feat: Implement Lateral Movement Detection Agent
Implements comprehensive lateral movement detection agent for Phase 3: Lateral Movement Agent Features: - Detects unrestricted lateral movement paths between resources - Identifies high-value pivot nodes with high connectivity - Finds excessive network permissions and security group issues - Analyzes network segmentation gaps and trust relationships - Supports multiple vantage points (internal, external, IAM) - Calculates attack path distances and trust chains Core Components: - agent.py: Main agent with vantage-aware analysis - graph_analyzer.py: NetworkX-based graph analysis engine - test_agent.py: Comprehensive test suite (11 tests) - requirements.txt: Dependencies (networkx, cloudsafeguard-sdk) - README.md: Complete documentation and usage guide Graph Analysis Capabilities: - Builds directed graph from resource nodes and edges - Extracts network attributes (security groups, VPCs, subnets) - Identifies network segments and trust relationships - Calculates shortest paths and connectivity scores - Detects overly permissive rules and public access Agent Registry Integration: - Registered in internal/orchestrator/agent_registry.go - Supports internal, external, and IAM vantage points - Enabled by default for security analysis Testing Results: - All 11 unit tests passing - Successfully executed against mini-cloud example - Generated 3 findings (pivot nodes with connectivity analysis) - Proper error handling and vantage point filtering Files Created: - agents/python/examples/lateral_movement/agent.py - agents/python/examples/lateral_movement/graph_analyzer.py - agents/python/examples/lateral_movement/test_agent.py - agents/python/examples/lateral_movement/requirements.txt - agents/python/examples/lateral_movement/README.md Files Modified: - internal/orchestrator/agent_registry.go (added lateral_movement agent) Status: ✅ Complete and tested Next: Data Exfiltration Agent implementation
V
Vacbo committed
c2e2ade18897af4bb4e1bcb2f323be254e80d9d4
Parent: b0bc3b6