heimdall_tools 1.3.35 → 1.3.39

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 30a8aa48d76c322433d3b7233585d2f7265c5d9906147f904a56d7c37468943d
-  data.tar.gz: de9c85b3ec842451ba8ccd52ef66b516390677c1d9971e602c434cc21725d619
+  metadata.gz: f629e9d519b119329b6bfd8a8eeb7826420262f654cbe127e6efe05b88fc9ac3
+  data.tar.gz: 1d66b4d6505221cbd2fbb06dc4d856c179d8db11566148386b2f67bd0110e851
 SHA512:
-  metadata.gz: 735203a3dedc20625a366530d50c5f0e11a5a654a13f1264b53dd239b6902a851b35ea49ae1b783714399d6c2215ebf137a2c54e4edb6a2c7e40e3a17ef1d8db
-  data.tar.gz: 19b63fc27d52ede491025d7880771e31ffeaf090707b73885970b9455e4c81bda1c15b428621436e8086f9e6d5521d6810fd1000df4f2900fe8b57911fc44488
+  metadata.gz: 6f7898ac0e5b94f3efaeda24117c4f8ff6dc06bf1140786d6c99eccffbdc1fa9792c93eda05847c7e6a9a1d2e5d70596a486ba4fe53bc931eace7bb6dff45146
+  data.tar.gz: 34b4302cae0fad8bcec837e2b81df578aade9e3850a1040a0cadf1510e57078a7f110bdae8c74fd4974bec079b7c9115f1ff573536a32221936ba93e4eaf9280

data/README.md

@@ -13,6 +13,8 @@ HeimdallTools supplies several methods to convert output from various tools to "
 - **snyk_mapper** - commercial package vulnerability scanner
 - **nikto_mapper** - open-source web server scanner 
 - **jfrog_xray_mapper** - package vulnerability scanner
+- **dbprotect_mapper** - database vulnerability scanner
+- **aws_config_mapper** - assess, audit, and evaluate AWS resources
 
 Ruby 2.4 or higher (check using "ruby -v")
 
@@ -197,6 +199,41 @@ FLAGS:
 example: heimdall_tools jfrog_xray_mapper -j xray_results.json -o xray_results_hdf.json
 ```
 
+## dbprotect_mapper
+
+dbprotect_mapper translates DBProtect report in `Check Results Details` format XML to HDF format JSON be viewed on Heimdall.
+  
+```
+USAGE: heimdall_tools dbprotect_mapper [OPTIONS] -x <check_results_details_report_xml> -o <db_protect_hdf.json>
+
+FLAGS:
+    -x <check_results_details_report_xml>           : path to DBProtect report XML file.
+    -o --output <scan-results>       : path to output scan-results json.
+    -V --verbose                     : verbose run [optional].
+
+example: heimdall_tools dbprotect_mapper -x check_results_details_report.xml -o db_protect_hdf.json
+```
+
+## aws_config_mapper
+
+aws_config_mapper pulls Ruby AWS SDK data to translate AWS Config Rule results into HDF format json to be viewable in Heimdall
+
+### AWS Config Rule Mapping:
+  The mapping of AWS Config Rules to 800-53 Controls was sourced from [this link](https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist-800-53_rev_4.html).
+  
+### Authentication with AWS:
+  [Developer Guide for configuring Ruby AWS SDK for authentication](https://docs.aws.amazon.com/sdk-for-ruby/v3/developer-guide/setup-config.html)
+  
+```
+USAGE: heimdall_tools aws_config_mapper [OPTIONS] -o <hdf-scan-results.json>
+
+FLAGS:
+    -o --output <scan-results>       : path to output scan-results json.
+    -V --verbose                     : verbose run [optional].
+
+example: heimdall_tools aws_config_mapper -o aws_config_results_hdf.json
+```
+
 ## version  
 
 Prints out the gem version

data/lib/data/aws-config-mapping.csv

@@ -0,0 +1,107 @@
+AwsConfigRuleName,NIST-ID,Rev
+secretsmanager-scheduled-rotation-success-check,AC-2(1)|AC-2(j),4
+iam-user-group-membership-check,AC-2(1)|AC-2(j)|AC-3|AC-6,4
+iam-password-policy,AC-2(1)|AC-2(f)|AC-2(j)|IA-2|IA-5(1)(a)(d)(e)|IA-5(4),4
+access-keys-rotated,AC-2(1)|AC-2(j),4
+iam-user-unused-credentials-check,AC-2(1)|AC-2(3)|AC-2(f)|AC-3|AC-6,4
+securityhub-enabled,AC-2(1)|AC-2(4)|AC-2(12)(a)|AC-2(g)|AC-17(1)|AU-6(1)(3)|CA-7(a)(b)|SA-10|SI-4(2)|SI-4(4)|SI-4(5)|SI-4(16)|SI-4(a)(b)(c),4
+guardduty-enabled-centralized,AC-2(1)|AC-2(4)|AC-2(12)(a)|AC-2(g)|AC-17(1)|AU-6(1)(3)|CA-7(a)(b)|RA-5|SA-10|SI-4(1)|SI-4(2)|SI-4(4)|SI-4(5)|SI-4(16)|SI-4(a)(b)(c),4
+cloud-trail-cloud-watch-logs-enabled,AC-2(4)|AC-2(g)|AU-2(a)(d)|AU-3|AU-6(1)(3)|AU-7(1)|AU-12(a)(c)|CA-7(a)(b)|SI-4(2)|SI-4(4)|SI-4(5)|SI-4(a)(b)(c),4
+cloudtrail-enabled,AC-2(4)|AC-2(g)|AU-2(a)(d)|AU-3|AU-12(a)(c),4
+multi-region-cloudtrail-enabled,AC-2(4)|AU-2(a)(d)|AU-3|AU-12(a)(c),4
+rds-logging-enabled,AC-2(4)|AC-2(g)|AU-2(a)(d)|AU-3|AU-12(a)(c),4
+cloudwatch-alarm-action-check,AC-2(4)|AU-6(1)(3)|AU-7(1)|CA-7(a)(b)|IR-4(1)|SI-4(2)|SI-4(4)|SI-4(5)|SI-4(a)(b)(c),4
+redshift-cluster-configuration-check,AC-2(4)|AC-2(g)|AU-2(a)(d)|AU-3|AU-12(a)(c)|SC-13|SC-28,4
+iam-root-access-key-check,AC-2(f)|AC-2(j)|AC-3|AC-6|AC-6(10),4
+s3-bucket-logging-enabled,AC-2(g)|AU-2(a)(d)|AU-3|AU-12(a)(c),4
+cloudtrail-s3-dataevents-enabled,AC-2(g)|AU-2(a)(d)|AU-3|AU-12(a)(c),4
+root-account-mfa-enabled,AC-2(j)|IA-2(1)(11),4
+emr-kerberos-enabled,AC-2(j)|AC-3|AC-5(c)|AC-6,4
+iam-group-has-users-check,AC-2(j)|AC-3|AC-5(c)|AC-6|SC-2,4
+iam-policy-no-statements-with-admin-access,AC-2(j)|AC-3|AC-5(c)|AC-6|SC-2,4
+iam-user-no-policies-check,AC-2(j)|AC-3|AC-5(c)|AC-6,4
+s3-bucket-public-write-prohibited,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+lambda-function-public-access-prohibited,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+rds-snapshots-public-prohibited,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+redshift-cluster-public-access-check,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+s3-bucket-policy-grantee-check,AC-3|AC-6|SC-7|SC-7(3),4
+s3-bucket-public-read-prohibited,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+s3-account-level-public-access-blocks,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+dms-replication-not-public,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+ebs-snapshot-public-restorable-check,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+sagemaker-notebook-no-direct-internet-access,AC-3|AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+rds-instance-public-access-check,AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+lambda-inside-vpc,AC-4|SC-7|SC-7(3),4
+ec2-instances-in-vpc,AC-4|SC-7|SC-7(3),4
+restricted-common-ports,AC-4|CM-2|SC-7|SC-7(3),4
+restricted-ssh,AC-4|SC-7|SC-7(3),4
+vpc-default-security-group-closed,AC-4|SC-7|SC-7(3),4
+vpc-sg-open-only-to-authorized-ports,AC-4|SC-7|SC-7(3),4
+acm-certificate-expiration-check,AC-4|AC-17(2)|SC-12,4
+ec2-instance-no-public-ip,AC-4|AC-6|AC-21(b)|SC-7|SC-7(3),4
+elasticsearch-in-vpc-only,AC-4|SC-7|SC-7(3),4
+emr-master-no-public-ip,AC-4|AC-21(b)|SC-7|SC-7(3),4
+internet-gateway-authorized-vpc-only,AC-4|AC-17(3)|SC-7|SC-7(3),4
+codebuild-project-envvar-awscred-check,AC-6|IA-5(7)|SA-3(a),4
+ec2-imdsv2-check,AC-6,4
+iam-no-inline-policy-check,AC-6,4
+alb-http-to-https-redirection-check,AC-17(2)|SC-7|SC-8|SC-8(1)|SC-13|SC-23,4
+redshift-require-tls-ssl,AC-17(2)|SC-7|SC-8|SC-8(1)|SC-13,4
+s3-bucket-ssl-requests-only,AC-17(2)|SC-7|SC-8|SC-8(1)|SC-13,4
+elb-acm-certificate-required,AC-17(2)|SC-7|SC-8|SC-8(1)|SC-13,4
+alb-http-drop-invalid-header-enabled,AC-17(2)|SC-7|SC-8|SC-8(1)|SC-23,4
+elb-tls-https-listeners-only,AC-17(2)|SC-7|SC-8|SC-8(1)|SC-23,4
+api-gw-execution-logging-enabled,AU-2(a)(d)|AU-3|AU-12(a)(c),4
+elb-logging-enabled,AU-2(a)(d)|AU-3|AU-12(a)(c),4
+vpc-flow-logs-enabled,AU-2(a)(d)|AU-3|AU-12(a)(c),4
+wafv2-logging-enabled,AU-2(a)(d)|AU-3|AU-12(a)(c)|SC-7|SI-4(a)(b)(c),4
+cloud-trail-encryption-enabled,AU-9|SC-13|SC-28,4
+cloudwatch-log-group-encrypted,AU-9|SC-13|SC-28,4
+s3-bucket-replication-enabled,AU-9(2)|CP-9(b)|CP-10|SC-5|SC-36,4
+cw-loggroup-retention-period-check,AU-11|SI-12,4
+ec2-instance-detailed-monitoring-enabled,CA-7(a)(b)|SI-4(2)|SI-4(a)(b)(c),4
+rds-enhanced-monitoring-enabled,CA-7(a)(b),4
+ec2-instance-managed-by-systems-manager,CM-2|CM-7(a)|CM-8(1)|CM-8(3)(a)|SA-3(a)|SA-10|SI-2(2)|SI-7(1),4
+ec2-managedinstance-association-compliance-status-check,CM-2|CM-7(a)|CM-8(3)(a)|SI-2(2),4
+ec2-stopped-instance,CM-2,4
+ec2-volume-inuse-check,CM-2|SC-4,4
+elb-deletion-protection-enabled,CM-2|CP-10,4
+cloudtrail-security-trail-enabled,CM-2,4
+ec2-managedinstance-patch-compliance-status-check,CM-8(3)(a)|SI-2(2)|SI-7(1),4
+db-instance-backup-enabled,CP-9(b)|CP-10|SI-12,4
+dynamodb-pitr-enabled,CP-9(b)|CP-10|SI-12,4
+elasticache-redis-cluster-automatic-backup-check,CP-9(b)|CP-10|SI-12,4
+dynamodb-in-backup-plan,CP-9(b)|CP-10|SI-12,4
+ebs-in-backup-plan,CP-9(b)|CP-10|SI-12,4
+efs-in-backup-plan,CP-9(b)|CP-10|SI-12,4
+rds-in-backup-plan,CP-9(b)|CP-10|SI-12,4
+dynamodb-autoscaling-enabled,CP-10|SC-5,4
+rds-multi-az-support,CP-10|SC-5|SC-36,4
+s3-bucket-versioning-enabled,CP-10|SI-12,4
+vpc-vpn-2-tunnels-up,CP-10,4
+elb-cross-zone-load-balancing-enabled,CP-10|SC-5,4
+root-account-hardware-mfa-enabled,IA-2(1)(11),4
+mfa-enabled-for-iam-console-access,IA-2(1)(2)(11),4
+iam-user-mfa-enabled,IA-2(1)(2)(11),4
+guardduty-non-archived-findings,IR-4(1)|IR-6(1)|IR-7(1)|RA-5|SA-10|SI-4(a)(b)(c),4
+codebuild-project-source-repo-url-check,SA-3(a),4
+autoscaling-group-elb-healthcheck-required,SC-5,4
+rds-instance-deletion-protection-enabled,SC-5,4
+alb-waf-enabled,SC-7|SI-4(a)(b)(c),4
+elasticsearch-node-to-node-encryption-check,SC-7|SC-8|SC-8(1),4
+cmk-backing-key-rotation-enabled,SC-12,4
+kms-cmk-not-scheduled-for-deletion,SC-12|SC-28,4
+api-gw-cache-enabled-and-encrypted,SC-13|SC-28,4
+efs-encrypted-check,SC-13|SC-28,4
+elasticsearch-encrypted-at-rest,SC-13|SC-28,4
+encrypted-volumes,SC-13|SC-28,4
+rds-storage-encrypted,SC-13|SC-28,4
+s3-bucket-server-side-encryption-enabled,SC-13|SC-28,4
+sagemaker-endpoint-configuration-kms-key-configured,SC-13|SC-28,4
+sagemaker-notebook-instance-kms-key-configured,SC-13|SC-28,4
+sns-encrypted-kms,SC-13|SC-28,4
+dynamodb-table-encrypted-kms,SC-13,4
+s3-bucket-default-lock-enabled,SC-28,4
+ec2-ebs-encryption-by-default,SC-28,4
+rds-snapshot-encrypted,SC-28,4
+cloud-trail-log-file-validation-enabled,SI-7|SI-7(1),4

data/lib/heimdall_tools.rb

@@ -13,4 +13,6 @@ module HeimdallTools
   autoload :SnykMapper, 'heimdall_tools/snyk_mapper'
   autoload :NiktoMapper, 'heimdall_tools/nikto_mapper'
   autoload :JfrogXrayMapper, 'heimdall_tools/jfrog_xray_mapper'
+  autoload :DBProtectMapper, 'heimdall_tools/dbprotect_mapper'
+  autoload :AwsConfigMapper, 'heimdall_tools/aws_config_mapper'
 end

data/lib/heimdall_tools/aws_config_mapper.rb

@@ -0,0 +1,284 @@
+require 'aws-sdk-configservice'
+require 'heimdall_tools/hdf'
+require 'csv'
+require 'json'
+
+RESOURCE_DIR = Pathname.new(__FILE__).join('../../data')
+
+AWS_CONFIG_MAPPING_FILE = File.join(RESOURCE_DIR, 'aws-config-mapping.csv')
+
+NOT_APPLICABLE_MSG = 'No AWS resources found to evaluate complaince for this rule'.freeze
+INSUFFICIENT_DATA_MSG = 'Not enough data has been collectd to determine compliance yet.'.freeze
+
+##
+# HDF mapper for use with AWS Config rules.
+#
+# Ruby AWS Ruby SDK for ConfigService: 
+# - https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/ConfigService/Client.html
+#
+# rubocop:disable Metrics/AbcSize, Metrics/ClassLength
+module HeimdallTools
+  class AwsConfigMapper
+    def initialize(custom_mapping, verbose = false)
+      @verbose = verbose
+      @default_mapping = get_rule_mapping(AWS_CONFIG_MAPPING_FILE)
+      @custom_mapping = custom_mapping.nil? ? {} : get_rule_mapping(custom_mapping)
+      @client = Aws::ConfigService::Client.new
+      @issues = get_all_config_rules
+    end
+
+    ##
+    # Convert to HDF
+    #
+    # If there is overlap in rule names from @default_mapping and @custom_mapping,
+    # then the tags from both will be added to the rule.
+    def to_hdf
+      controls = @issues.map do |issue|
+        @item = {}
+        @item['id']              = issue[:config_rule_name]
+        @item['title']           = issue[:config_rule_name]
+        @item['desc']            = issue[:description]
+        @item['impact']          = 0.5
+        @item['tags']            = hdf_tags(issue)
+        @item['descriptions']    = hdf_descriptions(issue)
+        @item['refs']            = NA_ARRAY
+        @item['source_location'] = { ref: issue[:config_rule_arn], line: 1 }
+        @item['code']            = ''
+        @item['results']         = issue[:results]
+        # Avoid duplicating rules that exist in the custom mapping as 'unmapped' in this loop
+        if @custom_mapping.include?(issue[:config_rule_name]) && !@default_mapping.include?(issue[:config_rule_name])
+          nil
+        else
+          @item
+        end
+      end
+      results = HeimdallDataFormat.new(
+        profile_name: 'AWS Config',
+         title: 'AWS Config',
+         summary: 'AWS Config',
+         controls: controls,
+         statistics: { aws_config_sdk_version: Aws::ConfigService::GEM_VERSION }
+        )
+      results.to_hdf
+    end
+
+    private
+
+    ##
+    # Read in a config rule -> 800-53 control mapping CSV.
+    #
+    # Params: 
+    # - path: The file path to the CSV file
+    #
+    # Returns: A mapped version of the csv in the format { rule_name: row, ... }
+    def get_rule_mapping(path)
+      Hash[CSV.read(path, headers: true).map { |row| [row[0], row] }]
+    end
+
+    ##
+    # Fetches information on all of the config rules available to the
+    # AWS account.
+    #
+    # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/ConfigService/Client.html#describe_config_rules-instance_method
+    #
+    # Returns: list of hash for all config rules available
+    def get_all_config_rules
+      config_rules = []
+
+      # Fetch all rules with pagination
+      response = @client.describe_config_rules
+      config_rules += response.config_rules
+      while response.next_token
+        response = @client.describe_config_rules(next_token: response.next_token)
+        config_rules += response.config_rules
+      end
+      config_rules = config_rules.map(&:to_h)
+
+      # Add necessary data to rules using helpers
+      add_compliance_to_config_rules(config_rules)
+      add_results_to_config_rules(config_rules)
+    end
+
+    ##
+    # Adds compliance information for config rules to the config rule hash
+    # from AwsConfigMapper::get_all_config_rules.
+    #
+    # `complaince_type` may be any of the following:
+    # ["COMPLIANT", "NON_COMPLIANT", "NOT_APPLICABLE", "INSUFFICIENT_DATA"]
+    #
+    # Params:
+    # - config_rules: The list of hash from AwsConfigMapper::get_all_config_rules
+    #
+    # Returns: The same config_rules array with `compliance` key added to each rule
+    def add_compliance_to_config_rules(config_rules)
+      mapped_compliance_results = fetch_all_compliance_info(config_rules)
+
+      # Add compliance to config_rules
+      config_rules.each do |rule|
+        rule[:compliance] = mapped_compliance_results[rule[:config_rule_name]]&.dig(:compliance, :compliance_type)
+      end
+
+      config_rules
+    end
+
+    ##
+    # Fetch and combine all compliance information for the config rules.
+    #
+    # AWS allows passing up to 25 rules at a time to this endpoint.
+    #
+    # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/ConfigService/Client.html#describe_compliance_by_config_rule-instance_method
+    #
+    # Params:
+    # - config_rules: The list of hash from AwsConfigMapper::get_all_config_rules
+    #
+    # Returns: Results mapped by config rule in the format { name: {<response>}, ... }
+    def fetch_all_compliance_info(config_rules)
+      compliance_results = []
+
+      config_rules.each_slice(25).each do |slice|
+        config_rule_names = slice.map { |r| r[:config_rule_name] }
+        response = @client.describe_compliance_by_config_rule(config_rule_names: config_rule_names)
+        compliance_results += response.compliance_by_config_rules
+      end
+
+      # Map based on name for easy lookup
+      Hash[compliance_results.collect { |r| [r.config_rule_name, r.to_h] }]
+    end
+
+    ##
+    # Takes in config rules and formats the results for hdf format.
+    #
+    # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/ConfigService/Client.html#get_compliance_details_by_config_rule-instance_method
+    #
+    # Example hdf results:
+    # [
+    #   {
+    #     "code_desc": "This rule...",
+    #     "run_time": 0.314016,
+    #     "start_time": "2018-11-18T20:21:40-05:00",
+    #     "status": "passed"
+    #   },
+    #   ...
+    # ]
+    #
+    # Status may be any of the following: ['passed', 'failed', 'skipped', 'loaded']
+    #
+    # Params:
+    # - rule: Rules from AwsConfigMapper::get_all_config_rules
+    #
+    # Returns: The same config_rules array with `results` key added to each rule.
+    def add_results_to_config_rules(config_rules)
+      config_rules.each do |rule|
+        response = @client.get_compliance_details_by_config_rule(config_rule_name: rule[:config_rule_name], limit: 100)
+        rule_results = response.to_h[:evaluation_results]
+        while response.next_token
+          response = @client.get_compliance_details_by_config_rule(next_token: response.next_token, limit: 100)
+          rule_results += response.to_h[:evaluation_results]
+        end
+
+        rule[:results] = []
+        rule_results.each do |result|
+          hdf_result = {}
+          # code_desc
+          hdf_result['code_desc'] = result.dig(:evaluation_result_identifier, :evaluation_result_qualifier)&.map do |k, v|
+                                      "#{k}: #{v}"
+                                    end&.join(', ')
+          # start_time
+          hdf_result['start_time'] = if result.key?(:config_rule_invoked_time)
+                                       DateTime.parse(result[:config_rule_invoked_time].to_s).strftime('%Y-%m-%dT%H:%M:%S%:z')
+                                     end
+          # run_time
+          hdf_result['run_time'] = if result.key?(:result_recorded_time) && result.key?(:config_rule_invoked_time)
+                                     (result[:result_recorded_time] - result[:config_rule_invoked_time]).round(6)
+                                   end
+          # status
+          hdf_result['status'] = case result.dig(:compliance_type)
+                                 when 'COMPLIANT'
+                                   'passed'
+                                 when 'NON_COMPLIANT'
+                                   'failed'
+                                 else
+                                   'skipped'
+                                 end
+          hdf_result['message'] = "(#{hdf_result['code_desc']}): #{result[:annotation] || 'Rule does not pass rule compliance'}" if hdf_result['status'] == 'failed'
+          rule[:results] << hdf_result
+        end
+        next unless rule[:results].empty?
+
+        case rule[:compliance]
+        when 'NOT_APPLICABLE'
+          rule[:impact] = 0
+          rule[:results] << {
+            'run_time': 0,
+            'code_desc': NOT_APPLICABLE_MSG,
+            'skip_message': NOT_APPLICABLE_MSG,
+            'start_time': DateTime.now.strftime('%Y-%m-%dT%H:%M:%S%:z'),
+            'status': 'skipped'
+          }
+        when 'INSUFFICIENT_DATA'
+          rule[:results] << {
+            'run_time': 0,
+            'code_desc': INSUFFICIENT_DATA_MSG,
+            'skip_message': INSUFFICIENT_DATA_MSG,
+            'start_time': DateTime.now.strftime('%Y-%m-%dT%H:%M:%S%:z'),
+            'status': 'skipped'
+          }
+        end
+      end
+
+      config_rules
+    end
+
+    ##
+    # Takes in a config rule and pulls out tags that are useful for HDF.
+    #
+    # Params:
+    # - config_rule: A single config rule from AwsConfigMapper::get_all_config_rules
+    #
+    # Returns: Hash containing all relevant HDF tags
+    def hdf_tags(config_rule)
+      result = {}
+
+      @default_mapping
+      @custom_mapping
+
+      # NIST tag
+      result['nist'] = []
+      default_mapping_match = @default_mapping[config_rule[:config_rule_name]]
+      
+      result['nist'] += default_mapping_match[1].split('|') unless default_mapping_match.nil?
+
+      custom_mapping_match = @custom_mapping[config_rule[:config_rule_name]]
+      
+      result['nist'] += custom_mapping_match[1].split('|').map { |name| "#{name} (user provided)" } unless custom_mapping_match.nil?
+
+      result['nist'] = ['unmapped'] if result['nist'].empty?
+
+      result
+    end
+
+    def check_text(config_rule)
+      params = (JSON.parse(config_rule[:input_parameters]).map { |key, value| "#{key}: #{value}" }).join('<br/>')
+      check_text = config_rule[:config_rule_arn]
+      check_text += "<br/>#{params}" unless params.empty?
+      check_text
+    end
+
+    ##
+    # Takes in a config rule and pulls out information for the descriptions array
+    #
+    # Params:
+    # - config_rule: A single config rule from AwsConfigMapper::get_all_config_rules
+    #
+    # Returns: Array containing all relevant descriptions information
+    def hdf_descriptions(config_rule)
+      [
+        {
+          'label': 'check',
+          'data': check_text(config_rule)
+        }
+      ]
+    end
+  end
+end
+# rubocop:enable Metrics/AbcSize, Metrics/ClassLength

data/lib/heimdall_tools/burpsuite_mapper.rb

@@ -63,7 +63,7 @@ module HeimdallTools
     end
 
     def nist_tag(cweid)
-      entries = @cwe_nist_mapping.select { |x| cweid.include? x[:cweid].to_s }
+      entries = @cwe_nist_mapping.select { |x| cweid.include?(x[:cweid].to_s) && !x[:nistid].nil? }
       tags = entries.map { |x| [x[:nistid], "Rev_#{x[:rev]}"] }
       tags.empty? ? DEFAULT_NIST_TAG : tags.flatten.uniq
     end

data/lib/heimdall_tools/cli.rb

@@ -98,6 +98,30 @@ module HeimdallTools
       puts "\r\HDF Generated:\n"
       puts "#{options[:output]}"
     end
+    
+    desc 'dbprotect_mapper', 'dbprotect_mapper translates dbprotect results xml to HDF format Json be viewed on Heimdall'
+    long_desc Help.text(:dbprotect_mapper)
+    option :xml, required: true, aliases: '-x'
+    option :output, required: true, aliases: '-o'
+    option :verbose, type: :boolean, aliases: '-V'
+    def dbprotect_mapper
+      hdf = HeimdallTools::DBProtectMapper.new(File.read(options[:xml])).to_hdf
+      File.write(options[:output], hdf)
+      puts "\r\HDF Generated:\n"
+      puts "#{options[:output]}"
+    end
+
+    desc 'aws_config_mapper', 'aws_config_mapper pulls Ruby AWS SDK data to translate AWS Config Rule results into HDF format Json to be viewable in Heimdall'
+    long_desc Help.text(:aws_config_mapper)
+    # option :custom_mapping, required: false, aliases: '-m'
+    option :output, required: true, aliases: '-o'
+    option :verbose, type: :boolean, aliases: '-V'
+    def aws_config_mapper
+      hdf = HeimdallTools::AwsConfigMapper.new(options[:custom_mapping]).to_hdf
+      File.write(options[:output], hdf)
+      puts "\r\HDF Generated:\n"
+      puts "#{options[:output]}"
+    end
 
     desc 'version', 'prints version'
     def version

data/lib/heimdall_tools/dbprotect_mapper.rb

@@ -0,0 +1,127 @@
+require 'json'
+require 'csv'
+require 'heimdall_tools/hdf'
+require 'utilities/xml_to_hash'
+
+IMPACT_MAPPING = {
+  High: 0.7,
+  Medium: 0.5,
+  Low: 0.3,
+  Informational: 0.0
+}.freeze
+
+# rubocop:disable Metrics/AbcSize
+
+module HeimdallTools
+  class DBProtectMapper
+    def initialize(xml, name=nil, verbose = false)
+      @verbose = verbose
+
+      begin
+        dataset = xml_to_hash(xml)
+        @entries = compile_findings(dataset['dataset'])
+
+      rescue StandardError => e
+        raise "Invalid DBProtect XML file provided Exception: #{e};\nNote that XML must be of kind `Check Results Details`."
+      end
+
+    end
+
+    def to_hdf
+      controls = []
+      @entries.each do |entry|
+        @item = {}
+        @item['id']                 = entry['Check ID']
+        @item['title']              = entry['Check']
+        @item['desc']               = format_desc(entry)
+        @item['impact']             = impact(entry['Risk DV'])
+        @item['tags']               = {}
+        @item['descriptions']       = []
+        @item['refs']               = NA_ARRAY
+        @item['source_location']    = NA_HASH
+        @item['code']               = ''
+        @item['results']            = finding(entry)
+
+        controls << @item
+      end
+      controls = collapse_duplicates(controls)
+      results = HeimdallDataFormat.new(profile_name: @entries.first['Policy'],
+                                       version: "",
+                                       title: @entries.first['Job Name'],
+                                       summary: format_summary(@entries.first),
+                                       controls: controls)
+      results.to_hdf
+    end
+
+    private
+
+    def compile_findings(dataset)
+      keys = dataset['metadata']['item'].map{ |e| e['name']}
+      findings = dataset['data']['row'].map { |e| Hash[keys.zip(e['value'])] }
+      findings
+    end
+
+    def format_desc(entry)
+      text = []
+      text << "Task : #{entry['Task']}"
+      text << "Check Category : #{entry['Check Category']}"
+      text.join("; ")
+    end
+
+    def format_summary(entry)
+      text = []
+      text << "Organization : #{entry['Organization']}"
+      text << "Asset : #{entry['Check Asset']}"
+      text << "Asset Type : #{entry['Asset Type']}"
+      text << "IP Address, Port, Instance : #{entry['Asset Type']}"
+      text << "IP Address, Port, Instance : #{entry['IP Address, Port, Instance']}"
+      text.join("\n")
+    end
+
+    def finding(entry)
+      finding = {}
+
+      finding['code_desc'] = entry['Details']
+      finding['run_time'] = 0.0
+      finding['start_time'] = entry['Date']
+
+      case entry['Result Status']
+      when 'Fact'
+        finding['status'] = 'skipped'
+      when 'Failed'
+        finding['status'] = 'failed'
+        finding['backtrace'] = ["DB Protect Failed Check"]
+      when 'Finding'
+        finding['status'] = 'failed'
+      when 'Not A Finding'
+        finding['status'] = 'passed'
+      when 'Skipped'
+        finding['status'] = 'skipped'
+      else 
+        finding['status'] = 'skipped'
+      end
+      [finding]
+    end
+
+    def impact(severity)
+      IMPACT_MAPPING[severity.to_sym]
+    end
+
+    # DBProtect report could have multiple issue entries for multiple findings of same issue type.
+    # The meta data is identical across entries 
+    # method collapse_duplicates return unique controls with applicable findings collapsed into it.
+    def collapse_duplicates(controls)
+      unique_controls = []
+
+      controls.map { |x| x['id'] }.uniq.each do |id|
+        collapsed_results = controls.select { |x| x['id'].eql?(id) }.map {|x| x['results']}
+        unique_control = controls.find { |x| x['id'].eql?(id) }
+        unique_control['results'] = collapsed_results.flatten
+        unique_controls << unique_control
+      end
+      unique_controls
+    end
+
+
+  end
+end

data/lib/heimdall_tools/hdf.rb

@@ -29,7 +29,8 @@ module HeimdallTools
                    groups: NA_ARRAY,
                    status: 'loaded',
                    controls: NA_TAG,
-                   target_id: NA_TAG)
+                   target_id: NA_TAG,
+                   statistics: NA_HASH)
 
       @results_json = {}
       @results_json['platform'] = {}
@@ -40,6 +41,7 @@ module HeimdallTools
 
       @results_json['statistics'] = {}
       @results_json['statistics']['duration'] = duration || NA_TAG
+      @results_json['statistics'].merge! statistics
 
       @results_json['profiles'] = []
 

data/lib/heimdall_tools/help/aws_config_mapper.md

@@ -0,0 +1,30 @@
+  aws_config_mapper pulls Ruby AWS SDK data to translate AWS Config Rule results into HDF format json to be viewable in Heimdall
+
+AWS Config Rule Mapping:
+  The mapping of AWS Config Rules to 800-53 Controls was sourced from [this link](https://docs.aws.amazon.com/config/latest/developerguide/operational-best-practices-for-nist-800-53_rev_4.html).
+  
+Authentication with AWS:
+  [Developer Guide for configuring Ruby AWS SDK for authentication](https://docs.aws.amazon.com/sdk-for-ruby/v3/developer-guide/setup-config.html)
+
+  Authentication Example:
+  
+  - Create `~/.aws/credentials`
+  - Add contents to file, replacing with your access ID and key 
+
+        ```
+        [default]
+        aws_access_key_id = your_access_key_id
+        aws_secret_access_key = your_secret_access_key
+        ```
+
+  - (optional) set AWS region through `~/.aws/config` file with contents
+
+        ```
+        [default]
+        output = json
+        region = us-gov-west-1
+        ```
+
+Examples:
+
+  heimdall_tools aws_config_mapper -o aws_config_results.json

data/lib/heimdall_tools/help/dbprotect_mapper.md

@@ -0,0 +1,5 @@
+  dbprotect_mapper translates DBProtect report in `Check Results Details` format XML to HDF format JSON be viewed on Heimdall.
+  
+Examples:
+
+  heimdall_tools dbprotect_mapper -x check_results_details_report.xml -o db_protect_hdf.json

data/lib/heimdall_tools/jfrog_xray_mapper.rb

@@ -58,7 +58,7 @@ module HeimdallTools
     end
 
     def nist_tag(cweid)
-      entries = @cwe_nist_mapping.select { |x| cweid.include? x[:cweid].to_s }
+      entries = @cwe_nist_mapping.select { |x| cweid.include?(x[:cweid].to_s) && !x[:nistid].nil? }
       tags = entries.map { |x| x[:nistid] }
       tags.empty? ? DEFAULT_NIST_TAG : tags.flatten.uniq
     end

data/lib/heimdall_tools/nessus_mapper.rb

@@ -140,7 +140,7 @@ module HeimdallTools
     end
 
     def plugin_nist_tag(pluginfamily, pluginid)
-      entries = @cwe_nist_mapping.select { |x| (x[:pluginfamily].eql?(pluginfamily) && (x[:pluginid].eql?('*') || x[:pluginid].eql?(pluginid.to_i)) ) }
+      entries = @cwe_nist_mapping.select { |x| (x[:pluginfamily].eql?(pluginfamily) && (x[:pluginid].eql?('*') || x[:pluginid].eql?(pluginid.to_i)) ) && !x[:nistid].nil? }
       tags = entries.map { |x| [x[:nistid].split('|'), "Rev_#{x[:rev]}"] }
       tags.empty? ? DEFAULT_NIST_TAG : tags.flatten.uniq
     end

data/lib/heimdall_tools/nikto_mapper.rb

@@ -71,7 +71,7 @@ module HeimdallTools
     end
 
     def nist_tag(niktoid)
-      entries = @nikto_nist_mapping.select { |x| niktoid.eql?(x[:niktoid].to_s) }
+      entries = @nikto_nist_mapping.select { |x| niktoid.eql?(x[:niktoid].to_s) && !x[:nistid].nil? }
       tags = entries.map { |x| x[:nistid] }
       tags.empty? ? DEFAULT_NIST_TAG : tags.flatten.uniq
     end

data/lib/heimdall_tools/snyk_mapper.rb

@@ -74,7 +74,7 @@ module HeimdallTools
     end
 
     def nist_tag(cweid)
-      entries = @cwe_nist_mapping.select { |x| cweid.include? x[:cweid].to_s }
+      entries = @cwe_nist_mapping.select { |x| cweid.include?(x[:cweid].to_s) && !x[:nistid].nil? }
       tags = entries.map { |x| x[:nistid] }
       tags.empty? ? DEFAULT_NIST_TAG : tags.flatten.uniq
     end

data/lib/heimdall_tools/zap_mapper.rb

@@ -65,7 +65,7 @@ module HeimdallTools
     end
 
     def nist_tag(cweid)
-      entries = @cwe_nist_mapping.select { |x| x[:cweid].to_s.eql?(cweid.to_s) }
+      entries = @cwe_nist_mapping.select { |x| x[:cweid].to_s.eql?(cweid.to_s) && !x[:nistid].nil? }
       tags = entries.map { |x| [x[:nistid], "Rev_#{x[:rev]}"] }
       tags.empty? ? DEFAULT_NIST_TAG : tags.flatten.uniq
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: heimdall_tools
 version: !ruby/object:Gem::Version
-  version: 1.3.35
+  version: 1.3.39
 platform: ruby
 authors:
 - Robert Thew
@@ -10,8 +10,22 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-02-17 00:00:00.000000000 Z
+date: 2021-03-11 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-configservice
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -181,18 +195,23 @@ files:
 - Rakefile
 - exe/heimdall_tools
 - lib/data/U_CCI_List.xml
+- lib/data/aws-config-mapping.csv
 - lib/data/cwe-nist-mapping.csv
 - lib/data/nessus-plugins-nist-mapping.csv
 - lib/data/nikto-nist-mapping.csv
 - lib/data/owasp-nist-mapping.csv
 - lib/heimdall_tools.rb
+- lib/heimdall_tools/aws_config_mapper.rb
 - lib/heimdall_tools/burpsuite_mapper.rb
 - lib/heimdall_tools/cli.rb
 - lib/heimdall_tools/command.rb
+- lib/heimdall_tools/dbprotect_mapper.rb
 - lib/heimdall_tools/fortify_mapper.rb
 - lib/heimdall_tools/hdf.rb
 - lib/heimdall_tools/help.rb
+- lib/heimdall_tools/help/aws_config_mapper.md
 - lib/heimdall_tools/help/burpsuite_mapper.md
+- lib/heimdall_tools/help/dbprotect_mapper.md
 - lib/heimdall_tools/help/fortify_mapper.md
 - lib/heimdall_tools/help/jfrog_xray_mapper.md
 - lib/heimdall_tools/help/nessus_mapper.md