Sub 3621 vulnerabilities + workloads structs + enrichments #190
Conversation
|
PR Description updated to latest commit (76aa2e0) |
PR Analysis
PR Feedback
|
armotypes/common.go
Outdated
| var RiskFactorMapping = map[string]RiskFactor{ | ||
| "C-0256": RiskFactorInternetFacing, | ||
| "C-0046": RiskFactorPrivileged, | ||
| "C-0057": RiskFactorPrivileged, | ||
| "C-0255": RiskFactorSecretAccess, | ||
| "C-0257": RiskFactorDataAccess, | ||
| "C-0038": RiskFactorHostAccess, | ||
| "C-0041": RiskFactorHostAccess, | ||
| "C-0044": RiskFactorHostAccess, | ||
| "C-0048": RiskFactorHostAccess, | ||
| } |
There was a problem hiding this comment.
Maybe it is better to put this mapping in the BL?
There was a problem hiding this comment.
I was not sure whether it's the only place we need it
armotypes/vulnerabilitytypes.go
Outdated
| @@ -9,11 +21,175 @@ type VulnerabilityJobParams struct { | |||
| JobID string `json:"jobID,omitempty"` | |||
| } | |||
|
|
|||
| type VulnerabilityWorkload struct { | |||
| Id string `json:"id"` | |||
There was a problem hiding this comment.
What is ID?
Workload unique identifiers is a combination of cluster, namespace, kind, name
We do not have GUID for this element
armotypes/vulnerabilitytypes.go
Outdated
| Id string `json:"id"` | ||
| Name string `json:"name"` | ||
| Namespace string `json:"namespace"` | ||
| Type string `json:"type"` |
There was a problem hiding this comment.
also here I was confused because they changed it in ui to kind
armotypes/vulnerabilitytypes.go
Outdated
| TopCves []TopCveDetails `json:"topCves"` | ||
| } | ||
|
|
||
| type TopCveDetails struct { |
There was a problem hiding this comment.
fetching top is the same as fetching the whole cves list? the goal is to avoid fetching redundant data
There was a problem hiding this comment.
in my query i bring all cves by severity
There was a problem hiding this comment.
We fetch all cves name sorted by severity according to the filter (if only critical is on so will be the list of CVEs)
armotypes/vulnerabilitytypes.go
Outdated
| Name string `json:"name"` | ||
| } | ||
|
|
||
| type VulnerabilitiesImage struct { |
There was a problem hiding this comment.
we show images in UI not containers
There was a problem hiding this comment.
But an image does not have a container and cluster
a container has an image and cluster
armotypes/vulnerabilitytypes.go
Outdated
| WorkloadsIds []string `json:"wlids"` | ||
| NameSpace string `json:"namespace"` |
There was a problem hiding this comment.
How can we have many wlids and one namespace and container ?
armotypes/vulnerabilitytypes.go
Outdated
| ImageTag string `json:"imageTag"` | ||
| ImageHash string `json:"imageHash"` |
There was a problem hiding this comment.
component should have many images
armotypes/vulnerabilitytypes.go
Outdated
| } | ||
|
|
||
| // EnrichCVSSData enriches the CVSS data by parsing the CVSS vector and updating the exploitability field | ||
| func EnrichCVSSData(vuln *Vulnerability) { |
There was a problem hiding this comment.
I am ot sure armo types is a good place for these functions ?
There was a problem hiding this comment.
are we sure that enrichment will happen only in BL? I thought about having it in common place
armotypes/vulnerabilitytypes.go
Outdated
| EpssInfo EpssInfo `json:"epssInfo"` | ||
| CisaKevInfo CisaKevInfo `json:"cisaKevInfo"` |
There was a problem hiding this comment.
inline means the fields are under the object, here we want it as inner feild
armotypes/vulnerabilitytypes.go
Outdated
|
|
||
| type CisaKevInfo struct { | ||
| // todo : verify tooltip and additional feilds | ||
| Date time.Time `json:"date"` |
There was a problem hiding this comment.
missing fields:
DateAdded string `json:"dateAdded"`
DueDate string `json:"dueDate"`
KnownRansomwareCampaignUse string `json:"knownRansomwareCampaignUse"`
Notes string `json:"notes"`
also if possible change the type to string, otherwise we will need to manually format each item during the enrichment task
armotypes/vulnerabilitytypes.go
Outdated
| Name string `json:"name"` | ||
| } | ||
|
|
||
| type VulnerabilitiesImage struct { |
There was a problem hiding this comment.
But an image does not have a container and cluster
a container has an image and cluster
armotypes/vulnerabilitytypes.go
Outdated
| TopCves []TopCveDetails `json:"topCves"` | ||
| } | ||
|
|
||
| type TopCveDetails struct { |
There was a problem hiding this comment.
We fetch all cves name sorted by severity according to the filter (if only critical is on so will be the list of CVEs)
armotypes/vulnerabilitytypes.go
Outdated
| @@ -9,11 +20,100 @@ type VulnerabilityJobParams struct { | |||
| JobID string `json:"jobID,omitempty"` | |||
| } | |||
|
|
|||
| type VulnerabilityWorkload struct { | |||
| Wlid string `json:"wlid"` | |||
There was a problem hiding this comment.
We do not have a wlid in container scan
let's drop this field we do not need it - a workload id is a combination of cluster namespace kind and name
armotypes/vulnerabilitytypes.go
Outdated
| } | ||
|
|
||
| type SeverityDetails struct { | ||
| Total int `json:"total"` |
There was a problem hiding this comment.
I think it is better to put the counter as fields
like CriticalCount etc
how do you send a sort by SeverityStats[Critical].total
it is much simpler to sort by criticalCount:desc,hightCount:desc ...
if we do that than maybe we can make all this SeverityStats simpler like map[string][]string (and name it CEVs)
armotypes/vulnerabilitytypes.go
Outdated
| IsRCE bool `json:"isRCE"` | ||
| Links []string `json:"links"` | ||
| Description string `json:"description"` | ||
| Id string `json:"id"` |
There was a problem hiding this comment.
the cve id is internal to the dal no need to add it
armotypes/vulnerabilitytypes.go
Outdated
| } | ||
|
|
||
| type ImagePathInfo struct { | ||
| WorkloadId string `json:"wlid"` |
There was a problem hiding this comment.
no wlid in container scan it is only for posture
We have workload hash but it is just combination of cluster, namespace ,kind, name, container-name
# Conflicts: # armotypes/vulnerabilitytypes.go
armotypes/vulnerabilitytypes.go
Outdated
| CveNames []string `json:"topCves"` | ||
| } | ||
|
|
||
| type ImagePathInfo struct { |
armotypes/vulnerabilitytypes.go
Outdated
| ClusterName string `json:"clusterName"` | ||
| ClusterShortName string `json:"clusterShortName"` | ||
| CustomerGUID string `json:"customerGUID"` | ||
| ImagesCount int `json:"imagesCount"` |
There was a problem hiding this comment.
CriticalCount int
HighCount int
MediumCount int
LowCount int
ImagesCount int
RiskControlsCount int
Type
Enhancement
Description
armotypes/common.go.GetRiskFactorsinarmotypes/common.gowhich returns a list of unique risk factors for given control IDs.armotypes/vulnerabilitytypes.go.EnrichCVSSData,ParseCVSSVector, andUpdateExploitableFieldinarmotypes/vulnerabilitytypes.goto enrich the CVSS data by parsing the CVSS vector and updating the exploitability field.PR changes walkthrough
2 files
common.go
armotypes/common.go
Added new types and constants related to RiskFactor. Also, a
new function
GetRiskFactorshas been added which returns alist of unique risk factors for given control IDs.
vulnerabilitytypes.go
armotypes/vulnerabilitytypes.go
Added new types and constants related to vulnerabilities.
Also, new functions
EnrichCVSSData,ParseCVSSVector, andUpdateExploitableFieldhave been added to enrich the CVSSdata by parsing the CVSS vector and updating the
exploitability field.