devsecops-engine-tools 1.15.0__py3-none-any.whl → 1.16.0__py3-none-any.whl

devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -97,7 +97,7 @@ def get_inputs_from_cli(args):
     parser.add_argument(
         "-p",
         "--platform",
-        type=parse_choices({"all", "docker", "k8s", "cloudformation", "openapi"}),
+        type=parse_choices({"all", "docker", "k8s", "cloudformation", "openapi", "terraform"}),
         required=False,
         default="all",
         help="Platform to scan, only apply engine_iac tool",

devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_deserealizator.py

@@ -10,23 +10,33 @@ from dataclasses import dataclass
 class CheckovDeserealizator:
     @classmethod
     def get_list_finding(
-        cls, results_scan_list: list, rules
+        cls, results_scan_list: list, rules, default_severity, default_category
     ) -> "list[Finding]":
-        list_open_findings = []
 
+        list_open_findings = []
         for result in results_scan_list:
             if "failed_checks" in str(result):
                 for scan in result["results"]["failed_checks"]:
+                    check_id = scan.get("check_id")
+                    if not rules.get(check_id):
+                        description = scan.get("check_name")
+                        severity = default_severity.lower()
+                        category = default_category.lower()
+                    else:
+                        description = rules[check_id].get("checkID", scan.get("check_name"))
+                        severity = rules[check_id].get("severity").lower()
+                        category = rules[check_id].get("category").lower()
+
                     finding_open = Finding(
-                        id=scan.get("check_id"),
+                        id=check_id,
                         cvss=None,
-                        where = scan.get("repo_file_path") + ": " + str(scan.get("resource")),
-                        description=rules[scan.get("check_id")].get("checkID", scan.get("check_name")),
-                        severity=rules[scan.get("check_id")].get("severity").lower(),
+                        where=scan.get("repo_file_path") + ": " + str(scan.get("resource")),
+                        description=description,
+                        severity=severity,
                         identification_date=datetime.now().strftime("%d%m%Y"),
                         published_date_cve=None,
                         module="engine_iac",
-                        category=Category(rules[scan.get("check_id")].get("category").lower()),
+                        category=Category(category),
                         requirements=scan.get("guideline"),
                         tool="Checkov"
                     )

devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py

@@ -42,12 +42,14 @@ class CheckovTool(ToolGateway):
         "RULES_K8S": "kubernetes",
         "RULES_CLOUDFORMATION": "cloudformation",
         "RULES_OPENAPI": "openapi",
+        "RULES_TERRAFORM": "terraform"
     }
     framework_external_checks = [
         "RULES_K8S",
         "RULES_CLOUDFORMATION",
         "RULES_DOCKER",
         "RULES_OPENAPI",
+        "RULES_TERRAFORM"
     ]
 
     def create_config_file(self, checkov_config: CheckovConfig):
@@ -191,10 +193,14 @@ class CheckovTool(ToolGateway):
                 if "all" in platform_to_scan or any(
                     elem.upper() in rule for elem in platform_to_scan
                 ):
+                    framework = [self.framework_mapping[rule]]
+                    if "terraform" in platform_to_scan or ("all" in platform_to_scan and self.framework_mapping[rule] == "terraform"): 
+                        framework.append("terraform_plan")
+
                     checkov_config = CheckovConfig(
                         path_config_file="",
                         config_file_name=rule,
-                        framework=self.framework_mapping[rule],
+                        framework=framework,
                         checks=[
                             key
                             for key, value in config_tool[self.TOOL_CHECKOV]["RULES"][
@@ -287,12 +293,21 @@ class CheckovTool(ToolGateway):
 
             checkov_deserealizator = CheckovDeserealizator()
             findings_list = checkov_deserealizator.get_list_finding(
-                result_scans, rules_run
+                result_scans, 
+                rules_run, 
+                config_tool[self.TOOL_CHECKOV]["DEFAULT_SEVERITY"],
+                config_tool[self.TOOL_CHECKOV]["DEFAULT_CATEGORY"]
             )
 
             return (
                 findings_list,
-                generate_file_from_tool(self.TOOL_CHECKOV, result_scans, rules_run),
+                generate_file_from_tool(
+                    self.TOOL_CHECKOV, 
+                    result_scans, 
+                    rules_run, 
+                    config_tool[self.TOOL_CHECKOV]["DEFAULT_SEVERITY"],
+                    config_tool[self.TOOL_CHECKOV]["DEFAULT_CATEGORY"]
+                ),
             )
         else:
             return [], None

devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/helpers/file_generator_tool.py

@@ -6,7 +6,7 @@ from devsecops_engine_tools.engine_utilities import settings
 logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 
-def generate_file_from_tool(tool, result_list, rules_doc):
+def generate_file_from_tool(tool, result_list, rules_doc, default_severity, default_category):
     if tool == "CHECKOV":
         try:
             if len(result_list) > 0:
@@ -20,7 +20,7 @@ def generate_file_from_tool(tool, result_list, rules_doc):
                 for result in result_list:
                     failed_checks = result.get("results", {}).get("failed_checks", [])
                     all_failed_checks.extend(
-                        map(lambda x: update_fields(x, rules_doc), failed_checks)
+                        map(lambda x: update_fields(x, rules_doc, default_severity, default_category), failed_checks)
                     )
                     summary_passed += result.get("summary", {}).get("passed", 0)
                     summary_failed += result.get("summary", {}).get("failed", 0)
@@ -60,15 +60,14 @@ def generate_file_from_tool(tool, result_list, rules_doc):
             logger.error(f"Error during handling checkov json integrator {ex}")
 
 
-def update_fields(check_result, rules_doc):
+def update_fields(check_result, rules_doc, default_severity, default_category):
     rule_info = rules_doc.get(check_result.get("check_id"), {})
 
-    check_result["severity"] = rule_info["severity"].lower()
+    check_result["severity"] = rule_info.get("severity", default_severity)
+    check_result["bc_category"] = rule_info.get("category", default_category)
     if "customID" in rule_info:
         check_result["custom_vuln_id"] = rule_info["customID"]
     if "guideline" in rule_info:
         check_result["guideline"] = rule_info["guideline"]
-    if "category" in rule_info:
-        check_result["bc_category"] = rule_info["category"]
 
     return check_result

devsecops_engine_tools/version.py

@@ -1 +1 @@
-version = '1.15.0'
+version = '1.16.0'

{devsecops_engine_tools-1.15.0.dist-info → devsecops_engine_tools-1.16.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.15.0
+Version: 1.16.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -67,7 +67,7 @@ pip3 install devsecops-engine-tools
 ### Scan running - flags (CLI)
 
 ```bash
-devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk", "engine_code"] --folder_path ["Folder path scan engine_iac, engine_code and engine_dependencies"] --platform ["k8s","cloudformation","docker", "openapi"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit"] --image_to_scan ["image_to_scan"]
+devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk", "engine_code"] --folder_path ["Folder path scan engine_iac, engine_code and engine_dependencies"] --platform ["k8s","cloudformation","docker", "openapi", "terraform"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit"] --image_to_scan ["image_to_scan"]
 ```
 
 ### Structure Remote Config

{devsecops_engine_tools-1.15.0.dist-info → devsecops_engine_tools-1.16.0.dist-info}/RECORD

@@ -1,9 +1,9 @@
 devsecops_engine_tools/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-devsecops_engine_tools/version.py,sha256=qPrSCN79LDGQE1nW80PFtFMdiMa_3P6jqc7EO1X72dg,19
+devsecops_engine_tools/version.py,sha256=tT_8ISLXFdCq-Rgso5Q9lk3Q5eDlHoUO7dbUcqFExA0,19
 devsecops_engine_tools/engine_core/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_core/src/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_core/src/applications/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py,sha256=HIxw71J4LILlgHoDLT_snIVImTUSKSZ7kz4SfUxNDEw,7196
+devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py,sha256=9QaRFl_QYXSLxK_Qo5B84Jyeq7iZP9WeLc2ioSdkLOc,7209
 devsecops_engine_tools/engine_core/src/deployment/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_core/src/deployment/infrastructure/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_core/src/domain/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -121,8 +121,8 @@ devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/__init__.py,sha
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_config.py,sha256=qbE6wUO5_WFXF_QolL0JYelaRGEOUakPEZR_6HAKzzI,4355
-devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_deserealizator.py,sha256=gBwnQ20QExHTrN1nvErUUqb_IMHvYKJijqc55XwZHQk,1404
-devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py,sha256=B7M8NoGSfrWaQCjQIvc9zZ0GLWNWpK9mGqhsC5gepow,10822
+devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_deserealizator.py,sha256=l_opY909gh1m3k2ud2xDrCVnDTBe3ApYT75juBf_uMk,1836
+devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py,sha256=8gbf4nGWxjaF6c9H6rEvPZg3JksZ8rn8ShEZRaxGgUI,11506
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_deserealizator.py,sha256=b1X5GWz2snJtsKZcGEsILNc178hv9p-lg-el0Jc-_Eo,2084
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/kics/kics_tool.py,sha256=8lda0A7huVSWgq2zMAN92vQv4ug0HiQMATGdXV5lgyA,5202
@@ -132,7 +132,7 @@ devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/entry_points/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/entry_points/entry_point_tool.py,sha256=60iaHYZZp5uTngD7a8vsQaQYsTfBzP_kp0xflfPNnk4,305
 devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/helpers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/helpers/file_generator_tool.py,sha256=stC0z4e20DGRAjKMp7q7cYSYkEXssvnSeGEB0xhbXSo,3084
+devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/helpers/file_generator_tool.py,sha256=O81l8ID6-1ozaL4qzbBLZINFyTV1sQiL1PurxPOpnc8,3192
 devsecops_engine_tools/engine_sast/engine_secret/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_secret/src/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 devsecops_engine_tools/engine_sast/engine_secret/src/applications/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -305,8 +305,8 @@ devsecops_engine_tools/engine_utilities/utils/name_conversion.py,sha256=ADJrRGax
 devsecops_engine_tools/engine_utilities/utils/printers.py,sha256=amYAr9YQfYgR6jK9a2l26z3oovFPQ3FAKmhq6BKhEBA,623
 devsecops_engine_tools/engine_utilities/utils/session_manager.py,sha256=yNtlT-8Legz1sHbGPH8LNYjL-LgDUE0zXG2rYjiab7U,290
 devsecops_engine_tools/engine_utilities/utils/utils.py,sha256=r_mng-OVWeqQyy6yIFsCeJrvH81VUPI3o1zdJO0JS0I,397
-devsecops_engine_tools-1.15.0.dist-info/METADATA,sha256=hK8nqnmEBOpmgVpjp4ftTCilioBG1NBqamqKbkGduBw,10854
-devsecops_engine_tools-1.15.0.dist-info/WHEEL,sha256=R0nc6qTxuoLk7ShA2_Y-UWkN8ZdfDBG2B6Eqpz2WXbs,91
-devsecops_engine_tools-1.15.0.dist-info/entry_points.txt,sha256=MHCTFFs9bdNKo6YcWCcBW2_8X6yTisgLOlmVx-V8Rxc,276
-devsecops_engine_tools-1.15.0.dist-info/top_level.txt,sha256=ge6y0X_xBAU1aG3EMWFtl9djbVyg5BxuSp2r2Lg6EQU,23
-devsecops_engine_tools-1.15.0.dist-info/RECORD,,
+devsecops_engine_tools-1.16.0.dist-info/METADATA,sha256=YXRISLfqURRXsKhLnN19CzANuAERAVKU_tNuUoCBoF4,10867
+devsecops_engine_tools-1.16.0.dist-info/WHEEL,sha256=R0nc6qTxuoLk7ShA2_Y-UWkN8ZdfDBG2B6Eqpz2WXbs,91
+devsecops_engine_tools-1.16.0.dist-info/entry_points.txt,sha256=MHCTFFs9bdNKo6YcWCcBW2_8X6yTisgLOlmVx-V8Rxc,276
+devsecops_engine_tools-1.16.0.dist-info/top_level.txt,sha256=ge6y0X_xBAU1aG3EMWFtl9djbVyg5BxuSp2r2Lg6EQU,23
+devsecops_engine_tools-1.16.0.dist-info/RECORD,,