regscale-cli 6.16.0.0__py3-none-any.whl

regscale/integrations/commercial/stigv2/click_commands.py

@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+RegScale STIG Integration
+"""
+
+import click
+
+from regscale.integrations.commercial.stigv2.stig_integration import StigIntegration
+
+
+@click.group(name="stigv2")
+def stigv2():
+    """STIG Integrations"""
+
+
+@stigv2.command(name="sync_findings")
+@click.option(
+    "-p",
+    "--regscale_ssp_id",
+    type=click.INT,
+    help="The ID number from RegScale of the System Security Plan",
+    prompt="Enter RegScale System Security Plan ID",
+    required=True,
+)
+@click.option(
+    "-d",
+    "--stig_directory",
+    type=click.Path(),
+    help="The directory where STIG files are located",
+    prompt="Enter STIG directory",
+    required=True,
+)
+def sync_findings(regscale_ssp_id, stig_directory):
+    """Sync GCP Findings to RegScale."""
+    StigIntegration.sync_findings(plan_id=regscale_ssp_id, path=stig_directory)
+
+
+@stigv2.command(name="sync_assets")
+@click.option(
+    "-p",
+    "--regscale_ssp_id",
+    type=click.INT,
+    help="The ID number from RegScale of the System Security Plan",
+    prompt="Enter RegScale System Security Plan ID",
+    required=True,
+)
+@click.option(
+    "-d",
+    "--stig_directory",
+    type=click.Path(),
+    help="The directory where STIG files are located",
+    prompt="Enter STIG directory",
+    required=True,
+)
+def sync_assets(regscale_ssp_id, stig_directory):
+    """Sync GCP Assets to RegScale."""
+    StigIntegration.sync_assets(plan_id=regscale_ssp_id, path=stig_directory)
+
+
+@stigv2.command(name="process_checklist")
+@click.option(
+    "-p",
+    "--regscale_ssp_id",
+    type=click.INT,
+    help="The ID number from RegScale of the System Security Plan",
+    prompt="Enter RegScale System Security Plan ID",
+    required=True,
+)
+@click.option(
+    "-d",
+    "--stig_directory",
+    type=click.Path(),
+    help="The directory where STIG files are located",
+    prompt="Enter STIG directory",
+    required=True,
+)
+def process_checklist(regscale_ssp_id, stig_directory):
+    """Process GCP Checklist."""
+    StigIntegration.sync_assets(plan_id=regscale_ssp_id, path=stig_directory)
+    StigIntegration.sync_findings(plan_id=regscale_ssp_id, path=stig_directory)
+
+
+@stigv2.command(name="cci_assessment")
+@click.option(
+    "-p",
+    "--regscale_ssp_id",
+    type=click.INT,
+    help="The ID number from RegScale of the System Security Plan",
+    prompt="Enter RegScale System Security Plan ID",
+    required=True,
+)
+def cci_assessment(regscale_ssp_id):
+    """Run CCI Assessment."""
+    StigIntegration.cci_assessment(plan_id=regscale_ssp_id)

regscale/integrations/commercial/stigv2/stig_integration.py

@@ -0,0 +1,202 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+RegScale STIG Integration
+"""
+import datetime
+from typing import Iterator, Optional, Generator
+
+from pathlib import Path
+
+from regscale.core.utils.date import date_str, days_from_today
+from regscale.integrations.commercial.stigv2.ckl_parser import (
+    parse_checklist,
+    find_stig_files,
+    Checklist,
+    Vuln,
+    STIG,
+)
+from regscale.integrations.scanner_integration import (
+    logger,
+    ScannerIntegration,
+    ScannerIntegrationType,
+)
+from regscale.models import regscale_models
+
+
+class StigIntegration(ScannerIntegration):
+    options_map_assets_to_components = True
+
+    title = "STIG Integration"
+    asset_identifier_field = "fqdn"
+    type = ScannerIntegrationType.CHECKLIST
+    checklist_status_map = {
+        "NotAFinding": regscale_models.ChecklistStatus.PASS,
+        "Open": regscale_models.ChecklistStatus.FAIL,
+    }
+    finding_severity_map = {
+        "critical": regscale_models.IssueSeverity.Critical,
+        "high": regscale_models.IssueSeverity.High,
+        "medium": regscale_models.IssueSeverity.Moderate,
+        "low": regscale_models.IssueSeverity.Low,
+    }
+
+    def fetch_findings(self, path: Path, **kwargs) -> Generator["IntegrationFinding", None, None]:  # type: ignore
+        """
+        Fetches GCP findings using the SecurityCenterClient
+
+        :param Path path: The path to the STIG files, defaults to None
+        :yields IntegrationFinding: An IntegrationFinding object for each finding
+        :return: A list of parsed findings
+        :rtype: Generator[IntegrationFinding, None, None]
+        """
+
+        logger.info("Fetching findings...")
+        stig_files = find_stig_files(path)
+
+        self.num_findings_to_process = 0
+        for stig_file in stig_files:
+            logger.info(f"Processing '{stig_file}'")
+            checklist = parse_checklist(stig_file)
+            logger.info(f"Found {len(checklist.stigs[0].vulns)} Vulnerabilities in '{stig_file}'")
+            for stig in checklist.stigs:
+                for vuln in stig.vulns:
+                    for finding in self.process_vulnerabilities(checklist, vuln, stig):
+                        self.num_findings_to_process += 1
+                        yield finding
+
+    def process_vulnerabilities(
+        self, checklist: Checklist, vuln: Vuln, stig: STIG
+    ) -> Generator["IntegrationFinding", None, None]:
+        """
+        Processes vulnerabilities for each asset in the checklist.
+
+        Iterates through each asset in the provided checklist, extracts the asset identifier (host_fqdn),
+        and yields an IntegrationFinding for each vulnerability associated with the asset.
+
+        :param Checklist checklist: The checklist containing assets to process.
+        :param Vuln vuln: The vulnerability information to be processed.
+        :param STIG stig: The STIG information to be processed.
+        :return: An iterator of IntegrationFinding objects.
+        :rtype: Generator[IntegrationFinding, None, None]
+        :yields: An IntegrationFinding object for each asset in the checklist.
+        :ytype: IntegrationFinding
+        """
+        for asset in checklist.assets:
+            asset_identifier = getattr(asset, "host_fqdn", None)
+            if not asset_identifier:
+                self.log_error(f"Failed to extract host_fqdn from Asset: {asset} and vuln from {vuln}")
+                continue
+
+            yield from self.create_integration_finding(asset_identifier, vuln, stig)
+
+    def create_integration_finding(
+        self, asset_identifier: str, vuln: Vuln, stig: STIG
+    ) -> Generator["IntegrationFinding", None, None]:
+        """
+        Creates an IntegrationFinding object from the provided asset identifier and vulnerability information.
+
+        :param str asset_identifier: The identifier of the asset associated with the finding.
+        :param Vuln vuln: The vulnerability information used to populate the finding.
+        :param STIG stig: The STIG information used to populate the finding.
+        :return: An iterator of IntegrationFinding objects populated with the provided information.
+        :rtype: Generator[IntegrationFinding, None, None]
+        :yields: An IntegrationFinding object for each asset in the checklist.
+        :ytype: IntegrationFinding
+        """
+        from regscale.integrations.scanner_integration import IntegrationFinding
+
+        severity = self.get_finding_severity(vuln.severity)
+        due_date_map = {
+            regscale_models.IssueSeverity.Critical: date_str(days_from_today(30)),
+            regscale_models.IssueSeverity.High: date_str(days_from_today(60)),
+            regscale_models.IssueSeverity.Moderate: date_str(days_from_today(210)),
+            regscale_models.IssueSeverity.Low: date_str(days_from_today(364)),
+        }
+        if not vuln.cci_ref:
+            vuln.cci_ref = ["CCI-000366"]
+
+        for cci_ref in vuln.cci_ref:
+            yield IntegrationFinding(
+                asset_identifier=asset_identifier,
+                control_labels=[],  # Determine how to populate this
+                title=f"{vuln.rule_title} {vuln.rule_ver} {stig.stig_info.releaseinfo} {vuln.vuln_num}",
+                issue_title=f"{vuln.rule_title} {vuln.rule_ver} {stig.stig_info.releaseinfo} {vuln.vuln_num}",
+                category=vuln.group_title,
+                severity=severity,
+                description=f"{vuln.check_content} {vuln.vuln_discuss} {vuln.fix_text}",
+                status=self.get_finding_status(vuln.status),
+                checklist_status=self.get_checklist_status(vuln.status),
+                external_id=f"{cci_ref}:{vuln.vuln_num}:{asset_identifier}",
+                vulnerability_number=vuln.vuln_num,
+                cci_ref=cci_ref,
+                rule_id=vuln.rule_id,
+                rule_version=vuln.rule_ver,
+                results=f"Vulnerability Number: {vuln.vuln_num}, Severity: {vuln.severity}, "
+                f"Rule Title: {vuln.rule_title}<br><br>Check Content: {vuln.check_content}<br><br>"
+                f"Fix Text: {vuln.fix_text}<br><br>STIG Reference: {vuln.stigref}<br><br>"
+                f"Vulnerability Discussion: {vuln.vuln_discuss}",
+                recommendation_for_mitigation=vuln.fix_text,
+                comments=vuln.comments,
+                poam_comments=vuln.finding_details,
+                date_created=date_str(datetime.datetime.now()),
+                due_date=due_date_map.get(severity, date_str(days_from_today(394))),
+                baseline=stig.baseline,
+                plugin_name=vuln.rule_id,
+                observations=vuln.finding_details or "",
+                gaps=vuln.check_content or "",
+                evidence=vuln.check_content or "",
+                impact=vuln.potential_impact or "",
+            )
+
+    def fetch_assets(self, path: Optional[Path] = None) -> Iterator["IntegrationAsset"]:
+        """
+        Fetches GCP assets using the AssetServiceClient
+
+        :param Optional[Path] path: The path to the STIG files, defaults to None
+        :raises ValueError: If no path is provided
+        :yield: An IntegrationAsset object representing an Assest extracted from a STIG file
+        :ytype: IntegrationAsset
+        :return: An iterator of parsed assets
+        :rtype: Iterator[IntegrationAsset]
+        """
+        from regscale.integrations.scanner_integration import IntegrationAsset
+
+        if not path:
+            raise ValueError("Path to STIG files is required.")
+        logger.info("Fetching assets...")
+        stig_files = find_stig_files(path)
+
+        self.num_assets_to_process = len(stig_files)
+
+        loading_stig_files = self.asset_progress.add_task(
+            f"[#f8b737]Loading {len(stig_files)} STIG files.",
+            total=len(stig_files),
+        )
+        for stig_file in stig_files:
+            logger.info(f"Processing '{stig_file}'")
+            checklist = parse_checklist(stig_file)
+            for stig_asset in checklist.assets:
+                component_names = []
+                for stig in checklist.stigs:
+                    component_names.append(stig.component_title)
+
+                if not stig_asset.host_name and not stig_asset.host_fqdn:
+                    self.log_error(f"Failed to extract asset from {stig_asset}")
+                    continue
+
+                yield IntegrationAsset(
+                    name=stig_asset.host_name or stig_asset.host_fqdn,
+                    ip_address=stig_asset.host_ip,
+                    fqdn=stig_asset.host_fqdn or stig_asset.host_name,
+                    identifier=stig_asset.host_fqdn,
+                    asset_type=stig_asset.asset_type,
+                    asset_owner_id=self.assessor_id,
+                    parent_id=self.plan_id,
+                    parent_module=regscale_models.SecurityPlan.get_module_slug(),
+                    asset_category=regscale_models.AssetCategory.Hardware,
+                    component_names=component_names,
+                    # TODO: Determine correct component type
+                    component_type=regscale_models.ComponentType.Hardware,
+                )
+            self.asset_progress.update(loading_stig_files, advance=1)

regscale/integrations/commercial/synqly/assets.py

@@ -0,0 +1,46 @@
+# flake8: noqa E501
+# pylint: disable=line-too-long
+
+"""Assets connector commands for the RegScale CLI"""
+
+import click
+from regscale.models import regscale_ssp_id
+
+
+@click.group()
+def assets() -> None:
+    """Assets connector commands for the RegScale CLI"""
+    pass
+
+
+@assets.command(name="sync_armis_centrix")
+@regscale_ssp_id()
+def sync_armis_centrix(regscale_ssp_id: int) -> None:
+    """Sync Assets from Armis Centrix to RegScale."""
+    from regscale.models.integration_models.synqly_models.connectors import Assets
+
+    assets_armis_centrix = Assets("armis_centrix")
+    assets_armis_centrix.run_sync(regscale_ssp_id=regscale_ssp_id)
+
+
+@assets.command(name="sync_nozomi_vantage")
+@regscale_ssp_id()
+def sync_nozomi_vantage(regscale_ssp_id: int) -> None:
+    """Sync Assets from Nozomi Vantage to RegScale."""
+    from regscale.models.integration_models.synqly_models.connectors import Assets
+
+    assets_nozomi_vantage = Assets("nozomi_vantage")
+    assets_nozomi_vantage.run_sync(regscale_ssp_id=regscale_ssp_id)
+
+
+@assets.command(name="sync_servicenow")
+@regscale_ssp_id()
+def sync_servicenow(regscale_ssp_id: int) -> None:
+    """Sync Assets from Servicenow to RegScale."""
+    from regscale.models.integration_models.synqly_models.connectors import Assets
+
+    assets_servicenow = Assets("servicenow")
+    assets_servicenow.run_sync(regscale_ssp_id=regscale_ssp_id)
+
+
+# pylint: enable=line-too-long

regscale/integrations/commercial/synqly/ticketing.py

@@ -0,0 +1,132 @@
+# flake8: noqa E501
+# pylint: disable=line-too-long
+
+"""Ticketing connector commands for the RegScale CLI"""
+
+import click
+from regscale.models import regscale_id, regscale_module
+
+
+@click.group()
+def ticketing() -> None:
+    """Ticketing connector commands for the RegScale CLI"""
+    pass
+
+
+@ticketing.command(name="sync_jira")
+@regscale_id()
+@regscale_module()
+@click.option(
+    "--issue_type",
+    type=click.STRING,
+    help="jira issue type",
+    required=True,
+    prompt="jira issue type",
+)
+@click.option(
+    "--project",
+    type=click.STRING,
+    help="jira project",
+    required=True,
+    prompt="jira project",
+)
+@click.option(
+    "--default_project",
+    type=click.STRING,
+    help="Default Project for the integration.",
+    required=False,
+)
+@click.option(
+    "--sync_attachments",
+    type=click.BOOL,
+    help="Whether to sync attachments between Jira and RegScale",
+    required=False,
+    default=True,
+)
+def sync_jira(
+    regscale_id: int, regscale_module: str, issue_type: str, project: str, default_project: str, sync_attachments: bool
+) -> None:
+    """Sync Ticketing data between Jira and RegScale."""
+    from regscale.models.integration_models.synqly_models.connectors import Ticketing
+
+    ticketing_jira = Ticketing("jira")
+    ticketing_jira.run_sync(
+        regscale_id=regscale_id,
+        regscale_module=regscale_module,
+        issue_type=issue_type,
+        project=project,
+        default_project=default_project,
+        sync_attachments=sync_attachments,
+    )
+
+
+@ticketing.command(name="sync_pagerduty")
+@regscale_id()
+@regscale_module()
+@click.option(
+    "--project",
+    type=click.STRING,
+    help="pagerduty project",
+    required=True,
+    prompt="pagerduty project",
+)
+@click.option(
+    "--name",
+    type=click.STRING,
+    help="pagerduty name",
+    required=True,
+    prompt="pagerduty name",
+)
+def sync_pagerduty(regscale_id: int, regscale_module: str, project: str, name: str) -> None:
+    """Sync Ticketing data between Pagerduty and RegScale."""
+    from regscale.models.integration_models.synqly_models.connectors import Ticketing
+
+    ticketing_pagerduty = Ticketing("pagerduty")
+    ticketing_pagerduty.run_sync(regscale_id=regscale_id, regscale_module=regscale_module, project=project, name=name)
+
+
+@ticketing.command(name="sync_servicenow")
+@regscale_id()
+@regscale_module()
+@click.option(
+    "--issue_type",
+    type=click.STRING,
+    help="servicenow issue type",
+    required=True,
+    prompt="servicenow issue type",
+)
+@click.option(
+    "--default_project",
+    type=click.STRING,
+    help="Default Project for the integration. This maps to the custom table for tickets. This table should be derived from Incident table. If not provided, defaults to the incident table.",
+    required=False,
+)
+def sync_servicenow(regscale_id: int, regscale_module: str, issue_type: str, default_project: str) -> None:
+    """Sync Ticketing data between Servicenow and RegScale."""
+    from regscale.models.integration_models.synqly_models.connectors import Ticketing
+
+    ticketing_servicenow = Ticketing("servicenow")
+    ticketing_servicenow.run_sync(
+        regscale_id=regscale_id, regscale_module=regscale_module, issue_type=issue_type, default_project=default_project
+    )
+
+
+@ticketing.command(name="sync_torq")
+@regscale_id()
+@regscale_module()
+@click.option(
+    "--name",
+    type=click.STRING,
+    help="torq name",
+    required=True,
+    prompt="torq name",
+)
+def sync_torq(regscale_id: int, regscale_module: str, name: str) -> None:
+    """Sync Ticketing data between Torq and RegScale."""
+    from regscale.models.integration_models.synqly_models.connectors import Ticketing
+
+    ticketing_torq = Ticketing("torq")
+    ticketing_torq.run_sync(regscale_id=regscale_id, regscale_module=regscale_module, name=name)
+
+
+# pylint: enable=line-too-long