Log4Shell Remediation Visibility with JupiterOne and Log4Shell_Sentinel
|December 27, 2021 BY Erich Smith
If you’re neck-deep in Log4Shell remediation and wanting the assurance of an automated process to ensure your hosts are patched and stay patched, the following approach may be helpful to you.
Identify Vulnerable Hosts
We found that ossie-git/log4shell_sentinel is a fast and accurate file-based scanner for vulnerable Log4J dependencies. JupiterOne Security team has wrapped this scanner with some additional scripts that ingest its output into the JupiterOne graph.
You will want to set up the scanning/ingestion script to run periodically, say at least every hour.
Prioritize Your Remediation
Once one or more hosts are reporting into JupiterOne, head to the JupiterOne Insights app and import this JSON schema. It should create a dashboard that gives you insight into which hosts need patching, how many vulnerabilities are still unpatched, and how long these hosts have been unpatched:
Patch Your Hosts, Monitor Insights
Use the above insights to help guide your remediation efforts. As you roll out patches, the scanning/ingestion script will verify them, and report each hosts’ updated status to JupiterOne.
Watching the number of vulnerabilities fall is satisfying, and you’ll have the confidence that regressions will not reoccur without your awareness.
If you’re using a different scanning tool, or this ingest-log4j-vulns project is otherwise not immediately helpful to you today, you may still find the approach taken here generally useful for cases where you want individual hosts to report periodically to the J1 graph.
The ingestion script uses the “Bulk Upload”/Sync Job API, and passes a unique scope for each host. This scope parameter is important: it ensures that multiple runs of the ingestion script will be idempotent, and that previous log4j_vulnerability Findings will be removed accurately from the graph once remediated. In our ingestion script we randomly generate a scope parameter for each host, persist it to the filesystem, and re-use on later runs of the script.
Erich is the Principal Security Engineer at JupiterOne. An industry veteran of 20+ years, his background includes roles in software development, security, devops, systems administration, and compliance automation.
To hear more from Erich, get our newsletter. No spam, just the good stuff once or twice a month. Sign up below.