mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
110 lines
3.9 KiB
Bash
110 lines
3.9 KiB
Bash
#!/bin/bash
|
|
# Security Incident Evidence Collection Script
|
|
# Usage: ./collect-evidence.sh [incident-id]
|
|
|
|
set -euo pipefail
|
|
|
|
INCIDENT_ID="${1:-incident-$(date +%Y%m%d-%H%M%S)}"
|
|
EVIDENCE_DIR="/tmp/evidence-$INCIDENT_ID"
|
|
HOSTNAME=$(hostname)
|
|
|
|
mkdir -p "$EVIDENCE_DIR"
|
|
|
|
echo "========================================="
|
|
echo "Security Incident Evidence Collection"
|
|
echo "Incident ID: $INCIDENT_ID"
|
|
echo "Host: $HOSTNAME"
|
|
echo "Time: $(date -u '+%Y-%m-%d %H:%M:%S UTC')"
|
|
echo "Output: $EVIDENCE_DIR"
|
|
echo "========================================="
|
|
echo ""
|
|
|
|
# Create metadata file
|
|
cat > "$EVIDENCE_DIR/metadata.txt" << EOF
|
|
Incident ID: $INCIDENT_ID
|
|
Collection Time: $(date -u '+%Y-%m-%d %H:%M:%S UTC')
|
|
Hostname: $HOSTNAME
|
|
Kernel: $(uname -a)
|
|
Collector: $(whoami)
|
|
EOF
|
|
|
|
# System information
|
|
echo "Collecting system information..."
|
|
mkdir -p "$EVIDENCE_DIR/system"
|
|
uname -a > "$EVIDENCE_DIR/system/uname.txt"
|
|
cat /etc/os-release > "$EVIDENCE_DIR/system/os-release.txt" 2>/dev/null || true
|
|
uptime > "$EVIDENCE_DIR/system/uptime.txt"
|
|
date -u > "$EVIDENCE_DIR/system/date.txt"
|
|
|
|
# Running processes
|
|
echo "Collecting process information..."
|
|
mkdir -p "$EVIDENCE_DIR/processes"
|
|
ps auxf > "$EVIDENCE_DIR/processes/ps-auxf.txt"
|
|
ps -eo pid,ppid,user,cmd --sort=-pid > "$EVIDENCE_DIR/processes/ps-sorted.txt"
|
|
pstree -p > "$EVIDENCE_DIR/processes/pstree.txt" 2>/dev/null || true
|
|
|
|
# Network connections
|
|
echo "Collecting network information..."
|
|
mkdir -p "$EVIDENCE_DIR/network"
|
|
ss -tlnp > "$EVIDENCE_DIR/network/listening-tcp.txt"
|
|
ss -ulnp > "$EVIDENCE_DIR/network/listening-udp.txt"
|
|
ss -anp > "$EVIDENCE_DIR/network/all-connections.txt"
|
|
ip addr > "$EVIDENCE_DIR/network/ip-addr.txt"
|
|
ip route > "$EVIDENCE_DIR/network/ip-route.txt"
|
|
iptables -L -n -v > "$EVIDENCE_DIR/network/iptables.txt" 2>/dev/null || true
|
|
cat /etc/hosts > "$EVIDENCE_DIR/network/hosts.txt"
|
|
|
|
# User information
|
|
echo "Collecting user information..."
|
|
mkdir -p "$EVIDENCE_DIR/users"
|
|
cat /etc/passwd > "$EVIDENCE_DIR/users/passwd.txt"
|
|
cat /etc/group > "$EVIDENCE_DIR/users/group.txt"
|
|
who > "$EVIDENCE_DIR/users/who.txt"
|
|
w > "$EVIDENCE_DIR/users/w.txt"
|
|
last -100 > "$EVIDENCE_DIR/users/last.txt"
|
|
lastlog > "$EVIDENCE_DIR/users/lastlog.txt" 2>/dev/null || true
|
|
|
|
# Authentication logs
|
|
echo "Collecting authentication logs..."
|
|
mkdir -p "$EVIDENCE_DIR/logs"
|
|
tail -1000 /var/log/auth.log > "$EVIDENCE_DIR/logs/auth.log" 2>/dev/null || true
|
|
tail -1000 /var/log/secure > "$EVIDENCE_DIR/logs/secure.log" 2>/dev/null || true
|
|
tail -1000 /var/log/syslog > "$EVIDENCE_DIR/logs/syslog.txt" 2>/dev/null || true
|
|
journalctl -u sshd --since "1 day ago" > "$EVIDENCE_DIR/logs/sshd.log" 2>/dev/null || true
|
|
|
|
# Scheduled tasks
|
|
echo "Collecting scheduled tasks..."
|
|
mkdir -p "$EVIDENCE_DIR/scheduled"
|
|
crontab -l > "$EVIDENCE_DIR/scheduled/crontab-current.txt" 2>/dev/null || true
|
|
ls -la /etc/cron.* > "$EVIDENCE_DIR/scheduled/cron-dirs.txt" 2>/dev/null || true
|
|
cat /etc/crontab > "$EVIDENCE_DIR/scheduled/etc-crontab.txt" 2>/dev/null || true
|
|
systemctl list-timers > "$EVIDENCE_DIR/scheduled/systemd-timers.txt" 2>/dev/null || true
|
|
|
|
# File system
|
|
echo "Collecting filesystem information..."
|
|
mkdir -p "$EVIDENCE_DIR/filesystem"
|
|
df -h > "$EVIDENCE_DIR/filesystem/df.txt"
|
|
mount > "$EVIDENCE_DIR/filesystem/mounts.txt"
|
|
find /tmp /var/tmp -type f -mtime -1 -ls > "$EVIDENCE_DIR/filesystem/recent-tmp.txt" 2>/dev/null || true
|
|
|
|
# Package hashes
|
|
echo "Collecting hash information..."
|
|
if command -v sha256sum &>/dev/null; then
|
|
find /usr/bin /usr/sbin -type f -executable 2>/dev/null | head -100 | xargs sha256sum > "$EVIDENCE_DIR/filesystem/binary-hashes.txt" 2>/dev/null || true
|
|
fi
|
|
|
|
# Create archive
|
|
echo ""
|
|
echo "Creating evidence archive..."
|
|
ARCHIVE="/tmp/$INCIDENT_ID-evidence.tar.gz"
|
|
tar -czf "$ARCHIVE" -C /tmp "evidence-$INCIDENT_ID"
|
|
|
|
echo ""
|
|
echo "========================================="
|
|
echo "Evidence collection complete"
|
|
echo "Archive: $ARCHIVE"
|
|
echo "Size: $(du -h "$ARCHIVE" | cut -f1)"
|
|
echo ""
|
|
echo "SHA256: $(sha256sum "$ARCHIVE" | cut -d' ' -f1)"
|
|
echo "========================================="
|