@sagentix-inc/evidence-collector 0.3.1 → 0.3.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +21 -0
- package/apps/sos-app/src/data/checks/prowler_aws.json +1455 -34
- package/apps/sos-app/src/data/checks/prowler_azure.json +497 -0
- package/apps/sos-app/src/data/checks/prowler_cloudflare.json +205 -1
- package/apps/sos-app/src/data/checks/prowler_gcp.json +175 -0
- package/apps/sos-app/src/data/checks/prowler_github.json +191 -1
- package/apps/sos-app/src/data/checks/prowler_googleworkspace.json +457 -1
- package/apps/sos-app/src/data/checks/prowler_kubernetes.json +133 -0
- package/apps/sos-app/src/data/checks/prowler_m365.json +574 -0
- package/apps/sos-app/src/data/checks/prowler_okta.json +205 -1
- package/collector/package.json +1 -1
- package/collector/src/agent.js +38 -1
- package/collector/src/channel.js +23 -2
- package/collector/src/cli.js +43 -4
- package/collector/src/config.js +18 -0
- package/collector/src/deliveries.js +244 -0
- package/collector/src/report.js +3 -1
- package/collector/src/sources/prowler.js +80 -25
- package/collector/src/vault.js +303 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -143,6 +143,27 @@ Top-level keys are `endpoint` (required), `keyId`, `keyFile`, `out`, `dryRun` an
|
|
|
143
143
|
|
|
144
144
|
The file holds no secret. The private key comes from the `keyFile` path or from `SAGENTIX_COLLECTOR_KEY`, and each source reads its credentials from the environment as before; a value that looks like a PEM block or a well-known token prefix (`ghp_`, `github_pat_`, `AKIA`, `xoxb-` …) is refused. Paths are relative to the directory the command runs in. Options given on the command line override the file's, and `--source` on the command line adds to the file's sources.
|
|
145
145
|
|
|
146
|
+
### Vault: connector secrets set from sos-app (0.3.3)
|
|
147
|
+
|
|
148
|
+
Since 0.3.3 an owner or admin sets each connector's secrets and settings on sos-app's Connect screen (Your collectors,
|
|
149
|
+
Connectors). A secret is encrypted in their browser for this collector only (X25519, HKDF-SHA256, AES-256-GCM): sos-app
|
|
150
|
+
keeps and relays bytes it cannot open, and the collector opens them into `sagentix-collector.vault` beside the config
|
|
151
|
+
(mode 0600, each value sealed on its own). Each run reads the vault into its environment; a variable already set wins.
|
|
152
|
+
The collector takes a value only for a name its config's `credentials` lists, and a secret only while its connector's
|
|
153
|
+
settings are the ones it was entered with. Design: `apps/sos-app/docs/COLLECTOR_VAULT.md` in the Sagentix repository.
|
|
154
|
+
|
|
155
|
+
The vault's key is kept in the strongest place the computer has: a systemd credential, a Docker secret, the macOS
|
|
156
|
+
Keychain, Windows DPAPI, or else `sagentix-collector.vault.key` (mode 0600). With a plain key file, seal it:
|
|
157
|
+
|
|
158
|
+
- **systemd** (Linux, the collector run as a system service; the generated agent unit is a user unit, so this means
|
|
159
|
+
installing it under `/etc/systemd/system` instead): `sudo systemd-creds encrypt --name=sagentix-vault-key sagentix-collector.vault.key /etc/credstore.encrypted/sagentix-vault-key`,
|
|
160
|
+
add `LoadCredentialEncrypted=sagentix-vault-key` to the collector's unit, restart it, then delete `sagentix-collector.vault.key`.
|
|
161
|
+
- **Docker**: create a Docker secret named `sagentix-vault-key` from the key file and give it to the container
|
|
162
|
+
(`/run/secrets/sagentix-vault-key`), then delete `sagentix-collector.vault.key`.
|
|
163
|
+
|
|
164
|
+
Values written earlier to `sagentix-collector.env` by the setup scripts keep working; the Connect screen offers to move
|
|
165
|
+
them into the vault, after which the collector removes those lines.
|
|
166
|
+
|
|
146
167
|
### The older v1 push
|
|
147
168
|
|
|
148
169
|
`--fedramp-target <id> [--class A|B|C|D]` sends the v1 format (`sagentix-fedramp-collect/1`) to `/api/fedramp/collect` instead. It carries the original 11 checks grouped into five KSIs with a Security Decision Record, validated locally against FedRAMP's schema. New installs should use the default v2 push; v1 stays for targets already wired to it.
|