diff --git a/README.md b/README.md index 9a00e77..2584ad2 100644 --- a/README.md +++ b/README.md @@ -60,9 +60,15 @@ The Centre for Internet Security (CIS) produce a number of cross industry standa ## Task Examples -### Converting a spreadsheet into a `component-definition` - -Plenty of compliance content exists today in spreadsheets. This [demonstration](./trestle_task_spread_sheet_to_component_definition) show how to use the xlsx-to-oscal-component-definition MVP functionality. +- Convert a spreadsheet into a `component-definition` +
+This [demonstration](./trestle_task_spread_sheet_to_component_definition) shows how to use the `trestle task xlsx-to-oscal-component-definition` functionality. +
+
+- Convert an OpenShift Compliance Operator (OSCO) results into a partial `assessment-results` +
+This [demonstration](./trestle_task_osco_to_oscal) shows how to use the `trestle task osco-to-oscal` functionality. +
## License & Authors diff --git a/trestle_task_osco_to_oscal/README.md b/trestle_task_osco_to_oscal/README.md new file mode 100644 index 0000000..68451da --- /dev/null +++ b/trestle_task_osco_to_oscal/README.md @@ -0,0 +1,72 @@ +# compliance-trestle-task-osco-to-oscal-demo + +Simple example of using trestle to facilitate transforming OSCO results to OSCAL (partial) results. + +## Prerequisites + +Download this repo + +``` +> cd +> mkdir git +> cd git +> git clone https://github.com/IBM/compliance-trestle-demos +``` + +Install compliance trestle, ideally in a python virtual environment. + +``` +> cd +> python -m venv venv.compliance-trestle-demos +> source venv.compliance-trestle-demos/bin/activate +> cd git/compliance-trestle-demos +> make install +``` + +Running the demo + +``` +> cd +> cd git/compliance-trestle-demos/trestle_task_osco_to_oscal +> trestle init +> trestle task osco-to-oscal -c ./demo-osco-to-oscal.config + +output: osco/runtime/ssg-ocp4-ds-cis-111.222.333.444-pod.oscal.json +inventory: 1 +observations: 125 +results: {} +Task: osco-to-oscal executed successfully. +``` + +Viewing the result + +``` +> cat osco/runtime/ssg-ocp4-ds-cis-111.222.333.444-pod.oscal.json +{ + "results": [ + { + "uuid": "5a69ce39-9ec9-4ded-8556-2c94a5b4e554", + "title": "OpenShift Compliance Operator", + "description": "OpenShift Compliance Operator Scan Results", + "start": "2021-09-09T19:18:09.000+00:00", + "end": "2021-09-09T19:18:09.000+00:00", + "local-definitions": { + "components": [ + { + "uuid": "1690228d-860d-4fa0-a43b-c95f2f53410e", + "type": "Service", + "title": "Red Hat OpenShift Kubernetes Service Compliance Operator for ocp4", + "description": "Red Hat OpenShift Kubernetes Service Compliance Operator for ocp4", + "status": { + "state": "operational" + } + } + ], + "inventory-items": [ + { + "uuid": "d4dff670-fe5e-4324-94aa-c1fffdef17c5", + "description": "inventory", + "props": [ + + ... +``` diff --git a/trestle_task_osco_to_oscal/demo-osco-to-oscal.config b/trestle_task_osco_to_oscal/demo-osco-to-oscal.config new file mode 100644 index 0000000..2223b72 --- /dev/null +++ b/trestle_task_osco_to_oscal/demo-osco-to-oscal.config @@ -0,0 +1,5 @@ +[task.osco-to-oscal] + +input-dir = osco/input +output-dir = osco/runtime +output-overwrite = true diff --git a/trestle_task_osco_to_oscal/osco/input/ssg-ocp4-ds-cis-111.222.333.444-pod.yaml b/trestle_task_osco_to_oscal/osco/input/ssg-ocp4-ds-cis-111.222.333.444-pod.yaml new file mode 100644 index 0000000..cba54d8 --- /dev/null +++ b/trestle_task_osco_to_oscal/osco/input/ssg-ocp4-ds-cis-111.222.333.444-pod.yaml @@ -0,0 +1,689 @@ +apiVersion: v1 +data: + exit-code: "2" + results: | + + + + OSCAP Scan Result + + kube-br7qsa3d0vceu2so1a90-roksopensca-default-0000026b.iks.mycorp + + chroot:///host + OpenSCAP + 1.3.3 + + + + + /kubernetes-api-resources + Webhook + 5m + + notselected + CCE-84209-6 + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + fail + + + + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + fail + + + + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + fail + + + + + + pass + + + + + + pass + + + + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + pass + + + + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + fail + + + + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + fail + + + + + + fail + + + + + + notselected + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + pass + + + + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + pass + + + + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + fail + + + + + + pass + + + + + + fail + + + + + + notchecked + No candidate or applicable check found. + + + notchecked + No candidate or applicable check found. + + + pass + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + pass + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + pass + + + + + + fail + + + + + + pass + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + pass + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + fail + + + + + + pass + + + + + + fail + + + + + + fail + + + + + + fail + + + + + 15.670996 + +kind: ConfigMap +metadata: + annotations: + compliance-remediations/processed: "" + compliance.openshift.io/scan-error-msg: "" + compliance.openshift.io/scan-result: NON-COMPLIANT + openscap-scan-result/node: 111.222.333.444 + creationTimestamp: "2020-08-03T02:26:34Z" + labels: + compliance-scan: ssg-ocp4-ds-cis + name: ssg-ocp4-ds-cis-111.222.333.444-pod + namespace: openshift-compliance + resourceVersion: "22693328" + selfLink: /api/v1/namespaces/openshift-compliance/configmaps/ssg-ocp4-ds-cis-111.222.333.444-pod + uid: 1da3ea81-0a25-4512-ad86-7ac360246b5d