69 KiB
- 2022
- 2022-W05
- 2022-W06
- 2022-W07
- 2022-W08
- 2022-W10
- 2022-W11
- 2022-W13
- 2022-W15
- 2022-W16
- 2022-W18
- 2022-W19
- 2022-W20
- 2022-W21
- 2022-W22
- 2022-W23
- 2022-06-07 Tuesday
- CANCELED PR to have 5min expiration time for iroh-ui client
- CHAT Rekha ask for 5min expiration access tokens
- CHAT Rekha questions
- Propose a technical solution for 6770
- Remove duplicates duplicate
- Weekly Leads
- PAUSE pause
- discuss Wanderson comment on Refresh Token
- Jeetu/Shaila keynote RSA keynote start 1:15/1:28
- Check Wanderson discussion switch-tenant jwt endpoint
- Team Space check-in
- pwreset
- 2022-06-08 Wednesday
- IN-PROGRESS Create issue about filtering matching orgs with already existing user email
- MEETING Tenant Switching sync
- CHAT Discussion about session token lifetime
- meeting things to talk about
- Check Doc for tenant switching
- CHAT Answered SecureX / CTR Support
- Answer to Refresh Session Tokens chat Refresh Token room
- 2022-06-09 Thursday
- 2022-06-10 Friday
- 2022-06-07 Tuesday
- 2022-W24
2022
2022-W05
2022-02-03 Thursday
DONE activate logout issue work
CLOCK: [2022-02-03 Thu 17:17]–[2022-02-03 Thu 19:02] => 1:45
[2022-02-03 Thu 17:17]
For https://github.com/advthreat/iroh/issues/6250
The fix (https://github.com/advthreat/iroh/pull/6194) has been reverted (https://github.com/advthreat/iroh/pull/6246) because SecureX and CTR work differently.
GLaDOS and CTR must find a common solution, for now, we are blocked. I think the technical solution to return a 401 when the org change from unactivated to activated was proposed by @alucigna but I couldn't find the link to the discussion.
cc: @alucigna @DarMontou @sabrinamokerji
2022-02-04 Friday
MEETING Weekly Kirill Presentation work meeting
CLOCK: [2022-02-04 Fri 17:04]–[2022-02-04 Fri 20:24] => 3:20
[2022-02-04 Fri 17:04]
- ref
Notes
MEETING Simplify Registration work meeting
CLOCK: [2022-02-04 Fri 16:37]–[2022-02-04 Fri 17:04] => 0:27
[2022-02-04 Fri 16:37]
- ref
- https://cisco-my.sharepoint.com/:w:/p/prdass/EXwUr_HCwOVNte7KFcFzUeABxvTZiL8vZTgd8-5WInt4hA?e=4%3an55ogS&at=9
Add your status in
Agenda (to discuss about)
Notes
Actions
2022-W06
2022-02-07 Monday
REVIEW Github tour work review
CHAT Webex tour work chat
CLOCK: [2022-02-07 Mon 10:33]–[2022-02-07 Mon 10:54] => 0:21
[2022-02-07 Mon 10:53]
DONE Check Customer bug with tiles. work
CLOCK: [2022-02-07 Mon 09:52]–[2022-02-07 Mon 10:33] => 0:41
[2022-02-07 Mon 10:52]
Confirmed this is UI for now.
2022-02-08 Tuesday
CHAT random rambling work chat
EMAIL Email tour work email
CLOCK: [2022-02-08 Tue 10:13]–[2022-02-08 Tue 10:47] => 0:34
[2022-02-08 Tue 10:13]
CHAT Webex tour work chat
CLOCK: [2022-02-08 Tue 09:49]–[2022-02-08 Tue 10:13] => 0:24
[2022-02-08 Tue 09:49]
IROH
Remark about deps in IROH for Ag (pb with the formatting-stack and clojurescript)
IROH-Social
OPs General
DI Integration
Replace SSE IDB with SXSO
Jason Chamber links:
- A-Ha link (Epic) https://ciscosecurity.aha.io/epics/SECUREX-E-471
- A-Ha link (Feature) https://ciscosecurity.aha.io/features/SECUREX-557
- Jira link https://jira-eng-rtp3.cisco.com/jira/projects/SSO/issues/SSO-458?filter=myopenissues
Demand A-HA access
SecureX + ThreatGrid
Follow 1-click deactivation discussion.
2022-02-09 Wednesday
MEETING API Design Meeting work meeting
CLOCK: [2022-02-09 Wed 17:30]–[2022-02-09 Wed 18:16] => 0:46
[2022-02-09 Wed 17:30]
- ref
Agenda (to discuss about)
Notes
Actions
MEETING Sync on the IROH Team capacity work meeting
CLOCK: [2022-02-09 Wed 15:26]–[2022-02-09 Wed 17:30] => 2:04
[2022-02-09 Wed 15:26]
- participants
- Prerna
notes
2022-02-10 Thursday
MEETING Town Hall Namrata work meeting
CLOCK: [2022-02-10 Thu 20:02]–[2022-02-10 Fri 21:09] => 1:07
[2022-02-10 Thu 20:02]
Really excited for our session today. Really candid feedback from you. Every Quarter.
What we are working on and why and where we're headed.
Intro
- Business Result (Martin)
- Product Strategy (demos)
- Product Demonstrations
Leave a few minutes at the end for some Q&A.
Business update & strategy discussion
MEETING Farewell Alex work meeting
CLOCK: [2022-02-10 Thu 19:01]–[2022-02-10 Thu 20:02] => 1:01
[2022-02-10 Thu 19:01]
Expertise and broad culture.
You have always been extremely helpful. Your insights were essential. Without them I wouldn't have been able to grasp the scope about what we are building.
And thanks for helping me remember about Gundam and all the first times.
MEETING Weekly Team Meeting work meeting
CLOCK: [2022-02-10 Thu 17:00]–[2022-02-10 Thu 19:01] => 2:01
[2022-02-10 Thu 17:00]
Waiting
Discussion about updating doc in the response repository.
Ag
- Module Type Patch UI
Ambrose
- put something in TEST might break something
G2
Description of lot of work for Q3, etc…
Irina
- soft delete
Kirill
Improve timeouts. Started a work around pmap
.
Mark
OIDC with AO.
Matt
Addressing security issue discovered by the Engine team.
Olivier
Emails of users in lower-case. Done in the code. Rollback system. And maintenance service that could update the stores.
Adding a new search function.
Rob
Support all modules that have a module-type in App Links. Integrating SXSO into that. SecureX endpoint.
Wanderson
Simplification Registration FT
Adding a new session to a new frontend.
Yann
- customer session to fix a bug
- IDB decommission must take the time, probably ask Matt some help.
-
Registration Simplification
- Wanderson work make it possible to finally have an IROH-Auth Application Session.
- Olivier is working on improving our textual search services and API.
- Reduction of the scope should make it possible to finish for Q3
- The current work will make it a lot easier to provide a better UI to manage your multiple orgs (like hide/disable/rename etc…)
- (background) fix the issue related to refresh token state in the DB, most of the work is now done for the new services, just need to populate the data during OAuth2 Code flow.
Guillaume
Removed the arrow, and now, design with OIDC to propose trial.
2022-02-11 Friday
MEETING Registration Simlification work meeting
CLOCK: [2022-02-11 Fri 16:31]–[2022-02-11 Fri 17:48] => 1:17
[2022-02-11 Fri 16:31]
- ref
Agenda (to discuss about)
Notes
Actions
CHAT Olivier Question like-match rule work chat
CLOCK: [2022-02-11 Fri 15:19]–[2022-02-11 Fri 16:31] => 1:12
[2022-02-11 Fri 15:19]
DONE Security Training work
CLOCK: [2022-02-11 Fri 11:24]–[2022-02-11 Fri 11:50] => 0:26
[2022-02-11 Fri 11:24]
DISC github notifications morning tour work discussion
CLOCK: [2022-02-11 Fri 10:15]–[2022-02-11 Fri 11:23] => 1:08
[2022-02-11 Fri 10:15]
CHAT Webex morning tour work chat
CLOCK: [2022-02-11 Fri 10:00]–[2022-02-11 Fri 10:15] => 0:15
[2022-02-11 Fri 10:14]
EMAIL Morning Email Tour work email
CLOCK: [2022-02-11 Fri 10:11]–[2022-02-11 Fri 10:14] => 0:03
[2022-02-11 Fri 10:11]
2022-W07
2022-02-14 Monday
MEETING Simplify Registration work meeting
CLOCK: [2022-02-14 Mon 16:30]–[2022-02-14 Mon 17:19] => 0:49
[2022-02-14 Mon 16:30]
2022-02-17 Thursday
MEETING Weekly Team Meetings work meeting
CLOCK: [2022-02-17 Thu 17:00]–[2022-02-17 Thu 20:45] => 3:45
[2022-02-17 Thu 17:00]
- ref
Ag
index page is always tk-server
2022-02-18 Friday
DONE Fix module-type work
CLOCK: [2022-02-18 Fri 12:21]–[2022-02-18 Fri 15:51] => 3:30
[2022-02-18 Fri 12:21]
APJC SCA
{
"description": "Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) improves security and incident response across the distributed network, from the private network and branch office to the public cloud. This solution addresses the need for digital businesses to quickly identify threats posed by their network devices and cloud resources, and to do so with minimal management, oversight, and security manpower.\n\nThe network is evolving. IT resources are frequently being moved into the cloud. At the same time, the number of connected devices on the private network is increasing dramatically. Security personnel are struggling just to know what entities are operating in their environment, let alone whether they pose a threat to the organization.\n\nSecure Cloud Analytics addresses this problem by providing comprehensive visibility and high-precision alerts with low noise, without the use of agents. Organizations can accurately detect threats in real time, regardless of whether an attack is taking place on the network, in the cloud, or across both environments. Secure Cloud Analytics is a cloud-based, Software-as-a-Service (SaaS)-delivered solution. It detects ransomware and other malware, data exfiltration, network vulnerabilities, and role changes that indicate compromise.\n\nAlso, developer teams are continuously adopting new and more dynamic compute environments like serverless and containers such as AWS Lambda and Kubernetes. Secure Cloud Analytics provides visibility into these environments as well, so that organizations don’t have to compromise on security on their path to digital transformation.",
"properties": "2MGqPrzLNIrfFeFK/UUzdpA98pKEUHLvd6d7+snqeh1lXokV9n6J8lKeAwp7tRdCSHT+crPhmilCkfBXkvfT+8NLp/rq+4TD32EkYqcYNngmgsAji/UJ6NuChgJnPd+FwwembDj2iPh7vFXHnGmLKlgOkweQzokI2CUROgbTw2JNruDhL47ws3LhMl2LRqlbJQP83yeGMmwjV0mjFSth/w25D1oIHR+mnYH7mrcKUH0XT/6xQzqJ3l6URkbun6wvzLycJhqtOtqtJSdB3cAfYlhfkpCY8ZXt9IO8/MyOeGJ6Qf2iz9gXIFAgtNBBz9bkZAPk4Uv0nei39F4lwFv9lmUdVGuHIHtHJKf4sn/qB40=",
"capabilities": [
{
"id": "health",
"description": "Healthcheck"
},
{
"id": "deliberate",
"description": "Deliberation"
},
{
"id": "observe",
"description": "Enrichments"
},
{
"id": "refer",
"description": "Reference links"
},
{
"id": "tiles",
"description": "Dashboard Tiles"
}
],
"app_link_meta": {
"url": "https://portal-anz.obsrvbl.com/auth/?next=%2Fv2%2F%23%2Fsettings%2Fintegrations%2Fsecurex",
"meta": {
"x_okta_bookmark_id": "0oa1idxamsrOKeFuN357"
},
"title": "Stealthwatch Cloud (ANZ)"
},
"tips": "If the Secure Cloud Analytics (formerly Stealthwatch Cloud) integration module displays a **Bidirectional** icon on the module panel, it indicates that the integration was enabled in Secure Cloud Analytics or SecureX. \n\nFor information on the Secure Cloud Analytics integration with SecureX, see [Secure Cloud Analytics SecureX integration Guide](https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/cloud/SecureX/SecureX_Integration_Guide_DV_2_0.pdf).",
"logo": "data:image/svg+xml;base64,PHN2ZyBkYXRhLW5hbWU9IkxheWVyIDEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgdmlld0JveD0iMCAwIDM0LjEgMzIuMiI+PHBhdGggZmlsbD0iIzI3NGJhMCIgZD0iTTAgMGgzNC4xdjMyLjE2SDB6Ii8+PHBhdGggZD0iTTIyLjcgMTYuOGEzIDMgMCAwMC0zLTNoLS4xYTQuMyA0LjMgMCAwMC04LjEgMS41IDIuMyAyLjMgMCAwMC0yLjYgMS44LjkuOSAwIDAwLS4xLjUgMi4yIDIuMiAwIDAwMi40IDIuMkgyMGEzIDMgMCAwMDIuNy0zeiIgZmlsbD0iI2ZmZiIvPjxwYXRoIGQ9Ik0yMC4zIDhhOC43IDguNyAwIDAwLTUuOC0yLjIgMTEuNyAxMS43IDAgMDAtNS4xIDEuNk0xMC4xIDIzLjZoMTMuM3M1LjctLjcgNS43LTYuM2E2LjUgNi41IDAgMDAtMi45LTUuNCIgZmlsbD0ibm9uZSIgc3Ryb2tlPSIjZmZmIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1taXRlcmxpbWl0PSIxMCIvPjxjaXJjbGUgY3g9IjIyLjciIGN5PSIxMC44IiByPSIxLjciIGZpbGw9IiNmZmYiLz48Y2lyY2xlIGN4PSI2LjMiIGN5PSIyMy42IiByPSIxLjgiIGZpbGw9IiNmZmYiLz48Y2lyY2xlIGN4PSI4IiBjeT0iOC43IiByPSIxLjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLW1pdGVybGltaXQ9IjEwIi8+PC9zdmc+",
"org_id": "4f169b08-bb0d-4e97-a358-8fd3fd819066",
"configuration_spec": [
{
"key": "token",
"type": "api_key",
"label": "Authorization Token",
"required": true
}
],
"short_description": "Gain the visibility and continuous threat detection needed to secure your public cloud, private network, and hybrid environments.",
"title": "Secure Cloud Analytics",
"external_references": [
{
"link": "https://info.securexanalytics.com/SecureX-Trial-Request.html",
"label": "Free Trial"
},
{
"link": "https://www.cisco.com/c/en/us/products/security/stealthwatch-cloud/index.html",
"label": "Product Information"
},
{
"link": "https://www.cisco.com/c/dam/r/ctp/docs/privacydatasheet/security/cisco-stealthwatch-cloud-privacy-data-sheet.pdf",
"label": "Privacy Policy"
},
{
"link": "https://portal-anz.obsrvbl.com/auth/?next=%2Fv2%2F%23%2Fsettings%2Fintegrations%2Fsecurex%3Fstatus%3Dtrue",
"class": "activation",
"label": "Activate"
}
],
"updated_at": "2022-02-18T10:17:14.710Z",
"id": "f31e83d1-48e7-4384-9c6a-64a5c9cee05b",
"record": "relay-module.module/RelayModule",
"user_id": "207347d9-65c0-402b-88ce-ef028989e95f",
"client_id": "iroh-ui",
"default_name": "Secure Cloud Analytics",
"flags": [
"default"
],
"enabled": true,
"visibility": "global",
"created_at": "2020-05-15T17:45:46.904Z",
"former_title": "Stealthwatch Cloud"
}
NAM:
{
"description": "Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) improves security and incident response across the distributed network, from the private network and branch office to the public cloud. This solution addresses the need for digital businesses to quickly identify threats posed by their network devices and cloud resources, and to do so with minimal management, oversight, and security manpower.\n\nThe network is evolving. IT resources are frequently being moved into the cloud. At the same time, the number of connected devices on the private network is increasing dramatically. Security personnel are struggling just to know what entities are operating in their environment, let alone whether they pose a threat to the organization.\n\nSecure Cloud Analytics addresses this problem by providing comprehensive visibility and high-precision alerts with low noise, without the use of agents. Organizations can accurately detect threats in real time, regardless of whether an attack is taking place on the network, in the cloud, or across both environments. Secure Cloud Analytics is a cloud-based, Software-as-a-Service (SaaS)-delivered solution. It detects ransomware and other malware, data exfiltration, network vulnerabilities, and role changes that indicate compromise.\n\nAlso, developer teams are continuously adopting new and more dynamic compute environments like serverless and containers such as AWS Lambda and Kubernetes. Secure Cloud Analytics provides visibility into these environments as well, so that organizations don’t have to compromise on security on their path to digital transformation.",
"properties": "yUY5o15RUpAfB7Lk3RxosIJYx2JpDTaf4TkddVzepwSbz3A9m9b+/KyHxuiSH1SbTf6r5qk2SgaSKA8efk3pbDqL2RQC248eQoez0EI0GaAmnXnnhuEH91ZFtddwyQdvX+tUY+vxbHfdkES6rKP0hLWxMMZcYikD5ONBfNwak3kqlq0g07c52Gnx9Qgg5UOdzwBqTVb883tJZ+fRAFhYU7Hu7DNZDRDnccTOUFNJw84hmg7NEFMjK5Z48BG51qBgW50u/Wxv7+ceCUFUYrwbFzQLB/zbspQcFJtlUwZHZ7jl/VQbLT5QqJLthRnphAIGE/xIsEeCG66fZg1Ds60Vwp/c12ueYJVsVZyhHBIG0wk=",
"capabilities": [
{
"id": "health",
"description": "Healthcheck"
},
{
"id": "deliberate",
"description": "Deliberation"
},
{
"id": "observe",
"description": "Enrichments"
},
{
"id": "refer",
"description": "Reference links"
},
{
"id": "tiles",
"description": "Dashboard Tiles"
}
],
"app_link_meta": {
"url": "https://portal-staging.obsrvbl.com/auth/?next=%2Fv2%2F%23%2Fsettings%2Fintegrations%2Fsecurex",
"meta": {
"x_okta_bookmark_id": "0oa1hyf3xtXD6Xqxg357"
},
"title": "Stealthwatch Cloud (US)"
},
"tips": "If the Secure Cloud Analytics (formerly Stealthwatch Cloud) integration module displays a **Bidirectional** icon on the module panel, it indicates that the integration was enabled in Secure Cloud Analytics or SecureX. \n\nFor information on the Secure Cloud Analytics integration with SecureX, see [Secure Cloud Analytics SecureX integration Guide](https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/cloud/SecureX/SecureX_Integration_Guide_DV_2_0.pdf).",
"logo": "data:image/svg+xml;base64,PHN2ZyBkYXRhLW5hbWU9IkxheWVyIDEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgdmlld0JveD0iMCAwIDM0LjEgMzIuMiI+PHBhdGggZmlsbD0iIzI3NGJhMCIgZD0iTTAgMGgzNC4xdjMyLjE2SDB6Ii8+PHBhdGggZD0iTTIyLjcgMTYuOGEzIDMgMCAwMC0zLTNoLS4xYTQuMyA0LjMgMCAwMC04LjEgMS41IDIuMyAyLjMgMCAwMC0yLjYgMS44LjkuOSAwIDAwLS4xLjUgMi4yIDIuMiAwIDAwMi40IDIuMkgyMGEzIDMgMCAwMDIuNy0zeiIgZmlsbD0iI2ZmZiIvPjxwYXRoIGQ9Ik0yMC4zIDhhOC43IDguNyAwIDAwLTUuOC0yLjIgMTEuNyAxMS43IDAgMDAtNS4xIDEuNk0xMC4xIDIzLjZoMTMuM3M1LjctLjcgNS43LTYuM2E2LjUgNi41IDAgMDAtMi45LTUuNCIgZmlsbD0ibm9uZSIgc3Ryb2tlPSIjZmZmIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1taXRlcmxpbWl0PSIxMCIvPjxjaXJjbGUgY3g9IjIyLjciIGN5PSIxMC44IiByPSIxLjciIGZpbGw9IiNmZmYiLz48Y2lyY2xlIGN4PSI2LjMiIGN5PSIyMy42IiByPSIxLjgiIGZpbGw9IiNmZmYiLz48Y2lyY2xlIGN4PSI4IiBjeT0iOC43IiByPSIxLjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLW1pdGVybGltaXQ9IjEwIi8+PC9zdmc+",
"org_id": "964a8c3b-9aef-4e1d-aadf-e2754004d230",
"configuration_spec": [
{
"key": "token",
"type": "api_key",
"label": "Authorization Token",
"required": true
}
],
"short_description": "Gain the visibility and continuous threat detection needed to secure your public cloud, private network, and hybrid environments.",
"title": "Secure Cloud Analytics",
"external_references": [
{
"link": "https://info.securexanalytics.com/SecureX-Trial-Request.html",
"label": "Free Trial"
},
{
"link": "https://www.cisco.com/c/en/us/products/security/stealthwatch-cloud/index.html",
"label": "Product Information"
},
{
"link": "https://www.cisco.com/c/dam/r/ctp/docs/privacydatasheet/security/cisco-stealthwatch-cloud-privacy-data-sheet.pdf",
"label": "Privacy Policy"
}
],
"updated_at": "2022-02-18T08:55:49.295Z",
"id": "b3874a82-1967-4f9c-a42a-47f1d61ab835",
"record": "relay-module.module/RelayModule",
"user_id": "dcffe020-1c6a-4d78-ba09-f21674a59c9c",
"client_id": "iroh-ui",
"default_name": "Secure Cloud Analytics",
"flags": [
"default"
],
"enabled": true,
"visibility": "global",
"created_at": "2020-05-15T17:38:39.788Z",
"former_title": "Stealthwatch Cloud"
}
EU
{
"description": "Cisco Secure Cloud Analytics (formerly Stealthwatch Cloud) improves security and incident response across the distributed network, from the private network and branch office to the public cloud. This solution addresses the need for digital businesses to quickly identify threats posed by their network devices and cloud resources, and to do so with minimal management, oversight, and security manpower.\n\nThe network is evolving. IT resources are frequently being moved into the cloud. At the same time, the number of connected devices on the private network is increasing dramatically. Security personnel are struggling just to know what entities are operating in their environment, let alone whether they pose a threat to the organization.\n\nSecure Cloud Analytics addresses this problem by providing comprehensive visibility and high-precision alerts with low noise, without the use of agents. Organizations can accurately detect threats in real time, regardless of whether an attack is taking place on the network, in the cloud, or across both environments. Secure Cloud Analytics is a cloud-based, Software-as-a-Service (SaaS)-delivered solution. It detects ransomware and other malware, data exfiltration, network vulnerabilities, and role changes that indicate compromise.\n\nAlso, developer teams are continuously adopting new and more dynamic compute environments like serverless and containers such as AWS Lambda and Kubernetes. Secure Cloud Analytics provides visibility into these environments as well, so that organizations don’t have to compromise on security on their path to digital transformation.",
"properties": "Y+2BcDiVdoyWy7JxQwcOXuCG+S/JH98ncFxmwhz27utYxlhrSNQIHGTGGifUZx4Yw2GQe5oy2051VjsrcTrXVCmXAEVpU7NVqLwjmgT01zoDkE1o2lO3bMQbLTZLkNnUKAnaef/4UFqlcorJ0CGfhQPvWZG6OnAPx5PLzbS0TjsRfSGpVSRPeW+aANy+CEXul1l6FKzHohgTelMZuYNGYncHEa+eqtpSVvFl5HITj7rx7NMPWWeRaqN3Ljnbs3l26picBEvRfPzXeAT26gh0gdieWYtB2xnUU8gFUx4MNcqyMVNwGYbtLQ150uQYbOxuoiVZ41ujCWgt0Eksa/g0MkLg+QC5QBHgquwpVdMDDSE=",
"capabilities": [
{
"id": "health",
"description": "Healthcheck"
},
{
"id": "deliberate",
"description": "Deliberation"
},
{
"id": "observe",
"description": "Enrichments"
},
{
"id": "refer",
"description": "Reference links"
},
{
"id": "tiles",
"description": "Dashboard Tiles"
}
],
"app_link_meta": {
"url": "https://portal-eu.obsrvbl.com/auth/?next=%2Fv2%2F%23%2Fsettings%2Fintegrations%2Fsecurex",
"meta": {
"x_okta_bookmark_id": "0oa1idwgt8itDu9jQ357"
},
"title": "Stealthwatch Cloud (EU)"
},
"tips": "If the Secure Cloud Analytics (formerly Stealthwatch Cloud) integration module displays a **Bidirectional** icon on the module panel, it indicates that the integration was enabled in Secure Cloud Analytics or SecureX. \n\nFor information on the Secure Cloud Analytics integration with SecureX, see [Secure Cloud Analytics SecureX integration Guide](https://www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/cloud/SecureX/SecureX_Integration_Guide_DV_2_0.pdf).",
"logo": "data:image/svg+xml;base64,PHN2ZyBkYXRhLW5hbWU9IkxheWVyIDEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgdmlld0JveD0iMCAwIDM0LjEgMzIuMiI+PHBhdGggZmlsbD0iIzI3NGJhMCIgZD0iTTAgMGgzNC4xdjMyLjE2SDB6Ii8+PHBhdGggZD0iTTIyLjcgMTYuOGEzIDMgMCAwMC0zLTNoLS4xYTQuMyA0LjMgMCAwMC04LjEgMS41IDIuMyAyLjMgMCAwMC0yLjYgMS44LjkuOSAwIDAwLS4xLjUgMi4yIDIuMiAwIDAwMi40IDIuMkgyMGEzIDMgMCAwMDIuNy0zeiIgZmlsbD0iI2ZmZiIvPjxwYXRoIGQ9Ik0yMC4zIDhhOC43IDguNyAwIDAwLTUuOC0yLjIgMTEuNyAxMS43IDAgMDAtNS4xIDEuNk0xMC4xIDIzLjZoMTMuM3M1LjctLjcgNS43LTYuM2E2LjUgNi41IDAgMDAtMi45LTUuNCIgZmlsbD0ibm9uZSIgc3Ryb2tlPSIjZmZmIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1taXRlcmxpbWl0PSIxMCIvPjxjaXJjbGUgY3g9IjIyLjciIGN5PSIxMC44IiByPSIxLjciIGZpbGw9IiNmZmYiLz48Y2lyY2xlIGN4PSI2LjMiIGN5PSIyMy42IiByPSIxLjgiIGZpbGw9IiNmZmYiLz48Y2lyY2xlIGN4PSI4IiBjeT0iOC43IiByPSIxLjQiIGZpbGw9Im5vbmUiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLW1pdGVybGltaXQ9IjEwIi8+PC9zdmc+",
"org_id": "99c5cf95-7788-4ce1-906f-86811aa57752",
"configuration_spec": [
{
"key": "token",
"type": "api_key",
"label": "Authorization Token",
"required": true
}
],
"short_description": "Gain the visibility and continuous threat detection needed to secure your public cloud, private network, and hybrid environments.",
"title": "Secure Cloud Analytics",
"external_references": [
{
"link": "https://info.securexanalytics.com/SecureX-Trial-Request.html",
"label": "Free Trial"
},
{
"link": "https://www.cisco.com/c/en/us/products/security/stealthwatch-cloud/index.html",
"label": "Product Information"
},
{
"link": "https://www.cisco.com/c/dam/r/ctp/docs/privacydatasheet/security/cisco-stealthwatch-cloud-privacy-data-sheet.pdf",
"label": "Privacy Policy"
}
],
"updated_at": "2022-02-18T09:00:11.280Z",
"id": "7739968f-4259-49c2-8c14-21e569a11d1c",
"record": "relay-module.module/RelayModule",
"user_id": "be72933d-8e87-4430-8b33-870e3db35bce",
"client_id": "iroh-ui",
"default_name": "Secure Cloud Analytics",
"flags": [
"default"
],
"enabled": true,
"visibility": "global",
"created_at": "2020-05-15T17:44:34.285Z",
"former_title": "Stealthwatch Cloud"
}
2022-W08
2022-02-22 Tuesday
CANCELED SXO Meeting work meeting
CLOCK: [2022-02- Tue 18:00]–[2022-02-22 Tue 18:02] => 0:02
[2022-02-22 Tue 18:00]
- ref
2022-02-23 Wednesday
MEETING SXO Meeting work meeting
CLOCK: [2022-02-23 Wed 19:39]–[2022-02-23 Wed 21:09] => 1:30
[2022-02-23 Wed 19:39]
- ref
- Tenant Provisioning
- Create CTR Client
MEETING Ribbon SCI work meeting
CLOCK: [2022-02-23 Wed 19:23]–[2022-02-23 Wed 19:39] => 0:16
[2022-02-23 Wed 19:23]
- ref
- ?
- client-6ff982a1-cc5a-4121-8f8c-b0f5b08c8860
- ?
- client-c4d3554b-452e-49e2-b76e-41458610adc1
Patched with availability everyone.
MEETING API Design work meeting
CLOCK: [2022-02-23 Wed 17:33]–[2022-02-23 Wed 19:23] => 1:50
[2022-02-23 Wed 17:33]
Two subjects
- Data Deletion
- Logs / debugging
*
DONE IDB Decomissioning work
CLOCK: [2022-02-23 Wed 14:48]–[2022-02-23 Wed 15:18] => 0:30
[2022-02-23 Wed 14:48]
Found in tenzin repository very old commit (ce43ddb)
The configs details are in: saltstack/pillar/*/iroh/init.sls
INT
idps:
amp:
kind: saml
authorize_uri: https://auth.amp.cisco.com/auth/session/new
cert_path: /srv/iroh/resources/cert/amp_idp.cert
threatgrid:
kind: oidc
authorize_uri: https://int.threatgrid.com/oauth2/authorize
token_uri: https://int.threatgrid.com/api/v3/oauth/token
org_id_key: :tg_org
client_id: 884a152d-e2a2-4552-b56b-7618274ab988
client_secret: |
-----BEGIN PGP MESSAGE-----
Version: GnuPG v1
hQIMA84RaiSk55caAQ/+NXy974NKjfdujj01jODDqqIIp4QXdGH8pC4LcHDW9rwx
EE1XELuP+7eZ1+UA2+qhPwcT+kOCEJteXGJt00FoL4bjfOTHqV6Zjl+KySGGYsHw
LQRQhI+odKpakGmtnMD7Zjf14phfUTHKs4Zs6EjLP0rm5LMw+eo3PhQ4zNGfoF1G
W3S7J+dmjNc0ZEsgOStxAmQ5SZM6nIoOo8qJY5p8LujbAzPTGq1hKYVjxM2FnuoQ
SkoIA77z9twJpFMqr3TgOPI/IZqu8rAAVEeAZHRP0W4j4Wk/PetmG4mJrJT5hFqV
Z6iOChTL8t2lbSd/QkwoxD2cZzZlY4c3Pe2JqtdfffhaF7LXcOtHm8R2cv2kjEm3
gdAw2EZucYZa2n78vxofXrLWayltFTzM9hmn616Yy3UtExOHv/ydj0xhLGEx+Woc
X0LS0La8ElNOMnp99x+9y1xmShlZMsRNOm5kjTFMtLry4K3QKTZLAzVa2835RV3e
Tb6T2tdkK5fIVpIQpv3E6meAmkFHWHl3rZw4qdPaPbDWctPDt8TxyX4LQ555ED2N
roCuBSWsu7Efz8s+oUgK3GleSj37O7kIyJq+GxOayyepU8D6WJqqh6TbeFQlyUBJ
YYrFxd+wUAEdeq4LoTxGrZp4jDopg9wVVdEmlcltJ79GbpOGf9uo0nyrlVRXDoHS
WwFPEYM+r1FWnWhrH+zbE3LwvVBMi8KluExN8KcilTnzhISrhR40J/HvEBXMM2DV
7TnS+FyxWHu0vBzIg2y7DdGh4SYw7ru35wH9V8x6L449ffD6diMaXLGoBAU=
=0OIa
-----END PGP MESSAGE-----
TEST
idps:
amp:
kind: saml
authorize_uri: https://auth.amp.cisco.com/auth/session/new
cert_path: /srv/iroh/resources/cert/amp_idp.cert
threatgrid:
kind: oidc
authorize_uri: https://test.threatgrid.com/oauth2/authorize
token_uri: https://test.threatgrid.com/api/v3/oauth/token
org_id_key: :tg_org
client_id: d1f5cbd2-610c-44b9-b5dd-92ecc7ef7f24
client_secret: |
-----BEGIN PGP MESSAGE-----
Version: GnuPG v1
hQIMA84RaiSk55caAQ//czS1KlsdqexkdpO7KizewEY5Wy2rBIT74FYJaJRPOh2k
YDTs1pxbu4SY/PWmyNVh97UAGVjwMAOEJvMaZt2fOA0EqHVwaPqe5xV1pS9eIAIf
JfmQyAzaCADaFvLpVwF7yuzJzUhrPq1JBbwssXh0YLnEOfEandspL6Tw2JunK67A
9GfPiSRNPr90wflsOAObuxRqtThw6usQKDVh8r5lSTpfLN/3gyDX/BNwYOBIgY/D
TvTtX9zYAKwb9lyvvAjVPueHwLBwwLJ0J2C4soKKM/xyqRfllFzWHAuF8dKAmsNO
t1HGcSmHh1mT8hLnZf453PHbItVc8gvyeEcFAtWmGI3hB8JGIFLrzSoO3Vu/opRy
5xovtKDbAcB6xjvkix6s4ppim2lunPa4uzni1XcXUZ5iF424SSSooWmySmFuYniS
pr5t2sulSWr4ptR5e/jWLr6hx6rkLntvJHf99DkK2MeAe35+lkvnKu4algH0Bul6
r3eXvtSZl+Ejwy8fLGv3Zkj12xL3eIZ5PIihAqmJ8cPcY8mZfoz7BjpfXLL0ykuY
HPeAU2YzG9+1TiZk/hADsb6B558nj9DjFbi5P1CyCCWvIAdN+lq3BWaU8VsphC5A
w8L7DGUSlVQXuvHzvuFktYG5z/2FL4Oil924/jiTMiyglcq0qUqTIaR6F/5UdMfS
WwFQJ7Mco7nkak9JMzCos+h/l4IpeM0nSK/5ANzXeNRq5TzGXCYsNZhRtH2JNa1d
Et1dSAy0iR+v5wyozjppTC/o6vOkIVhvYoiDaT9ZVx4/t5552/qGRIdIH8c=
=RJtM
-----END PGP MESSAGE-----
PROD
idps:
amp:
kind: saml
authorize_uri: https://auth.amp.cisco.com/auth/session/new
cert_path: /srv/iroh/resources/cert/amp_idp.cert
threatgrid:
kind: oidc
authorize_uri: https://panacea.threatgrid.com/oauth2/authorize
token_uri: https://panacea.threatgrid.com/api/v3/oauth/token
org_id_key: :tg_org
client_id: 4fe0068b-eb2a-4918-871f-dd9c9592990e
client_secret: |
-----BEGIN PGP MESSAGE-----
Version: GnuPG v1
hQIMA84RaiSk55caAQ/+JHsdFHlM0yxwYJTMgzCPp0wOJozy1/lB4I3pdk/mQlA3
KX0D9VahiZatTG+N0z2dx+rDs/T3XJIShwJsDbO0kBN18kOSEIU5eFZGTj1u7ev1
vPAq+ekmxfRnYsQ0CRdp45uM8jhrO19zbJVu7oL1XaLGFYJxzt6BIkCExSnEBA/i
T3nNxa0CNw7sYUjw0kxDkCwl2RpdmMJ6QWNuqKqRc5olzz0mnu0ioCMXnPu1w4oD
Sck0pZQYacnr8/bCWsLR7kLA9GFHcApT1DoLDhOr8PB6/blpCd+t+nHflUx5SCgn
rqeeA8PaFCZ7wBRa8WuVZXmSll8/siSlTUyBxDKq9y5EjhJBFVRgCRjd4WzwGaMn
F3soOMKKpM1Dj1u3+PkgIprV6nWSUvEOrYxtUEWfBeVdD7Kng57AG+Xz8k1e9ium
s+ITYdo5oG5O4ks5bXuO9ILpt92GLoKC/TAbo2doxiGk63rBxu9HsUTMZVC96FzE
PkWXQxD4LDXlFTqIlCQmjUq6Q6K71t0+pvAS0x4dKHhvuJdAJEHrZe6nnLtiBcjA
TcYoFGHqx32mqbvq7LThoRYFVXvO2tMDoRrDjYKRKNpmTfHNDjhGf+TOhHiw7Rnf
TAJLWCyHrpupu47NPtqAN1fnY9m6yjNGRe6tzgG78vsdCSR6QdAHILwMjUR1QULS
WwHmb/heYDgwuhzbcwDAQuiotWA++xYzAy52cXNuunkC+e/4qob7iIN/ifcPDH3z
rEmF6TVvvE0tzW81X7tdyaOf3Q8rmwMSZzhK7HUhgWIdDhf3Dl6FrrdFoi0=
=srU6
-----END PGP MESSAGE-----
2022-W10
2022-03-07 Monday
DONE Big PR Refresh Tokens work
CLOCK: [2022-03-07 Mon 09:47]–[2022-03-07 Mon 18:17] => 8:30
[2022-03-07 Mon 09:47]
This PR is big, due to different changes.
So the main goal is to fix a bug in our OAuth2 Provider related to scopes associated to refresh tokens. See:
- https://github.com/advthreat/iroh/issues/5877
- https://github.com/threatgrid/response/issues/950
- https://github.com/advthreat/iroh/issues/3189
Related to the discussion in this thread we should fix the issue correctly. Before this PR, refresh tokens are only JWT, so the "state" and "trust" that a refresh token is valid, as well as the scopes associated to this refresh token are put inside this JWT.
For different reason we want to be able to change for some client, the scopes associated to some existing refresh tokens. Typical example, the ribbon support more scopes than the one at the time the user granted the ribbon. So to update the ribbon, not only the ribbon client need to be updated, but the user need to grant the scopes again interactively.
Most of the ribbon clients are trusted which mean that we bypass the list of scopes authorized to return access tokens with the maximal number of scopes. Still there are some exceptions. Also this is a missing piece of the OAuth2 provider to have refresh-tokens administration endpoints for our end-users.
Before this PR we only have a notion of "granted client" at the client level, not for every different refresh token provided.
After this PR we will keep track in our DB the exhaustive list of scopes associated to refresh tokens.
Some details:
This create two new services, RefreshGrantService
and
RefreshGrantWebService
.
I preferred not to use RefreshTokenService
because the word refresh token
is already used at different places.
And the object we save in DB is not a refresh token but a really just an
object keeping the scopes granted to some refresh token for some client and
for some user.
I have added a few common helpers in this PR:
mandatory-get-in-config
-
Small improvements about
match?
:str-uuid?
because we use strings and not proper UUID for which the clojure core functionuuid?
would be more suitable.- check the length equality between two sequences during
match?
- Fixed a problem related to requesting
edn
in our http client helpers. Now the read-string is done for you. - Centralized
pure-crud-store-svc
to be used in our tests to the test-helpers of crud-store service. - added an
iroh-web.request-identity
ns that is useful to manipulate the(:identity request)
generated by the JWT middleware - by default the time
svc-helper
will use a fixed date.
Also some non trivial changes made to achieve the goal of this PR:
- Add a
realized-client
to theOAuth2ClientService
. What is this about? Soget-client
of theOAuth2ClientService
is purely about search clients in DB, just a think layer around CRUD. Before this PR there was also aget-client
method exposed by theOAuthService
which act differently. This second get client take care of looking at the client saved in theconfig.edn
file (yes we have some of them) and also applying theClientPreset
logic to the resulting client. Therealized-client
ofOAuth2ClientService
replace the oldget-client
fromOAuth2Service
. The method is still exposed to prevent any bug and as the PR is already big I didn't want to also make a refactorization to remove it. But this would be a nice idea. - Now
check-app-authorization
of theGrantService
can be called with either 4 or 5 arguments. If called with 4 argument, no refresh token is involved. We just try to remember if the user already granted a set of scopes (every time the user manually grant different scopes we add them up, so we make a union). This is useful to see if we need to automatically redirect the user in many interactive workflows. If it is called with 5 argument, one of the new argument will be the refresh token id (thejti
claim of the refresh token which is a JWT). In that case we also use theRefreshGrantSerice
to verify the refresh token associated has granted the scopes we are going to provide.
Another few important notes:
This change made again pretty clear why it really helps to use the
with-tk
pattern. A lot of manual changes was made because we have a lot of
tests that have not be migrated to this new pattern.
The main consequence for IROH-Auth dev, is that many changes will break
tests far away with almost not real related issue.
So I will probably take the time to really invest in using the new pattern for
IROH-Auth + IROH-Web. Because it really took me days to just fix these manually.
After going full to the "test the service/core.clj" function by providing
pure contexts. I think that while valuable, it is probably a bit too much
work regarding the potential gain. And we should probably focus a lot more
on the "semi-integration" tests of the services themselves with the with-tk
macros.
Looking at the core_test.clj
tests will show that these tests are often a
bit verbose, and difficult to initialized when your service works with big contexts.
The main test testing the feature is:
iroh-auth.oauth2_web_service_test/multiple-authorizations-with-different-scopes
2022-03-10 Thursday
MEETING Weekly work meeting
CLOCK: [2022-03-10 Thu 17:43]–[2022-03-10 Thu 19:18] => 1:35
[2022-03-10 Thu 17:43]
- Work on Registration => Olivier
- like-search
- Work on Registration => Generated some interesting stats about SecureX orgs/user/domain email
- TG IdB decomission => Wait and ask Prerna
- Work on the TG bug => maybe split some part before merging, because this is a risky PR
- Idea about Tenzin-Config. Use Ambrose work to find the common bootstrap+config.edn on all our current envs and use that into the new `iroh.main` and change in tenzin how we start the application to have a merge of both the config and the bootstrap. This should reduce the size, and we could but inside the IROH repository changes that should be shared accross all deployed env.
ops in our team
2022-03-11 Friday
MEETING Simplified Registration work meeting
CLOCK: [2022-03-11 Fri 16:29]–[2022-03-11 Fri 17:59] => 1:30
[2022-03-11 Fri 16:29]
- ref
Agenda (to discuss about)
Notes
Actions
2022-W11
2022-03-15 Tuesday
DONE IDB Decommission CSA work
CLOCK: [2022-03-15 Tue 17:35]–[2022-03-16 Wed 15:31] => 21:56
[2022-03-15 Tue 17:35]
INT { "client_id": "0oa2ovopagy06D2IV1d7", "client_secret": "N7yEnBQWMHohD0LbwzXwsjuOUI9pVlbzI5lH28O9" }
2022-03-16 Wednesday
MEETING API Design Meeting work meeting
CLOCK: [2022-03-16 Wed 16:32]–[2022-03-18 Fri 11:55] => 43:23
[2022-03-16 Wed 16:32]
IROH-Auth login
MEETING Registration Simplification work meeting
CLOCK: [2022-03-16 Wed 15:31]–[2022-03-16 Wed 15:57] => 0:26
[2022-03-16 Wed 15:31]
- ref
2022-W13
2022-03-28 Monday
MEETING Workshop work meeting
CLOCK: [2022-03-28 Mon 17:52]–[2022-03-30 Wed 16:20] => 46:28 CLOCK: [2022-03-28 Mon 17:30]–[2022-03-28 Mon 17:52] => 0:22
[2022-03-28 Mon 17:30]
MEETING Registration work meeting
CLOCK: [2022-03-28 Mon 16:29]–[2022-03-28 Mon 16:54] => 0:25
[2022-03-28 Mon 16:29]
- ref
Chris Duan concerns:
- email domain check in the UI
- risk of email domain mismatch, for now, just one admin is enough to match the org, etc…
2022-03-30 Wednesday
MEETING Registration FT work meeting
CLOCK: [2022-03-30 Wed 16:20]–[2022-03-30 Wed 22:07] => 5:47
[2022-03-30 Wed 16:20]
- ref
Testing
Only safe solution involve the Ops.
Have a specific domain for us.
I suggest: qa.security.cisco.com
so every mail sent to foo@qa.security.cisco.com
should be redirected to foo@cisco.com
.
That way we could create a few testing org without being polluted by all
the other cisco activity.
We could test the emails, etc…
2022-03-31 Thursday
MEETING work meeting
CLOCK: [2022-03-31 Thu 13:52]–[2022-03-31 Thu 15:30] => 1:38
[2022-03-31 Thu 13:52]
Agenda
What to do next?
- Important potential refacto to help Matt add a the ccoId
- Refacto the tests (tried and it is a lot of work)
Notes
Actions
2022-W15
2022-04-11 Monday
MEETING Q4: Limited Demo Mode XP/Detail Design Discussion work meeting
CLOCK: [2022-04-11 Mon 15:59]–[2022-04-15 Fri 17:14] => 97:15
[2022-04-11 Mon 15:59]
- ref
Agenda (to discuss about)
Agenda for this meeting is to go over the ideas/design proposed by MA/PO/PM team for a limited SecureX Demo Mode experience. We want the Engineering team to weigh in feasibility and discuss the options in detail. Below AHA ticket has been updated with details discussed. Next, we want an estimate of the effort and since this is in the Q4 Priority list get commitment if this can be done in Q4 or not.
Notes
AHA shared screen:
Requirement. SecureX demo giving away too much information.
Expiry dates to SecureX demo (30 days) Limit the number of investigations (50 investigations).
Actions
2022-W16
2022-04-19 Tuesday
MEETING Switch Tenants work meeting
CLOCK: [2022-04-19 Tue 17:02]–[2022-04-19 Tue 18:12] => 1:10
[2022-04-19 Tue 17:02]
- Hide/Disable Orgs
- Login workflow
- Petr, make an org default for users.
- Just hide/unhide the org for the UI.
.
UI demo
List orgs / hide/ switch
Also cross regions
-
remarks
- default not auto-login
- login
MEETING Umbrella Deep Dive 1-click module setup work meeting
CLOCK: [2022-04-19 Tue 16:33]–[2022-04-19 Tue 17:02] => 0:29
[2022-04-19 Tue 16:33]
- ref
- ?
- Matt: describe The modules
- ?
- Aaron Woland: for the diff function in SecureX we use every exposed API
- ?
- Rajendra Shirhatti: requirement, single API key
2022-04-20 Wednesday
MEETING Cisco Leader Fundamental Program work meeting
CLOCK: [2022-04-20 Wed 10:03]–[2022-04-20 Wed 18:47] => 8:44
[2022-04-20 Wed 10:03]
- ref
- ?
- First Next Steps writeable PDF:
https://cisco.sharepoint.com/🅱️/s/GLOTeam/Ef_alzOAOoVHqHmmZ8dZYscBbHsYA5tLWgfj0tZL6iXvZQ?e=LFMQl3
Miro board- https://miro.com/app/board/o9J_lZRkMM8=/ Password - CiscoLF2020
- Consciously Create Culture: https://wwwin.cisco.com/c/cec/cisco/conscious-culture.html
Come to me when
- Come to me when you need to design a new abstraction to improve the code reliability
- Come to me when you need to write a code refactorisation
- Come to me when you need to build a new OAuth2 RFC from scratch
- Come to me when you need to improve CI reliability
With:
- Alex Cruz Farmer
2022-04-21 Thursday
MEETING Leader meeting
CLOCK: [2022-04-21 Thu 10:38]–[2022-05-05 Thu 13:11] => 338:33
[2022-04-21 Thu 10:38]
- ref
- ?
- Register for Cisco Mind Set: http://learn.cisco.com/?courseID=COT00305503
- ?
- Mindfulness & Resilience SharePoint: https://cisco.sharepoint.com/Sites/
- ?
- MindfulnessandResilienceatCisco
- ?
- Expert Medical Opinion Program: https://cisco.service-now.com/helpzone?id=kb_article&sysparm_article=KB0047880
- ?
- Mental Health Awareness: https://cisco.sharepoint.com/Sites/SafetoTalkMentalHealthAwareness
- ?
- Employee Assistance Program: https://cisco.service-now.com/helpzone?id=kb_article&sysparm_article=KB0047879
- ?
- Cisco Global Wellbeing: https://cisco.sharepoint.com/sites/GlobalWellbeing
Prepare meetings: https://www.cisco.com/c/r/team-development/performance/team-leader-index.html Reward: https://cisco.sharepoint.com/sites/RewardsCentral Further: https://cisco.sharepoint.com/sites/NewLeaderJourneyRegistration Talent Space
Analyze
Ask her how to develop other in the team.
Says
I noticed this or that, no judgement. Wait for their perspective.
I wouldn't want to demotivate you by blocking your PR.
2022-W18
2022-05-05 Thursday
MEETING Weekly Platform Meeting work meeting
CLOCK: [2022-05-05 Thu 17:10]–[2022-05-09 Mon 17:04] => 95:54
[2022-05-05 Thu 17:10]
MEETING Registration FT work meeting
CLOCK: [2022-05-05 Thu 16:52]–[2022-05-05 Thu 17:10] => 0:18 CLOCK: [2022-05-05 Thu 16:30]–[2022-05-05 Thu 16:51] => 0:21
[2022-05-05 Thu 16:30]
Prerna love to Sing, Adele, indian songs, Karaoke, (feel bad at gardening) Hamed Saadi: wanted to be professional soccer, love orchid Jilian: two young children, love gardening (strawberries, 12ft tall sun flower etc…). During Cisco has a full orchid division. Hissan: not much Olivier: make italian food, watch video on climate change. Fan of Jancovici, Aurelien Barrault.
2022-W19
2022-05-09 Monday
MEETING Umbrella 1-click work meeting
CLOCK: [2022-05-09 Mon 17:04]–[2022-05-10 Tue 09:47] => 16:43
[2022-05-09 Mon 17:04]
Presenting SecureX
2022-05-11 Wednesday
MEETING Tenant switching work meeting
CLOCK: [2022-05-11 Wed 16:28]–[2022-05-11 Wed 17:09] => 0:41
[2022-05-11 Wed 16:28]
How to have errors shared.
Proposal,
- host on the same URL as IROH (so both CTR and Visibility)
- Use query parameters + localStorage might not be enough because there is a huge risk of attack.
2022-05-12 Thursday
DISC Topo for meeting work discussion
CLOCK: [2022-05-12 Thu 11:21]–[2022-05-12 Thu 15:39] => 4:18
[2022-05-12 Thu 11:21]
Go to the dashboard page
Invisible work:
- Olivier will start on org-level client
- UI design discussion about tenant switching even if we agree about most of the backend work that could be done concurrently.
- Discussion about "bugs" that were just wording issue
2022-W20
2022-05-17 Tuesday
MEETING Devin Walters work meeting
CLOCK: [2022-05-17 Tue 17:03]–[2022-05-17 Tue 19:03] => 2:00
[2022-05-17 Tue 17:03]
- ref
Agenda (to discuss about)
Notes
Actions
2022-05-18 Wednesday
MEETING API Design Meeting work meeting
CLOCK: [2022-05-18 Wed 17:42]–[2022-05-18 Wed 19:35] => 1:53
[2022-05-18 Wed 17:42]
- ref
Umbrella talk, hunting, etc…
Check Token Exchange Okta token exchange for a IROH Auth exchange.
DONE Create a new Epic for IROH Auth Token Exchange.
2022-05-19 Thursday
DONE Analyze Token Exchange RFC #6740 work
SCHEDULED: <2022-05-30 Mon 14:00-16:00>
- State "DONE" from "HOLD" [2022-05-30 Mon 17:16]
- State "HOLD" from "TODO" [2022-05-30 Mon 17:15]
Appear to be ok, need to write the doc
CLOCK: [2022-05-30 Mon 16:15]–[2022-05-30 Mon 17:15] => 1:00
[2022-05-19 Thu 09:27]
- ref
- #6740
SCHEDULED: <2022-05-19 Thu>
2022-W21
2022-05-24 Tuesday
CHAT Work on BUG for the UI work chat
CLOCK: [2022-05-24 Tue 17:06]–[2022-05-25 Wed 10:27] => 17:21
[2022-05-24 Tue 17:06]
- ref
on NAM backup value with idp-mapping from Rekha and probably Dar.
{
"role": "admin",
"scopes": [
"event:read",
"vault/configs:read",
"integration",
"private-intel",
"admin",
"profile",
"inspect",
"asset",
"feedback",
"sse",
"registry",
"users",
"investigation",
"invite",
"casebook",
"vault/config/metadata:read",
"orbital",
"enrich",
"oauth",
"collect",
"response",
"ui-settings",
"telemetry:write",
"openid",
"notification",
"global-intel:read",
"webhook",
"vault/config/posture:read",
"ao"
],
"updated-at": "2022-04-04T19:02:50.007Z",
"idp-mappings": [
{
"idp": "sxso",
"enabled?": true,
"user-identity-id": "00u4b0w7zx5wOv6bP357"
},
{
"idp": "sxso",
"cco-id": "DiogenesDavili83107",
"enabled?": true,
"user-identity-id": "00uh73n7l8T19iA80357"
},
{
"idp": "sxso",
"enabled?": true,
"user-identity-id": "00u4fiegn96MYiUVb357"
}
],
"user-email": "diogenes_davoli@hstsoft.com",
"user-name": "Diogenes Davoli",
"org-id": "0217a770-8d36-4934-9a4f-e136aac10e39",
"user-id": "fcc3ef21-ea15-4774-822a-7dcc5a642750",
"enabled?": true,
"last-logged-at": [
"2022-04-13T19:16:18.315Z",
"2022-04-13T19:15:24.239Z",
"2022-04-13T19:15:15.552Z",
"2022-04-13T19:15:05.421Z",
"2022-04-13T18:45:13.063Z"
],
"created-at": "2022-04-01T13:24:27.909Z",
"user-nick": "Diogenes Davoli"
}
2022-W22
2022-05-30 Monday
DONE Help Michael Simonson #response/1315 work
SCHEDULED: <2022-05-29 Sun 10:30-10:40>
CLOCK: [2022-05-30 Mon 10:30]–[2022-05-30 Mon 10:34] => 0:04
[2022-05-30 Mon 10:15]
- ref
- /yogsototh/deft/src/commit/4cf1a8f49bfc0e40a4d2d4c354c0896144682523/~/Library/Mobile%20Documents/iCloud~com~appsonthemove~beorg/Documents/org/inbox.org::%2ACreate%20Tasks%20from%20%5C%5B%5C%5Bhttps:/github.com/notifications%5C%5D%5C%5BGithub%20notifications%5C%5D%5C[Create Tasks from Github notifications]]
DONE Reply to Rekha GlaDoS#3239 work
SCHEDULED: <2022-05-30 Mon 10:20-10:30>
CLOCK: [2022-05-30 Mon 10:25]–[2022-05-30 Mon 10:29] => 0:04
[2022-05-30 Mon 10:12]
DONE Reset https://pwreset.cisco.com work
SCHEDULED: <2022-05-30 Mon 10:30-10:40>
CLOCK: [2022-05-30 Mon 10:34]–[2022-05-30 Mon 10:37] => 0:03
[2022-05-30 Mon 09:38]
2022-06-01 Wednesday
DONE Document what need to be done for Token Exchange work
SCHEDULED: <2022-06-01 Wed 10:35-11:30>
CLOCK: [2022-06-01 Wed 11:26]–[2022-06-01 Wed 11:59] => 0:33 CLOCK: [2022-06-01 Wed 10:35]–[2022-06-01 Wed 11:25] => 0:50
[2022-06-01 Wed 10:32]
2022-06-02 Thursday
MEETING Town Hall work meeting
CLOCK: [2022-06-02 Thu 18:00]–[2022-06-02 Thu 19:20] => 1:20
[2022-06-02 Thu 20:13]
MEETING Weekly meeting work meeting
CLOCK: [2022-06-02 Thu 17:06]–[2022-06-02 Thu 17:55] => 0:49
[2022-06-02 Thu 17:06]
- ref
Notes
- org-level clients (security concerns and complex technical details)
- tenant switching should be good for 6th of July
- token exchange issue
- maximal session time issue
- refresh token revocation with a grace period
- configuration issues fix incoming using
iroh.main
=> on hold
- oauth2 client password update
- simplification
MEETING Tenant Switching work meeting
CLOCK: [2022-06-02 Thu 16:32]–[2022-06-02 Thu 17:06] => 0:34
[2022-06-02 Thu 16:32]
- ref
Agenda (to discuss about)
Notes
Actions
DONE Fix config issue work
SCHEDULED: <2022-06-02 Thu>
CLOCK: [2022-06-03 Fri 17:00]–[2022-06-03 Fri 17:55] => 0:55 CLOCK: [2022-06-02 Thu 15:34]–[2022-06-02 Thu 16:30] => 0:56
[2022-06-02 Thu 15:34]
PAUSE sortir le chien pause
CLOCK: [2022-06-02 Thu 14:25]–[2022-06-02 Thu 15:33] => 1:08
[2022-06-02 Thu 15:32]
MEETING Meeting with Olivier work meeting
CLOCK: [2022-06-02 Thu 09:55]–[2022-06-02 Thu 11:58] => 2:03
[2022-06-02 Thu 09:55]
- ref
Agenda (to discuss about)
Notes
Actions
GEEK org-mode / org-calendar tweaking perso
CLOCK: [2022-06-02 Thu 09:32]–[2022-06-02 Thu 09:55] => 0:23
[2022-06-02 Thu 09:38]
DISC answered to Jyoti work discussion
CLOCK: [2022-06-02 Thu 09:02]–[2022-06-02 Thu 09:32] => 0:30
[2022-06-02 Thu 09:32]
2022-06-03 Friday
MEETING Tenant Switching work meeting
CLOCK: [2022-06-03 Fri 16:31]–[2022-06-03 Fri 16:42] => 0:11
[2022-06-03 Fri 16:31]
- Accept invitation redundancy: https://github.com/advthreat/GLaDOS/issues/3273 To be moved to the IROH repository as enhancement.
CHAT Rekha discussion with access/refresh tokens work chat
CLOCK: [2022-06-03 Fri 16:45]–[2022-06-03 Fri 16:59] => 0:14 CLOCK: [2022-06-03 Fri 14:36]–[2022-06-03 Fri 16:31] => 1:55
[2022-06-03 Fri 14:36]
DONE Check duplicate user by org work
SCHEDULED: <2022-06-03 Fri>
CLOCK: [2022-06-03 Fri 13:50]–[2022-06-03 Fri 14:36] => 0:46
[2022-06-03 Fri 13:49]
2022-W23
2022-06-07 Tuesday
CANCELED PR to have 5min expiration time for iroh-ui client work
SCHEDULED: <2022-06-08 Wed 14:30-16:00>
- State "CANCELED" from "TODO" [2022-06-08 Wed 17:06]
we'll work on that later
[2022-06-07 Tue 18:02]
CHAT Rekha ask for 5min expiration access tokens work chat
CLOCK: [2022-06-07 Tue 17:58]–[2022-06-07 Tue 18:58] => 1:00
[2022-06-07 Tue 17:58]
CHAT Rekha questions work chat
CLOCK: [2022-06-07 Tue 16:40]–[2022-06-07 Tue 17:00] => 0:20
[2022-06-07 Tue 16:40]
DONE Propose a technical solution for 6770 work
SCHEDULED: <2022-06-08 Wed 11:00>
CLOCK: [2022-06-08 Wed 11:20]–[2022-06-08 Wed 11:49] => 0:29
[2022-06-07 Tue 15:23]
TODO Remove duplicates duplicate work
SCHEDULED: <2022-06-15 Wed 11:00-11:20>
CLOCK: [2022-06-09 Thu 10:43]–[2022-06-09 Thu 10:44] => 0:01
[2022-06-07 Tue 15:14]
DONE Weekly Leads work meeting
CLOCK: [2022-06-07 Tue 15:14]–[2022-06-07 Tue 16:30] => 1:16
[2022-06-07 Tue 15:14]
PAUSE pause pause
CLOCK: [2022-06-07 Tue 11:17]–[2022-06-07 Tue 14:38] => 3:21
[2022-06-07 Tue 11:17]
DONE discuss Wanderson comment on Refresh Token work
SCHEDULED: <2022-06-07 Tue 14:30-14:45> [2022-06-07 Tue 10:02]
DONE Jeetu/Shaila keynote RSA keynote start 1:15/1:28 work
SCHEDULED: <2022-06-07 Tue 10:50-11:20>
CLOCK: [2022-06-07 Tue 10:58]–[2022-06-07 Tue 11:03] => 0:05
[2022-06-07 Tue 09:47]
DONE Check Wanderson discussion switch-tenant jwt endpoint work
SCHEDULED: <2022-06-07 Tue 10:30-10:50>
CLOCK: [2022-06-07 Tue 10:41]–[2022-06-07 Tue 10:58] => 0:17 CLOCK: [2022-06-07 Tue 10:19]–[2022-06-07 Tue 10:40] => 0:21
[2022-06-07 Tue 09:45]
DONE Team Space check-in work
SCHEDULED: <2022-06-07 Tue 10:00>
CLOCK: [2022-06-07 Tue 10:07]–[2022-06-07 Tue 10:12] => 0:05
[2022-06-07 Tue 09:42]
DONE pwreset work
CLOCK: [2022-06-07 Tue 09:30]–[2022-06-07 Tue 09:41] => 0:11
[2022-06-07 Tue 09:38]
2022-06-08 Wednesday
IN-PROGRESS Create issue about filtering matching orgs with already existing user email work
CLOCK: [2022-06-08 Wed 16:56]–[2022-06-08 Wed 17:06] => 0:10
[2022-06-08 Wed 16:56]
MEETING Tenant Switching sync work meeting
CLOCK: [2022-06-08 Wed 16:45]–[2022-06-08 Wed 16:56] => 0:11
[2022-06-08 Wed 16:45]
remove matched orgs if user already exists (with same email)
CHAT Discussion about session token lifetime work chat
CLOCK: [2022-06-08 Wed 16:09]–[2022-06-08 Wed 16:45] => 0:36 CLOCK: [2022-06-08 Wed 15:32]–[2022-06-08 Wed 16:09] => 0:37
[2022-06-08 Wed 15:32]
DONE meeting things to talk about work
SCHEDULED: <2022-06-08 Wed 16:30-17:00> [2022-06-08 Wed 11:37]
Invitations UI/UX improvements
DONE Check Doc for tenant switching work
SCHEDULED: <2022-06-08 Wed 14:00-14:15>
CLOCK: [2022-06-08 Wed 14:02]–[2022-06-08 Wed 14:16] => 0:14
[2022-06-08 Wed 10:42]
CHAT Answered SecureX / CTR Support work chat
CLOCK: [2022-06-08 Wed 10:25]–[2022-06-08 Wed 10:32] => 0:07
[2022-06-08 Wed 10:31]
DONE Answer to Refresh Session Tokens chat Refresh Token room work
SCHEDULED: <2022-06-08 Wed 14:15-14:30> [2022-06-08 Wed 10:19]
Adding a new temporary route is not straightforward, because it would mean supporting multiple clients depending on the route, then also adding a feature flag, and also adding a different config, etc…
But notice that you can refresh after 5min even if the access token is still valid. So you should probably start with that.
2022-06-09 Thursday
MEETING weekly meeting work meeting
CLOCK: [2022-06-09 Thu 17:15]–[2022-06-09 Thu 18:08] => 0:53
[2022-06-09 Thu 17:14]
Agenda (to discuss about)
Notes
Actions
CHAT Houman work chat
CLOCK: [2022-06-09 Thu 15:10]–[2022-06-09 Thu 15:27] => 0:17
[2022-06-09 Thu 15:10]
IN-PROGRESS Add refresh token / client info in the access tokens work
SCHEDULED: <2022-06-14 Tue 11:00-12:00>
CLOCK: [2022-06-09 Thu 15:27]–[2022-06-09 Thu 17:15] => 1:48 CLOCK: [2022-06-09 Thu 14:12]–[2022-06-09 Thu 15:10] => 0:58
[2022-06-09 Thu 14:12]
TODO Check Free Trial Design Doc work
SCHEDULED: <2022-06-14 Tue 16:00-16:30> [2022-06-09 Thu 11:45]
CHAT Chris Duane PenTest work chat
CLOCK: [2022-06-09 Thu 11:17]–[2022-06-09 Thu 11:54] => 0:37
[2022-06-09 Thu 11:17]
DONE impression chiens interruption work
CLOCK: [2022-06-09 Thu 10:32]–[2022-06-09 Thu 10:42] => 0:10
[2022-06-09 Thu 10:32]
DONE Answer to Ag work
SCHEDULED: <2022-06-09 Thu 10:45-10:55>
CLOCK: [2022-06-09 Thu 11:54]–[2022-06-09 Thu 12:02] => 0:08 CLOCK: [2022-06-09 Thu 10:44]–[2022-06-09 Thu 11:17] => 0:33
[2022-06-09 Thu 10:18]
ann, my current work for module-patching-ui for the Doc team is now on halt, since our Ops is a huge clusterfuck right now. I can't believe it, but they can't figure out provisioning a simple server with a configuration similar to CTIA. Since March.
Anyway, I've been tasked with some other things and I need your help (because Rob has no clue, and Mark is mumbling in a language I can't comprehend. Not to throw my colleagues under the bus, I don't get it due to my own cretinism). I literally have no idea what's being asked here: https://github.com/advthreat/iroh/issues/6688
Can you tell me what you know about the tac-web-service? My understanding that it's only available through /admin/tac • Who consumes these routes? • Are they actively being used? • Does the ticket mean that we're going to have to copy some of the functionality out of admin zone and make it avaliable for non-admins? • Could you point me to the similar things somewhere in the repo?
Basically, can you help me start on this? I know, you've probably (as always) super-busy with other things, and the last thing you need is to hold someone's hand, but it's been ages since I contributed any code to the repo. It would take me forever on my own. Thanks a lot.
Answer
Hi Ag!
Yep, I am pretty blocked myself with this password reset.
Regarding the issue, I didn't hear about that one. So to answer your questions.
- who consumes these routes? Mainly people from TAC so they could help
customers. I manually created an Org so all users of this orgs have the scope
iroh-master/tac
. This way the TAC team could access only the routes for TAC without giving them access to more dangerous routes like direct store access (where a manual mistake could really break the entire PROD). - are they actively being used? YES
- Does the ticket mean that we're going to have to copy some of the
functionality out of admin zone and make it available for non-admins?
NO, the routes will stay under the admin zone, but only under the TAC Web
Services that only requires
iroh-master/tac
scope.
So you should start at iroh-admin.tac-web-service.routes
Mainly you should add a few functions so they could provide the functionalities
they would like.
But beware that, unlike the direct store functions, you should take great care
of not breaking the expected schemas in the DB.
But you could probably just provide a few new routes, to search users by email,
enable/disable users. For that you should use the UserService
the current route
already use the OrgService
to update orgs.
For enabling a module by id I don't know much, this is probably a method from ModuleInstanceService
.
Cheers, Yann.
2022-06-10 Friday
DISC Chien Espoir & Handicap work discussion
CLOCK: [2022-06-10 Fri 10:41]–[2022-06-10 Fri 14:35] => 3:54
[2022-06-10 Fri 10:41]
Acceuil
[À propos](/about):
Handicap supportés:
- handicap moteur
- troubles autistiques
- troubles visuels
CHAT Allison Walters role sync work chat
CLOCK: [2022-06-10 Fri 09:05]–[2022-06-10 Fri 09:41] => 0:36
[2022-06-10 Fri 09:05]
Hi Allison, the confusion is expected unfortunately, the current state of affair is the result of a very long and painful work that was called "IdP Migration""SXSO Migration""Account Migration" mainly, I will try to give the most exhaustive answer I can about this.
First, SecureX and Threat Response are two Cisco products that have different URL, different UI, but behind the hood both use the same and single API which is called IROH. So both SecureX and Cisco Threat Response (and in fact a few other products like the Ribbon, etc…) use the IROH API.
Inside the IROH API, there is a big component dedicated to everything related to Authentication, OAuth2 management, etc… This component is called IROH-Auth.
So before the "migration", when a customer wanted to login into Threat Response or SecureX he saw 2 buttons (one for AMP which is now CSA and one for Threatgrid now called Secure Malware Analytics).
So took place a huge concerted effort to only show 1 button. After more than one and half a year of effort from multiple teams and lot of people involved we finally had 3 buttons (both older 2 buttons + SecureX Sign-On).
:)
Today we still have 3 login choices to login, but the UI subtly hide 2 buttons by making the default login (SXSO) more prominent.
That was for the small story. Now, let's talk about the technical details:
The goal of the migration (let's call it that way) was to force every CSA user to migrate toward using SecureX Sign-On to login. So one more complexity, CSA accounts could or could not be directly related to an active AMP (Secure Endpoint) account. So this add a layer on complexity for the CSA team.
IROH-Auth provided multiple different mechanisms to minimize the inevitable friction that would occurs when user will change their login system. So technically this is not that complex, we "just" needed from the CSA team to add the "link" from the previous account and new account. IROH-Auth exposes a provisioning API for this purpose.
Mainly, every time a user perform a migration from CSA to SXSO in CSA (using the CSA URL, workflow, etc…) as IROH could not know that, CSA team call the provisioning API when:
- a user perform a migration, so we could link the old CSA user-identity to the new SXSO user-identity in SecureX as well as it is done in CSA
- a new user is created into a CSA organization and login via SXSO, in that case the CSA team create a new user inside SecureX, with the SXSO identity. So if this user login in SecureX it is automatically put in the correct org.
This is what should occurs when user only uses CSA. And this is the responsibility of CSA to perform these call to the provisioning API. But the provisioning API is not called when the user's role is changed in SE.
So once an org is marked to have migrated, they should no more be able to login via CSA, but should be forced to pass through SXSO.
OK. That's the first migration path.
Now, what about a user that has a CSA/SE account but before migrating the org uses SecureX but create an SXSO account without passing through the migration workflow?
In that case, IROH-Auth tries to be "smart" about it. So we try to detect email matches. If a user login via SXSO and we have known users with the same email, we links all these accounts together.
Note, SXSO do not provide any info about the role, nor the org.
So the role in SecureX could change only via:
- an admin in some non migrated SE org change the SE user role and later that user login via a CSA button on a non migrated org in SE
- Inside SecureX, an admin could change the role of another user in SecureX
- The provisioning API during user migration or user creation
To give an example about how role could be updated:
-
on a non migrated org in SE:
- user-1 logged in a long time ago in SecureX with some role
- user-2 never logged into SecureX
- admin perform a role change for both user-1 and user-2; (in that step user-1 role in SecureX and SE are different, SecureX could only sync the role if user-1 login via CSA)
- admin perform the migration of its org in CSA => CSA call the provisioning API, that should sync all users from CSA/SE into SecureX
- after the migration users should not be able to login again via CSA so the link between the role is cut. And a change of role in SE will not result in a change of role in SecureX.
And I think there are missing workflow paths about it. But to try to put it more simply, "most of the time", once an org migrate from CSA to SXSO the link between the role is cut and the role are expected not to be synchronized.
I hope it could help a little. I think I left a lot more specific details some of them I forgotten, some of them I cannot know about because it depends on the CSA team. The doc related to this is probably long deprecated now, because so many last minute bug fix occurred that we lost track of some minor details that could potential make the simple rule (no relation between user's role once migrated to SXSO) not work.
For example, one detail I forgot to mention, when CSA call the provisioning API to mark an Org as being migrated, SecureX will no more accept login via CSA for this org. So things are more complex when user create SXSO account before officially migrating their org for example.
Cheers.
DONE Review #6791 Wanderson access/refresh work
SCHEDULED: <2022-06-10 Fri 14:00-14:30> [2022-06-10 Fri 09:00]
2022-W24
2022-06-13 Monday
DONE Krystelle rescrit interruption
CLOCK: [2022-06-13 Mon 16:55]–[2022-06-13 Mon 17:02] => 0:07
[2022-06-13 Mon 16:55]
DONE Lionel Rebière interruption
CLOCK: [2022-06-13 Mon 16:43]–[2022-06-13 Mon 16:55] => 0:12
[2022-06-13 Mon 16:43]
MEETING weekly Account Switching work meeting
CLOCK: [2022-06-13 Mon 16:32]–[2022-06-13 Mon 16:43] => 0:11
[2022-06-13 Mon 16:32]
Maison
Relancer le rescrit, dons défiscalisés.
- 2 premiers benef test.
IN-PROGRESS telephone interruption work
CLOCK: [2022-06-13 Mon 15:24]–[2022-06-13 Mon 16:32] => 1:08
[2022-06-13 Mon 15:24]
IN-PROGRESS Security Fix (revocation on disable) work
CLOCK: [2022-06-13 Mon 15:10]–[2022-06-13 Mon 15:24] => 0:14
[2022-06-13 Mon 15:10]
2022-06-14 Tuesday
TODO Review Tenant switching route to return JWT of other account work
SCHEDULED: <2022-06-13 Mon 15:00-15:30> [2022-06-14 Tue 14:52]