devsecops-engine-tools 1.8.8__tar.gz → 1.8.9__tar.gz

{devsecops_engine_tools-1.8.8 → devsecops_engine_tools-1.8.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.8.8
+Version: 1.8.9
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -67,7 +67,7 @@ pip3 install devsecops-engine-tools
 ### Scan running - flags (CLI)
 
 ```bash
-devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container"] --folder_path ["Folder path scan engine_iac"] --platform ["k8s","cloudformation","docker", "openapi"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit"] --image_to_scan ["image_to_scan"]
+devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container", "engine_risk"] --folder_path ["Folder path scan engine_iac"] --platform ["k8s","cloudformation","docker", "openapi"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit"] --image_to_scan ["image_to_scan"]
 ```
 
 ### Structure Remote Config
@@ -76,6 +76,9 @@ devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_con
 📦Remote_Config
    ┣ 📂engine_core
    ┃ ┗ 📜ConfigTool.json
+   ┣ 📂engine_risk
+   ┃ ┗ 📜ConfigTool.json
+   ┃ ┗ 📜Exclusions.json
    ┣ 📂engine_sast
    ┃ ┗ 📂engine_iac
    ┃   ┗ 📜ConfigTool.json
@@ -99,6 +102,11 @@ devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_con
     <th>Module</th>
     <th>Tool</th>
     <th>Type</th>
+  </tr>
+    <tr>
+    <td>ENGINE_RISK</td>
+    <td><a href="https://defectdojo.com/">DEFECTDOJO</a></td>
+    <td>Free</td>
   </tr>
   <tr>
     <td rowspan="3">ENGINE_IAC</td>

{devsecops_engine_tools-1.8.8 → devsecops_engine_tools-1.8.9}/README.md

@@ -19,6 +19,19 @@ devsecops_engine_tools
 |                   entry_points
 |                   utils.
 |
+├───engine_risk -> Vulnerability management plaform report.
+|           test
+|           src
+|               applications
+|               deployment
+|               domain
+|                   model
+|                   usecases
+|               infraestructure
+|                   driven_adapters
+|                   entry_points
+|                   utils.
+|
 ├───engine_dast -> DAST Practice
 |           test
 |           src

{devsecops_engine_tools-1.8.8 → devsecops_engine_tools-1.8.9}/devsecops_engine_tools/engine_core/src/domain/model/gateway/vulnerability_management_gateway.py

@@ -17,7 +17,7 @@ class VulnerabilityManagementGateway(metaclass=ABCMeta):
         "get_findings_excepted"
 
     @abstractmethod
-    def get_all_findings(
+    def get_all(
         self, service, dict_args, secret_tool, config_tool
     ):
-        "get_report"
+        "get all findings and exclusions from vulnerability management platform"

devsecops_engine_tools-1.8.9/devsecops_engine_tools/engine_core/src/domain/model/report.py

@@ -0,0 +1,34 @@
+from dataclasses import dataclass
+
+
+@dataclass
+class Report:
+    def __init__(self, **kwargs):
+        self.id = kwargs.get("id", [])
+        self.vuln_id_from_tool = kwargs.get("vuln_id_from_tool", "")
+        self.where = kwargs.get("where", "")
+        self.tags = kwargs.get("tags", [])
+        self.severity = kwargs.get("severity", "")
+        self.age = kwargs.get("age", "")
+        self.active = kwargs.get("active", "")
+        self.status = kwargs.get("status", "")
+        self.risk_status = kwargs.get("risk_status", "")
+        self.risk_score = kwargs.get("risk_score", "")
+        self.created = kwargs.get("created", "")
+        self.publish_date = kwargs.get("publish_date", "")
+        self.last_reviewed = kwargs.get("last_reviewed", "")
+        self.last_status_update = kwargs.get("last_status_update", "")
+        self.accepted_risks = kwargs.get("accepted_risks", "")
+        self.transfer_finding = kwargs.get("transfer_finding", "")
+        self.epss_score = kwargs.get("epss_score", "")
+        self.epss_percentile = kwargs.get("epss_percentile", "")
+        self.mitigated = kwargs.get("mitigated", "")
+        self.vul_description = kwargs.get("vul_description", "")
+        self.risk_accepted = kwargs.get("risk_accepted", "")
+        self.false_p = kwargs.get("false_p", "")
+        self.service = kwargs.get("service", "")
+        self.reason = kwargs.get("reason", "")
+        self.component_name = kwargs.get("component_name", "")
+        self.component_version = kwargs.get("component_version", "")
+        self.file_path = kwargs.get("file_path", "")
+        self.endpoints = kwargs.get("endpoints", "")

{devsecops_engine_tools-1.8.8 → devsecops_engine_tools-1.8.9}/devsecops_engine_tools/engine_core/src/domain/usecases/handle_risk.py

@@ -16,6 +16,9 @@ from devsecops_engine_tools.engine_risk.src.applications.runner_engine_risk impo
 from devsecops_engine_tools.engine_core.src.domain.model.customs_exceptions import (
     ExceptionGettingFindings,
 )
+from devsecops_engine_tools.engine_core.src.domain.model.input_core import (
+    InputCore
+)
 
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
@@ -36,29 +39,63 @@ class HandleRisk:
         self.devops_platform_gateway = devops_platform_gateway
         self.print_table_gateway = print_table_gateway
 
-    def get_finding_list(self, dict_args, secret_tool, remote_config):
+    def _get_all_from_vm(self, dict_args, secret_tool, remote_config, service):
         try:
-            findigs_list = self.vulnerability_management.get_all_findings(
-                self.devops_platform_gateway.get_variable("pipeline_name"),
+            return self.vulnerability_management.get_all(
+                service,
                 dict_args,
                 secret_tool,
                 remote_config,
             )
-            return findigs_list
         except ExceptionGettingFindings as e:
-            logger.error("Error getting finding list in handle risk: {0}".format(str(e)))
-
+            logger.error(
+                "Error getting finding list in handle risk: {0}".format(str(e))
+            )
 
     def process(self, dict_args: any, remote_config: any):
         secret_tool = None
         if dict_args["use_secrets_manager"] == "true":
             secret_tool = self.secrets_manager_gateway.get_secret(remote_config)
 
-        findigs_list = self.get_finding_list(dict_args, secret_tool, remote_config)
+        risk_config = self.devops_platform_gateway.get_remote_config(
+            dict_args["remote_config_repo"], "engine_risk/ConfigTool.json"
+        )
+
+        service = self.devops_platform_gateway.get_variable("pipeline_name")
+        parent_identifier = risk_config["PARENT_ANALYSIS"]["PARENT_IDENTIFIER"]
+
+        parent_findings = []
+        parent_exclusions = []
+        if (
+            risk_config["PARENT_ANALYSIS"]["ENABLED"].lower() == "true"
+            and parent_identifier in service
+        ):
+            parent_service = service.split(parent_identifier)[0] + parent_identifier
+            parent_findings, parent_exclusions = self._get_all_from_vm(
+                dict_args, secret_tool, remote_config, parent_service
+            )
+
+        findings, exclusions = self._get_all_from_vm(
+            dict_args, secret_tool, remote_config, service
+        )
 
-        runner_engine_risk(
+        findings_list = parent_findings + findings
+
+        exclusions_list = parent_exclusions + exclusions
+
+        result = runner_engine_risk(
             dict_args,
-            findigs_list,
+            findings_list,
+            exclusions_list,
             self.devops_platform_gateway,
-            self.print_table_gateway
+            self.print_table_gateway,
+        )
+        input_core = InputCore(
+            [],
+            {},
+            "",
+            "",
+            service,
+            self.devops_platform_gateway.get_variable("stage").capitalize(),
         )
+        return result, input_core

{devsecops_engine_tools-1.8.8 → devsecops_engine_tools-1.8.9}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/defect_dojo.py

@@ -199,7 +199,11 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 "Transferred Finding",
             )
 
-            return list(exclusions_risk_accepted) + list(exclusions_false_positive) + list(exclusions_transfer_finding)
+            return (
+                list(exclusions_risk_accepted)
+                + list(exclusions_false_positive)
+                + list(exclusions_transfer_finding)
+            )
         except Exception as ex:
             raise ExceptionFindingsExcepted(
                 "Error getting excepted findings with the following error: {0} ".format(
@@ -207,7 +211,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 )
             )
 
-    def get_all_findings(self, service, dict_args, secret_tool, config_tool):
+    def get_all(self, service, dict_args, secret_tool, config_tool):
         try:
             all_findings_query_params = {
                 "limit": config_tool["VULNERABILITY_MANAGER"]["DEFECT_DOJO"][
@@ -225,16 +229,18 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 all_findings_query_params,
             )
 
-            maped_list = list(
+            all_findings = list(
                 map(
-                    partial(
-                        self._create_report, date_fn=self._format_date_to_dd_format
-                    ),
+                    partial(self._create_report),
                     findings,
                 )
             )
 
-            return maped_list
+            all_exclusions = self._get_report_exclusions(
+                all_findings, self._format_date_to_dd_format
+            )
+
+            return all_findings, all_exclusions
 
         except Exception as ex:
             raise ExceptionGettingFindings(
@@ -250,6 +256,29 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
             config_tool["VULNERABILITY_MANAGER"]["DEFECT_DOJO"]["HOST_DEFECT_DOJO"],
         )
 
+    def _get_report_exclusions(self, total_findings, date_fn):
+        exclusions = []
+        for finding in total_findings:
+            if finding.risk_accepted:
+                exclusions.append(
+                    self._create_exclusion(
+                        finding, date_fn, "engine_risk", "Risk Accepted"
+                    )
+                )
+            elif finding.false_p:
+                exclusions.append(
+                    self._create_exclusion(
+                        finding, date_fn, "engine_risk", "False Positive"
+                    )
+                )
+            elif finding.risk_status == "Transfer Accepted":
+                exclusions.append(
+                    self._create_exclusion(
+                        finding, date_fn, "engine_risk", "Transferred Finding"
+                    )
+                )
+        return exclusions
+
     def _get_findings_with_exclusions(
         self, session_manager, service, max_retries, query_params, tool, date_fn, reason
     ):
@@ -293,24 +322,44 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
             last_accepted_risk = finding.accepted_risks[-1]
             create_date = date_fn(last_accepted_risk["created"])
             expired_date = date_fn(last_accepted_risk["expiration_date"])
-        
+
         return Exclusions(
             id=finding.vuln_id_from_tool,
             where=self._get_where(finding, tool),
             create_date=create_date,
             expired_date=expired_date,
+            severity=finding.severity,
             reason=reason,
         )
 
-    def _create_report(self, finding, date_fn):
+    def _create_report(self, finding):
         return Report(
-            id=finding.vuln_id_from_tool,
-            date=date_fn(finding.date),
+            id=finding.vulnerability_ids,
+            vuln_id_from_tool=finding.vuln_id_from_tool,
             status=finding.display_status,
-            where=self._get_where_report(finding),
+            component_name=finding.component_name,
+            component_version=finding.component_version,
+            file_path=finding.file_path,
+            endpoints=finding.endpoints,
+            where=self._get_where(finding, "engine_risk"),
             tags=finding.tags,
             severity=finding.severity,
+            age=finding.age,
             active=finding.active,
+            risk_status=finding.risk_status,
+            created=finding.created,
+            publish_date=finding.publish_date,
+            last_reviewed=finding.last_reviewed,
+            last_status_update=finding.last_status_update,
+            accepted_risks=finding.accepted_risks,
+            transfer_finding=finding.transfer_finding,
+            epss_score=finding.epss_score,
+            epss_percentile=finding.epss_percentile,
+            mitigated=finding.is_mitigated,
+            vul_description=finding.description,
+            risk_accepted=finding.risk_accepted,
+            false_p=finding.false_p,
+            service=finding.service,
         )
 
     def _format_date_to_dd_format(self, date_string):
@@ -320,14 +369,13 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
             else None
         )
 
-    def _get_where_report(self, finding):
-        for tag in finding.tags:
-            return self._get_where(finding, tag)
-
     def _get_where(self, finding, tool):
         if tool in ["engine_container", "engine_dependencies"]:
             return finding.component_name + ":" + finding.component_version
         elif tool == "engine_dast":
             return finding.endpoints
+        elif tool == "engine_risk":
+            for tag in finding.tags:
+                return self._get_where(finding, tag)
         else:
             return finding.file_path

{devsecops_engine_tools-1.8.8 → devsecops_engine_tools-1.8.9}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/printer_pretty_table/printer_pretty_table.py

@@ -63,22 +63,23 @@ class PrinterPrettyTable(PrinterTableGateway):
             print(sorted_table)
 
     def print_table_report(self, report_list: "list[Report]"):
-        headers = ["Severity", "ID", "Tag", "Where"]
+        headers = ["Risk Score", "Severity", "ID", "Tags", "Where", "Service"]
         table = PrettyTable(headers)
         for report in report_list:
             row_data = [
+                report.risk_score,
                 report.severity.lower(),
-                report.id,
+                report.vuln_id_from_tool if report.vuln_id_from_tool else report.id,
                 report.tags,
                 report.where,
+                report.service
             ]
             table.add_row(row_data)
 
-        severity_order = {"critical": 0, "high": 1, "medium": 2, "low": 3}
         sorted_table = PrettyTable()
         sorted_table.field_names = table.field_names
         sorted_table.add_rows(
-            sorted(table._rows, key=lambda row: severity_order[row[0]])
+            sorted(table._rows, key=lambda row: row[0], reverse=True)
         )
 
         for column in table.field_names:

{devsecops_engine_tools-1.8.8 → devsecops_engine_tools-1.8.9}/devsecops_engine_tools/engine_core/src/infrastructure/entry_points/entry_point_core.py

@@ -30,12 +30,13 @@ def init_engine_core(
 
     if config_tool[args["tool"].upper()]["ENABLED"] == "true":
         if args["tool"] == "engine_risk":
-            HandleRisk(
+            results, input_core = HandleRisk(
                 vulnerability_management_gateway,
                 secrets_manager_gateway,
                 devops_platform_gateway,
                 print_table_gateway,
             ).process(args, config_tool)
+
         else:
             findings_list, input_core = HandleScan(
                 vulnerability_management_gateway,
@@ -43,15 +44,15 @@ def init_engine_core(
                 devops_platform_gateway,
             ).process(args, config_tool)
 
-            scan_result = BreakBuild(devops_platform_gateway, print_table_gateway).process(
+            results = BreakBuild(devops_platform_gateway, print_table_gateway).process(
                 findings_list,
                 input_core,
                 args
             )
-            if args["send_metrics"] == "true":
-                MetricsManager(devops_platform_gateway, metrics_manager_gateway).process(
-                    config_tool, input_core, args, scan_result
-                )
+        if args["send_metrics"] == "true":
+            MetricsManager(devops_platform_gateway, metrics_manager_gateway).process(
+                config_tool, input_core, args, results
+            )
     else:
         print(
             devops_platform_gateway.message(

{devsecops_engine_tools-1.8.8 → devsecops_engine_tools-1.8.9}/devsecops_engine_tools/engine_core/src/infrastructure/helpers/util.py

@@ -11,5 +11,5 @@ def define_env(variable_env, branch):
     return (
         "pdn"
         if branch in ["trunk", "master"]
-        else "qa" if branch in "release" else "dev"
+        else "qa" if branch=="release" else "dev"
     )

{devsecops_engine_tools-1.8.8 → devsecops_engine_tools-1.8.9}/devsecops_engine_tools/engine_risk/src/applications/runner_engine_risk.py

@@ -1,3 +1,6 @@
+from devsecops_engine_tools.engine_risk.src.infrastructure.driven_adapters.first_csv.first_epss_csv import (
+    FirstCsv,
+)
 from devsecops_engine_tools.engine_risk.src.infrastructure.entry_points.entry_point_risk import (
     init_engine_risk,
 )
@@ -10,11 +13,15 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 
 def runner_engine_risk(
-    dict_args, findings, devops_platform_gateway, print_table_gateway
+    dict_args, findings, vm_exclusions, devops_platform_gateway, print_table_gateway
 ):
-    init_engine_risk(
+    add_epss_gateway = FirstCsv()
+
+    return init_engine_risk(
+        add_epss_gateway,
         devops_platform_gateway,
         print_table_gateway,
         dict_args,
         findings,
+        vm_exclusions,
     )

devsecops_engine_tools-1.8.9/devsecops_engine_tools/engine_risk/src/domain/model/gateways/add_epss_gateway.py

@@ -0,0 +1,7 @@
+from abc import ABCMeta, abstractmethod
+
+
+class AddEpssGateway(metaclass=ABCMeta):
+    @abstractmethod
+    def add_epss_data(self, findings) -> list:
+        "run add epss tool"

devsecops_engine_tools-1.8.9/devsecops_engine_tools/engine_risk/src/domain/usecases/add_data.py

@@ -0,0 +1,16 @@
+from devsecops_engine_tools.engine_risk.src.domain.model.gateways.add_epss_gateway import (
+    AddEpssGateway,
+)
+
+
+class AddData:
+    def __init__(
+        self,
+        add_epss_gateway: AddEpssGateway,
+        findings,
+    ):
+        self.add_epss_gateway = add_epss_gateway
+        self.findings = findings
+
+    def process(self):
+        return self.add_epss_gateway.add_epss_data(self.findings)