-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
add documentation of use cmdb and update unit test
- Loading branch information
Showing
17 changed files
with
510 additions
and
93 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,118 @@ | ||
| # Example use remote config for vulnerability management | ||
|
|
||
| Initially, we need to know that the DevSecOps engine tools include a module for connecting to a vulnerability centralizer (DefectDojo). As a primary requirement for using this module, it must be considered whether a CMDB will be used or not. This is configurable through the remote config located in the [engine_core](https://github.com/bancolombia/devsecops-engine-tools/blob/trunk/example_remote_config_local/engine_core/ConfigTool.json). Below, examples of the two possible cases will be provided: | ||
|
|
||
| ### Using CMDB: | ||
| Let's suppose the CMDB response is as follows: | ||
| ```json | ||
| { | ||
| "count": 2, | ||
| "value": [ | ||
| { | ||
| "ApplicationCode": "code1-app", | ||
| "ApplicationName": "Example Application Name 1", | ||
| "ApplicationType": "Example Application type 1", | ||
| "ApplicationTag": "Example Application tag 1", | ||
| "ApplicationDescription": "Example Application description 1", | ||
| "Env": "PDN" | ||
| }, | ||
| { | ||
| "ApplicationCode": "code1-app", | ||
| "ApplicationName": "Example Application Name 1", | ||
| "ApplicationType": "Example Application type 1", | ||
| "ApplicationTag": "Example Application tag 1", | ||
| "ApplicationDescription": "Example Application description 1", | ||
| "Env": "DEV" | ||
| } | ||
| ] | ||
| } | ||
| ``` | ||
|
|
||
| Then, the remote config settings should look similar to this: | ||
| ```json | ||
| "DEFECT_DOJO": { | ||
| "HOST_DEFECT_DOJO": "http://localhost:8080", | ||
| "LIMITS_QUERY": 100, | ||
| "MAX_RETRIES_QUERY": 5, | ||
| "CMDB": { | ||
| "USE_CMDB": true, | ||
| "HOST_CMDB": "http://host_cmdb_example", | ||
| "REGEX_EXPRESSION_CMDB": "^([^-]+)", | ||
| "CMDB_MAPPING_PATH": "/path/mapping_cmdb.json", | ||
| "CMDB_MAPPING": { | ||
| "PRODUCT_TYPE_NAME": "ApplicationType", | ||
| "PRODUCT_NAME": "ApplicationName", | ||
| "TAG_PRODUCT": "ApplicationTag", | ||
| "PRODUCT_DESCRIPTION": "ApplicationDescription", | ||
| "CODIGO_APP": "ApplicationCode" | ||
| }, | ||
| "CMDB_REQUEST_RESPONSE": { | ||
| "HEADERS": { | ||
| "Content-Type": "application/json", | ||
| "Api-Key": "tokenvalue" | ||
| }, | ||
| "METHOD": "GET", | ||
| "PARAMS": { | ||
| "appCode": "codappvalue" | ||
| }, | ||
| "RESPONSE": ["value", 0] | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| **Let’s detail the description for the elements under the CMDB key:** | ||
|
|
||
| *USE_CMDB:* The value is a boolean, indicating whether or not CMDB will be used. | ||
|
|
||
| *USE_CMDB:* The value is a boolean, indicating whether or not CMDB will be used. | ||
|
|
||
| *HOST_CMDB:* The URL of the API for querying the CMDB. | ||
|
|
||
| *REGEX_EXPRESSION_CMDB:* Regular expression. | ||
|
|
||
| *CMDB_MAPPING_PATH:* Location of the mapping for possible product types. | ||
|
|
||
| *CMDB_MAPPING:* Element containing the equivalent mappings between DefectDojo and the CMDB. | ||
|
|
||
| *MDB_REQUEST_RESPONSE:* Contains the necessary elements to make a request to the CMDB. | ||
|
|
||
| *HEADERS:* Headers required to make the request. Note that the authentication type must be via Api-Key. The value "tokenvalue" should remain as is, as it is necessary for replacing the token. | ||
|
|
||
| *METHOD:* Can be either POST or GET. | ||
|
|
||
| *PARAMS:* Used if the selected METHOD is GET. The value "codappvalue" should remain as is, as it is necessary for replacement. | ||
|
|
||
| *BODY:* Used if the selected METHOD is POST. The value "codappvalue" should remain as is, as it is necessary for replacement. | ||
|
|
||
| ### Without Using CMDB: | ||
| For this case, three environment variables must be created according to the DevOps platform. | ||
| ```bash | ||
| ## Platform local | ||
| DET_VM_PRODUCT_TYPE_NAME="Example product type name" | ||
| DET_VM_PRODUCT_NAME="Example product type name" | ||
| DET_VM_PRODUCT_DESCRIPTION="Example product descrition" | ||
|
|
||
| ## Platform azure | ||
| VM_PRODUCT_TYPE_NAME="Example product type name" | ||
| VM_PRODUCT_NAME="Example product type name" | ||
| VM_PRODUCT_DESCRIPTION="Example product descrition" | ||
|
|
||
| ## Platform github | ||
| VM_PRODUCT_TYPE_NAME="Example product type name" | ||
| VM_PRODUCT_NAME="Example product type name" | ||
| VM_PRODUCT_DESCRIPTION="Example product descrition" | ||
| ``` | ||
|
|
||
| The remote config settings should look similar to this: | ||
| ```json | ||
| "DEFECT_DOJO": { | ||
| "HOST_DEFECT_DOJO": "http://localhost:8080", | ||
| "LIMITS_QUERY": 100, | ||
| "MAX_RETRIES_QUERY": 5, | ||
| "CMDB": { | ||
| "USE_CMDB": false, | ||
| "REGEX_EXPRESSION_CMDB": "^([^-]+)", | ||
| } | ||
| } | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.