-
Notifications
You must be signed in to change notification settings - Fork 65
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into trivy-template
- Loading branch information
Showing
9 changed files
with
352 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| # Improvements | ||
|
|
||
| Postee like any other software isn't perfect and as the writing of this document can be improved in the following areas: | ||
|
|
||
| ## UI | ||
|
|
||
| This is an improvement that would benefit not just new users of Postee but also add ease of use for existing users to configure Postee on the fly with drag and drop-'ing of components to configure Postee. | ||
|
|
||
|  | ||
|
|
||
| The above is an example of a User Interface that Postee could have where the blocks (Trivy, AWS Security Hub and Slack) are dragged and dropped into the view and connected as needed. This would translate into a Postee configuration file being written to disk. | ||
|
|
||
|
|
||
| ## Alternate Policy language | ||
|
|
||
| Today Postee supports Rego as the primary language for policy evaluation. While Rego is purposely suited for being a policy language, it might be challenging to learn for new users and feel comfortable in. | ||
|
|
||
| Therefore, having an alternate policy language to write rules could benefit with Postee adoption even further. A few ideas that we've experimented in some of our other projects are as follows: | ||
|
|
||
| 1. Golang Policies | ||
| 2. [CEL-Go](https://github.com/google/cel-go) | ||
|
|
||
| ## Support for more Actions | ||
|
|
||
| Today Postee supports a wide variety of Postee Actions but the list can be further expanded by including the following: | ||
|
|
||
| 1. AWS Cloudwatch Logs | ||
| 2. Azure automation | ||
| 3. GCP automation | ||
|
|
||
| Extending Postee to support a new Action is very simple. You can take a look at this PR to see exactly which places you'll need to modify in order to support a new Action. | ||
|
|
||
| [Link to example PR](https://github.com/aquasecurity/postee/pull/468) | ||
|
|
||
|
|
||
| ## My idea is not listed here | ||
| Do you have an idea that you'd like to implement in Postee? Reach out to us via GitHub Issues or on Slack to discuss more about it. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,158 @@ | ||
| package postee.vuls.html | ||
| ############################################# Common functions ############################################ | ||
| with_default(obj, prop, default_value) = default_value { | ||
| not obj[prop] | ||
| } | ||
|
|
||
| with_default(obj, prop, default_value) = obj[prop] { | ||
| obj[prop] | ||
| } | ||
|
|
||
| #import common.by_flag | ||
| ################################################ Templates ################################################ | ||
| #main template to render message | ||
|
|
||
| tpl:=` | ||
| h1. Image name: %s | ||
| %s | ||
| %s | ||
| %s | ||
| %s | ||
| %s | ||
| ` | ||
|
|
||
| vlnrb_tpl = ` | ||
| h4. %s severity vulnerabilities | ||
| %s | ||
| ` | ||
| #Extra % is required in width:100% | ||
|
|
||
| table_tpl := ` | ||
| %s | ||
| ` | ||
|
|
||
| cell_tpl := `| %s ` | ||
|
|
||
| header_tpl := `|| %s ` | ||
|
|
||
| row_tpl := ` | ||
| | %s ` | ||
|
|
||
| colored_text_tpl := "{color:%s}%s{color}" | ||
|
|
||
| ########################################################################################################### | ||
|
|
||
| ############################################## Html rendering ############################################# | ||
|
|
||
| render_table_headers(headers) = row { | ||
| count(headers) > 0 | ||
| ths := [th | | ||
| header := headers[_] | ||
| th := sprintf(header_tpl, [header]) | ||
| ] | ||
|
|
||
| row := sprintf(row_tpl, [concat("", ths)]) | ||
| } | ||
|
|
||
| render_table_headers(headers) = "" { #if headers not specified return empty results | ||
| count(headers) == 0 | ||
| } | ||
|
|
||
| render_table(headers, content_array) = s { | ||
| rows := [tr | | ||
| cells := content_array[_] | ||
| tds := [td | | ||
| ctext := cells[_] | ||
| td := to_cell(ctext) | ||
| ] | ||
|
|
||
| tr = sprintf(row_tpl, [concat("", tds)]) | ||
| ] | ||
|
|
||
| s := sprintf(table_tpl, [concat("", array.concat([render_table_headers(headers)], rows))]) | ||
| } | ||
|
|
||
| ## why I added it? | ||
| to_cell(txt) = c { | ||
| c := sprintf(cell_tpl, [txt]) | ||
| } | ||
|
|
||
| to_colored_text(color, txt) = spn { | ||
| spn := sprintf(colored_text_tpl, [color, txt]) | ||
| } | ||
|
|
||
| ####################################### Template specific functions ####################################### | ||
| to_severity_color(color, level) = spn { | ||
| spn := to_colored_text(color, format_int(with_default(input.Metadata.vulnerability_summary, level, 0), 10)) | ||
| } | ||
|
|
||
| cnt_by_severity(severity) = cnt { | ||
| vln_list := [r | | ||
| some i, j | ||
| item := input.Results[i] | ||
|
|
||
| item.Vulnerabilities[j].Severity == severity | ||
|
|
||
| r := item.Vulnerabilities[j] | ||
| ] | ||
|
|
||
| cnt := count(vln_list) | ||
| } | ||
|
|
||
| # 2 dimension array for vulnerabilities summary | ||
| severities_stats := [ | ||
| ["critical", to_severity_color("#c00000", "critical")], | ||
| ["high", to_severity_color("#e0443d", "high")], | ||
| ["medium", to_severity_color("#f79421", "medium")], | ||
| ["low", to_severity_color("#e1c930", "low")], | ||
| ["negligible", to_severity_color("green", "negligible")], | ||
| ] | ||
|
|
||
| vlnrb_headers := ["Layer", "Title","Vulnerability ID", "Resource name", "Path", "Installed version", "Fix version", "Url"] | ||
|
|
||
| render_vlnrb(severity, list) = sprintf(vlnrb_tpl, [severity, render_table(vlnrb_headers, list)]) { | ||
| count(list) > 0 | ||
| } | ||
|
|
||
| render_vlnrb(severity, list) = "" { #returns empty string if list of vulnerabilities is passed | ||
| count(list) == 0 | ||
| } | ||
|
|
||
| # builds 2-dimension array for vulnerability table | ||
| vln_list(severity) = vlnrb { | ||
| some i, j | ||
| vlnrb := [r | | ||
| item := input.Results[i] | ||
|
|
||
| target := item.Target | ||
| vlnname := item.Vulnerabilities[j].VulnerabilityID | ||
| title := item.Vulnerabilities[j].Title | ||
| fxvrsn := with_default(item.Vulnerabilities[j], "FixedVersion", "none") | ||
| resource_name = with_default(item.Vulnerabilities[j], "PkgName", "none") | ||
| resource_path = with_default(item.Vulnerabilities[j], "PkgPath", "none") | ||
| resource_version = with_default(item.Vulnerabilities[j], "InstalledVersion", "none") | ||
| primaryurl = with_default(item.Vulnerabilities[j], "PrimaryURL", "none") | ||
| references = with_default(item.Vulnerabilities[j], "References", "none") | ||
|
|
||
| item.Vulnerabilities[j].Severity == severity # only items with severity matched | ||
| r := [target, title, vlnname, resource_name, resource_path, resource_version, fxvrsn, primaryurl] | ||
| ] | ||
| } | ||
|
|
||
| ########################################################################################################### | ||
|
|
||
| title = sprintf("%s vulnerability scan report", [input.ArtifactName]) | ||
|
|
||
| aggregation_pkg := "postee.vuls.slack.trivy.aggregation" | ||
|
|
||
| result = msg { | ||
|
|
||
| msg := sprintf(tpl, [ | ||
| input.ArtifactName, | ||
| render_vlnrb("Critical", vln_list("CRITICAL")), | ||
| render_vlnrb("High", vln_list("HIGH")), | ||
| render_vlnrb("Medium", vln_list("MEDIUM")), | ||
| render_vlnrb("Low", vln_list("LOW")), | ||
| render_vlnrb("Negligible", vln_list("NEGLIGIBLE")) | ||
| ]) | ||
| } |