fix: remove leaked Alibaba Cloud AccessKey secret data#14421
Open
karabo17-x wants to merge 2 commits into
Open
fix: remove leaked Alibaba Cloud AccessKey secret data#14421karabo17-x wants to merge 2 commits into
karabo17-x wants to merge 2 commits into
Conversation
Author
|
@microsoft-github-policy-service agree |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fix GitHub Secret Scanning Alert #63
Summary
This PR removes a publicly leaked Alibaba Cloud AccessKey Secret that was
hardcoded in sample data, flagged by GitHub Secret Scanning as Alert #63.
What was changed
File:
Sample Data/Fortinet FortiNDR Cloud/suricata_http_domain.jsonReplaced real credential values in the
intel[0]object with clearlylabelled placeholder strings:
aggregator9bniCI45031Ye01WwhFhoi2vBZhNmYSAMPLE_AGGREGATOR_ID_REPLACE_WITH_ACTUALmetaGEP1ZeEAIZymjKss5EYQbpBwJ5Gy6HSAMPLE_META_TOKEN_REPLACE_WITH_ACTUALAction Required from Codeowners
Since this is a public repository and the secret has already been exposed,
the key must be revoked in Alibaba Cloud regardless of this merge.
Steps for the repository owner to action:
**Log in to Alibaba Cloud **
Navigate to:
Identities -- Users-- find the user owning this AccessKeyDisable the key
Authentication tab -- find key
GEP1ZeEAIZymjKss5EYQbpBwJ5Gy6H-- click DisableDelete the key
Once disabled -- click Delete -- confirm
Check ActionTrail for unauthorized use
Filter by this AccessKey ID and look for any unexpected API calls
(e.g.
CreateUser,AttachPolicy,ListBuckets,GetObject)Rotate if the key was in active use
Create a new AccessKey and update it in any systems that relied on it
Close GitHub Secret Scanning Alert Add data sources to VM insights dashboard #63
Security -- Secret scanning -- Alert #63 -- Close as -- RevokedReferences
alibaba_cloud_access_key_secret