56] => 6:36 +:END: +[2023-12-04 Mon 15:20] +***** Agenda (to discuss about) +***** Notes +***** Actions + +- monitor failed pushed incidents +- improve robustness of incidents scoring by having default quick score + harder score +*** 2023-12-08 Friday +**** MEETING IROH Sync :work:meeting: +:LOGBOOK: +CLOCK: [2023-12-08 Fri 17:08]--[2023-12-09 Sat 09:31] => 16:23 +:END: +[2023-12-08 Fri 17:08] +***** Agenda (to discuss about) +- Retrospective +***** Notes +****** Guillaume (4/5) +- Communication Quality: 4/5 +- Well: +- Badly: + - CRITICAL ESCALATION INCIDENT. + Went undetected. + Too confident in monitoring. +****** Yann (4/5) ... +****** Matt (4/5) ++ positive: data dog ++ negative: ++ suggestions: + + put name into anonymous function +****** Mario (4/5) ++ positive: + - people are implicated + - many patches that improved the situation ++ negative: + - lot of people impacted + - accounting for every task ++ Suggestion: + - keep track of successful/failed jobs +****** Olivier (4/5) ++ positive: ++ negative: + - nb of PG queries ++ suggestions: + - could have tried to help +****** Jerôme (?/5) ++ positive + - we will improve our monitoring ++ negative: + - monitoring ++ suggestion: + - we could have been helpful to retrieve logs for example. + - work on monitoring + - add sentry to get all trace back +****** Ambrose (?/5) ++ postive: + - great resume from GB ++ negative: + - incident and CPU, cut corners ++ suggestion: + - ... +****** Kirill (4/5) ++ positive: + - great to see how people collaborating ++ negative: + - ns, db functionality, relation logic, + - process to introduce big architecture changes. + - not actively collaborating on PR ++ suggestion + - look more to other's PRs + - big architecture changes +****** Shafiq (?/5) ++ positive: + - identified the mapping issue in the iroh-event feature ++ negative: + - ... ++ suggestion: +***** Actions +** 2023-W50 +*** 2023-12-14 Thursday +**** MEETING Refresh tokens :work:meeting: +:LOGBOOK: +CLOCK: [2023-12-14 Thu 19:06]--[2023-12-15 Fri 15:51] => 20:45 +:END: +[2023-12-14 Thu 19:06] +***** Agenda (to discuss about) +***** Notes + +- Create Trusted clients (read only) with longer refresh tokens +- Write the doc for the UI team +***** Actions +**** DONE Refresh tokens (doc + create read-only clients) :work: +SCHEDULED: <2023-12-15 Fri 11:00> +[2023-12-14 Thu 19:06] +*** 2023-12-15 Friday +**** DISC Sync with team :work:discussion: +:LOGBOOK: +CLOCK: [2023-12-15 Fri 15:51]--[2023-12-15 Fri 17:21] => 1:30 +:END: +[2023-12-15 Fri 15:51] +** Initial + + +For the end of the week, I feel I didn't sync'd enough with both of you. + +So let me give a short update about what is going on. + +1. I started working on finally provide a correct impersonating mechanism. + It will use the same JWT generation as the login mechanism. Providing not + only an access token but also a refresh token. + + - If you impersonate, your user details are saved in an ~act~ claim that will + contain an user identity. + - If you use an impersonated JWT to switch account, the new JWT will keep the + same ~act~ claim as the first impersonated claim. + - I don't think we need to go down up to the point of tracking OAuth2 + clients, but this is a possibility. +2. I will have a meeting with Danny an Prerna to provide a script that will make + customer responsible for connecting their PIAM account to their XDR account. + The script looks like something very easy to write and provide. + We'll see. +3. I started a discussion with the UI team because I was pinged by Piotr to have + a long living dashboard (so very long session to show an XDR dashboard). + Here is what I proposed: + + 1. create a few specific trusted clients (with dummy password...) for which + refresh tokens expires only after 1 month. + 2. When the user want to display a long living dashboard, the UI could switch + the tokens used from the session token to the token retrieved from this + client by using the `/iroh/oauth2/custom/tokens` route. + + 4. A similar discussion spawned with Chris Duane about providing a safer + mechanism to hand JWT to the AI component. And I proposed the exact same + solution. + Create a specific client and hand over these new token we can control more + easily than a user session token. + 5. The priority is still Universal Provisioning fixes and improvements. This is + why I didn't started to talk about the rest of the work yet + 6. After looking at the fiasco that was trying to use events to create a cache + for Entitlement Summary. Not much a fiasco, but a clear reminder that + concurrent (or even worse distributed) event systems are a nightmare to + internalize and understand. + We could have a longer discussion about this if you feel inclined. + 7. Last but not least in anyway, we might finally start a new big chunck of work + to support multi-region/sub-region. We worked with GB on a new design that + would provide the ability to our customer to select their prefered AWS + deployment region while minimizing the impact on the ops, development teams + and other integrated teams. For now, this is just a proposal that we bubbled + up to the PMs. We will see if this is accepted or if there is another plan to + support more geos. +** ChatGPT English corrected + +As the end of the week approaches, I feel like I haven't synced enough with both of you. To provide a brief update on my progress, here are some key points: + +1. I have been working on implementing an impersonating mechanism that uses JWT generation similar to the login process. This will not only generate an access token but also a refresh token. If you use an impersonated JWT to switch accounts, the new JWT will retain the same ~act~ claim as the first impersonated claim. While it may be possible to track OAuth2 clients, I don't think we need to go that far. +2. I have a meeting scheduled with Danny and Prerna to provide them with a script that will enable customers to connect their PIAM account to their XDR account. The script should be relatively easy to write and implement. We'll see how it goes. +3. I recently had a discussion with the UI team because Piotr pinged me about creating a long-living dashboard. To achieve this, I proposed the following solution: + * Create a few trusted clients (with dummy passwords) for which refresh tokens expire only after one month. + * When the user wants to display a long-living dashboard, the UI can switch from using the session token to retrieving a token from this client by using the `/iroh/oauth2/custom/tokens` route. +4. A similar discussion took place with Chris Duane about providing a safer mechanism for handing JWTs to the AI component. I suggested creating a specific client and controlling these new tokens more easily than user session tokens. +5. The priority remains fixing and improving Universal Provisioning, which is why I haven't started discussing other work yet. +6. After attempting to use events to create an Entitlement Summary cache, I was reminded of the challenges associated with concurrent (or even distributed) event systems. We could have a longer discussion about this if you're interested. +7. Lastly, we might finally begin working on a new project to support multi-region/sub-region deployment options. Our team has proposed a design that would allow customers to select their preferred AWS deployment region while minimizing the impact on ops, development teams, and other integrated teams. This is currently being reviewed by PMs, and we'll see if it's accepted or if there are alternative plans in place. +** 2023-W51 +*** 2023-12-19 Tuesday +**** MEETING 1-1 Olivier :work:meeting: +:LOGBOOK: +CLOCK: [2023-12-19 Tue 15:32]--[2023-12-19 Tue 22:00] => 6:28 +:END: +[2023-12-19 Tue 15:32] +***** Agenda (to discuss about) +***** Notes +***** Actions +*** 2023-12-20 Wednesday +**** IN-PROGRESS Investigate org-not-found for DI :work: +:LOGBOOK: +CLOCK: [2023-12-20 Wed 09:48]--[2023-12-20 Wed 22:42] => 12:54 +:END: +[2023-12-20 Wed 09:48]