regscale-cli 6.16.0.0__py3-none-any.whl

regscale/integrations/commercial/tenablev2/utils.py

@@ -0,0 +1,78 @@
+"""
+Tenable V2 Utils
+"""
+
+import datetime
+from typing import List
+
+from dateutil.relativedelta import relativedelta
+
+from regscale.core.app.application import Application
+from regscale.core.app.utils.app_utils import get_current_datetime
+from regscale.core.utils.date import date_str, datetime_obj
+from regscale.models import ScanHistory, regscale_models
+
+
+def get_last_pull_epoch(regscale_ssp_id: int) -> int:
+    """
+    Gather last pull epoch from RegScale Security Plan
+
+    :param int regscale_ssp_id: RegScale System Security Plan ID
+    :return: Last pull epoch
+    :rtype: int
+    """
+    two_months_ago = datetime.datetime.now() - relativedelta(months=2)
+    two_weeks_ago = datetime.datetime.now() - relativedelta(weeks=2)
+    last_pull = round(two_weeks_ago.timestamp())  # default the last pull date to two weeks
+
+    # Limit the query with a filter_date to avoid taxing the database in the case of a large number of scans
+    filter_date = date_str(two_months_ago)
+
+    if res := ScanHistory.get_by_parent_recursive(
+        parent_id=regscale_ssp_id, parent_module="securityplans", filter_date=filter_date
+    ):
+        # Sort by ScanDate desc
+        res = sorted(res, key=lambda x: (datetime_obj(x.scanDate) or get_current_datetime()), reverse=True)
+        # Convert to timestamp
+        last_pull = round(datetime_obj(res[0].scanDate).timestamp()) if res else 0
+
+    return last_pull
+
+
+def get_filtered_severities() -> List[regscale_models.IssueSeverity]:
+    """
+    Return a list of severities that we want from Tenable
+
+    :return: A list of severities
+    :rtype: List[regscale_models.IssueSeverity]
+    """
+    app = Application()
+    severity_filter = app.config.get("tenableMinimumSeverityFilter", "low").lower()
+    severity_map = {
+        "info": [
+            regscale_models.IssueSeverity.NotAssigned,
+            regscale_models.IssueSeverity.Low,
+            regscale_models.IssueSeverity.Moderate,
+            regscale_models.IssueSeverity.High,
+            regscale_models.IssueSeverity.Critical,
+        ],
+        "low": [
+            regscale_models.IssueSeverity.Low,
+            regscale_models.IssueSeverity.Moderate,
+            regscale_models.IssueSeverity.High,
+            regscale_models.IssueSeverity.Critical,
+        ],
+        "moderate": [regscale_models.IssueSeverity.Moderate, regscale_models.IssueSeverity.High],
+        "medium": [regscale_models.IssueSeverity.Moderate, regscale_models.IssueSeverity.High],
+        "high": [regscale_models.IssueSeverity.High, regscale_models.IssueSeverity.Critical],
+        "critical": [regscale_models.IssueSeverity.Critical],
+    }
+    return severity_map.get(
+        severity_filter,
+        [
+            regscale_models.IssueSeverity.Low,
+            regscale_models.IssueSeverity.Moderate,
+            regscale_models.IssueSeverity.High,
+            regscale_models.IssueSeverity.Critical,
+        ],
+    )

regscale/integrations/commercial/tenablev2/variables.py

@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""Tenable Variables"""
+
+from regscale.core.app.utils.variables import RsVariableType, RsVariablesMeta
+
+
+class TenableVariables(metaclass=RsVariablesMeta):
+    """
+    Tenable Variables class to define class-level attributes with type annotations and examples
+    """
+
+    # Define class-level attributes with type annotations and examples
+    tenableAccessKey: RsVariableType(str, "xxxxxxxxxxxxxxxxxxxxxx", sensitive=True)  # type: ignore # noqa: F722,F821
+    tenableSecretKey: RsVariableType(str, "xxxxxxxxxxxxxxxxxxxxxx", sensitive=True)  # type: ignore # noqa: F722,F821
+    tenableUrl: RsVariableType(str, "https://cloud.tenable.com")  # type: ignore # noqa: F722,F821
+    tenableMinimumSeverityFilter: RsVariableType(str, "critical")  # type: ignore # noqa: F722,F821

regscale/integrations/commercial/trivy.py

@@ -0,0 +1,162 @@
+"""
+Module for processing Trivy scan results and loading them into RegScale.
+"""
+
+import logging
+import traceback
+from datetime import datetime
+from typing import List, Optional, Union
+
+import click
+from pathlib import Path
+
+from regscale.core.app.utils.file_utils import (
+    download_from_s3,
+    find_files,
+    iterate_files,
+    move_file,
+)
+from regscale.models.integration_models.flat_file_importer import FlatFileImporter
+from regscale.models.integration_models.trivy_import import TrivyImport
+
+logger = logging.getLogger(__name__)
+
+
+class TrivyProcessingError(Exception):
+    """Custom exception for Trivy processing errors."""
+
+    pass
+
+
+@click.group()
+def trivy():
+    """Performs actions from the Trivy scanner integration."""
+    pass
+
+
+@trivy.command("import_scans")
+@FlatFileImporter.common_scanner_options(
+    message="File path to the folder containing Trivy .json files to process to RegScale.",
+    prompt="File path for Trivy files",
+    import_name="trivy",
+)
+@click.option("--destination", "-d", type=click.Path(exists=True, dir_okay=True), required=False)
+@click.option("--file_pattern", "-p", type=str, required=False, default="trivy*.json")
+def import_scans(
+    destination: Optional[Path],
+    file_pattern: str,
+    folder_path: Path,
+    regscale_ssp_id: int,
+    scan_date: datetime,
+    mappings_path: Path,
+    disable_mapping: bool,
+    s3_bucket: str,
+    s3_prefix: str,
+    aws_profile: str,
+    upload_file: bool,
+) -> None:
+    """
+    Process Trivy scan results from a folder containing trivy scan files and load into RegScale.
+    """
+    import_trivy_scans(
+        destination=destination,
+        file_pattern=file_pattern,
+        folder_path=folder_path,
+        regscale_ssp_id=regscale_ssp_id,
+        scan_date=scan_date,
+        mappings_path=mappings_path,
+        disable_mapping=disable_mapping,
+        s3_bucket=s3_bucket,
+        s3_prefix=s3_prefix,
+        aws_profile=aws_profile,
+        upload_file=upload_file,
+    )
+
+
+def import_trivy_scans(
+    folder_path: Path,
+    regscale_ssp_id: int,
+    scan_date: datetime,
+    mappings_path: Optional[Path] = None,
+    disable_mapping: Optional[bool] = False,
+    s3_bucket: Optional[str] = None,
+    s3_prefix: Optional[str] = None,
+    aws_profile: Optional[str] = None,
+    destination: Optional[Path] = None,
+    file_pattern: Optional[str] = "trivy*.json",
+    upload_file: Optional[bool] = True,
+) -> None:
+    """
+    Process Trivy scan results from a folder container trivy scan files and load into RegScale.
+
+    :param Path folder_path: Path to the Trivy scan results JSON file
+    :param int regscale_ssp_id: RegScale SSP ID
+    :param datetime scan_date: The date of the scan
+    :param Optional[Path] mappings_path: Path to the header mapping file, default: None
+    :param Optional[bool] disable_mapping: Disable the header mapping, default: False
+    :param Optional[str] s3_bucket: S3 bucket to download scan files from, default: None
+    :param Optional[str] s3_prefix: Prefix (folder path) within the S3 bucket, default: None
+    :param Optional[str] aws_profile: AWS profile to use for S3 access, default: None
+    :param Optional[Path] destination: The destination folder for the processed files, default: None
+    :param Optional[str] file_pattern: The file pattern to search for in the file path Default: trivy*.json
+    :param Optional[bool] upload_file: Whether to upload the file to RegScale after processing, default: True
+    """
+    from regscale.exceptions import ValidationException
+    from regscale.core.app.application import Application
+
+    try:
+        if s3_bucket and s3_prefix and aws_profile:
+            download_from_s3(bucket=s3_bucket, prefix=s3_prefix, local_path=destination, aws_profile=aws_profile)
+            files = find_files(path=destination, pattern=file_pattern)
+            logger.info("Downloaded all Trivy scan files from S3. Processing...")
+        elif destination and not s3_bucket:
+            logger.info("Moving Trivy scan files to %s", destination)
+            stored_file_collection = find_files(path=folder_path, pattern=file_pattern)
+            move_all_files(stored_file_collection, destination)
+            files = find_files(path=destination, pattern=file_pattern)
+            logger.info("Done moving files")
+        else:
+            stored_file_collection = find_files(path=folder_path, pattern=file_pattern)
+            files = stored_file_collection
+        if not files:
+            logger.error("No Trivy scan results found in the specified directory")
+            return
+    except Exception as e:
+        logger.error(f"Error processing Trivy results: {str(e)}")
+        logger.error(traceback.format_exc())
+        raise TrivyProcessingError(f"Failed to process Trivy results: {str(e)}")
+
+    for file in files:
+        try:
+            TrivyImport(
+                name="Trivy",
+                app=Application(),
+                file_path=str(file),
+                file_type=file.suffix,
+                parent_id=regscale_ssp_id,
+                parent_module="securityplans",
+                scan_date=scan_date,
+                mappings_path=mappings_path,
+                disable_mapping=disable_mapping,
+                upload_file=upload_file,
+                file_name=file.name,
+            )
+        except ValidationException as e:
+            logger.error(f"Validation error on {file}: {e}")
+            continue
+    logger.info("Completed Trivy processing.")
+
+
+def move_all_files(file_collection: List[Union[Path, str]], destination: Union[Path, str]) -> None:
+    """
+    Move all Trivy files in the current directory to a folder called 'processed'.
+
+    :param List[Union[Path, str]] file_collection: A list of file paths or S3 URIs
+    :param Union[Path, str] destination: The destination folder
+    :rtype: None
+    """
+    for file in iterate_files(file_collection):
+        file_path = Path(file)
+        new_filename = f"{file_path.stem}{file_path.suffix}"
+        new_file_path = Path(destination) / new_filename
+        move_file(file, new_file_path)

regscale/integrations/commercial/veracode.py

@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""Veracode RegScale integration"""
+from datetime import datetime
+from os import PathLike
+from typing import Optional
+
+import click
+from pathlib import Path
+
+from regscale.models.integration_models.flat_file_importer import FlatFileImporter
+from regscale.models.integration_models.veracode import Veracode
+
+
+@click.group()
+def veracode():
+    """Performs actions on Veracode export files."""
+
+
+FlatFileImporter.show_mapping(
+    group=veracode,
+    import_name="veracode",
+)
+
+
+@veracode.command(name="import_veracode")
+@FlatFileImporter.common_scanner_options(
+    message="File path to the folder containing Veracode .xlsx files to process to RegScale.",
+    prompt="File path for Veracode files",
+    import_name="veracode",
+)
+def import_veracode(
+    folder_path: PathLike[str],
+    regscale_ssp_id: int,
+    scan_date: datetime,
+    mappings_path: Path,
+    disable_mapping: bool,
+    s3_bucket: str,
+    s3_prefix: str,
+    aws_profile: str,
+    upload_file: bool,
+):
+    """
+    Import scans, vulnerabilities and assets to RegScale from Veracode export files
+    """
+    import_veracode_data(
+        folder_path=folder_path,
+        regscale_ssp_id=regscale_ssp_id,
+        scan_date=scan_date,
+        mappings_path=mappings_path,
+        disable_mapping=disable_mapping,
+        s3_bucket=s3_bucket,
+        s3_prefix=s3_prefix,
+        aws_profile=aws_profile,
+        upload_file=upload_file,
+    )
+
+
+def import_veracode_data(
+    folder_path: PathLike[str],
+    regscale_ssp_id: int,
+    scan_date: datetime,
+    mappings_path: Path,
+    s3_bucket: str,
+    s3_prefix: str,
+    aws_profile: str,
+    disable_mapping: Optional[bool] = False,
+    upload_file: Optional[bool] = True,
+) -> None:
+    """Import scans, vulnerabilities and assets to RegScale from Veracode export files"
+
+    :param os.PathLike[str] folder_path: Path to the folder containing Veracode files
+    :param int regscale_ssp_id: RegScale SSP ID
+    :param datetime scan_date: Scan date
+    :param os.PathLike[str] mappings_path: Path to the header mapping file
+    :param str s3_bucket: S3 bucket to download the files from
+    :param str s3_prefix: S3 prefix to download the files from
+    :param str aws_profile: AWS profile to use for S3 access
+    :param bool disable_mapping: Disable mapping
+    :param Optional[bool] upload_file: Whether to upload the file to RegScale after processing, defaults to True
+    :rtype: None
+    """
+    FlatFileImporter.import_files(
+        import_type=Veracode,
+        import_name="Veracode",
+        file_types=[".xml", ".xlsx"],
+        folder_path=folder_path,
+        regscale_ssp_id=regscale_ssp_id,
+        scan_date=scan_date,
+        mappings_path=mappings_path,
+        disable_mapping=disable_mapping,
+        s3_bucket=s3_bucket,
+        s3_prefix=s3_prefix,
+        aws_profile=aws_profile,
+        upload_file=upload_file,
+    )

regscale/integrations/commercial/wizv2/WizDataMixin.py

@@ -0,0 +1,97 @@
+import json
+import logging
+import os
+from datetime import datetime, timedelta
+from typing import Optional, Dict, Any, List
+
+from regscale.core.app.utils.app_utils import error_and_exit, check_file_path
+from regscale.integrations.commercial.wizv2.constants import CONTENT_TYPE
+from regscale.core.app.application import Application
+from regscale.utils import PaginatedGraphQLClient
+
+logger = logging.getLogger("regscale")
+
+
+class WizMixin(Application):
+    def fetch_data_if_needed(
+        self,
+        file_path: str,
+        query: str,
+        topic_key: str,
+        interval_hours: int,
+        variables: Optional[Dict[str, Any]] = None,
+    ) -> List[Dict]:
+        """
+        Fetches data if the file is not present or is older than the fetch interval
+        :param str file_path: File path to write to
+        :param str query: GraphQL Query
+        :param str topic_key: Topic Key
+        :param int interval_hours: Interval in hours to fetch new data
+        :param Optional[Dict[str, Any]] variables: Variables
+        :returns: List[Dict] of data nodes
+        :rtype: List[Dict]
+        """
+        fetch_interval = timedelta(hours=interval_hours)  # Interval to fetch new data
+        current_time = datetime.now()
+
+        # Check if the file exists and its last modified time
+        if os.path.exists(file_path):
+            file_mod_time = datetime.fromtimestamp(os.path.getmtime(file_path))
+            if current_time - file_mod_time < fetch_interval:
+                nodes = self.load_file(file_path)
+                return nodes
+        nodes = self.fetch_data(query, topic_key, variables)
+        self.write_to_file(file_path, nodes)
+        return nodes
+
+    @staticmethod
+    def write_to_file(file_path: str, nodes: List[Dict]):
+        """
+        Writes the nodes to a file
+        :param str file_path: File path to write to
+        :param List[Dict] nodes: List of nodes to write
+        """
+        check_file_path("artifacts")
+        with open(file_path, "w") as file:
+            json.dump(nodes, file)
+
+    @staticmethod
+    def load_file(file_path: str) -> List[Dict]:
+        """
+        Loads the file and maps the nodes to Vulnerability objects
+        :param str file_path: File path to load
+        Returns: List of Dict
+        :rtype: List[Dict]
+        """
+        check_file_path("artifacts")
+        with open(file_path, "r") as file:
+            return json.load(file)
+
+    def fetch_data(self, query: str, topic_key: str, variables: Optional[Dict[str, Any]] = None) -> List[Dict]:
+        """
+        Fetches data from Wiz
+        :param str query: GraphQL Query
+        :param str topic_key: Topic Key
+        :param Optional[Dict[str, Any]] variables: Variables
+        :returns: List of nodes
+        :rtype: List[Dict]
+        """
+        client = None
+        api_endpoint_url = self.config.get("wizUrl")
+        if not api_endpoint_url:
+            logger.error("Wiz API endpoint not configured")
+            error_and_exit("Wiz API endpoint not configured")
+        if token := self.config.get("wizAccessToken"):
+            client = PaginatedGraphQLClient(
+                endpoint=api_endpoint_url,
+                query=query,
+                headers={
+                    "Content-Type": CONTENT_TYPE,
+                    "Authorization": "Bearer " + token,
+                },
+            )
+
+        logger.info(f"Fetching data from Wiz on topic key for {topic_key}")
+        # Fetch all results using the client's pagination logic
+        data = client.fetch_all(variables=variables, topic_key=topic_key) if client else []
+        return data