Threat Exposure Management (TEM)
Quick Start
Project setup and execution guide
Getting Started
Step One
- Ensure you have generated an RSSD using EAA or that you already own an RSSD.
- Write SQL views and queries in
.sqlfiles and supporting queries in a Markdown file. - Ingest these SQL views and queries into your RSSD and view the Web UI using Surveilr.
- Copy or place your RSSD file into this directory (for example:
tem.sqlite.db). - Create a
sqlpage.jsonfile inside a sqlpage folder:
mkdir sqlpage && cd sqlpage
cat <<EOF > sqlpage.json
{
"database_url": "sqlite://tem.sqlite.db?mode=rwc",
"allow_exec": true,
"port": 9227
}
EOF- Write your SQL views in a file with a .sql extension (for example:
stateless.sql). - Write SQL queries that call these views inside a Markdown file (for example:
Spryfile.md). - Create interpretations and store them inside a folder named
interpretationat the same level.
Project Structure
Your directory should look like this:
project-tem/
├─ Spryfile.md
├─ stateless.sql
├─ tem.sqlite.db
├─ interpretation/
└─ *.md
├─ sqlpage/
└─ sqlpage.jsonManual Steps
Add the following executable blocks at the top of Spryfile.md.
Ingest Interpretations into sqlite.db
#!/usr/bin/env bash
surveilr ingest files -r interpretation -d tem.sqlite.dbIngest SQL Views from stateless.sql into sqlite.db
#!/usr/bin/env bash
cat stateless.sql | sqlite3 tem.sqlite.dbIngest SQL Query from Spryfile.md into sqlite.db
#!/usr/bin/env bash
spry sp spc --md Spryfile.md --package --conf sqlpage/sqlpage.json | sqlite3 tem.sqlite.dbView the sqlite.db Locally Using Surveilr
#!/usr/bin/env bash
surveilr web-ui -d tem.sqlite.dbAccess the Web UI
Use the following command to start the local Web UI and open it in your browser:
#!/usr/bin/env bash
echo "Visit http://localhost:9227"Automated Step
- Copy paste the manual commands inside
Spryfile.mdas an executable block - Then verify by running these are executables by:
spry rb ls Spryfile.md- if you see the tasks listed, you are good to go.
- Finally run the entire Spryfile by:
spry rb run Spryfile.md --verbose richFinal Execution
Final command to run all scripts and launch the Web UI:
Run this from the root of your project directory.
spry rb run Spryfile.md --verbose richThen visit localhost
How is this guide?
Last updated on