mcpField
S
security-automation

security-automation

github.com/bagelholeSecurity1.2k355 installsUpdated 23w ago
Repository

About security-automation

A skill for automating security operations, including remediation, SOAR playbooks, and compliance checks. It is intended for teams building security pipelines and repeatable response processes.

Key features

  1. 01Security pipeline automation
  2. 02Automated remediation scripts
  3. 03SOAR playbook examples
  4. 04Custom compliance checks
  5. 05Staging tests and manual review gates

Use cases

  1. 01Automate security checks in CI workflows
  2. 02Remediate public S3 bucket access
  3. 03Enrich and respond to suspicious-login alerts
  4. 04Add custom infrastructure compliance rules

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill security-automation

After installing, type/security-automationin Claude Code to confirm it loaded.

Details

From the project README

Security Automation

Automate security operations for scale and efficiency.

Security Pipeline

# .github/workflows/security.yml
name: Security Pipeline

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Secret Scanning
        uses: trufflesecurity/trufflehog@main
        
      - name: SAST
        uses: returntocorp/semgrep-action@v1
        
      - name: Dependency Scan
        run: npm audit --audit-level=high
        
      - name: Container Scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          
      - name: Compliance Check
        run: |
          checkov -d . --framework terraform

Automated Remediation

# Auto-remediation script
def remediate_public_s3(bucket_name):
    """Remove public access from S3 bucket."""
    s3 = boto3.client('s3')
    s3.put_public_access_block(
        Bucket=bucket_name,
        PublicAccessBlockConfiguration={
            'BlockPublicAcls': True,
            'IgnorePublicAcls': True,
            'BlockPublicPolicy': True,
            'RestrictPublicBuckets': True
        }
    )

SOAR Integration

playbook:
  name: Suspicious Login Response
  trigger: alert.type == "suspicious_login"
  actions:
    - enrich_ip:
        source: threat_intel
    - if_condition: ip.is_malicious
      then:
        - block_ip:
            firewall: cloudflare
        - disable_user:
            duration: 1h
        - notify:
            channel: security
        - create_ticket:
            priority: high

Compliance as Code

# Checkov custom check
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck

class S3Encryption(BaseResourceCheck):
    def __init__(self):
        name = "Ensure S3 bucket has encryption enabled"
        id = "CUSTOM_S3_1"
        supported_resources = ['aws_s3_bucket']
        super().__init__(name=name, id=id, ...)
    
    def scan_resource_conf(self, conf):
        if 'server_side_encryption_configuration' in conf:
            return CheckResult.PASSED
        return CheckResult.FAILED

Best Practices

  • Start with high-impact automations
  • Test in staging first
  • Include manual review gates
  • Monitor automation effectiveness
  • Regular rule updates

Related Skills

Comments

Markdown supported