diff --git a/.eslintrc b/.eslintrc index bcd9d7ff5..cc20d1678 100644 --- a/.eslintrc +++ b/.eslintrc @@ -13,12 +13,16 @@ "unicorn/no-zero-fractions": "off", "unicorn/no-array-for-each": "off", "unicorn/explicit-length-check": "off", + "unicorn/no-process-exit": "off", + "no-process-exit": "off", + "no-await-in-loop": "off", "no-control-regex": "off", "max-nested-callbacks": "off", "unicorn/prefer-json-parse-buffer": "off", "camelcase": "off", // Camel case fields are used in CKL "no-console": "off", "node/no-missing-import": "off", - "complexity": "off" + "complexity": "off", + "no-constant-condition": "off" } } diff --git a/.github/workflows/build-binary.yml b/.github/workflows/build-binary.yml index a98e54f2b..a014d454b 100644 --- a/.github/workflows/build-binary.yml +++ b/.github/workflows/build-binary.yml @@ -26,22 +26,22 @@ jobs: run: npm install - name: Pack Windows Installer - run: yarn run oclif-dev pack:win + run: yarn run oclif pack win - name: Pack Debian Package - run: sudo yarn run oclif-dev pack:deb + run: sudo yarn run oclif pack deb - name: Upload SAF-CLI Windows Build x64 Artifact uses: actions/upload-artifact@v2 with: name: SAF-CLI Windows Build x64 - path: dist/win/saf-*-x64.exe + path: dist/win32/saf-*-x64.exe - name: Upload SAF-CLI Windows Build x86 Artifact uses: actions/upload-artifact@v2 with: name: SAF-CLI Windows Build x86 - path: dist/win/saf-*-x86.exe + path: dist/win32/saf-*-x86.exe - name: Upload SAF-CLI Debian x64 Artifact uses: actions/upload-artifact@v2 diff --git a/.github/workflows/build-macos.yml b/.github/workflows/build-macos.yml index 1c9882967..b0b1394a3 100644 --- a/.github/workflows/build-macos.yml +++ b/.github/workflows/build-macos.yml @@ -23,7 +23,7 @@ jobs: run: rm -rf test - name: npm install and pack - run: yarn run oclif-dev pack:macos + run: yarn run oclif pack macos - name: Upload SAF-CLI macOS Installer Artifact uses: actions/upload-artifact@v2 diff --git a/.github/workflows/e2e-ci.yml b/.github/workflows/e2e-ci.yml index 1899d2a20..7a819576c 100644 --- a/.github/workflows/e2e-ci.yml +++ b/.github/workflows/e2e-ci.yml @@ -33,6 +33,9 @@ jobs: - name: Install dependencies run: yarn install + + - name: Prepack + run: yarn prepack - name: Run e2e tests run: yarn test diff --git a/.github/workflows/test-docker-image.yml b/.github/workflows/test-docker-image.yml new file mode 100644 index 000000000..ca4daa159 --- /dev/null +++ b/.github/workflows/test-docker-image.yml @@ -0,0 +1,32 @@ +name: Build and Test SAF CLI Docker Image on every Pull Request or Push to Main + +on: + push: + branches: [ main ] + pull_request: + branches: [ main ] + +env: + TEST_TAG: saf:testTag + +jobs: + docker: + runs-on: ubuntu-latest + steps: + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v1 + - name: Checkout the SAF Repository + uses: actions/checkout@v2 + - name: Build Docker Image + id: docker_build + uses: docker/build-push-action@v2 + with: + context: . + file: Dockerfile + push: false + load: true + tags: ${{ env.TEST_TAG }} + - name: Test + run: | + docker run --rm ${{ env.TEST_TAG }} + diff --git a/Dockerfile b/Dockerfile index 2921fddfa..9918c74c5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,7 +23,7 @@ COPY --from=builder /build/saf.tgz /build/ RUN npm install -g /build/saf.tgz # Useful for CI pipelines -RUN apk add bash jq +RUN apk add bash jq curl ca-certificates ENTRYPOINT ["saf"] VOLUME ["/share"] diff --git a/README.md b/README.md index 6ed9cadd9..7a3ed4335 100644 --- a/README.md +++ b/README.md @@ -4,6 +4,11 @@ The MITRE Security Automation Framework (SAF) Command Line Interface (CLI) bring The SAF CLI is the successor to [Heimdall Tools](https://github.com/mitre/heimdall_tools) and [InSpec Tools](https://github.com/mitre/inspec_tools). +## Terminology: + +- "[Heimdall](https://github.com/mitre/heimdall2)" - Our visualizer for all security result data +- "[Heimdall Data Format (HDF)](https://saf.mitre.org/#/normalize)" - Our common data format to preserve and transform security data + ## Contents: - [SAF CLI Installation](#installation) @@ -12,18 +17,39 @@ The SAF CLI is the successor to [Heimdall Tools](https://github.com/mitre/heimda - [Via Windows Installer](#installation-via-windows-installer) * [SAF CLI Usage](#usage) - * Scan - Visit https://saf.mitre.org/#/validate to explore and run inspec profiles - * [Generate](#generate) - Generate InSpec validation code, set pipeline thresholds, and generate options to support other saf commands. - * [Validate](#validate) - Verify pipeline thresholds - * [View](#view) - Identify overall security status and deep-dive to solve specific security defects + * [Attest](#attest) - Create and Apply attestations in JSON, YAML, and XLSX format * [Convert](#convert) - Convert security results from all your security tools into a common data format + * [HDF to AWS Security Hub](#hdf-to-asff) + * [AWS Security Hub to HDF](#asff-to-hdf) + * [HDF to Splunk](#hdf-to-splunk) + * [HDF to XCCDF](#hdf-to-xccdf) + * [Splunk to HDF](#splunk-to-hdf) + * [AWS Config to HDF](#aws-config-to-hdf) + * [Snyk to HDF](#snyk-to-hdf) + * [Twistlock to HDF](#twistlock-to-hdf) + * [Ion Channel to HDF](#ion-channel-2-hdf) + * [Trivy to HDF](#trivy-to-hdf) + * [Tenable Nessus to HDF](#tenable-nessus-to-hdf) + * [DBProtect to HDF](#dbprotect-to-hdf) + * [HDF to CSV](#hdf-to-csv) + * [Netsparker to HDF](#netsparker-to-hdf) + * [Burp Suite to HDF](#burp-suite-to-hdf) + * [SonarQube to HDF](#sonarqube-to-hdf) + * [OWASP ZAP to HDF](#owasp-zap-to-hdf) + * [Prowler to HDF](#prowler-to-hdf) + * [Fortify to HDF](#fortify-to-hdf) + * [JFrog Xray to HDF](#jfrog-xray-to-hdf) + * [Nikto to HDF](#nikto-to-hdf) + * [Sarif to HDF](#sarif-to-hdf) + * [Scoutsuite to HDF](#scoutsuite-to-hdf) + * [HDF to DISA Checklist](#hdf-to-checklist) + * [DISA XCCDF Results to HDF](#xccdf-results-to-hdf) + * [View](#view) - Identify overall security status and deep-dive to solve specific security defects + * [Validate](#validate) - Verify pipeline thresholds + * [Generate](#generate) - Generate InSpec validation code, set pipeline thresholds, and generate options to support other saf commands. + * Scan - Visit https://saf.mitre.org/#/validate to explore and run inspec profiles * Harden - Visit https://saf.mitre.org/#/harden to explore and run hardening scripts -## Terminology: - -- "[Heimdall](https://github.com/mitre/heimdall2)" - our visualizer for all security result data -- "[Heimdall Data Format (HDF)](https://saf.mitre.org/#/normalize)" - our common data format to preserve and transform security data - ## Installation #### Installation via NPM @@ -84,162 +110,32 @@ To update the SAF CLI on Windows, uninstall any existing version from your syste ## Usage --- -### Generate - -#### CKL Templates - -Checklist template files are used to give extra information to `saf convert:hdf2ckl`. - -``` -generate:ckl_metadata Generate a checklist metadata template for "saf convert:hdf2ckl" - - OPTIONS - -o, --output=output (required) Output JSON File - - EXAMPLE - saf generate:ckl_metadata -o rhel_metadata.json -``` - -#### InSpec Metadata - -InSpec metadata files are used to give extra information to `saf convert:*2inspec_stub`. - -``` -generate:inspec_metadata Generate an InSpec metadata file for "saf convert:*2inspec_stub" - - OPTIONS - -o, --output=output (required) Output JSON File - - EXAMPLE - saf generate:inspec_metadata -o ms_sql_baseline_metadata.json -``` - -#### Thresholds - -Threshold files are used in CI to ensure minimum compliance levels and validate control severities and statuses using `saf validate:threshold` - -``` -generate:threshold Generate a compliance template for "saf validate threshold" - - OPTIONS - -c, --generateControlIds Validate control IDs have the correct severity - and status - -e, --exact All counts should be exactly the same when - validating not just less than or greater than - -i, --input Input HDF JSON file - -o, --output Output threshold YAML file - - EXAMPLE - saf generate:threshold -i rhel7-results.json -e -c -o output.yaml -``` - -#### Spreadsheet (csv/xlsx) to InSpec - -You can use `saf generate:spreadsheet2inspec_stub` to generate an InSpec profile stub from a spreadsheet file. - -``` -generate:spreadsheet2inspec_stub Generate an InSpec profile stub from a CSV STIGs or CIS XLSX benchmarks - -USAGE - $ saf generate:spreadsheet2inspec_stub -i, --input= -o, --output=FOLDER - -OPTIONS - -M, --mapping=mapping Path to a YAML file with mappings for each field, by default, CIS Benchmark - fields are used for XLSX, STIG Viewer CSV export is used by CSV - -c, --controlNamePrefix=controlNamePrefix Prefix for all control IDs - -f, --format=cis|disa|general [default: general] - -h, --help show CLI help - -i, --input=input (required) - -l, --lineLength=lineLength [default: 80] Characters between lines within InSpec controls - -m, --metadata=metadata Path to a JSON file with additional metadata for the inspec.yml file - -o, --output=output (required) [default: profile] Output InSpec profile stub folder - - -EXAMPLE - saf generate:spreadsheet2inspec_stub -i spreadsheet.xlsx -o profile -``` - -#### XCCDF to InSpec Stub -``` -generate:xccdf2inspec_stub Generate an InSpec profile stub from a DISA STIG XCCDF XML file - - USAGE - $ saf generate:xccdf2inspec_stub -i, --input=XML -o, --output=FOLDER - - OPTIONS - -h, --help show CLI help - -i, --input=input (required) Path to the DISA STIG XCCDF file - -m, --metadata=metadata Path to a JSON file with additional metadata for the inspec.yml file - -l, --lineLength=lineLength [default: 80] Characters between lines within InSpec controls - -o, --output=output (required) [default: profile] Output InSpec profile stub folder - -r, --useVulnerabilityId Use Vulnerability IDs (ex. 'SV-XXXXX') instead of Group IDs (ex. 'V-XXXXX') - -s, --singleFile Output the resulting controls as a single file -``` - ---- - -### Validate - -#### Thresholds +### Attest -See the wiki for more information on [template files](https://github.com/mitre/saf/wiki/Validation-with-Thresholds). +Attesting to 'Not Reviewed' controls can be done with the `saf attest` commands. `saf attest create` lets you create attestation files and `saf attest apply` lets you apply attestation files +#### Create Attestations ``` -validate:threshold Validate the compliance and status counts of an HDF file +attest create Create attestation files for use with `saf attest apply` OPTIONS - -F, --templateFile Expected data template, generate one with - "saf generate:threshold" - -T, --templateInline= Flattened JSON containing your validation thresholds - (Intended for backwards compatibility with InSpec Tools) - -i, --input Input HDF JSON file - - EXAMPLES - saf validate:threshold -i rhel7-results.json -F output.yaml + -h, --help Show CLI help. + -i, --input= (optional) An input HDF file used to search for controls + -o, --output= (required) The output filename + -t, --format=