nexpose_servicenow 0.7.3 → 0.8.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +51 -15
- data/bin/nexpose_servicenow +10 -2
- data/lib/nexpose_servicenow.rb +1 -174
- data/lib/nexpose_servicenow/version.rb +14 -1
- data/nexpose_servicenow.gemspec +2 -4
- metadata +13 -59
- data/lib/nexpose_servicenow/arg_parser.rb +0 -283
- data/lib/nexpose_servicenow/chunker.rb +0 -109
- data/lib/nexpose_servicenow/csv_compare.rb +0 -177
- data/lib/nexpose_servicenow/helpers/connection_helper.rb +0 -84
- data/lib/nexpose_servicenow/helpers/data_warehouse_helper.rb +0 -140
- data/lib/nexpose_servicenow/helpers/nexpose_console_helper.rb +0 -164
- data/lib/nexpose_servicenow/historical_data.rb +0 -102
- data/lib/nexpose_servicenow/nx_logger.rb +0 -166
- data/lib/nexpose_servicenow/queries/nexpose_queries.rb +0 -459
- data/lib/nexpose_servicenow/queries/queries_base.rb +0 -25
- data/lib/nexpose_servicenow/queries/warehouse_queries.rb +0 -341
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: 5e967c074f8c4c535e640903dc77ec5f6c2dd2ed
|
4
|
+
data.tar.gz: c5b213e5bb831222296562b95e7ad20faf7015fc
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 103bf5074a22896ce2af1d2e831ab0e6a6049f4351e29ae98855eb426c66596d6e2d5cdcba84054b14a9383134cc28a395f04106977722c2b60ebe4a03f277ec
|
7
|
+
data.tar.gz: fe10749154c31b158e2081a9c177dcfcf778973d7b8b47fa8adb6e2a52c50fde07e08b1ae01836b8a3d7e9a82f158284c511ca1c14df0e6f386aaae3fd268672
|
data/README.md
CHANGED
@@ -1,26 +1,62 @@
|
|
1
|
-
#
|
1
|
+
# ServiceNow Ruby Gem End-of-Life Announcement
|
2
2
|
|
3
|
-
|
4
|
-
The gem may installed via the following command from the RubyGems repository:
|
3
|
+
As of June 4, 2019, Rapid7 will start the End of Life (EOL) process for the legacy ServiceNow Ruby Gem integration for InsightVM and Nexpose. The ServiceNow Ruby Gem will no longer be publicly available for download on the [rubygems.org](https://rubygems.org/) page. This EOL announcement does not affect the in-product InsightVM integration, [ServiceNow IT Service Management (ITSM)](https://insightvm.help.rapid7.com/docs/servicenow), or the recently released [ServiceNow app](https://store.servicenow.com/sn_appstore_store.do#!/store/application/8a2aa078e7330300809a268b03f6a988/7.1.0) that leverages the ServiceNow VRM (Vulnerability Response Module) product, a component of ServiceNow Security Operations (SecOps).
|
5
4
|
|
6
|
-
|
5
|
+
This EOL announcement only pertains to future deployments or feature requests related to ServiceNow Ruby Gem.
|
7
6
|
|
8
|
-
|
9
|
-
The gem is called by the ServiceNow console when a vulnerability integration executes.
|
7
|
+
Customers that currently have the Ruby Gem integration will not see changes in functionality, but Rapid7 encourages migration to one of the solutions listed below:
|
10
8
|
|
11
|
-
|
12
|
-
|
9
|
+
* ServiceNow ITSM Integration
|
10
|
+
* Service Now SecOps Integration
|
13
11
|
|
12
|
+
## ServiceNow ITSM Integration
|
13
|
+
Streamline your InsightVM vulnerability remediation workflow with the ServiceNow ITSM integration by tracking remediation progress in real-time.
|
14
14
|
|
15
|
-
|
16
|
-
|
17
|
-
[Rapid7 Support Portal](https://rapid7support.force.com/customers/login)
|
15
|
+
### ServiceNow ITSM Integration Benefits
|
16
|
+
The ServiceNow ITSM integration provides the following InsightVM benefits:
|
18
17
|
|
19
|
-
|
18
|
+
* **Rule Intelligence** - Create targeted and precise tickets automatically with assignment rules that you can reuse across Remediation Projects in InsightVM.
|
19
|
+
* **Contextual Information** - Customize ticketing templates to include as much security detail as needed.
|
20
|
+
* **Central Tracking** - Manage and track your remediation projects in a central location through the Remediation Projects page.
|
20
21
|
|
21
|
-
|
22
|
+
### ServiceNow ITSM Integration Overview
|
23
|
+
The ServiceNow ITSM integration provides automated ticketing for Remediation Projects. See our help documentation for instruction to [enable automated ticketing](https://insightvm.help.rapid7.com/docs/ticketing-integration-for-remediation-workflow-projects#section-enabling-automated-ticketing-for-remediation-projects).
|
22
24
|
|
23
|
-
|
25
|
+
You can also integrate ServiceNow ITSM with InsightVM. See our help documentation for [integration instructions](https://insightvm.help.rapid7.com/docs/servicenow).
|
24
26
|
|
25
|
-
|
27
|
+
If you run into any issues or have questions, reach out to [Rapid7 Support](https://www.rapid7.com/for-customers/).
|
26
28
|
|
29
|
+
## ServiceNow SecOps Integration
|
30
|
+
This cloud-to-cloud integration pulls data from InsightVM and helps you automatically identify remediation priorities by determining the impact of vulnerabilities.
|
31
|
+
|
32
|
+
### ServiceNow SecOps Integration Benefits
|
33
|
+
* **Data Import** - Execute scheduled jobs to import vulnerability, vulnerable items, and solution and site data automatically.
|
34
|
+
* **Lookup Rules** - Search for configuration items (CIs) in the Configuration Management Database (CMDB) with matching information from the Rapid7 Vulnerability iIntegration.
|
35
|
+
* **Efficient Remediation** - Map vulnerabilities to CIs and business services and display them in a dashboard to facilitate efficient remediation.
|
36
|
+
|
37
|
+
### ServiceNow SecOps Integration Overview
|
38
|
+
To take advantage of the ServiceNow SecOps integration:
|
39
|
+
|
40
|
+
1. Go to the ServiceNow store listing.
|
41
|
+
2. Click the Get button on the top right. After logging into ServiceNow, follow the steps accordingly.
|
42
|
+
|
43
|
+
If you run into any issues or have questions, reach out to ServiceNow Support.
|
44
|
+
|
45
|
+
Schedule of Events
|
46
|
+
Date | Event
|
47
|
+
--------------|------------
|
48
|
+
June 4, 2019 | Rapid7 announces that the ServiceNow Ruby Gem will no longer be available for download on rubygems.org
|
49
|
+
June 4, 2020 | Rapid7 will no longer support the ServiceNow Ruby Gem.
|
50
|
+
|
51
|
+
|
52
|
+
## Frequently Asked Questions
|
53
|
+
If you have additional questions not listed here, reach out to your Customer Success Manager or [Rapid7 Support](https://www.rapid7.com/for-customers/).
|
54
|
+
|
55
|
+
### If I use the legacy Ruby Gem integration now, how will this impact me?
|
56
|
+
Any customers currently utilizing this legacy Ruby Gem will not experience an interruption in service for 12 months from the date of this announcement. You can contact your Customer Success Manager for options after the last date of support.
|
57
|
+
|
58
|
+
### How do I get ServiceNow?
|
59
|
+
ServiceNow is a third party product that integrates with InsightVM. New or existing InsightVM customers can purchase an account through ServiceNow.
|
60
|
+
|
61
|
+
### Who can I contact if I have more questions that are not addressed in this announcement?
|
62
|
+
Contact your Customer Success Representative or [contact Rapid7 Support](https://www.rapid7.com/for-customers/). If your questions pertain to setting up the ServiceNow supported integration option, reach out directly to [ServiceNow](https://www.servicenow.com/support/contact-support.html).
|
data/bin/nexpose_servicenow
CHANGED
@@ -1,4 +1,12 @@
|
|
1
1
|
#!/usr/bin/env ruby
|
2
|
-
require 'nexpose_servicenow'
|
3
2
|
|
4
|
-
|
3
|
+
###################
|
4
|
+
#
|
5
|
+
# STOP. THIS GEM HAS BEEN DEPRECATED. NO CHANGES SHOULD BE MADE TO THIS CODE ANYMORE.
|
6
|
+
#
|
7
|
+
###################
|
8
|
+
|
9
|
+
require 'nexpose_servicenow/version'
|
10
|
+
|
11
|
+
puts NexposeServiceNow::DEPRECATION_NOTICE
|
12
|
+
raise RuntimeError
|
data/lib/nexpose_servicenow.rb
CHANGED
@@ -1,177 +1,4 @@
|
|
1
|
-
require 'csv'
|
2
|
-
require 'optparse'
|
3
|
-
require 'nexpose'
|
4
|
-
require 'uri'
|
5
|
-
require_relative './nexpose_servicenow/helpers/connection_helper'
|
6
|
-
require_relative './nexpose_servicenow/helpers/nexpose_console_helper'
|
7
|
-
require_relative './nexpose_servicenow/helpers/data_warehouse_helper'
|
8
|
-
require 'nexpose_servicenow/arg_parser'
|
9
|
-
require 'nexpose_servicenow/chunker'
|
10
|
-
require 'nexpose_servicenow/nx_logger'
|
11
|
-
require 'nexpose_servicenow/historical_data'
|
12
1
|
require 'nexpose_servicenow/version'
|
13
2
|
|
14
3
|
module NexposeServiceNow
|
15
|
-
|
16
|
-
def self.start(args)
|
17
|
-
options = ArgParser.parse(args)
|
18
|
-
|
19
|
-
@log = setup_logging(options)
|
20
|
-
|
21
|
-
censored_options = options.dup
|
22
|
-
censored_options[:username] = '*****'
|
23
|
-
censored_options[:password] = '*****'
|
24
|
-
@log.log_message("Options: #{censored_options}")
|
25
|
-
|
26
|
-
query = options[:query]
|
27
|
-
site_ids = options[:nexpose_ids]
|
28
|
-
|
29
|
-
# Filter out irrelevant sites
|
30
|
-
if query == :vulnerable_old_items
|
31
|
-
site_ids = get_historical_data(options).filter_ids(site_ids)
|
32
|
-
if site_ids.count == 0
|
33
|
-
puts 'No sites remaining for vulnerable old items query. Exiting.'
|
34
|
-
exit 0
|
35
|
-
end
|
36
|
-
end
|
37
|
-
|
38
|
-
report_details = ConnectionHelper.get_report_names(query, site_ids)
|
39
|
-
|
40
|
-
report_details.each do |r|
|
41
|
-
r[:report_name] = ConnectionHelper.get_filepath(r[:report_name],
|
42
|
-
options[:output_dir])
|
43
|
-
end
|
44
|
-
|
45
|
-
report_results = create_report(report_details, options)
|
46
|
-
|
47
|
-
# If data was returned, we can short circuit here
|
48
|
-
if !report_results.nil? and options[:mode] == 'chunk_info'
|
49
|
-
puts report_results
|
50
|
-
exit 0
|
51
|
-
end
|
52
|
-
|
53
|
-
@log.log_message("Initialising #{options[:mode]} mode")
|
54
|
-
self.send("#{options[:mode]}_mode", report_details, options)
|
55
|
-
end
|
56
|
-
|
57
|
-
def self.get_historical_data(options)
|
58
|
-
HistoricalData.new(options[:output_dir])
|
59
|
-
end
|
60
|
-
|
61
|
-
def self.get_helper(options)
|
62
|
-
name = options[:conn_type].to_s.split('_').map(&:capitalize).join('')
|
63
|
-
|
64
|
-
helper = eval("#{name}Helper")
|
65
|
-
helper.new(options[:url],
|
66
|
-
options[:port],
|
67
|
-
options[:username],
|
68
|
-
options[:password],
|
69
|
-
options[:database_name])
|
70
|
-
end
|
71
|
-
|
72
|
-
def self.setup_logging(options)
|
73
|
-
log = NexposeServiceNow::NxLogger.instance
|
74
|
-
log.setup_statistics_collection(NexposeServiceNow::VENDOR,
|
75
|
-
NexposeServiceNow::PRODUCT,
|
76
|
-
NexposeServiceNow::VERSION)
|
77
|
-
log.setup_logging(true,
|
78
|
-
options[:log_level] || 'info',
|
79
|
-
false)
|
80
|
-
log
|
81
|
-
end
|
82
|
-
|
83
|
-
# Create a report if explicitly required or else an existing
|
84
|
-
# report file isn't found
|
85
|
-
def self.create_report(report_details, options)
|
86
|
-
if %w(update_ remove_).any? { |m| options[:mode].start_with? m} or
|
87
|
-
(options[:mode] == 'latest_scans' && options[:id_type] != :site)
|
88
|
-
return
|
89
|
-
end
|
90
|
-
|
91
|
-
# Perform all queries if a file is missing, regardless of other settings
|
92
|
-
unless options[:gen_report]
|
93
|
-
return if report_details.all? { |f| File.exists? f[:report_name] }
|
94
|
-
end
|
95
|
-
|
96
|
-
credentials = %i{username password}
|
97
|
-
if credentials.any? { |cred| options[cred].to_s == '' }
|
98
|
-
@log.log_error_message 'Nexpose credentials necessary but not supplied.'
|
99
|
-
exit -1
|
100
|
-
end
|
101
|
-
|
102
|
-
# Filter it down to sites which actively need queried
|
103
|
-
sites_to_scan = options[:nexpose_ids].keys
|
104
|
-
|
105
|
-
query_options = { delta_values: options[:nexpose_ids] }
|
106
|
-
query_options[:vuln_query_date] = options[:vuln_query_date]
|
107
|
-
query_options[:filters] = options[:filters]
|
108
|
-
query_options[:page_size] = options[:row_limit]
|
109
|
-
query_options[:row_limit] = options[:row_limit]
|
110
|
-
query_options[:cvss_v3] = options[:cvss_v3]
|
111
|
-
|
112
|
-
report_helper = get_helper(options)
|
113
|
-
@log.log_message("Querying using the #{report_helper.class}.")
|
114
|
-
report_helper.generate_report(options[:query],
|
115
|
-
sites_to_scan,
|
116
|
-
options[:id_type],
|
117
|
-
options[:output_dir],
|
118
|
-
query_options)
|
119
|
-
end
|
120
|
-
|
121
|
-
# Print the chunk info
|
122
|
-
def self.chunk_info_mode(report_details, options)
|
123
|
-
site_ids = options[:nexpose_ids].keys
|
124
|
-
|
125
|
-
# Assign -1 to reports without site IDs
|
126
|
-
report_details = report_details.select do |d|
|
127
|
-
d[:id] == -1 or site_ids.include? d[:id]
|
128
|
-
end
|
129
|
-
|
130
|
-
chunker = Chunker.new(report_details, options[:row_limit])
|
131
|
-
|
132
|
-
puts chunker.preprocess
|
133
|
-
end
|
134
|
-
|
135
|
-
# Prints a chunk of CSV to the console
|
136
|
-
def self.get_chunk_mode(report_details, options)
|
137
|
-
#Get the byte offset and length
|
138
|
-
chunker = Chunker.new(report_details, options[:row_limit])
|
139
|
-
|
140
|
-
puts chunker.read_chunk(options[:chunk_start],
|
141
|
-
options[:chunk_length],
|
142
|
-
options[:nexpose_ids].keys.first)
|
143
|
-
end
|
144
|
-
|
145
|
-
def self.latest_scans_mode(report_details, options)
|
146
|
-
historical_data = get_historical_data(options)
|
147
|
-
puts historical_data.filter_report options[:nexpose_ids].keys
|
148
|
-
end
|
149
|
-
|
150
|
-
def self.remove_last_scan_mode(report_details, options)
|
151
|
-
historical_data = get_historical_data(options)
|
152
|
-
historical_data.remove_last_scan_data
|
153
|
-
end
|
154
|
-
|
155
|
-
def self.update_last_scan_mode(report_details, options)
|
156
|
-
historical_data = get_historical_data(options)
|
157
|
-
historical_data.set_last_scan(options[:nexpose_ids].first,
|
158
|
-
options[:last_scan_data])
|
159
|
-
end
|
160
|
-
|
161
|
-
def self.remove_last_vuln_mode(report_details, options)
|
162
|
-
historical_data = get_historical_data(options)
|
163
|
-
historical_data.remove_last_vuln_data
|
164
|
-
end
|
165
|
-
|
166
|
-
def self.update_last_vuln_mode(report_details, options)
|
167
|
-
historical_data = get_historical_data(options)
|
168
|
-
historical_data.set_last_vuln(options[:last_scan_data],
|
169
|
-
options[:nexpose_ids])
|
170
|
-
end
|
171
|
-
|
172
|
-
def self.remove_diff_comparison_mode(report_details, options)
|
173
|
-
historical_data = get_historical_data(options)
|
174
|
-
historical_data.remove_diff_files options[:output_dir]
|
175
|
-
end
|
176
|
-
end
|
177
|
-
end
|
4
|
+
end
|
@@ -1,5 +1,18 @@
|
|
1
1
|
module NexposeServiceNow
|
2
|
-
VERSION = '0.
|
2
|
+
VERSION = '0.8.0'
|
3
3
|
VENDOR = 'ServiceNow'
|
4
4
|
PRODUCT = 'CMDB'
|
5
|
+
DEPRECATION_NOTICE = <<-DEPRECATION
|
6
|
+
As of June 4, 2019, the ServiceNow SecOps/Vulnerability Response Ruby Gem
|
7
|
+
has been deprecated and is no longer available for use. An updated integration
|
8
|
+
is currently available in product for ServiceNow ITSM and Secops, the setup
|
9
|
+
instructions for both of which can be found here:
|
10
|
+
|
11
|
+
https://insightvm.help.rapid7.com/docs/servicenow
|
12
|
+
|
13
|
+
For more information please see our announcement which can be found here:
|
14
|
+
|
15
|
+
https://kb.help.rapid7.com/docs/servicenow-ruby-gem-end-of-life-announcement
|
16
|
+
|
17
|
+
DEPRECATION
|
5
18
|
end
|
data/nexpose_servicenow.gemspec
CHANGED
@@ -11,7 +11,7 @@ Gem::Specification.new do |spec|
|
|
11
11
|
|
12
12
|
spec.require_paths = ['lib']
|
13
13
|
spec.summary = %Q{Gem for Nexpose-ServiceNow integration.}
|
14
|
-
spec.description =
|
14
|
+
spec.description = NexposeServiceNow::DEPRECATION_NOTICE
|
15
15
|
spec.executables = ['nexpose_servicenow']
|
16
16
|
spec.homepage = 'http://www.rapid7.com'
|
17
17
|
spec.license = 'MIT'
|
@@ -27,12 +27,10 @@ Gem::Specification.new do |spec|
|
|
27
27
|
spec.files = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
|
28
28
|
spec.bindir = 'bin'
|
29
29
|
spec.require_paths = ['lib']
|
30
|
+
spec.post_install_message = NexposeServiceNow::DEPRECATION_NOTICE
|
30
31
|
|
31
32
|
spec.add_development_dependency 'bundler', '~> 1.11'
|
32
33
|
spec.add_development_dependency 'rake', '~> 10.0'
|
33
|
-
spec.add_dependency 'nexpose', '~> 3.2'
|
34
|
-
spec.add_dependency 'csv-diff', '~> 0.3.5'
|
35
|
-
spec.add_dependency 'pg', '~> 0.21.0'
|
36
34
|
|
37
35
|
spec.required_ruby_version = ['>= 2.1.5', '< 2.5.0']
|
38
36
|
end
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: nexpose_servicenow
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.
|
4
|
+
version: 0.8.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- David Valente
|
@@ -9,7 +9,7 @@ authors:
|
|
9
9
|
autorequire:
|
10
10
|
bindir: bin
|
11
11
|
cert_chain: []
|
12
|
-
date:
|
12
|
+
date: 2019-06-06 00:00:00.000000000 Z
|
13
13
|
dependencies:
|
14
14
|
- !ruby/object:Gem::Dependency
|
15
15
|
name: bundler
|
@@ -39,50 +39,11 @@ dependencies:
|
|
39
39
|
- - "~>"
|
40
40
|
- !ruby/object:Gem::Version
|
41
41
|
version: '10.0'
|
42
|
-
|
43
|
-
|
44
|
-
|
45
|
-
|
46
|
-
|
47
|
-
- !ruby/object:Gem::Version
|
48
|
-
version: '3.2'
|
49
|
-
type: :runtime
|
50
|
-
prerelease: false
|
51
|
-
version_requirements: !ruby/object:Gem::Requirement
|
52
|
-
requirements:
|
53
|
-
- - "~>"
|
54
|
-
- !ruby/object:Gem::Version
|
55
|
-
version: '3.2'
|
56
|
-
- !ruby/object:Gem::Dependency
|
57
|
-
name: csv-diff
|
58
|
-
requirement: !ruby/object:Gem::Requirement
|
59
|
-
requirements:
|
60
|
-
- - "~>"
|
61
|
-
- !ruby/object:Gem::Version
|
62
|
-
version: 0.3.5
|
63
|
-
type: :runtime
|
64
|
-
prerelease: false
|
65
|
-
version_requirements: !ruby/object:Gem::Requirement
|
66
|
-
requirements:
|
67
|
-
- - "~>"
|
68
|
-
- !ruby/object:Gem::Version
|
69
|
-
version: 0.3.5
|
70
|
-
- !ruby/object:Gem::Dependency
|
71
|
-
name: pg
|
72
|
-
requirement: !ruby/object:Gem::Requirement
|
73
|
-
requirements:
|
74
|
-
- - "~>"
|
75
|
-
- !ruby/object:Gem::Version
|
76
|
-
version: 0.21.0
|
77
|
-
type: :runtime
|
78
|
-
prerelease: false
|
79
|
-
version_requirements: !ruby/object:Gem::Requirement
|
80
|
-
requirements:
|
81
|
-
- - "~>"
|
82
|
-
- !ruby/object:Gem::Version
|
83
|
-
version: 0.21.0
|
84
|
-
description: Provides an interface to Nexpose for the Rapid7 ServiceNow MarketPlace
|
85
|
-
application.
|
42
|
+
description: "As of June 4, 2019, the ServiceNow SecOps/Vulnerability Response Ruby
|
43
|
+
Gem \nhas been deprecated and is no longer available for use. An updated integration
|
44
|
+
\nis currently available in product for ServiceNow ITSM and Secops, the setup \ninstructions
|
45
|
+
for both of which can be found here: \n\nhttps://insightvm.help.rapid7.com/docs/servicenow\n\nFor
|
46
|
+
more information please see our announcement which can be found here: \n\nhttps://kb.help.rapid7.com/docs/servicenow-ruby-gem-end-of-life-announcement\n\n"
|
86
47
|
email:
|
87
48
|
- david_valente@rapid7.com
|
88
49
|
executables:
|
@@ -97,17 +58,6 @@ files:
|
|
97
58
|
- bin/nexpose_servicenow
|
98
59
|
- bin/setup
|
99
60
|
- lib/nexpose_servicenow.rb
|
100
|
-
- lib/nexpose_servicenow/arg_parser.rb
|
101
|
-
- lib/nexpose_servicenow/chunker.rb
|
102
|
-
- lib/nexpose_servicenow/csv_compare.rb
|
103
|
-
- lib/nexpose_servicenow/helpers/connection_helper.rb
|
104
|
-
- lib/nexpose_servicenow/helpers/data_warehouse_helper.rb
|
105
|
-
- lib/nexpose_servicenow/helpers/nexpose_console_helper.rb
|
106
|
-
- lib/nexpose_servicenow/historical_data.rb
|
107
|
-
- lib/nexpose_servicenow/nx_logger.rb
|
108
|
-
- lib/nexpose_servicenow/queries/nexpose_queries.rb
|
109
|
-
- lib/nexpose_servicenow/queries/queries_base.rb
|
110
|
-
- lib/nexpose_servicenow/queries/warehouse_queries.rb
|
111
61
|
- lib/nexpose_servicenow/version.rb
|
112
62
|
- nexpose_servicenow.gemspec
|
113
63
|
homepage: http://www.rapid7.com
|
@@ -115,7 +65,11 @@ licenses:
|
|
115
65
|
- MIT
|
116
66
|
metadata:
|
117
67
|
allowed_push_host: https://rubygems.org
|
118
|
-
post_install_message:
|
68
|
+
post_install_message: "As of June 4, 2019, the ServiceNow SecOps/Vulnerability Response
|
69
|
+
Ruby Gem \nhas been deprecated and is no longer available for use. An updated integration
|
70
|
+
\nis currently available in product for ServiceNow ITSM and Secops, the setup \ninstructions
|
71
|
+
for both of which can be found here: \n\nhttps://insightvm.help.rapid7.com/docs/servicenow\n\nFor
|
72
|
+
more information please see our announcement which can be found here: \n\nhttps://kb.help.rapid7.com/docs/servicenow-ruby-gem-end-of-life-announcement\n\n"
|
119
73
|
rdoc_options: []
|
120
74
|
require_paths:
|
121
75
|
- lib
|
@@ -134,7 +88,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
134
88
|
version: '0'
|
135
89
|
requirements: []
|
136
90
|
rubyforge_project:
|
137
|
-
rubygems_version: 2.
|
91
|
+
rubygems_version: 2.5.2.3
|
138
92
|
signing_key:
|
139
93
|
specification_version: 4
|
140
94
|
summary: Gem for Nexpose-ServiceNow integration.
|
@@ -1,283 +0,0 @@
|
|
1
|
-
require 'optparse'
|
2
|
-
require 'json'
|
3
|
-
require 'time'
|
4
|
-
require_relative './queries/nexpose_queries'
|
5
|
-
require_relative './nx_logger'
|
6
|
-
|
7
|
-
module NexposeServiceNow
|
8
|
-
class ArgParser
|
9
|
-
NX_ID_TYPES = %i[site asset_group]
|
10
|
-
NX_CONNECTION_TYPES = %i[nexpose_console data_warehouse]
|
11
|
-
MODES = %i[chunk_info get_chunk latest_scans
|
12
|
-
remove_last_scan remove_last_vuln]
|
13
|
-
REQUIRED_OPTIONS = %i[url port username password]
|
14
|
-
QUERY_NAMES = NexposeQueries.methods(false)
|
15
|
-
|
16
|
-
def self.parse(args)
|
17
|
-
options = Hash.new
|
18
|
-
|
19
|
-
log = NexposeServiceNow::NxLogger.instance
|
20
|
-
log.log_message 'Parsing options.'
|
21
|
-
|
22
|
-
opt_parser = OptionParser.new do |opts|
|
23
|
-
opts.banner = 'Usage: example.rb [options]'
|
24
|
-
|
25
|
-
opts.on('-o', '--output-dir DIRECTORY',
|
26
|
-
'Directory in which to save reports') do |output_dir|
|
27
|
-
options[:output_dir] = output_dir
|
28
|
-
end
|
29
|
-
|
30
|
-
opts.on('-m', '--mode MODE',
|
31
|
-
"Mode for program output. (#{MODES.join(', ')})") do |mode|
|
32
|
-
options[:mode] = mode
|
33
|
-
end
|
34
|
-
|
35
|
-
opts.on('-g', '--generate-report BOOLEAN',
|
36
|
-
'True to generate and download new report') do |gen|
|
37
|
-
char = gen.downcase[0]
|
38
|
-
options[:gen_report] = %w(y t).any? { |c| c == char }
|
39
|
-
end
|
40
|
-
|
41
|
-
opts.separator ''
|
42
|
-
opts.separator 'Query options:'
|
43
|
-
|
44
|
-
opts.on('-q', '--query QUERY', QUERY_NAMES,
|
45
|
-
"Select query (#{QUERY_NAMES.join(', ')})") do |query|
|
46
|
-
options[:query] = query
|
47
|
-
end
|
48
|
-
|
49
|
-
opts.on('-t', '--type ID~CONNECTION', 'Select ID type ' \
|
50
|
-
"(#{NX_ID_TYPES.join(', ')}) and connection type " \
|
51
|
-
"(#{NX_CONNECTION_TYPES.join(', ')})") do |types|
|
52
|
-
type = types.split('~')
|
53
|
-
options[:id_type] = type[0].intern
|
54
|
-
options[:conn_type] = type[1].intern
|
55
|
-
|
56
|
-
if options[:conn_type].equal? :data_warehouse
|
57
|
-
REQUIRED_OPTIONS << :database_name
|
58
|
-
end
|
59
|
-
end
|
60
|
-
|
61
|
-
opts.on('-i', '--items x~x,y~y,z~z', Array,
|
62
|
-
'IDs of the nexpose items to ' \
|
63
|
-
'scan, provided with their previous scan IDs or timestamp ' \
|
64
|
-
'of last scan') do |items|
|
65
|
-
options[:nexpose_ids] = {}
|
66
|
-
|
67
|
-
# Split the string up into site and scan pairs
|
68
|
-
items = items.map { |s| s.split('~') }
|
69
|
-
|
70
|
-
# Store the information in site:scan_id dict
|
71
|
-
items.each { |site, scan| options[:nexpose_ids][site] = scan }
|
72
|
-
end
|
73
|
-
|
74
|
-
opts.on('-a', '--abs-vulntime TIMESTAMP',
|
75
|
-
'Timestamp of last vulnerability definition import') do |vulnt|
|
76
|
-
# TODO: Does the date need formatted?
|
77
|
-
options[:vuln_query_date] = vulnt
|
78
|
-
end
|
79
|
-
|
80
|
-
opts.on('-y', '--cvss-version VERSION',
|
81
|
-
'The CVSS version to import ' \
|
82
|
-
'(2 or 3 where available)') do |version|
|
83
|
-
options[:cvss_v3] = version == '3'
|
84
|
-
end
|
85
|
-
|
86
|
-
opts.separator ''
|
87
|
-
opts.separator 'Connection options:'
|
88
|
-
|
89
|
-
opts.on('-n', '--nexpose-datastore URL',
|
90
|
-
'URL of the Nexpose/Data Warehouse server') do |url|
|
91
|
-
port = url.slice!(/:(\d+)$/)
|
92
|
-
port.slice! ':' unless port.nil?
|
93
|
-
|
94
|
-
url.slice! 'https://'
|
95
|
-
options[:url] = url
|
96
|
-
options[:port] = port
|
97
|
-
end
|
98
|
-
|
99
|
-
opts.on('-u', '--user USER',
|
100
|
-
'Username for Nexpose/Data Warehouse') do |username|
|
101
|
-
options[:username] = username
|
102
|
-
end
|
103
|
-
|
104
|
-
opts.on('-p', '--password PASSWORD',
|
105
|
-
'Password for the Nexpose/Data Warehouse user') do |password|
|
106
|
-
options[:password] = password
|
107
|
-
end
|
108
|
-
|
109
|
-
opts.on('-b', '--database DATABASE_NAME',
|
110
|
-
'The name of the Postgres Database '\
|
111
|
-
'(DataWarehouse Only)') do |database|
|
112
|
-
options[:database_name] = database
|
113
|
-
end
|
114
|
-
|
115
|
-
opts.separator ''
|
116
|
-
opts.separator 'Chunk info mode options:'
|
117
|
-
|
118
|
-
opts.on('-r', '--row-limit LIMIT',
|
119
|
-
'Maximum number of rows per chunk (inc. header).') do |limit|
|
120
|
-
options[:row_limit] = limit.to_i
|
121
|
-
options[:row_limit] = 9_999_999 if options[:row_limit] <= 0
|
122
|
-
end
|
123
|
-
|
124
|
-
opts.separator ''
|
125
|
-
opts.separator 'Get chunk mode options:'
|
126
|
-
|
127
|
-
opts.on('-s', '--start START',
|
128
|
-
'The chunk starting offset.') do |start|
|
129
|
-
options[:chunk_start] = start.to_i
|
130
|
-
end
|
131
|
-
|
132
|
-
opts.on('-l', '--length LENGTH',
|
133
|
-
'The chunk length.') do |length|
|
134
|
-
options[:chunk_length] = length.to_i
|
135
|
-
end
|
136
|
-
|
137
|
-
opts.separator ''
|
138
|
-
opts.separator 'Filter options:'
|
139
|
-
|
140
|
-
|
141
|
-
opts.on('-c', '--cvss-score CVSS',
|
142
|
-
'The minimum CVSS score to import') do |data|
|
143
|
-
|
144
|
-
cvss_range = data.split('~')
|
145
|
-
|
146
|
-
if cvss_range.count != 2
|
147
|
-
error = "Expected two CVSS scores. Received #{cvss_range.count}"
|
148
|
-
puts error
|
149
|
-
log.log_message error
|
150
|
-
exit -1
|
151
|
-
end
|
152
|
-
|
153
|
-
cvss_range.each do |cvss|
|
154
|
-
next if cvss.to_s =~ /^0*(10(\.0+)?|\d(\.\d+)?)?$/
|
155
|
-
error = "Invalid CVSS score supplied: #{cvss}. Exiting"
|
156
|
-
puts error
|
157
|
-
log.log_message error
|
158
|
-
exit -1
|
159
|
-
end
|
160
|
-
|
161
|
-
options[:filters] ||= {}
|
162
|
-
options[:filters][:cvss] = cvss_range
|
163
|
-
end
|
164
|
-
|
165
|
-
opts.on('-d', '--date DATE',
|
166
|
-
'The minimum date for each vulnerability instance.') do |date|
|
167
|
-
# Date should be in format 'YYYY-MM-DD~YYYY-MM-DD'
|
168
|
-
dates = date.to_s.split('~')
|
169
|
-
|
170
|
-
if dates.count != 2
|
171
|
-
error = "Expected two dates. Received #{dates.count}"
|
172
|
-
puts error
|
173
|
-
log.log_message error
|
174
|
-
exit -1
|
175
|
-
end
|
176
|
-
|
177
|
-
# Add the dates
|
178
|
-
dates[0] = dates[0] + ' 00:00:00'
|
179
|
-
dates[1] = dates[1] + ' 23:59:59'
|
180
|
-
|
181
|
-
# Remove rogue '' in datetime format
|
182
|
-
dates[0] = dates[0].gsub("'","")
|
183
|
-
dates[1] = dates[1].gsub("'","")
|
184
|
-
|
185
|
-
# Check for valid dates and placeholders
|
186
|
-
dates.map! do |d|
|
187
|
-
if d =~ /Y{4}-M{1,2}-D{1,2}/i
|
188
|
-
nil
|
189
|
-
elsif d =~ /\d{4}-\d{1,2}-\d{1,2}/
|
190
|
-
d
|
191
|
-
else
|
192
|
-
error = "Invalid date supplied: #{d}. Exiting."
|
193
|
-
puts error
|
194
|
-
log.log_message error
|
195
|
-
exit -1
|
196
|
-
end
|
197
|
-
end
|
198
|
-
|
199
|
-
options[:filters] ||= {}
|
200
|
-
options[:filters][:date] = dates
|
201
|
-
end
|
202
|
-
|
203
|
-
opts.separator ''
|
204
|
-
opts.separator 'Common options:'
|
205
|
-
|
206
|
-
opts.on_tail('-h', '--help', 'Show this message') do
|
207
|
-
puts opts
|
208
|
-
exit
|
209
|
-
end
|
210
|
-
end
|
211
|
-
|
212
|
-
opt_parser.parse!(args)
|
213
|
-
options = self.get_env_settings(options)
|
214
|
-
options = self.validate_input(options)
|
215
|
-
options
|
216
|
-
end
|
217
|
-
|
218
|
-
def self.validate_input(options)
|
219
|
-
#Insert defaults. Some are mode-specific.
|
220
|
-
options[:output_dir] ||= '.'
|
221
|
-
options[:row_limit] ||= 9_999_999
|
222
|
-
options[:vuln_query_date] ||= '1985-01-01 00:00:00'
|
223
|
-
options[:id_type] ||= 'site'
|
224
|
-
options[:conn_type] ||= :nexpose_console
|
225
|
-
options[:nexpose_ids] ||= {}
|
226
|
-
options[:filters] ||= {}
|
227
|
-
options[:cvss_v3] ||= false
|
228
|
-
|
229
|
-
options[:query] = 'latest_scans' if options[:mode] == 'latest_scans'
|
230
|
-
|
231
|
-
#By default, a report won't be generated if a chunk's being retrieved
|
232
|
-
if options[:gen_report].nil?
|
233
|
-
options[:gen_report] = options[:mode] == 'chunk_info' ||
|
234
|
-
options[:mode] == 'latest_scans'
|
235
|
-
end
|
236
|
-
|
237
|
-
options[:port] ||= if options[:conn_type].equal? :nexpose_console
|
238
|
-
'3780'
|
239
|
-
else
|
240
|
-
'5432'
|
241
|
-
end
|
242
|
-
|
243
|
-
log = NexposeServiceNow::NxLogger.instance
|
244
|
-
|
245
|
-
if options[:mode].to_s == ''
|
246
|
-
log.log_message('Script was called without mode.')
|
247
|
-
puts 'No mode selected. Use -h to see command line options.'
|
248
|
-
exit -1
|
249
|
-
end
|
250
|
-
|
251
|
-
#Only need to check these if a query is being performed
|
252
|
-
return options unless options[:gen_report]
|
253
|
-
|
254
|
-
REQUIRED_OPTIONS.each do |setting|
|
255
|
-
if options[setting].nil?
|
256
|
-
error = "Option #{setting} wasn't supplied."
|
257
|
-
log.log_error_message error
|
258
|
-
$stderr.puts "ERROR: #{error}"
|
259
|
-
exit -1
|
260
|
-
end
|
261
|
-
end
|
262
|
-
|
263
|
-
options
|
264
|
-
end
|
265
|
-
|
266
|
-
def self.get_env_settings(options)
|
267
|
-
#Only need these if a query is being performed
|
268
|
-
return options unless options[:gen_report]
|
269
|
-
|
270
|
-
log = NexposeServiceNow::NxLogger.instance
|
271
|
-
log.log_message 'Retrieving environment variables.'
|
272
|
-
|
273
|
-
# Retrieve environment variable settings
|
274
|
-
REQUIRED_OPTIONS.each do |setting|
|
275
|
-
option = "nexpose_#{setting}"
|
276
|
-
env_setting = ENV[option.upcase]
|
277
|
-
options[setting] ||= env_setting
|
278
|
-
end
|
279
|
-
|
280
|
-
options
|
281
|
-
end
|
282
|
-
end
|
283
|
-
end
|