-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Exploits family enricher #36
Conversation
fishkerez
commented
Jan 22, 2023
•
edited
Loading
edited
- Add exploit family scanner/enricher to the scanner CLI
- Use vuls go-exploitdb tool to setup exploits DB and server on the backend VM
- output exploits scanner results
- export results to the backend
- add config for exploit server address
- update exploitsScan object in the swagger
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Quite a few comments, I think need to be addressed.
optimize export logic to fetch and insert scan results only one time and not for each family
I know @FrimIdan brought this up in the teams channel, this was done specifically so that we can separate them in the future and patch each result to the backend as they completed instead of all at the same time.
Even if we decide to make this change I don't believe it belongs in this PR which is specifically meant to be adding the Exploits enricher family and changing nothing else.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overall looks good to me, I think the only blocking issues are:
- the naming the cloud-formation for the new ingress rule
- the cveID reference in the task closure
We can open follow up tickets for the others:
- Cleaning up the SourceTypes so they are per family and adding validation at each family level for the ones they support
- Moving the exploit DB script out of cloud-init into its own container
Everything else is just nits which are just minor improvements.
Co-authored-by: Sam Betts <116557335+sambetts-cisco@users.noreply.github.com>
Co-authored-by: Sam Betts <116557335+sambetts-cisco@users.noreply.github.com>