pia@piasoftware.net

(804) 5050PIA

(804) 505-0742

  • Pia Software on LinkedIn
  • Pia Software on Twitter
  • PiaSoftware on Facebook

©2017 BY PIA SOFTWARE.  All rights reserved.

thomas.munn
Jul 30, 2018
Edited: Jul 30, 2018

Cross Correlate ENI ID to InstanceID?

Would be a nice function to get a list of associated instance ID's so I can see which instance IDS are affected. New table with ENI/InstanceID/(IP? private/public?)/DNS NAME?


Really would enable me to then see what actual instance ENI ID (Nice security groups screen which lists all associated Instance IDS, retrieve and collate.

4 comments0 replies
pia
Aug 20, 2018Edited: Aug 25, 2018

As requested, we just added that. There's a link to click that will direct you to all of the instances attached to that SG. It will be released soon in v1.09, which will go to AWS for approval today or tomorrow. Please contact me if you'd like to try it out in beta.

0
pia
Aug 25, 2018

It went live in the marketplace yesterday.we didn't make the additional table,but linked out to it on the console since it provides more fields of data. Let us know what you think.

0
thomas.munn
Aug 27, 2018

Would to love to test.

0
pia
Aug 27, 2018

Hi Thomas, It's live in the marketplace now! You can launch it with just a few clicks from this CloudFormation template. We did away with access/secret keys and use AWS' preferred method of attaching a role to the ec2 instance. This makes setup much easier. Here's the CloudFormation template (it's also linked by AWS from our marketplace listing): https://s3.amazonaws.com/awsmp-fulfillment-cf-templates-prod/844763a9-1bd1-4d4b-a6a3-57bad3cf4fe9.fe262328-cd32-4585-a4d2-797f3a3a87be.template https://aws.amazon.com/marketplace/pp/B074N3YQ1P

0
New Posts
  • thomas.munn
    Jul 30, 2018

    Ability to read S3 buckets with vpc flow data?

    Discussion 
    It seems that the aws api limits you to about the last 4 hours worth of data. How hard would it be to look at vpc flows logs exported to an s3 bucket? They store the flow data as an unstructured compressed (and possibly encrypted) text file within a directory structure. This would make it much easier for the system to look at more flow data without the added expense of an api call. I am enclosing an example table structure that I used to do sql: CREATE TABLE "public"."vpc" ( "time" timestamp NOT NULL, "version" integer NOT NULL, "account" text NOT NULL, "interface" text NOT NULL, "srcaddr" inet, "dstaddr" inet, "srcport" integer, "dstport" integer, "protocol" int, "packets" bigint, "bytes" bigint, "start" int, "end" int, "action" text, "log-status" text ) WITH (oids = false); Here is an example single line (uncompressed) 2018-07-26T21:01:11.000Z 2 678049594014 eni-0foobar 10.111.15.10 12.16.612.124 35136 2100 6 2 104 1532638871 1532638930 ACCEPT OK
  • thomas.munn
    Jul 30, 2018

    Really Fast regex parser

    Discussion 
    I know the program is written in ruby, but have you looked at hyperscan? Its a really fast regex parser if you need that kind of functionality. https://www.hyperscan.io/
  • thomas.munn
    Jul 30, 2018

    Allow UX to do > 1,000,000

    Discussion 
    You might want to have a warning "If you do this it will take a really long time unless you upgrade to a t2.medium blah." My vpc flow logs often run into the 26M/day and would be nice to put in a day's worth if I could run it over night. I don't mind upgrading to higher level instances. P.S. Great tool. Laser focused and I don't have to have 10,000 instances of elastic search.