Skip to content

Commit 16e9001

Browse files
valentijnscholtenvalentijnscholten
committed
sysdig: support new csv format
1 parent 45b5383 commit 16e9001

13 files changed

Lines changed: 3243 additions & 48 deletions

‎dojo/tools/sysdig_reports/parser.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type):
1818
return "Sysdig Vulnerability Report Scan"
1919

2020
def get_description_for_scan_types(self, scan_type):
21-
return "Import of Sysdig Pipeline, Registry and Runtime Vulnerability Report Scans in CSV format or a Sysdig UI JSON Report"
21+
return "Legacy scanner: Import of Sysdig Pipeline, Registry and Runtime Vulnerability Report Scans in CSV format or a Sysdig UI JSON Report"
2222

2323
def get_findings(self, filename, test):
2424
if filename is None:
@@ -215,6 +215,7 @@ def parse_csv(self, arr_data, test):
215215
if row.vuln_link != "":
216216
finding.references = row.vuln_link
217217
finding.url = row.vuln_link
218+
finding.epss_score = row.epss_score
218219
# finally, Add finding to list
219220
sysdig_report_findings.append(finding)
220221
return sysdig_report_findings

‎dojo/tools/sysdig_reports/sysdig_csv_parser.py‎

Lines changed: 81 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -41,40 +41,86 @@ def parse(self, filename) -> SysdigData:
4141
for row in csvarray:
4242

4343
csv_data_record = SysdigData()
44-
45-
csv_data_record.vulnerability_id = row.get("vulnerability id", "")
46-
csv_data_record.severity = csv_data_record._map_severity(row.get("severity").upper())
47-
csv_data_record.package_name = row.get("package name", "")
48-
csv_data_record.package_version = row.get("package version", "")
49-
csv_data_record.package_type = row.get("package type", "")
50-
csv_data_record.package_path = row.get("package path", "")
51-
csv_data_record.image = row.get("image", "")
52-
csv_data_record.os_name = row.get("os name", "")
53-
csv_data_record.cvss_version = row.get("cvss version", "")
54-
csv_data_record.cvss_score = row.get("cvss score", "")
55-
csv_data_record.cvss_vector = row.get("cvss vector", "")
56-
csv_data_record.vuln_link = row.get("vuln link", "")
57-
csv_data_record.vuln_publish_date = row.get("vuln publish date", "")
58-
csv_data_record.vuln_fix_date = row.get("vuln fix date", "")
59-
csv_data_record.vuln_fix_version = row.get("fix version", "")
60-
csv_data_record.public_exploit = row.get("public exploit", "")
61-
csv_data_record.k8s_cluster_name = row.get("k8s cluster name", "")
62-
csv_data_record.k8s_namespace_name = row.get("k8s namespace name", "")
63-
csv_data_record.k8s_workload_type = row.get("k8s workload type", "")
64-
csv_data_record.k8s_workload_name = row.get("k8s workload name", "")
65-
csv_data_record.k8s_container_name = row.get("k8s container name", "")
66-
csv_data_record.image_id = row.get("image id", "")
67-
csv_data_record.k8s_pod_count = row.get("k8s pod count", "")
68-
csv_data_record.package_suggested_fix = row.get("package suggested fix", "")
69-
csv_data_record.in_use = row.get("in use", "") == "TRUE"
70-
csv_data_record.risk_accepted = row.get("risk accepted", "") == "TRUE"
71-
csv_data_record.registry_name = row.get("registry name", "")
72-
csv_data_record.registry_image_repository = row.get("registry image repository", "")
73-
csv_data_record.cloud_provider_name = row.get("cloud provider name", "")
74-
csv_data_record.cloud_provider_account_id = row.get("cloud provider account ID", "")
75-
csv_data_record.cloud_provider_region = row.get("cloud provider region", "")
76-
csv_data_record.registry_vendor = row.get("registry vendor", "")
77-
78-
arr_csv_data.append(csv_data_record)
44+
if "vulnerability id" in reader.fieldnames:
45+
# Legacy report format
46+
csv_data_record.vulnerability_id = row.get("vulnerability id", "")
47+
csv_data_record.severity = csv_data_record._map_severity(row.get("severity").upper())
48+
csv_data_record.package_name = row.get("package name", "")
49+
csv_data_record.package_version = row.get("package version", "")
50+
csv_data_record.package_type = row.get("package type", "")
51+
csv_data_record.package_path = row.get("package path", "")
52+
csv_data_record.image = row.get("image", "")
53+
csv_data_record.os_name = row.get("os name", "")
54+
csv_data_record.cvss_version = row.get("cvss version", "")
55+
csv_data_record.cvss_score = row.get("cvss score", "")
56+
csv_data_record.cvss_vector = row.get("cvss vector", "")
57+
csv_data_record.vuln_link = row.get("vuln link", "")
58+
csv_data_record.vuln_publish_date = row.get("vuln publish date", "")
59+
csv_data_record.vuln_fix_date = row.get("vuln fix date", "")
60+
csv_data_record.vuln_fix_version = row.get("fix version", "")
61+
csv_data_record.public_exploit = row.get("public exploit", "")
62+
csv_data_record.k8s_cluster_name = row.get("k8s cluster name", "")
63+
csv_data_record.k8s_namespace_name = row.get("k8s namespace name", "")
64+
csv_data_record.k8s_workload_type = row.get("k8s workload type", "")
65+
csv_data_record.k8s_workload_name = row.get("k8s workload name", "")
66+
csv_data_record.k8s_container_name = row.get("k8s container name", "")
67+
csv_data_record.image_id = row.get("image id", "")
68+
csv_data_record.k8s_pod_count = row.get("k8s pod count", "")
69+
csv_data_record.package_suggested_fix = row.get("package suggested fix", "")
70+
csv_data_record.in_use = row.get("in use", "") == "TRUE"
71+
csv_data_record.risk_accepted = row.get("risk accepted", "") == "TRUE"
72+
csv_data_record.registry_name = row.get("registry name", "")
73+
csv_data_record.registry_image_repository = row.get("registry image repository", "")
74+
csv_data_record.cloud_provider_name = row.get("cloud provider name", "")
75+
csv_data_record.cloud_provider_account_id = row.get("cloud provider account ID", "")
76+
csv_data_record.cloud_provider_region = row.get("cloud provider region", "")
77+
csv_data_record.registry_vendor = row.get("registry vendor", "")
78+
79+
arr_csv_data.append(csv_data_record)
80+
81+
elif "cve id" in reader.fieldnames:
82+
# Vulnerability Engine report format
83+
csv_data_record.vulnerability_id = row.get("cve id", "")
84+
csv_data_record.severity = csv_data_record._map_severity(row.get("cve severity").upper())
85+
csv_data_record.cvss_score = row.get("cvss score", "")
86+
csv_data_record.cvss_version = row.get("cvss score version", "")
87+
csv_data_record.package_name = row.get("package name", "")
88+
csv_data_record.package_version = row.get("package version", "")
89+
csv_data_record.package_type = row.get("package type", "")
90+
csv_data_record.package_path = row.get("package path", "")
91+
csv_data_record.vuln_fix_version = row.get("fix version", "")
92+
csv_data_record.vuln_link = row.get("cve url", "")
93+
csv_data_record.vuln_publish_date = row.get("vuln disclosure date", "")
94+
csv_data_record.vuln_fix_date = row.get("vuln fix date", "")
95+
csv_data_record.risk_accepted = row.get("risk accepted", "") == "TRUE"
96+
97+
# new fields:
98+
csv_data_record.epss_score = row.get("epss score", "")
99+
100+
# not present:
101+
# csv_data_record.public_exploit = row.get("public exploit", "")
102+
# csv_data_record.cvss_vector = row.get("cvss vector", "")
103+
# csv_data_record.image = row.get("image", "")
104+
# csv_data_record.os_name = row.get("os name", "")
105+
# csv_data_record.k8s_cluster_name = row.get("k8s cluster name", "")
106+
# csv_data_record.k8s_namespace_name = row.get("k8s namespace name", "")
107+
# csv_data_record.k8s_workload_type = row.get("k8s workload type", "")
108+
# csv_data_record.k8s_workload_name = row.get("k8s workload name", "")
109+
# csv_data_record.k8s_container_name = row.get("k8s container name", "")
110+
# csv_data_record.image_id = row.get("image id", "")
111+
# csv_data_record.k8s_pod_count = row.get("k8s pod count", "")
112+
# csv_data_record.package_suggested_fix = row.get("package suggested fix", "")
113+
# csv_data_record.in_use = row.get("in use", "") == "TRUE"
114+
# csv_data_record.registry_name = row.get("registry name", "")
115+
# csv_data_record.registry_image_repository = row.get("registry image repository", "")
116+
# csv_data_record.cloud_provider_name = row.get("cloud provider name", "")
117+
# csv_data_record.cloud_provider_account_id = row.get("cloud provider account ID", "")
118+
# csv_data_record.cloud_provider_region = row.get("cloud provider region", "")
119+
# csv_data_record.registry_vendor = row.get("registry vendor", "")
120+
121+
arr_csv_data.append(csv_data_record)
122+
else:
123+
msg = "Unknown CSV format: expected Vulnerability ID or CVE ID column"
124+
raise ValueError(msg)
79125

80126
return arr_csv_data

‎dojo/tools/sysdig_reports/sysdig_data.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,3 +57,4 @@ def __init__(self):
5757
self.cloud_provider_name: str = ""
5858
self.cloud_provider_account_id: str = ""
5959
self.cloud_provider_region: str = ""
60+
self.epss_score: float = 0

unittests/scans/sysdig_reports/sysdig.json renamed to unittests/scans/sysdig_reports/legacy_scanner/sysdig.json

File renamed without changes.

unittests/scans/sysdig_reports/sysdig_reports_empty_with_error.csv renamed to unittests/scans/sysdig_reports/legacy_scanner/sysdig_reports_empty_with_error.csv

File renamed without changes.

unittests/scans/sysdig_reports/sysdig_reports_many_vul.csv renamed to unittests/scans/sysdig_reports/legacy_scanner/sysdig_reports_many_vul.csv

File renamed without changes.

unittests/scans/sysdig_reports/sysdig_reports_missing_cve_field.csv renamed to unittests/scans/sysdig_reports/legacy_scanner/sysdig_reports_missing_cve_field.csv

File renamed without changes.

unittests/scans/sysdig_reports/sysdig_reports_not_starting_with_cve.csv renamed to unittests/scans/sysdig_reports/legacy_scanner/sysdig_reports_not_starting_with_cve.csv

File renamed without changes.

unittests/scans/sysdig_reports/sysdig_reports_one_vul.csv renamed to unittests/scans/sysdig_reports/legacy_scanner/sysdig_reports_one_vul.csv

File renamed without changes.

unittests/scans/sysdig_reports/sysdig_reports_zero_vul.csv renamed to unittests/scans/sysdig_reports/legacy_scanner/sysdig_reports_zero_vul.csv

File renamed without changes.

0 commit comments

Comments
 (0)