Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Exploits family enricher #36

Merged
merged 6 commits into from
Feb 13, 2023
Merged

Exploits family enricher #36

merged 6 commits into from
Feb 13, 2023

Conversation

fishkerez
Copy link
Contributor

@fishkerez fishkerez commented Jan 22, 2023

  • Add exploit family scanner/enricher to the scanner CLI
  • Use vuls go-exploitdb tool to setup exploits DB and server on the backend VM
  • output exploits scanner results
  • export results to the backend
  • add config for exploit server address
  • update exploitsScan object in the swagger

@fishkerez fishkerez changed the title Exploits DB Exploits family enricher Jan 22, 2023
@fishkerez fishkerez requested review from a user and FrimIdan and removed request for a user January 22, 2023 22:26
@fishkerez fishkerez self-assigned this Jan 22, 2023
@fishkerez fishkerez requested review from akpsgit and pbalogh-sa and removed request for FrimIdan, akpsgit and pbalogh-sa January 22, 2023 22:27
cli/cmd/exportresults.go Outdated Show resolved Hide resolved
cli/cmd/exportresults.go Outdated Show resolved Hide resolved
cli/cmd/exportresults.go Outdated Show resolved Hide resolved
installation/aws/VmClarity.cfn Outdated Show resolved Hide resolved
installation/aws/VmClarity.cfn Outdated Show resolved Hide resolved
shared/pkg/families/exploits/exploitdb/utils.go Outdated Show resolved Hide resolved
shared/pkg/families/exploits/exploitdb/exploitdb.go Outdated Show resolved Hide resolved
shared/pkg/families/exploits/exploitdb/utils.go Outdated Show resolved Hide resolved
shared/pkg/families/exploits/exploitdb/utils.go Outdated Show resolved Hide resolved
shared/pkg/families/exploits/family.go Outdated Show resolved Hide resolved
Copy link

@ghost ghost left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Quite a few comments, I think need to be addressed.

optimize export logic to fetch and insert scan results only one time and not for each family

I know @FrimIdan brought this up in the teams channel, this was done specifically so that we can separate them in the future and patch each result to the backend as they completed instead of all at the same time.

Even if we decide to make this change I don't believe it belongs in this PR which is specifically meant to be adding the Exploits enricher family and changing nothing else.

.families.yaml Outdated Show resolved Hide resolved
api/openapi.yaml Outdated Show resolved Hide resolved
backend/pkg/config/config.go Outdated Show resolved Hide resolved
shared/pkg/families/exploits/exploitdb/utils.go Outdated Show resolved Hide resolved
shared/pkg/families/exploits/exploitdb/exploitdb.go Outdated Show resolved Hide resolved
shared/pkg/families/exploits/exploitdb/exploitdb.go Outdated Show resolved Hide resolved
shared/pkg/families/exploits/exploitdb/exploitdb.go Outdated Show resolved Hide resolved
shared/pkg/families/exploits/family.go Show resolved Hide resolved
shared/pkg/families/exploits/merge.go Show resolved Hide resolved
shared/pkg/families/exploits/result.go Show resolved Hide resolved
Copy link

@ghost ghost left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looks good to me, I think the only blocking issues are:

  • the naming the cloud-formation for the new ingress rule
  • the cveID reference in the task closure

We can open follow up tickets for the others:

  • Cleaning up the SourceTypes so they are per family and adding validation at each family level for the ones they support
  • Moving the exploit DB script out of cloud-init into its own container

Everything else is just nits which are just minor improvements.

installation/aws/VmClarity.cfn Show resolved Hide resolved
installation/aws/VmClarity.cfn Outdated Show resolved Hide resolved
shared/pkg/families/exploits/exploitdb/exploitdb.go Outdated Show resolved Hide resolved
shared/pkg/families/exploits/exploitdb/exploitdb.go Outdated Show resolved Hide resolved
shared/pkg/families/exploits/family.go Outdated Show resolved Hide resolved
shared/pkg/families/exploits/family.go Outdated Show resolved Hide resolved
ghost
ghost previously approved these changes Feb 13, 2023
Erez Fishhimer and others added 5 commits February 13, 2023 11:47
Co-authored-by: Sam Betts <116557335+sambetts-cisco@users.noreply.github.com>
Co-authored-by: Sam Betts <116557335+sambetts-cisco@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants