Verwendung
- Installationsbefehl kopieren und das Quellpaket vor der Installation in der eigenen Agentenumgebung prüfen.
- Benötigte Werkzeuge, Zugangsdaten und Hosts im Original prüfen.
- Eingabe und gewünschtes Ergebnis beschreiben und die Ausgabe mit den Quellen abgleichen.
npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill security-automationVor dem Start
- Die Installation umfasst weder Modellabo noch API-Kontingent oder Dateizugriffsrechte.
- Sterne und Installationen zeigen Aktivität, keine unabhängige Qualitäts- oder Sicherheitsprüfung.
Originales Skill-Dokument
Aus dem Quell-Repository gerendert; Überschriften, Beispiele, Code, Tabellen, Links und Bilder bleiben erhalten.
Security Automation
Automate security operations for scale and efficiency.
Security Pipeline
yaml
# .github/workflows/security.yml
name: Security Pipeline
on: [push, pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Secret Scanning
uses: trufflesecurity/trufflehog@main
- name: SAST
uses: returntocorp/semgrep-action@v1
- name: Dependency Scan
run: npm audit --audit-level=high
- name: Container Scan
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
- name: Compliance Check
run: |
checkov -d . --framework terraformAutomated Remediation
python
# Auto-remediation script
def remediate_public_s3(bucket_name):
"""Remove public access from S3 bucket."""
s3 = boto3.client('s3')
s3.put_public_access_block(
Bucket=bucket_name,
PublicAccessBlockConfiguration={
'BlockPublicAcls': True,
'IgnorePublicAcls': True,
'BlockPublicPolicy': True,
'RestrictPublicBuckets': True
}
)SOAR Integration
yaml
playbook:
name: Suspicious Login Response
trigger: alert.type == "suspicious_login"
actions:
- enrich_ip:
source: threat_intel
- if_condition: ip.is_malicious
then:
- block_ip:
firewall: cloudflare
- disable_user:
duration: 1h
- notify:
channel: security
- create_ticket:
priority: highCompliance as Code
python
# Checkov custom check
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
class S3Encryption(BaseResourceCheck):
def __init__(self):
name = "Ensure S3 bucket has encryption enabled"
id = "CUSTOM_S3_1"
supported_resources = ['aws_s3_bucket']
super().__init__(name=name, id=id, ...)
def scan_resource_conf(self, conf):
if 'server_side_encryption_configuration' in conf:
return CheckResult.PASSED
return CheckResult.FAILEDBest Practices
- Start with high-impact automations
- Test in staging first
- Include manual review gates
- Monitor automation effectiveness
- Regular rule updates
Related Skills
- github-actions - CI/CD automation
- policy-as-code - Policy enforcement
