Skip to main content

Resource Release / Sync Deployment (for MSSP partners)

What this page covers

This page documents the GitHub-based release workflow partners use to author resources once and deliver them to many client instances: the repository layout, the sync_cli tool, and the manifest files that drive the hourly pull. It is the concept and CLI half of resource sync.

The interface half is the Configuration → Resource Sync page (v1: Platform → Administration → Resource Sync), a toggle table of the built-in Fluency_* sync groups on each instance, described in The Resource Sync page below. Use that page to see which groups an instance subscribes to; use the rest of this page to publish content into a group of your own.

Related pages in the web interface

The release workflow below runs server-side and from the command line. In the web interface, the related page is Configuration → Resource Sync (v1: Platform → Administration → Resource Sync), where the built-in Fluency_* sync groups are enabled or disabled; the repositories an instance syncs from are configured server-side, as described under Release Management, and have no page in the web interface. API tokens are issued on Admin console → API Tokens (v1: Settings → Advanced → Permissions); see API Tokens. The v1 screenshot of the issued token in step 5 shows the legacy interface; both the v2 and v1 interfaces likewise show the token value once, at creation.

The Resource Sync page​

Configuration → Resource Sync (URL path /v2/configuration/resource-sync) lists the git resource groups that can sync into the tenant (one per supported integration) and lets you turn each group on or off. Enabled groups keep that integration's resources synchronized to the instance.

Resource Sync Groups page with a Save Changes button, a Search groups field, and a table of groups with an Enabled switch, Name, and Description per row

The header shows a Back to Configuration link above the title Resource Sync Groups and the subtitle Git resource groups that sync into this tenant, with the Save Changes button on the right. Below it are a Search groups… field and a table of sync groups, sorted by name, with Enabled, Name, and Description columns:

  • Enabled: a switch per group: blue and to the right when the group syncs, grey and to the left when it does not.
  • Name: the group's identifier. Groups follow a Fluency_ naming pattern, for example Fluency_AWS, Fluency_AzureAD, or Fluency_CiscoMeraki.
  • Description: the integration or log source the group covers, such as Amazon Web Services CloudTrail / CloudWatch (flowlog) Integration or Cisco Duo (Duo Security) Admin API integration.

Type in Search groups… to find a sync group by its name or description. Flip a switch to change its state, then click Save Changes to apply; the button is greyed out until a switch has been changed. See Resource Sync for the page reference.

Release Management​

Fluency uses an integration with GitHub to manage and sync / deploy resources to existing client instances. This functionality is provided for use by Fluency's MSSP partners, to facilitate resource deployments to multiple client sites.

Each Fluency instance can be configured to sync resources with one or more GitHub repositories. By default, Fluency's own content repository is configured:

/etc/repos/Fluency.json

{
  "name": "Fluency",
  "token":"<github access token>",
  "owner": "SecurityDo (<account/company name>)",
  "repo":"Scripts (<repository name>)",
  "branch":"master (<branch name>)"
}

Additional repositories can be added with a new file placed in the same directory, on the server-side.

NOTE: For MSSPs looking to add their own repository(s), please contact Fluency Support to deploy the additional configuration file(s) to all of their client instances.

GitHub Repository​

An additional GitHub repository can be added. Normally, this repository is owned by the MSSP.

  1. Create a repository on GitHub.com

New repository form on GitHub.com

Fluency will access this repository via a GitHub user's personal access token.

  1. Create Personal access token for the user

GitHub personal access token creation page

  1. Allow the github user (access token) to access the repository (Read access)

Repository collaborator settings granting the token&#39;s user read access

Repository structure​

The repository expects, at a minimum, the group_config.json file. Each resource type is located in its corresponding folder. The sync_cli will create the correct sub-folders, as long as the main resource folder exists.

- /
    EntityInfos/
    Filters/
    fplProcessors/
    rules/
    group_config.json
    ...

NOTE: The resource_dump.json and resource_release.json files are automatically generated by the sync_cli tool. These files are the release manifest files, and should be committed to the repository whenever they are modified.

Contact Fluency Support​

Raise a support ticket with the following information, so Fluency can create and deploy the repository file to your client instances.

- MSSP Name (short name)
- GitHub Account / repository owner name
- GitHub Repository name
- GitHub branch (normally master, or main)
- GitHub access token, for user with access to repository

Command Line Tool​

Fluency provides a command line tool (CLI) to assist with managing the content of the repository, and to facilitate the creation of release manifest files. This tool can be run on a Linux instance, such as any x86 based RHEL variants. (This tool was developed and tested on CentOS, but other Linux variants may also work.)

Additionally, the CLI also makes use of Fluency APIs to copy/download specific resources from an existing Fluency site.

To setup the CLI environment:

  1. Create a Linux machine / instance
  • this instance will run 'git' and the binary CLI tool via command line
  • ensure that "git" can be installed on this machine (likely via "yum/dnf")
  1. Download CLI tool

Configuration File​

  1. Create the tool configuration file, in /etc/account_config.json ('root' user or 'sudo' may be required for this operation)

/etc/account_config.json

{
  "idOffset": 50000,
  "accounts":[
    {
        "name":"mssptestsite",
        "url": "https://mssptestsite.app.fluencyplatform.com",
        "token": "f032261b-68e0-47ff-4d3f-a55bac9db3ff"
    },
    ...
    {
        "name":"mssptestsite2",
        "url": "https://mssptestsite2.cloud.fluencysecurity.com",
        "token": "9fedf0e6-c479-4c29-4eb0-55a437c9d306"
    }
  ]
}

NOTE: Raise a support ticket to request an Offset ID (idOffset). This offset value is used to ensure resource ID's between different MSSP partners and Fluency's own resources do not conflict.

  1. Designate one (or more) site(s) as the "test" or "origin" site(s), for example:
   mssptestsite

NOTE: this should be an existing Fluency site currently managed by the MSSP.

  1. Obtain an API token from the designated site(s), via the Fluency Web Interface (see API Tokens).
   https://mssptestsite.app.fluencyplatform.com

In the Admin console, open API Tokens and click Add API Token.

Add API Token dialog with Name and Description fields and empty Roles, Data Policies, and API Policies lists

After you click Add, the dialog shows the new token in a read-only Token field with a Copy token button. Copy it then: it is not shown again after the dialog closes.

For the /etc/account_config.json file, these three items above consitute one entry in the accounts array:

  "accounts":[
  ...
    {
        "name":"mssptestsite",
        "url": "https://mssptestsite.app.fluencyplatform.com",
        "token": "f032261b-68e0-47ff-4d3f-a55bac9db3ff"
    },
  ...
  ]

Workflow​

The MSSP will create/test/deploy resources on this (these) designated sites initially. The CLI tool will then connect to these sites to download a copy of the resources to the local Linux machine.

Using "git", add and commit these files to the repository.

Using the CLI tool, generate the release manifest file.

Using "git", add and commit the release manifest files to the repository

Using "git", push the changes to the remote origin.

Within one hour, all connected Fluency instances should receive the updated manifest files, and will download the newly made resource changes.

Last updated on