Databucket

Purpose

The Databucket Core Data Product is an inventory of your cloud storage resources, such as object
storage buckets and managed file-storage services. Use it to answer questions
such as which storage resources are publicly accessible, which are unencrypted, and which have no
backup configured, and to join back to OCSF activity and findings that involve those resources.

Entity Correlation

The Entity Correlator identifies a cloud asset by its unique ID (uid), for example an Amazon
Resource Name. For this resource, Entity Correlator looks at the resource_details.type_id = 2 (Databucket) and the resource_details.uid from the feed populating OCSF class 5023.
When several feeds report the same uid, they are merged into a single asset with a single id.

Understanding the Table

An asset appears in this table when the feed that reports it classifies it as a databucket (type ID
2). Assets that a feed reports without a type are not placed in any of the cloud-asset tables.

The end_time field is populated when an asset is closed. This can happen because the source reports it as decommissioned, or no feed has reported it in the retention period (365 days by default, configurable). A closed asset has active = FALSE. If a closed asset is reported again, it is tracked as a new asset with a new id.

Security attributes such as is_public, is_encrypted and encryption_details are populated only when the reporting feed supplies them. If a feed does not supply these details, the value is null, not false.

Joining to CDPs and OCSF

OCSF event tables that reference cloud resources carry the asset in their resources array, and each element's id matches the CDP id. Join on that element to find the activity and findings that involve a storage resource.

Schema

Example Queries

Find all active databuckets

SELECT * FROM databucket WHERE active=TRUE

Find the latest record for a given id

SELECT * FROM databucket WHERE active=TRUE AND id={id}

Find publicly accessible buckets that are not encrypted

SELECT id, name, uid
FROM databucket
WHERE active=TRUE
  AND is_public=TRUE
  AND is_encrypted=FALSE

Find storage resources with no backup configured

SELECT id, name, uid
FROM databucket
WHERE active=TRUE
  AND is_backed_up=FALSE

How to join back to OCSF

SELECT d.name, a.*
FROM OCSF.{activity} a,
     LATERAL FLATTEN(input => a.resources) r,
     CDP.databucket d
WHERE d.id = r.value:id::INT
  AND d.active=TRUE