Package: trello-watchman
Trello WatchmanMonitoring your Trello boards for sensitive informationAbout Trello WatchmanTrello Watchman is an application that uses the Trello API to look for potentially sensitive data exposed in your public Trello boards.FeaturesTrello Watchman looks for:API Keys, Tokens & Service AccountsAWS, Azure, GCP, Google API, Slack (keys & webhooks), Twitter, Facebook, GitHubGeneric Private keysAccess Tokens, Bearer Tokens, Client Secrets, Private TokensFilesCertificate filesPotentially interesting/malicious/sensitive files (.docm, .xlsm, .zip etc.)Executable filesPersonal DataLeaked passwordsPassport numbers, Dates of birth, Social security numbers, National insurance numbers, Drivers licence numbers (UK), Individual Taxpayer Identification NumberTime based searchingYou can run Trello Watchman to look for results going back as far as:24 hours7 days30 daysAll timeThis means after one deep scan, you can schedule Trello Watchman to run regularly and only return results from your chosen timeframe.RulesTrello Watchman uses custom YAML rules to detect matches in Trello.They follow this format:---filename:enabled:[true|false]meta:name:author:date:description:#what the search should findseverity:#rating out of 100scope:-#[text|attachments]test_cases:match_cases:-#test case that should match the regex*fail_cases:-#test case that should not match the regex*strings:-#search query to use in Trello*pattern:#Regex pattern to filter out false positives*There are Python tests to ensure rules are formatted properly and that the Regex patterns work in thetestsdirMore information about rules, and how you can add your own, is in the filedocs/rules.md.LoggingTrello Watchman gives the following logging options:StdoutLog fileTCP streamResults are output in JSON format, perfect for ingesting into a SIEM or other log analysis platform.For file and TCP stream logging, configuration options need to be passed via.conffile or environment variable. See the filedocs/logging.mdfor instructions on how to set it up.If no logging option is given, Trello Watchman defaults to Stdout logging.RequirementsTrello API tokenTo run Trello Watchman, you will need a Trello API OAuth access token, which take the form of akeyand asecret. You can generate thesehere.Note: User tokens act on behalf of the user who generates them, so I would suggest you create this app and authorise it using a service account, otherwise the app will have access to your private Trello boards.Providing tokenTrello Watchman will first try to get the secret and key from the environment variablesTRELLO_WATCHMAN_SECRETandTRELLO_WATCHMAN_KEY, if this fails it will load the token from .conf file (see below)..conf fileConfiguration options can be passed in a file namedwatchman.confwhich must be stored in your home directory. The file should follow the YAML format, and should look like below:trello_watchman:secret:abc123key:abc123logging:file_logging:path:/var/log/json_tcp:host:localhostport:9020Trello Watchman will look for this file at runtime, and use the configuration options from here. If you are not using the advanced logging features, leave them blank.If you are having issues with your .conf file, run it through a YAML linter.An example file is indocs/example.confInstallationInstall via pippython3 -m pip install trello-watchmanUsageTrello Watchman will be installed as a global command, use as follows:usage: trello-watchman [-h] --timeframe {d,w,m,a} [--output {file,stdout,stream}]
                   [--version] [--all] [--attachments] [--text]

Monitoring your Trello boards for sensitive information

optional arguments:
  -h, --help            show this help message and exit
  --version             show program's version number and exit
  --all                 Find everything
  --attachments         Search for attachments
  --text                Search text

required arguments:
  --timeframe {d,w,m,a}
                        How far back to search: d = 24 hours w = 7 days, m =
                        30 days, a = all time
  --output {file,stdout,stream}
                        Where to send resultsYou can run Trello Watchman to look for everything, and output to default CSV:trello-watchman --timeframe a --allOther Watchman appsYou may be interested in some of the other apps in the Watchman family:Slack WatchmanGitLab WatchmanGitHub WatchmanLicenseThe source code for this project is released under theGNU General Public Licence. This project is not associated with Trello or Atlassian.