cernus-plugins 0.1.0__py3-none-any.whl

cernus_plugins/__init__.py

@@ -0,0 +1,5 @@
+"""First-party Cernus plugins. Importing this package registers them all."""
+
+from . import cyclonedx, genesis, oscal, sarif, syft, trivy  # noqa: F401
+
+__version__ = "0.1.0"

cernus_plugins/cyclonedx.py

@@ -0,0 +1,113 @@
+"""CycloneDX SBOM connector: the document is stored as-is; the subject
+(image/application) becomes an Asset so findings from a later scan reconcile
+to the same asset id.
+
+Components are *not* turned into assets — that explodes the graph. They are
+queryable through the stored SBOM (Phase 1: new-CVE matching).
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+from cernus_core.model import Asset, EvidenceRecord, IngestBatch, Sbom, Source, new_id
+from cernus_core.plugins import Connector, register_connector
+
+from .trivy import normalize_ref
+
+
+@register_connector
+class CycloneDXConnector(Connector):
+    name = "cyclonedx"
+    description = "CycloneDX JSON SBOMs (syft, trivy, cdxgen, …)"
+    tools = ("syft", "trivy", "cdxgen")
+
+    def detect(self, path: Path, document: dict[str, Any] | None = None) -> bool:
+        return bool(document) and document.get("bomFormat") == "CycloneDX"
+
+    def ingest(
+        self, path: Path, document: dict[str, Any] | None = None, **context: Any
+    ) -> IngestBatch:
+        doc = document if document is not None else json.loads(path.read_text())
+        meta = doc.get("metadata") or {}
+        tools = _tool_names(meta)
+        source = Source(tool=tools[0] if tools else "cyclonedx", connector=self.name)
+        batch = IngestBatch(source=source)
+
+        subject = meta.get("component") or {}
+        name = subject.get("name") or path.stem
+        version = subject.get("version")
+        ref = f"{name}:{version}" if version else name
+        kind = {"container": "container_image", "application": "service"}.get(
+            subject.get("type", ""), "other"
+        )
+        digest = _digest(subject)
+        facet = normalize_ref(ref) if kind == "container_image" else (subject.get("purl") or ref)
+        asset_id = context.get("asset_id") or Asset.id_for(kind, facet)
+        if not context.get("asset_id"):
+            identifiers = (
+                {"image_ref": ref}
+                if kind == "container_image"
+                else {"purl": subject.get("purl", ref)}
+            )
+            if digest:
+                identifiers["digest"] = digest
+            batch.assets.append(
+                Asset(
+                    id=asset_id,
+                    asset_kind=kind,
+                    name=ref,
+                    identifiers=identifiers,
+                    system_id=context.get("system_id"),
+                    deployment_id=context.get("deployment_id"),
+                    environment=context.get("environment", "unknown"),
+                    source=source,
+                )
+            )
+
+        sbom_id = f"sbom_{doc.get('serialNumber', new_id('x'))}".replace("urn:uuid:", "")
+        batch.sboms.append(
+            Sbom(id=sbom_id, format="cyclonedx-json", document=doc, asset_id=asset_id)
+        )
+        components = doc.get("components") or []
+        batch.evidence.append(
+            EvidenceRecord(
+                id=new_id("ev"),
+                record_kind="sbom",
+                subject_kind="asset",
+                subject_id=asset_id,
+                produced_by=" ".join(tools) or "cyclonedx",
+                summary=f"SBOM for {ref}: {len(components)} components",
+                payload={
+                    "sbom_id": sbom_id,
+                    "spec_version": doc.get("specVersion"),
+                    "component_count": len(components),
+                    "timestamp": meta.get("timestamp"),
+                },
+            )
+        )
+        return batch
+
+
+def _tool_names(meta: dict[str, Any]) -> list[str]:
+    tools = meta.get("tools")
+    names: list[str] = []
+    if isinstance(tools, dict):  # CycloneDX 1.5+
+        for c in tools.get("components") or []:
+            names.append(f"{c.get('name')} {c.get('version', '')}".strip())
+    elif isinstance(tools, list):  # 1.4
+        for t in tools:
+            names.append(f"{t.get('name')} {t.get('version', '')}".strip())
+    return names
+
+
+def _digest(component: dict[str, Any]) -> str | None:
+    for h in component.get("hashes") or []:
+        if h.get("alg", "").upper().startswith("SHA-256"):
+            return h.get("content")
+    purl = component.get("purl") or ""
+    if "sha256" in purl:
+        return purl.split("sha256")[-1].lstrip(":%3A")[:64]
+    return None

cernus_plugins/genesis.py

@@ -0,0 +1,318 @@
+"""Genesis connector — the seam between build-time proof and Day-2 posture.
+
+Accepts any of:
+
+* a Genesis **EvidencePackage** JSON (``kind: EvidencePackage``), as returned by
+  ``GET /api/projects/{id}/evidence`` or stored in ``Evidence.package``;
+* a **DeliveryManifest** YAML/JSON (``kind: DeliveryManifest``);
+* a Genesis **workspace directory** containing ``.genesis-work/manifest.yaml``
+  and optionally ``.genesis-work/evidence.json`` and
+  ``.genesis-work/deployment.json`` (written by the Genesis post-deploy hook).
+
+Produces one System (from the manifest's ``service``), one Deployment (carrying
+the manifest and evidence verbatim), and one Finding per evidence finding —
+mapped losslessly because the Cernus Finding is a superset of the genesis-gates
+finding shape.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+from typing import Any
+
+import yaml
+from cernus_core.model import (
+    Asset,
+    Component,
+    Deployment,
+    EvidenceRecord,
+    Finding,
+    IngestBatch,
+    Source,
+    System,
+    canonical_hash,
+    new_id,
+    now_iso,
+)
+from cernus_core.plugins import Connector, register_connector
+
+from .trivy import normalize_ref
+
+_GATE_CATEGORY = {
+    "secret-scan": "secret",
+    "dependency-scan": "vulnerability",
+    "container-scan": "vulnerability",
+    "sast": "sast",
+    "iac-policy-check": "misconfiguration",
+    "design-lint": "other",
+    "unit-tests": "other",
+    "sbom": "other",
+    "risk-classify": "other",
+}
+
+WORK_DIR = ".genesis-work"
+
+
+@register_connector
+class GenesisConnector(Connector):
+    name = "genesis"
+    description = (
+        "Genesis EvidencePackage / DeliveryManifest / workspace → System, Deployment, Findings"
+    )
+    tools = ("genesis-gates", "genesis-server")
+
+    def detect(self, path: Path, document: dict[str, Any] | None = None) -> bool:
+        if document and document.get("kind") in {"EvidencePackage", "DeliveryManifest"}:
+            return True
+        if path.is_dir() and (path / WORK_DIR / "manifest.yaml").exists():
+            return True
+        if path.suffix in {".yaml", ".yml"}:
+            try:
+                doc = yaml.safe_load(path.read_text())
+                return isinstance(doc, dict) and doc.get("kind") == "DeliveryManifest"
+            except yaml.YAMLError:
+                return False
+        return False
+
+    def ingest(
+        self, path: Path, document: dict[str, Any] | None = None, **context: Any
+    ) -> IngestBatch:
+        manifest, evidence, deployment_info = self._load(path, document)
+        return self.build(manifest, evidence, deployment_info, fallback_name=path.stem, **context)
+
+    def build(
+        self,
+        manifest: dict[str, Any] | None,
+        evidence: dict[str, Any] | None,
+        deployment_info: dict[str, Any] | None = None,
+        fallback_name: str = "genesis-app",
+        **context: Any,
+    ) -> IngestBatch:
+        """Build a batch from already-loaded documents (used by the server's
+        ``POST /api/ingest/genesis`` as well as by :meth:`ingest`)."""
+        deployment_info = deployment_info or {}
+        source = Source(tool="genesis-gates", connector=self.name)
+        batch = IngestBatch(source=source)
+        seen = now_iso()
+
+        service = (manifest or {}).get("service") or {}
+        release = (manifest or {}).get("release") or {}
+        change = (manifest or {}).get("change") or {}
+        service_name = (
+            service.get("name")
+            or (evidence or {}).get("service")
+            or deployment_info.get("service")
+            or context.get("system_name")
+            or fallback_name
+        )
+        system_id = (
+            context.get("system_id") or f"sys_{canonical_hash(['genesis', service_name])[:16]}"
+        )
+        batch.systems.append(
+            System(
+                id=system_id,
+                name=service_name,
+                owner=service.get("owner") or (evidence or {}).get("owner"),
+                criticality=service.get("criticality", "unknown"),
+                data_classification=service.get("data_classification", "unknown"),
+                genesis_project_id=deployment_info.get("project_id")
+                or context.get("genesis_project_id"),
+                repository_url=deployment_info.get("repository_url"),
+            )
+        )
+
+        change_id = change.get("id") or (evidence or {}).get("change_id")
+        deployed_at = (
+            deployment_info.get("deployed_at") or (evidence or {}).get("created_at") or seen
+        )
+        environment = (
+            deployment_info.get("environment") or context.get("environment") or "development"
+        )
+        deployment_id = (
+            context.get("deployment_id")
+            or f"dep_{canonical_hash([system_id, change_id, deployed_at])[:16]}"
+        )
+        artifact_refs = [
+            {"name": a.get("name", "?"), "image_ref": a.get("image_ref"), "digest": a.get("digest")}
+            for a in deployment_info.get("artifacts") or []
+        ]
+        batch.deployments.append(
+            Deployment(
+                id=deployment_id,
+                system_id=system_id,
+                environment=environment,
+                deployed_at=deployed_at,
+                deployed_by=deployment_info.get("deployed_by"),
+                change_id=change_id,
+                artifact_refs=artifact_refs,
+                manifest=manifest,
+                evidence=evidence,
+                preview_url=deployment_info.get("preview_url"),
+                source=source,
+            )
+        )
+
+        # One asset per deployed artifact (compose service / image) so later
+        # image scans reconcile to the same ids. Falls back to one service asset.
+        asset_ids: dict[str, str] = {}
+        for a in artifact_refs:
+            facet = normalize_ref(a.get("image_ref") or a["name"])
+            aid = Asset.id_for("container_image", facet)
+            asset_ids[a["name"]] = aid
+            ident = {
+                k: v
+                for k, v in (("image_ref", a.get("image_ref")), ("digest", a.get("digest")))
+                if v
+            }
+            batch.assets.append(
+                Asset(
+                    id=aid,
+                    asset_kind="container_image",
+                    name=a.get("image_ref") or a["name"],
+                    identifiers=ident,
+                    system_id=system_id,
+                    deployment_id=deployment_id,
+                    environment=environment,
+                    data_classification=service.get("data_classification", "unknown"),
+                    owner=service.get("owner"),
+                    source=source,
+                )
+            )
+        service_asset_id = Asset.id_for("service", system_id)
+        batch.assets.append(
+            Asset(
+                id=service_asset_id,
+                asset_kind="service",
+                name=service_name,
+                identifiers={"url": deployment_info.get("preview_url")}
+                if deployment_info.get("preview_url")
+                else {},
+                system_id=system_id,
+                deployment_id=deployment_id,
+                environment=environment,
+                data_classification=service.get("data_classification", "unknown"),
+                owner=service.get("owner"),
+                source=source,
+            )
+        )
+
+        for f in (evidence or {}).get("findings") or []:
+            gate = f.get("gate")
+            component = _component_from_text(f.get("title"), f.get("remediation"))
+            batch.findings.append(
+                Finding(
+                    id=new_id("fnd"),
+                    title=f.get("title", gate or "finding"),
+                    severity=f.get("severity"),
+                    source=Source(tool="genesis-gates", connector=self.name),
+                    source_ref=f.get("title"),
+                    gate=gate,
+                    category=_GATE_CATEGORY.get(gate or "", "other"),
+                    detail=f.get("detail"),
+                    location=f.get("location"),
+                    remediation=f.get("remediation"),
+                    component=component,
+                    asset_id=service_asset_id,
+                    deployment_id=deployment_id,
+                    system_id=system_id,
+                    first_seen=deployed_at,
+                    last_seen=seen,
+                    raw=f,
+                )
+            )
+
+        if evidence:
+            batch.evidence.append(
+                EvidenceRecord(
+                    id=new_id("ev"),
+                    record_kind="gate_run",
+                    subject_kind="deployment",
+                    subject_id=deployment_id,
+                    produced_by="genesis-gates",
+                    summary=(
+                        f"gates {evidence.get('status')} for change {change_id}: "
+                        f"{len(evidence.get('gate_results') or [])} gates, "
+                        f"{len(evidence.get('findings') or [])} findings"
+                    ),
+                    payload={
+                        "status": evidence.get("status"),
+                        "risk_level": evidence.get("risk_level") or release.get("risk_level"),
+                        "gate_results": [
+                            {k: g.get(k) for k in ("gate", "status", "summary", "duration_s")}
+                            for g in evidence.get("gate_results") or []
+                        ],
+                    },
+                    created_at=evidence.get("created_at") or seen,
+                )
+            )
+        if deployment_info:
+            batch.evidence.append(
+                EvidenceRecord(
+                    id=new_id("ev"),
+                    record_kind="deploy",
+                    subject_kind="deployment",
+                    subject_id=deployment_id,
+                    produced_by="genesis-server",
+                    summary=f"deployed {service_name} to {environment}",
+                    payload=deployment_info,
+                    created_at=deployed_at,
+                )
+            )
+        return batch
+
+    @staticmethod
+    def _load(path: Path, document: dict[str, Any] | None) -> tuple[dict | None, dict | None, dict]:
+        manifest: dict | None = None
+        evidence: dict | None = None
+        deployment: dict = {}
+        if document is not None:
+            if document.get("kind") == "EvidencePackage":
+                evidence = document
+                manifest = document.get("manifest") or None
+            elif document.get("kind") == "DeliveryManifest":
+                manifest = document
+            return manifest, evidence, deployment
+        if path.is_dir():
+            work = path / WORK_DIR
+            if (work / "manifest.yaml").exists():
+                manifest = yaml.safe_load((work / "manifest.yaml").read_text())
+            if (work / "evidence.json").exists():
+                evidence = json.loads((work / "evidence.json").read_text())
+            if (work / "deployment.json").exists():
+                deployment = json.loads((work / "deployment.json").read_text())
+            return manifest, evidence, deployment
+        text = path.read_text()
+        doc = yaml.safe_load(text) if path.suffix in {".yaml", ".yml"} else json.loads(text)
+        if isinstance(doc, dict) and doc.get("kind") == "EvidencePackage":
+            return doc.get("manifest") or None, doc, deployment
+        return doc, None, deployment
+
+
+_UPGRADE = re.compile(
+    r"^Upgrade\s+(?P<name>[A-Za-z0-9_.@/-]+)\s+to\s+(?P<version>[A-Za-z0-9_.:+~-]+)\.?$"
+)
+_CVE_PKG = re.compile(r"^(?:CVE|GHSA)-[A-Za-z0-9-]+\s+(?P<name>[A-Za-z0-9_.@/-]+)$")
+
+
+def _component_from_text(title: str | None, remediation: str | None) -> Component | None:
+    """Genesis gate findings carry the fix as prose; recover the structure.
+
+    "Upgrade idna to 3.7" → Component(name=idna, fixed_version=3.7). The title
+    ("CVE-2024-3651 idna") supplies the name when only that is available.
+    """
+    name = None
+    fixed = None
+    if remediation:
+        match = _UPGRADE.match(remediation.strip())
+        if match:
+            name = match.group("name")
+            fixed = match.group("version")
+    if name is None and title:
+        match = _CVE_PKG.match(title.strip())
+        if match:
+            name = match.group("name")
+    if name is None:
+        return None
+    return Component(name=name, fixed_version=fixed, type="library")

cernus_plugins/oscal.py

@@ -0,0 +1,249 @@
+"""OSCAL exporter — Phase 0 skeleton.
+
+Writes a minimal, schema-shaped **OSCAL 1.1.x Plan of Action and Milestones**
+from open findings. Each finding becomes one ``poam-item`` with an
+``observation`` carrying the scanner evidence and a ``risk`` carrying severity
+and remediation. Control mapping (``related-controls``) is filled in Phase 2
+when the gate/finding → 800-53 crosswalk lands.
+
+Validation against the official OSCAL JSON Schema is available through the
+optional ``compliance-trestle`` extra; this module does not depend on it.
+"""
+
+from __future__ import annotations
+
+import json
+import uuid
+from pathlib import Path
+from typing import Any
+
+from cernus_core.model import Finding, IngestBatch, now_iso
+from cernus_core.plugins import Exporter, register_exporter
+
+OSCAL_VERSION = "1.1.2"
+
+# FedRAMP remediation windows by severity, in days (Rev 5 ConMon guidance).
+FEDRAMP_SLA_DAYS = {"critical": 30, "high": 30, "medium": 90, "low": 180, "info": 180}
+
+
+def _uuid(seed: str) -> str:
+    return str(uuid.uuid5(uuid.NAMESPACE_URL, f"https://cernus.ai/oscal/{seed}"))
+
+
+@register_exporter
+class OscalExporter(Exporter):
+    name = "oscal"
+    description = "OSCAL 1.1 Plan of Action & Milestones from open findings"
+    formats = ("oscal-poam", "oscal-assessment-results")
+
+    def export(self, fmt: str, batch: IngestBatch, out: Path, **options: Any) -> Path:
+        if fmt == "oscal-assessment-results":
+            return self._assessment_results(batch, out, **options)
+        if fmt != "oscal-poam":
+            raise ValueError(f"oscal exporter does not produce {fmt!r}")
+        system_name = options.get("system_name") or (
+            batch.systems[0].name if batch.systems else "unnamed-system"
+        )
+        system_id = options.get("system_id") or (
+            batch.systems[0].id if batch.systems else "unknown"
+        )
+        open_findings = [f for f in batch.findings if f.status.value == "open"]
+
+        observations, risks, items = [], [], []
+        for f in open_findings:
+            obs_uuid = _uuid(f"obs/{f.fingerprint}")
+            risk_uuid = _uuid(f"risk/{f.fingerprint}")
+            observations.append(_observation(f, obs_uuid))
+            risks.append(_risk(f, risk_uuid, obs_uuid))
+            items.append(
+                {
+                    "uuid": _uuid(f"item/{f.fingerprint}"),
+                    "title": f.title,
+                    "description": f.detail or f.title,
+                    "props": [
+                        {
+                            "name": "cernus-finding-id",
+                            "ns": "https://cernus.ai/ns/oscal",
+                            "value": f.id,
+                        },
+                        {
+                            "name": "cernus-fingerprint",
+                            "ns": "https://cernus.ai/ns/oscal",
+                            "value": f.fingerprint,
+                        },
+                    ],
+                    "related-observations": [{"observation-uuid": obs_uuid}],
+                    "associated-risks": [{"risk-uuid": risk_uuid}],
+                }
+            )
+
+        doc = {
+            "plan-of-action-and-milestones": {
+                "uuid": _uuid(f"poam/{system_id}/{batch.produced_at}"),
+                "metadata": {
+                    "title": f"POA&M — {system_name}",
+                    "last-modified": now_iso(),
+                    "version": batch.produced_at,
+                    "oscal-version": OSCAL_VERSION,
+                    "props": [
+                        {"name": "generator", "ns": "https://cernus.ai/ns/oscal", "value": "cernus"}
+                    ],
+                },
+                "system-id": {"identifier-type": "https://cernus.ai/ns/system-id", "id": system_id},
+                "observations": observations,
+                "risks": risks,
+                "poam-items": items,
+            }
+        }
+        out.write_text(json.dumps(doc, indent=2))
+        return out
+
+    def _assessment_results(self, batch: IngestBatch, out: Path, **options: Any) -> Path:
+        """OSCAL Assessment Results from Cernus ControlResults.
+
+        ``options["control_results"]`` is a list of ControlResult dicts (the
+        contract shape, optionally with ``title``/``statement``). Each becomes
+        one ``finding`` with a ``target`` of type ``objective-id`` whose status
+        is ``satisfied`` / ``not-satisfied``; partial and unknown map to
+        ``not-satisfied`` with the Cernus status preserved as a prop.
+        """
+        results = list(options.get("control_results") or [])
+        system_name = options.get("system_name") or (
+            batch.systems[0].name if batch.systems else "unnamed-system"
+        )
+        system_id = options.get("system_id") or (
+            batch.systems[0].id if batch.systems else "unknown"
+        )
+        catalog = results[0]["catalog"] if results else "nist-800-53r5"
+        evaluated_at = results[0]["evaluated_at"] if results else now_iso()
+        findings = []
+        for r in results:
+            implemented = r["status"] == "satisfied"
+            findings.append(
+                {
+                    "uuid": _uuid(f"ar-finding/{system_id}/{r['control_id']}/{r['evaluated_at']}"),
+                    "title": f"{r['control_id']} {r.get('title') or ''}".strip(),
+                    "description": r.get("rationale") or r.get("statement") or r["control_id"],
+                    "target": {
+                        "type": "objective-id",
+                        "target-id": r["control_id"],
+                        "status": {"state": "satisfied" if implemented else "not-satisfied"},
+                        "props": [
+                            {
+                                "name": "cernus-status",
+                                "ns": "https://cernus.ai/ns/oscal",
+                                "value": r["status"],
+                            },
+                            {
+                                "name": "evaluator",
+                                "ns": "https://cernus.ai/ns/oscal",
+                                "value": r.get("evaluator", ""),
+                            },
+                        ],
+                    },
+                }
+            )
+        doc = {
+            "assessment-results": {
+                "uuid": _uuid(f"ar/{system_id}/{evaluated_at}"),
+                "metadata": {
+                    "title": f"Assessment Results — {system_name}",
+                    "last-modified": now_iso(),
+                    "version": evaluated_at,
+                    "oscal-version": OSCAL_VERSION,
+                    "props": [
+                        {
+                            "name": "generator",
+                            "ns": "https://cernus.ai/ns/oscal",
+                            "value": "cernus",
+                        },
+                        {"name": "catalog", "ns": "https://cernus.ai/ns/oscal", "value": catalog},
+                    ],
+                },
+                "import-ap": {"href": f"urn:cernus:assessment-plan:{system_id}"},
+                "results": [
+                    {
+                        "uuid": _uuid(f"ar-result/{system_id}/{evaluated_at}"),
+                        "title": f"Continuous control evaluation ({catalog})",
+                        "description": (
+                            "Automated evaluation of runtime facts against the Cernus crosswalk."
+                        ),
+                        "start": evaluated_at,
+                        "end": evaluated_at,
+                        "findings": findings,
+                    }
+                ],
+            }
+        }
+        out.write_text(json.dumps(doc, indent=2))
+        return out
+
+
+def _observation(f: Finding, obs_uuid: str) -> dict[str, Any]:
+    subjects = []
+    if f.asset_id:
+        subjects.append({"subject-uuid": _uuid(f"asset/{f.asset_id}"), "type": "component"})
+    return {
+        "uuid": obs_uuid,
+        "title": f.title,
+        "description": f.detail or f.title,
+        "methods": ["TEST"],
+        "types": ["finding"],
+        "origins": [{"actors": [{"type": "tool", "actor-uuid": _uuid(f"tool/{f.source.tool}")}]}],
+        **({"subjects": subjects} if subjects else {}),
+        "collected": f.last_seen,
+        "props": [
+            {"name": "tool", "ns": "https://cernus.ai/ns/oscal", "value": f.source.tool},
+            *(
+                [
+                    {
+                        "name": "vulnerability-id",
+                        "ns": "https://cernus.ai/ns/oscal",
+                        "value": f.vuln.id,
+                    }
+                ]
+                if f.vuln
+                else []
+            ),
+            *(
+                [{"name": "location", "ns": "https://cernus.ai/ns/oscal", "value": f.location}]
+                if f.location
+                else []
+            ),
+        ],
+    }
+
+
+def _risk(f: Finding, risk_uuid: str, obs_uuid: str) -> dict[str, Any]:
+    sev = f.severity.value
+    props = [
+        {"name": "severity", "ns": "https://cernus.ai/ns/oscal", "value": sev},
+        {
+            "name": "remediation-sla-days",
+            "ns": "https://cernus.ai/ns/oscal",
+            "value": str(FEDRAMP_SLA_DAYS[sev]),
+        },
+    ]
+    if f.vuln and f.vuln.cvss is not None:
+        props.append(
+            {"name": "cvss-score", "ns": "https://cernus.ai/ns/oscal", "value": str(f.vuln.cvss)}
+        )
+    risk: dict[str, Any] = {
+        "uuid": risk_uuid,
+        "title": f.title,
+        "description": f.detail or f.title,
+        "statement": f"Open {sev} finding reported by {f.source.tool}.",
+        "status": "open",
+        "props": props,
+        "related-observations": [{"observation-uuid": obs_uuid}],
+    }
+    if f.remediation:
+        risk["remediations"] = [
+            {
+                "uuid": _uuid(f"rem/{f.fingerprint}"),
+                "lifecycle": "planned",
+                "title": "Remediate",
+                "description": f.remediation,
+            }
+        ]
+    return risk