tenable_aws_sechub 2.2.2__tar.gz

tenable_aws_sechub-2.2.2/PKG-INFO

@@ -0,0 +1,112 @@
+Metadata-Version: 2.4
+Name: tenable_aws_sechub
+Version: 2.2.2
+Summary: Tenable Vulnerability Management to AWS Security Hub
+Author-email: "Tenable, Inc." <smcgrath@tenable.com>
+License: MIT License
+Project-URL: Homepage, https://github.com/tenable/Security-Hub
+Project-URL: Repository, https://github.com/tenable/Security-Hub
+Project-URL: Issues, https://github.com/tenable/Security-Hub/issues
+Project-URL: Changelog, https://github.com/tenable/Security-Hub/blob/main/CHANGELOG.md
+Keywords: tenable,tenable vulnerability management,tenable security center,tenable.io,tenable.sc,aws,security hub
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Information Technology
+Classifier: Topic :: System :: Systems Administration
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Description-Content-Type: text/markdown
+Requires-Dist: arrow>=1.3.0
+Requires-Dist: restfly>=1.4.5
+Requires-Dist: typer>=0.9.0
+Requires-Dist: tomlkit>=0.12.4
+Requires-Dist: rich>=13.3.1
+Requires-Dist: boto3>=1.34.68
+Requires-Dist: pytenable>=1.5.0
+
+# Tenable Vulnerability Management to AWS Transformer
+
+| :exclamation: | If upgrading from v1 please read the upgrade section |
+| ------------- | :--------------------------------------------------- |
+
+This tool is designed to consume Tenable.io asset and vulnerability data,
+transform that data into the AWS Security Hub Finding format, and then upload
+the resulting data into AWS Security Hub.
+
+The tool can be run as either a one-shot docker container or as a command-line
+tool. To run as a docker image, you'll need to build the image and then pass
+the config file to the container.
+
+## Requirements
+
+- The Tenable Vulnerability Management Integration for Security Hub must be
+  configured to accept findings from the integration.
+- At a minimum the configuration file must have the account id that the events
+  will be sent to. Ideally the region should be configured as well.
+- A set of API Keys within TVM should be configured to allow exportation of
+  assets and vulnerability findings from the platform. These keys should be
+  wither configured within the configuration file or as environment variables
+
+## Installation
+
+```
+pip install tenable_aws_sechub
+```
+
+## Upgrading from v1
+
+If you are upgrading from the original version of the integration, please note
+that there are some additional steps that need to be taken as the ARN that is
+used has changed.
+
+1. Disable the Tenable.io SecurityHub integration
+2. Enable the Tenable Vulnerability Management integration
+3. Configure and run the updated integration (this code)
+
+## Configuration
+
+Simply build a configuration file (or use the [example file][cfg] provided)
+with the following details:
+
+```toml
+access_key = "1234567890abcdef1234567890"
+secret_key = "1234567890abcdef1234567890"
+
+[[aws_profile]]
+name = "default"
+accounts = [1234567890]
+region = "us-east-1"
+```
+
+Once the configuration file is saved, go ahead and ensure that the AWS CLI can
+communicate to AWS, or generate the appropriate configuration parameters that
+AWS needs for their boto3 client. Details for how to do this is documented
+below:
+
+1. [Boto3 Configuration](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/quickstart.html#configuration)
+2. [AWS CLI Config](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html)
+
+## Running the integration
+
+```
+❯ tvm2aws --configfile /path/to/config.toml
+```
+
+## Commandline options
+
+```
+❯ tvm2aws --help
+
+ Usage: tvm2aws [OPTIONS]
+
+ Tenable to AWS Security Hub vulnerability finding importer.
+
+╭─ Options ───────────────────────────────────────────────────────────────────╮
+│ --configfile          PATH                  [default: tvm2aws.toml]         │
+│ --verbose     -v      INTEGER RANGE [x<=5]  [default: 2]                    │
+│ --help                                      Show this message and exit.     │
+╰─────────────────────────────────────────────────────────────────────────────╯
+```
+
+[cfg]: tvm2aws.toml

tenable_aws_sechub-2.2.2/README.md

@@ -0,0 +1,85 @@
+# Tenable Vulnerability Management to AWS Transformer
+
+| :exclamation: | If upgrading from v1 please read the upgrade section |
+| ------------- | :--------------------------------------------------- |
+
+This tool is designed to consume Tenable.io asset and vulnerability data,
+transform that data into the AWS Security Hub Finding format, and then upload
+the resulting data into AWS Security Hub.
+
+The tool can be run as either a one-shot docker container or as a command-line
+tool. To run as a docker image, you'll need to build the image and then pass
+the config file to the container.
+
+## Requirements
+
+- The Tenable Vulnerability Management Integration for Security Hub must be
+  configured to accept findings from the integration.
+- At a minimum the configuration file must have the account id that the events
+  will be sent to. Ideally the region should be configured as well.
+- A set of API Keys within TVM should be configured to allow exportation of
+  assets and vulnerability findings from the platform. These keys should be
+  wither configured within the configuration file or as environment variables
+
+## Installation
+
+```
+pip install tenable_aws_sechub
+```
+
+## Upgrading from v1
+
+If you are upgrading from the original version of the integration, please note
+that there are some additional steps that need to be taken as the ARN that is
+used has changed.
+
+1. Disable the Tenable.io SecurityHub integration
+2. Enable the Tenable Vulnerability Management integration
+3. Configure and run the updated integration (this code)
+
+## Configuration
+
+Simply build a configuration file (or use the [example file][cfg] provided)
+with the following details:
+
+```toml
+access_key = "1234567890abcdef1234567890"
+secret_key = "1234567890abcdef1234567890"
+
+[[aws_profile]]
+name = "default"
+accounts = [1234567890]
+region = "us-east-1"
+```
+
+Once the configuration file is saved, go ahead and ensure that the AWS CLI can
+communicate to AWS, or generate the appropriate configuration parameters that
+AWS needs for their boto3 client. Details for how to do this is documented
+below:
+
+1. [Boto3 Configuration](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/quickstart.html#configuration)
+2. [AWS CLI Config](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html)
+
+## Running the integration
+
+```
+❯ tvm2aws --configfile /path/to/config.toml
+```
+
+## Commandline options
+
+```
+❯ tvm2aws --help
+
+ Usage: tvm2aws [OPTIONS]
+
+ Tenable to AWS Security Hub vulnerability finding importer.
+
+╭─ Options ───────────────────────────────────────────────────────────────────╮
+│ --configfile          PATH                  [default: tvm2aws.toml]         │
+│ --verbose     -v      INTEGER RANGE [x<=5]  [default: 2]                    │
+│ --help                                      Show this message and exit.     │
+╰─────────────────────────────────────────────────────────────────────────────╯
+```
+
+[cfg]: tvm2aws.toml

tenable_aws_sechub-2.2.2/pyproject.toml

@@ -0,0 +1,91 @@
+[build-system]
+requires        = ["setuptools"]
+build-backend   = "setuptools.build_meta"
+
+[project]
+dynamic         = ["version", "readme"]
+name            = "tenable_aws_sechub"
+description     = "Tenable Vulnerability Management to AWS Security Hub"
+authors         = [
+ {name = "Tenable, Inc.", email = "smcgrath@tenable.com" }
+]
+keywords        = [
+    "tenable",
+    "tenable vulnerability management",
+    "tenable security center",
+    "tenable.io",
+    "tenable.sc",
+    "aws",
+    "security hub"
+]
+license = {text = "MIT License"}
+classifiers     = [
+    "Development Status :: 5 - Production/Stable",
+    "Intended Audience :: Information Technology",
+    "Topic :: System :: Systems Administration",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12"
+]
+dependencies    = [
+    "arrow>=1.3.0",
+    "restfly>=1.4.5",
+    "typer>=0.9.0",
+    "tomlkit>=0.12.4",
+    "rich>=13.3.1",
+    "boto3>=1.34.68",
+    "pytenable>=1.5.0",
+]
+
+[project.urls]
+Homepage        = "https://github.com/tenable/Security-Hub"
+Repository      = "https://github.com/tenable/Security-Hub"
+Issues          = "https://github.com/tenable/Security-Hub/issues"
+Changelog       = "https://github.com/tenable/Security-Hub/blob/main/CHANGELOG.md"
+
+[project.scripts]
+tvm2aws         = "tenable_aws_sechub.cli:app"
+
+[tool.setuptools.dynamic]
+version = {attr = "tenable_aws_sechub.version.version"}
+readme = {file = ["README.md"], content-type = "text/markdown"}
+
+[tool.setuptools.packages.find]
+include         = ["tenable_aws_sechub*"]
+
+[tool.ruff.lint]
+select = ["E4", "E7", "E9", "F", "B"]
+fixable = [ "ALL" ]
+unfixable = [ "B" ]
+
+
+[tool.ruff.format]
+quote-style = "single"
+indent-style = "space"
+skip-magic-trailing-comma = false
+line-ending = "lf"
+docstring-code-format = false
+docstring-code-line-length = "dynamic"
+
+
+[tool.ruff.lint.per-file-ignores]
+"__init__.py" = ["E402", "F401"]
+"tenable/vm.py" = ["F401"]
+"**/{tests,docs,tools}/*" = ["E402"]
+
+[tool.pytest.ini_options]
+addopts  = "--cov-report term-missing --cov=tenable_aws_sechub"
+pythonpath = ["."]
+testpaths = ["./tests"]
+filterwarnings = ["ignore:::DeprecationWarning"]
+
+[dependency-groups]
+dev = [
+    "moto>=5.0.28",
+    "ptpython>=3.0.30",
+    "pytest>=8.3.4",
+    "pytest-console-scripts>=1.4.1",
+    "pytest-cov>=6.0.0",
+    "ruff>=0.9.6",
+]

tenable_aws_sechub-2.2.2/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

tenable_aws_sechub-2.2.2/tenable_aws_sechub/cli.py

@@ -0,0 +1,42 @@
+"""
+Simple CLI wrapper for commandline interaction with the integration.
+"""
+
+import logging
+from pathlib import Path
+from typing_extensions import Annotated
+import typer
+import tomlkit
+from rich.logging import RichHandler
+from .transform import Processor
+
+
+app = typer.Typer(add_completion=False)
+
+
+@app.command()
+def sechub(
+    configfile: Path = Path('tvm2aws.toml'),
+    verbose: Annotated[int, typer.Option('--verbose', '-v', max=5, count=True)] = 2,
+):
+    """
+    Tenable to AWS Security Hub vulnerability finding importer.
+    """
+    # Set the logging handler.
+    logging.basicConfig(
+        level=(5 - verbose) * 10,
+        datefmt='[%X]',
+        handlers=[RichHandler(rich_tracebacks=True)],
+    )
+
+    # Read the configuration file
+    with configfile.open('r', encoding='utf-8') as cobj:
+        config = tomlkit.load(cobj)
+
+    # Instantiate and run the ingestion processor.
+    processor = Processor(config)
+    processor.ingest()
+
+    # Write out the updated configuration file with the updated parameters.
+    with configfile.open('w', encoding='utf-8') as cobj:
+        tomlkit.dump(processor.config, cobj)

tenable_aws_sechub-2.2.2/tenable_aws_sechub/finding.py

@@ -0,0 +1,184 @@
+"""
+The findings module handles transforming a TVM vulnerability finding into an
+AWS Security Hub finding.
+"""
+
+import logging
+from typing import Dict, List
+
+import arrow
+from restfly.utils import dict_clean, dict_flatten, trunc
+
+log = logging.getLogger('sechub.finding')
+
+SEV_MAP = {
+    0: [0, 'INFORMATIONAL'],
+    1: [10, 'LOW'],
+    2: [40, 'MEDIUM'],
+    3: [70, 'HIGH'],
+    4: [90, 'CRITICAL'],
+}
+
+STATE_MAP = {
+    'OPEN': 'ACTIVE',
+    'NEW': 'ACTIVE',
+    'REOPENED': 'ACTIVE',
+    'FIXED': 'ARCHIVED',
+}
+
+
+class Finding:
+    """
+    Security Hub Finding transformer
+    """
+
+    region: str
+    start_date: str
+
+    def __init__(
+        self,
+        region: str,
+    ):
+        self.region = region
+        # self.account_id = account_id
+        # self.map_to_asset_account = map_to_asset_account
+        self.start_date = arrow.now().isoformat()
+        # if allowed_accounts:
+        #     self.allowed_accounts = allowed_accounts
+        # elif map_to_asset_account and not allowed_accounts:
+        #     self.allowed_accounts = [account_id]
+
+    def check_required_params(self, vuln: Dict):
+        """
+        Checks to see if all of the required attributes exist for the finding
+        to be generated.  If validation fails, then a KeyError will be raised
+        detailing the missing keys or keys with empty data.
+
+        Args:
+            vuln (dict): The vuln object to check
+        """
+        # We only need to specify the asset fields that are required as these
+        # fields must never have a NoneType value in them.
+        required_attributes = [
+            'asset.cloud.aws.region',
+            'asset.cloud.aws.ec2_instance_id',
+            'asset.cloud.aws.owner_id',
+            'asset.cloud.aws.ec2_instance_type',
+            'asset.cloud.aws.ec2_instance_ami_id',
+        ]
+        failed = []
+        for attr in required_attributes:
+            if vuln.get(attr) is None:
+                failed.append(attr)
+        if failed:
+            raise KeyError(
+                (
+                    f'The required asset attributes {",".join(failed)}'
+                    f' were not set on asset {vuln["asset.uuid"]}'
+                )
+            )
+        # NOTE: Disabled the account checking as we will always be using the account
+        #       owner from the asset moving forward.
+        #
+        # if (
+        #     self.allowed_accounts
+        #     and vuln.get('asset.aws_owner_id') not in self.allowed_accounts
+        #     and self.map_to_asset_account
+        # ):
+        #     raise KeyError(
+        #         f'asset {vuln["asset.aws_owner_id"]}:{vuln["asset.uuid"]} is not within'
+        #         ' one of the allowed accounts.'
+        #     )
+
+    def generate(self, vuln: Dict) -> Dict:
+        """
+        Generates an AWS Security Hub finding based on the TVM asset and vuln
+        finding that was inputted
+
+        Args:
+            vuln (dict): The vuln object from the vuln export
+
+        Returns:
+            dict:
+                The transformed AWS Sechub finding
+        """
+        vuln = dict_flatten(vuln)
+        self.check_required_params(vuln)
+        normalized, label = SEV_MAP[vuln.get('severity_id', 0)]
+
+        finding = {
+            'SchemaVersion': '2018-10-08',
+            'FirstObservedAt': vuln['first_found'],
+            'LastObservedAt': vuln['last_found'],
+            'ProductArn': (
+                f'arn:aws:securityhub:{self.region}::product/tenable/vulnerability-management'
+            ),
+            'AwsAccountId': vuln['asset.cloud.aws.owner_id'],
+            'GeneratorId': f'tenable-plugin-{vuln["plugin.id"]}',
+            'Id': (
+                f'{vuln["asset.cloud.aws.region"]}/'
+                f'{vuln["asset.cloud.aws.ec2_instance_id"]}/'
+                f'{vuln["plugin.id"]}'
+            ),
+            'CreatedAt': self.start_date,
+            'UpdatedAt': self.start_date,
+            'Types': ['Software and Configuration Checks/Vulnerabilities/CVE'],
+            'Severity': {
+                'Label': label,
+                'Normalized': normalized,
+                'Original': vuln.get('severity', 'info'),
+            },
+            # Some plugin names run quite long, we will need to truncate to
+            # the max string size that AWS supports.
+            'Title': trunc(vuln['plugin.name'], 256),
+            # The description cannot exceed 1024 characters in size.
+            'Description': trunc(vuln['plugin.description'], 1024),
+            'Resources': [
+                {
+                    'Type': 'AwsEc2Instance',
+                    'Id': (
+                        'arn:aws:ec2:'
+                        f'{vuln["asset.cloud.aws.region"]}:'
+                        f'{vuln["asset.cloud.aws.owner_id"]}:'
+                        'instance:'
+                        f'{vuln["asset.cloud.aws.ec2_instance_id"]}'
+                    ),
+                    'Region': vuln['asset.cloud.aws.region'],
+                    'Details': {
+                        'AwsEc2Instance': {
+                            'Type': vuln['asset.cloud.aws.ec2_instance_type'],
+                            'ImageId': vuln['asset.cloud.aws.ec2_instance_ami_id'],
+                            'IpV4Addresses': vuln['asset.network.ipv4s']
+                            if vuln.get('asset.network.ipv4s')
+                            else None,
+                            'IpV6Addresses': vuln['asset.network.ipv6s']
+                            if vuln.get('asset.network.ipv6s')
+                            else None,
+                        },
+                    },
+                }
+            ],
+            'ProductFields': {
+                'CVE': ', '.join(vuln.get('plugin.cve', [])),
+                'Plugin Family': vuln['plugin.family'],
+                'Type': vuln['plugin.type'],
+            },
+            # Have to research if we want to continue to construct direct
+            # links into the relevant part of the UI.  This may be more
+            # complicated with the export workbenches than they were with the
+            # legacy workbenches.
+            # 'SourceUrl': 'XXXXXXX',
+            'Remediation': {
+                'Recommendation': {
+                    # The solution cannot exceed 1024 characters in length.
+                    'Text': trunc(vuln['plugin.solution'], 512)
+                    if vuln.get('plugin.solution')
+                    else None,
+                    'Url': vuln.get('plugin.see_also')[0]
+                    if vuln.get('plugin.see_also')
+                    else None,
+                }
+            },
+            'RecordState': STATE_MAP[vuln['state']],
+        }
+        return dict_clean(finding)

tenable_aws_sechub-2.2.2/tenable_aws_sechub/transform.py

@@ -0,0 +1,194 @@
+"""
+Transform module handles connection to both APIs and the mechanics of pushing
+the data between them.
+"""
+
+import logging
+from typing import Any, Dict, List
+
+import arrow
+import boto3
+from restfly.utils import dict_flatten, dict_merge
+from tenable.io import TenableIO
+
+from .finding import Finding
+
+
+class Cache:
+    """
+    AWS Cache Profile
+    """
+
+    session: 'boto3.session.Session'
+    client: 'boto3.session.Session'
+    cache: List[Dict]
+    region: str
+    finding: Finding
+    limit: int
+    count: int
+
+    def __init__(self, region: str, profile: str, limit: int = 100):
+        self.region = region
+        self.finding = Finding(region=region)
+        self.cache = []
+        self.count = 0
+        self.limit = limit
+        self.session = boto3.session.Session(
+            profile_name=profile,
+            region_name=region,
+        )
+        self.client = self.session.client('securityhub')
+
+    def add(self, finding: Dict):
+        """
+        Adds the finding to the cache to be uploaded.  If the cache exceeds the max
+        size limit, then we will automatically push the cache up to SecurityHub.
+
+        Args:
+            finding: Merged TVM finding and asset metadata
+        """
+        transformed = self.finding.generate(finding)
+        self.count += 1
+        self.cache.append(transformed)
+        if len(self.cache) >= self.limit:
+            self.commit()
+
+    def commit(self):
+        """
+        Flushes the cache of findings up to Security Hub.
+        """
+        if len(self.cache) > 0:
+            self.client.batch_import_findings(Findings=self.cache)
+            self.cache = []
+
+
+class Processor:  # noqa PLR902
+    """
+    Main transform processor class.
+    """
+
+    tvm: TenableIO
+    aws_finding: Finding
+    since: int = 0
+    config: Dict
+    accounts: Dict[str, str]
+    caches: Dict[str, Cache]
+    states: List[str] = ['open', 'reopened', 'fixed']
+    sources: List[str] = ['CloudDiscoveryConnector']
+    severity: List[str] = ['high', 'critical']
+
+    def __init__(self, config: Dict):
+        # We will be maintining caches and boto3 sessions for each profile described
+        # within the configuration file.  As many accounts can also exist within a
+        # singular profile, we will also have an independent dictionary to store the
+        # mapping between account and profile.  This will mean that the "add" method
+        # will now automatically refuse any account_ids that arent in the mapping and
+        # instead throw a warning log message instead.
+        self.caches = {}
+        self.accounts = {}
+        for profile in config.get('aws_profile', []):
+            # For each profile defined, we will be creating a new session, client,
+            # cache, and build the account to profile linkages.
+            self.caches[profile['name']] = Cache(
+                region=profile['region'],
+                profile=profile['name'],
+                limit=config.get('upload_batch_size', 100),
+            )
+            for account in profile['accounts']:
+                self.accounts[str(account)] = profile['name']
+
+        self.config = config
+        self.since = config.get('since', self.since)
+        self.states = config.get('states', self.states)
+        self.sources = config.get('sources', self.sources)
+        self.severity = config.get('severity', self.severity)
+        self.tvm = TenableIO(
+            access_key=config.get('access_key'),
+            secret_key=config.get('secret_key'),
+            url=config.get('tvm_url', 'https://cloud.tenable.com'),
+        )
+        self._log = logging.getLogger('Tenb2SecHub')
+        self._log.debug(self.caches)
+        self._log.debug(self.accounts)
+
+    def get_trimmed_assets(self):
+        """
+        Retreives the asset metadata and then trims out the fields that we will
+        not be needing to merge into the finding data.  We do this in order to
+        ensure that we dont eat up any more memory than we need to.
+
+        Returns:
+            dict:
+                The dictionary of the trimmed assets.
+        """
+        ts = arrow.utcnow().shift(days=-30).timestamp()
+        if ts > self.since:
+            ts = self.since
+
+        assets = self.tvm.exports.assets_v2(since=ts)
+        trims = [
+            'network.ipv4s',
+            'network.ipv6s',
+            'cloud.aws.region',
+            'cloud.aws.ec2_instance_id',
+            'cloud.aws.owner_id',
+            'cloud.aws.ec2_instance_type',
+            'cloud.aws.ec2_instance_ami_id',
+        ]
+        trimmed = {}
+        for asset in assets:
+            a = dict_flatten(asset)
+            if a.get('cloud.aws.owner_id', None) not in self.accounts:
+                self._log.warning(f'Asset {a["id"]} not found in AWS account listing')
+                continue
+            trimmed[a['id']] = {k: v for k, v in a.items() if k in trims}
+            self._log.debug(f'Adding {a["id"]} to {a["cloud.aws.owner_id"]}')
+        return trimmed
+
+    def ingest(self):
+        """
+        Perform the finding ingestion into AWS Security Hub.
+        """
+        # Update the since parameter stored int he configuration to the current
+        # timestamp.
+        self.config['since'] = int(arrow.now().timestamp())
+
+        # Initiate the vulnerability export and get the trimmed asset data.
+        vulns = self.tvm.exports.vulns(
+            since=self.since, state=self.states, severity=self.severity
+        )
+        assets = self.get_trimmed_assets()
+
+        # For each vulnerability finding, we will merge in the associated
+        # asset metadata, then feed the merged information into the AWS
+        # finding generator.  If we successfully got a finding generated, then
+        # add that finding to the batch queue.
+        for vuln in vulns:
+            asset_obj = assets.get(vuln['asset']['uuid'])
+            if not asset_obj:
+                self._log.warning(
+                    f'No asset data for {vuln["asset"]["uuid"]} within asset cache.  '
+                    f'Not reporting plugin {vuln["plugin"]["id"]}.'
+                )
+                continue
+            aws_account = asset_obj['cloud.aws.owner_id']
+            profile_id = self.accounts.get(aws_account)
+            vuln['asset'] = dict_merge(vuln['asset'], asset_obj)
+            try:
+                self._log.debug(vuln)
+                self.caches[profile_id].add(vuln)
+            except Exception as err:
+                self._log.warning(
+                    (
+                        f'Asset {vuln["asset"]["uuid"]} finding '
+                        f'{vuln["plugin"]["id"]} failed to add '
+                        f'with error: {err}'
+                    )
+                )
+
+        # Commit any remaining findings in the queues to AWS.
+        for _, cache in self.caches.items():
+            cache.commit()
+
+        for profile, cache in self.caches.items():
+            self._log.info(f'Sent {cache.count} events to profile {profile}')

tenable_aws_sechub-2.2.2/tenable_aws_sechub/version.py

@@ -0,0 +1 @@
+version = '2.2.2'

tenable_aws_sechub-2.2.2/tenable_aws_sechub.egg-info/PKG-INFO

@@ -0,0 +1,112 @@
+Metadata-Version: 2.4
+Name: tenable_aws_sechub
+Version: 2.2.2
+Summary: Tenable Vulnerability Management to AWS Security Hub
+Author-email: "Tenable, Inc." <smcgrath@tenable.com>
+License: MIT License
+Project-URL: Homepage, https://github.com/tenable/Security-Hub
+Project-URL: Repository, https://github.com/tenable/Security-Hub
+Project-URL: Issues, https://github.com/tenable/Security-Hub/issues
+Project-URL: Changelog, https://github.com/tenable/Security-Hub/blob/main/CHANGELOG.md
+Keywords: tenable,tenable vulnerability management,tenable security center,tenable.io,tenable.sc,aws,security hub
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Information Technology
+Classifier: Topic :: System :: Systems Administration
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Description-Content-Type: text/markdown
+Requires-Dist: arrow>=1.3.0
+Requires-Dist: restfly>=1.4.5
+Requires-Dist: typer>=0.9.0
+Requires-Dist: tomlkit>=0.12.4
+Requires-Dist: rich>=13.3.1
+Requires-Dist: boto3>=1.34.68
+Requires-Dist: pytenable>=1.5.0
+
+# Tenable Vulnerability Management to AWS Transformer
+
+| :exclamation: | If upgrading from v1 please read the upgrade section |
+| ------------- | :--------------------------------------------------- |
+
+This tool is designed to consume Tenable.io asset and vulnerability data,
+transform that data into the AWS Security Hub Finding format, and then upload
+the resulting data into AWS Security Hub.
+
+The tool can be run as either a one-shot docker container or as a command-line
+tool. To run as a docker image, you'll need to build the image and then pass
+the config file to the container.
+
+## Requirements
+
+- The Tenable Vulnerability Management Integration for Security Hub must be
+  configured to accept findings from the integration.
+- At a minimum the configuration file must have the account id that the events
+  will be sent to. Ideally the region should be configured as well.
+- A set of API Keys within TVM should be configured to allow exportation of
+  assets and vulnerability findings from the platform. These keys should be
+  wither configured within the configuration file or as environment variables
+
+## Installation
+
+```
+pip install tenable_aws_sechub
+```
+
+## Upgrading from v1
+
+If you are upgrading from the original version of the integration, please note
+that there are some additional steps that need to be taken as the ARN that is
+used has changed.
+
+1. Disable the Tenable.io SecurityHub integration
+2. Enable the Tenable Vulnerability Management integration
+3. Configure and run the updated integration (this code)
+
+## Configuration
+
+Simply build a configuration file (or use the [example file][cfg] provided)
+with the following details:
+
+```toml
+access_key = "1234567890abcdef1234567890"
+secret_key = "1234567890abcdef1234567890"
+
+[[aws_profile]]
+name = "default"
+accounts = [1234567890]
+region = "us-east-1"
+```
+
+Once the configuration file is saved, go ahead and ensure that the AWS CLI can
+communicate to AWS, or generate the appropriate configuration parameters that
+AWS needs for their boto3 client. Details for how to do this is documented
+below:
+
+1. [Boto3 Configuration](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/quickstart.html#configuration)
+2. [AWS CLI Config](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html)
+
+## Running the integration
+
+```
+❯ tvm2aws --configfile /path/to/config.toml
+```
+
+## Commandline options
+
+```
+❯ tvm2aws --help
+
+ Usage: tvm2aws [OPTIONS]
+
+ Tenable to AWS Security Hub vulnerability finding importer.
+
+╭─ Options ───────────────────────────────────────────────────────────────────╮
+│ --configfile          PATH                  [default: tvm2aws.toml]         │
+│ --verbose     -v      INTEGER RANGE [x<=5]  [default: 2]                    │
+│ --help                                      Show this message and exit.     │
+╰─────────────────────────────────────────────────────────────────────────────╯
+```
+
+[cfg]: tvm2aws.toml

tenable_aws_sechub-2.2.2/tenable_aws_sechub.egg-info/SOURCES.txt

@@ -0,0 +1,16 @@
+README.md
+pyproject.toml
+tenable_aws_sechub/__init__.py
+tenable_aws_sechub/cli.py
+tenable_aws_sechub/finding.py
+tenable_aws_sechub/transform.py
+tenable_aws_sechub/version.py
+tenable_aws_sechub.egg-info/PKG-INFO
+tenable_aws_sechub.egg-info/SOURCES.txt
+tenable_aws_sechub.egg-info/dependency_links.txt
+tenable_aws_sechub.egg-info/entry_points.txt
+tenable_aws_sechub.egg-info/requires.txt
+tenable_aws_sechub.egg-info/top_level.txt
+tests/test_cli.py
+tests/test_finding.py
+tests/test_transform.py

tenable_aws_sechub-2.2.2/tenable_aws_sechub.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

tenable_aws_sechub-2.2.2/tenable_aws_sechub.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+tvm2aws = tenable_aws_sechub.cli:app

tenable_aws_sechub-2.2.2/tenable_aws_sechub.egg-info/requires.txt

@@ -0,0 +1,7 @@
+arrow>=1.3.0
+restfly>=1.4.5
+typer>=0.9.0
+tomlkit>=0.12.4
+rich>=13.3.1
+boto3>=1.34.68
+pytenable>=1.5.0

tenable_aws_sechub-2.2.2/tenable_aws_sechub.egg-info/top_level.txt

@@ -0,0 +1 @@
+tenable_aws_sechub

tenable_aws_sechub-2.2.2/tests/test_cli.py

@@ -0,0 +1,9 @@
+import pytest
+from pytest_console_scripts import ScriptRunner
+from moto import mock_aws
+
+
+@pytest.mark.skip(reason='Moto doesnt mock BatchImportFindings yet')
+@mock_aws
+def test_cli_command(script_runner: ScriptRunner):
+    result = script_runner.run(['tvm2aws'])

tenable_aws_sechub-2.2.2/tests/test_finding.py

@@ -0,0 +1,109 @@
+import pytest
+
+from tenable_aws_sechub.finding import Finding
+
+
+def test_finding_required_typerror(finding_local):
+    """
+    Tests the check_required_params method and check to see if all of the
+    required params actually fail on this local asset.
+    """
+    f = Finding('')
+    with pytest.raises(
+        KeyError,
+        match=(
+            'The required asset attributes '
+            'asset.cloud.aws.region,'
+            'asset.cloud.aws.ec2_instance_id,'
+            'asset.cloud.aws.owner_id,'
+            'asset.cloud.aws.ec2_instance_type,'
+            'asset.cloud.aws.ec2_instance_ami_id '
+            'were not set on asset '
+            '01234567-1234-abcd-0987-01234567890a'
+        ),
+    ):
+        f.check_required_params(finding_local)
+
+
+def test_finding_generate_finding_keyerror(finding_local, finding_aws):
+    """
+    Tests the generate finding method and ensures that a key error is thrown
+    when an asset or a finding doesn't have the required parameters to generate
+    AWS finding.
+    """
+    f = Finding('')
+    with pytest.raises(KeyError):
+        f.generate(finding_local)
+
+    del finding_aws['plugin.type']
+    with pytest.raises(KeyError, match='plugin.type'):
+        f.generate(finding_aws)
+
+
+def test_finding_generate_finding_success(finding_aws):
+    """
+    Tests the generate finding method on what should be a successful transform.
+    From there we will perform some minor checks to ensure that the generated
+    finding object looks correct.
+    """
+    f = Finding('AWS-REGION-1')
+    resp = f.generate(finding_aws)
+
+    # Pulled the asserts from the v1 code and made the minor modifications
+    # necessary for the test to pass the new finding obj.
+    assert resp['SchemaVersion'] == '2018-10-08'
+    assert resp['FirstObservedAt'] == '2018-03-22T13:29:22.070Z'
+    assert resp['LastObservedAt'] == '2018-12-14T12:07:38.155Z'
+    assert (
+        resp['ProductArn']
+        == 'arn:aws:securityhub:AWS-REGION-1::product/tenable/vulnerability-management'
+    )
+    assert resp['AwsAccountId'] == '600832220000'
+    assert resp['GeneratorId'] == 'tenable-plugin-106875'
+    assert resp['Id'] == 'us-east-1/i-00f9e618482900000/106875'
+    assert resp['Types'] == ['Software and Configuration Checks/Vulnerabilities/CVE']
+    assert resp['CreatedAt']
+    assert resp['UpdatedAt']
+    assert resp['Severity']['Product'] == 7
+    assert resp['Severity']['Normalized'] == 28
+    assert resp['Severity']['Label'] == 'HIGH'
+    assert resp['Title'] == 'Debian DSA-4117-1 : gcc-4.9 - security update'
+    assert isinstance(resp['Description'], str)
+    assert resp['Resources'][0]['Type'] == 'AwsEc2Instance'
+    assert (
+        resp['Resources'][0]['Id']
+        == 'arn:aws:ec2:us-east-1:600832220000:instance:i-00f9e618482900000'
+    )
+    assert resp['Resources'][0]['Region'] == 'us-east-1'
+    assert resp['Resources'][0]['Details']['AwsEc2Instance']['Type'] == 't2.medium'
+    assert (
+        resp['Resources'][0]['Details']['AwsEc2Instance']['ImageId'] == 'ami-daf89000'
+    )
+    assert resp['Resources'][0]['Details']['AwsEc2Instance']['IpV4Addresses'] == [
+        '192.168.101.249'
+    ]
+    assert 'IpV6Addresses' not in resp['Resources'][0]['Details']['AwsEc2Instance']
+    assert resp['ProductFields']['CVE'] == ''
+    assert resp['ProductFields']['Plugin Family'] == 'Debian Local Security Checks'
+    assert resp['ProductFields']['Type'] == 'local'
+    assert isinstance(resp['Remediation']['Recommendation']['Text'], str)
+    assert (
+        resp['Remediation']['Recommendation']['Url']
+        == 'https://security-tracker.debian.org/tracker/source-package/gcc-4.9'
+    )
+    assert resp['RecordState'] == 'ACTIVE'
+
+    # Also check to make sure that a fixed finding returns an "ARCHIVED"
+    # record state.
+    finding_aws['state'] = 'FIXED'
+    resp = f.generate(finding_aws)
+    assert resp['RecordState'] == 'ARCHIVED'
+
+
+def test_generate_finding_none_url(finding_aws):
+    f = Finding('')
+
+    del finding_aws['plugin.see_also']
+    resp = f.generate(finding_aws)
+
+    assert 'Url' not in resp['Remediation']['Recommendation']

tenable_aws_sechub-2.2.2/tests/test_transform.py

@@ -0,0 +1,102 @@
+import logging
+
+import pytest
+import responses
+from moto import mock_aws
+
+from tenable_aws_sechub.transform import Processor
+
+
+@pytest.fixture
+def config():
+    return {
+        'since': 0,
+        'access_key': '1234567890abcdef1234567890',
+        'secret_key': '1234567890abcdef1234567890',
+        'aws_profile': [
+            {
+                'name': 'default',
+                'region': 'us-east-1',
+                'accounts': ['600832220000'],
+            }
+        ],
+    }
+
+
+@responses.activate
+@mock_aws
+def test_processor_asset_trim(asset_aws, config):
+    id = '12345678-1234-1234-1234-1234567890ab'
+    responses.post(
+        'https://cloud.tenable.com/assets/v2/export', json={'export_uuid': id}
+    )
+    responses.get(
+        f'https://cloud.tenable.com/assets/export/{id}/status',
+        json={'status': 'FINISHED', 'chunks_available': [1]},
+    )
+    responses.get(
+        f'https://cloud.tenable.com/assets/export/{id}/chunks/1', json=[asset_aws]
+    )
+    p = Processor(config)
+
+    assets = p.get_trimmed_assets()
+    asset_id = '01234567-1234-abcd-0987-01234567890b'
+    assert isinstance(assets, dict)
+    assert asset_id in assets
+    assert 'cloud.aws.subnet_id' not in assets[asset_id].keys()
+    assert 'cloud.aws.owner_id' in assets[asset_id].keys()
+
+
+@responses.activate
+@mock_aws
+def test_processor_ingest_warn(asset_local, finding, config, caplog):
+    id = '12345678-1234-1234-1234-1234567890ab'
+    finding['asset']['uuid'] = asset_local['id']
+    responses.post(
+        'https://cloud.tenable.com/assets/v2/export', json={'export_uuid': id}
+    )
+    responses.get(
+        f'https://cloud.tenable.com/assets/export/{id}/status',
+        json={'status': 'FINISHED', 'chunks_available': [1]},
+    )
+    responses.get(
+        f'https://cloud.tenable.com/assets/export/{id}/chunks/1', json=[asset_local]
+    )
+    responses.post('https://cloud.tenable.com/vulns/export', json={'export_uuid': id})
+    responses.get(
+        f'https://cloud.tenable.com/vulns/export/{id}/status',
+        json={'status': 'FINISHED', 'chunks_available': [1]},
+    )
+    responses.get(
+        f'https://cloud.tenable.com/vulns/export/{id}/chunks/1', json=[finding]
+    )
+    p = Processor(config)
+    with caplog.at_level(logging.WARNING, logger='Tenb2SecHub'):
+        p.ingest()
+    msg = f'Asset {asset_local["id"]} not found in AWS account listing'
+    assert msg in [r.message for r in caplog.records]
+
+
+@pytest.mark.skip(reason='BatchImportFindings is not yet implemented in moto')
+@responses.activate
+@mock_aws
+def test_processor_ingest(asset_aws, finding, config):
+    id = '12345678-1234-1234-1234-1234567890ab'
+    responses.post('https://cloud.tenable.com/assets/export', json={'export_uuid': id})
+    responses.get(
+        f'https://cloud.tenable.com/assets/export/{id}/status',
+        json={'status': 'FINISHED', 'chunks_available': [1]},
+    )
+    responses.get(
+        f'https://cloud.tenable.com/assets/export/{id}/chunks/1', json=[asset_aws]
+    )
+    responses.post('https://cloud.tenable.com/vulns/export', json={'export_uuid': id})
+    responses.get(
+        f'https://cloud.tenable.com/vulns/export/{id}/status',
+        json={'status': 'FINISHED', 'chunks_available': [1]},
+    )
+    responses.get(
+        f'https://cloud.tenable.com/vulns/export/{id}/chunks/1', json=[finding]
+    )
+    p = Processor(config)
+    p.ingest()