Project

garrison-api

0.01
Repository is archived
No commit activity in last 3 years
No release in over 3 years
garrison-apiforward3d/garrisonHomepageDocumentationSource CodeBug Tracker
RubyGem to talk to the Garrison API
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
 Popularity
Downloads
18,520
Stars
25
Forks
3
Watchers
15
 Releases
Current version
2.0.0
Total releases
10
First release
2018-06-13
Latest release
2019-07-02
 Issues
Open Issues
0
Closed Issues
4
Total Issues
4
Issue Closure Rate
100%
 Pull Requests
Open Pull Requests
0
Closed Pull Requests
157
Merged Pull Requests
205
Pull Request Acceptance Rate
56%
 Development
Primary Language
Ruby
Licenses
MIT
Average date of last 50 commits
2020-11-25
Reverse Dependencies
0

 Dependencies

Development

bundler
~> 2.0
rake
~> 12.3

Runtime

httparty
>= 0.16.2, < 0.18.0
 Project Readme

Garrison

Garrison is a security service for consolidating alerts from many other systems down to a single web dashboard.

Garrison UI

This project is in active development, we aim to always keep it functional, however we may break things from time to time. If you spot a problem, please raise a GitHub issue.

Preface

Garrison is made up of two parts...

  1. Dashboard
  2. Agents

Web interface

A Ruby on Rails web app, which utilizes a PostgreSQL database for alert storage.

Agents

These populate the alerts you see in the dashboard, they are primarily lightweight docker containers. They are responsible for sending data to the web API which populates the interface.

There are some pre-built agents, but you can create your own agents very easily if you need to.

Installation

We provide pre-build Docker containers for all parts of the service which are available on Docker Hub.

Configuration

Dashboard

TODO

Agents

There are some global configuration options for agents, these are provided to the agent containers via environmental variables. Some agents may have additional configuration options, however these will be documented with the individual agent.

Each agent must be registered before you use them as they need an Agent UUID. You can get this by POSTing to the API...

curl -d '{"agent": {"source": "aws-rds", "check": "check_engine_version"}}' -H "Content-Type: application/json" -X POST https://garrison.internal.acme.com/api/v1/agents

This is done so that alerts can be traced back to a single run of an agent, all the way down to the specific check type.

Global Configuration Options (Mandatory)
Environmental Variable Description
GARRISON_URL URL to the Garrison web interface eg. https://garrison.internal.acme.com
GARRISON_AGENT_UUID The UUID that was previously registered with the API
Global Configuration Options (Optional)

All optional variables will contain a sane default by the individual check itself, these options are provided for if you want to override that default.

Environmental Variable Description
GARRISON_ALERT_SOURCE Source slug eg. aws-rds, cve-detail
GARRISON_ALERT_SEVERITY Severity slug eg. critical, high, medium, low, info [1]
GARRISON_ALERT_FAMILY Family slug eg. attack, infrastructure, software, networking [1]
GARRISON_ALERT_TYPE Type slug eg. security, compliance, informational [1]
GARRISON_ALERT_DEPARTMENTS Comma Separated list of Department slugs eg. it,development [2]
GARRISON_AUTO_OBSOLETE Setting this to anything will automatically mark Alerts generated by previous runs by this agent as obsolete
  1. Or any other custom ones you have created within Garrison.
  2. Departments must already exist.

Available Agents

This is just a list of the official agents, you might find more with the GitHub Tag garrison-agent