sysdig: support new json format

Author: valentijnscholten

docs/content/en/connecting_your_tools/parsers/file/sysdig_reports.md

@@ -2,10 +2,15 @@
 title: "Sysdig Vulnerability Reports"
 toc_hide: true
 ---
+Legacy Scanning Engine:
+
 Import CSV report files from Sysdig or a Sysdig UI JSON Report
 Parser will accept Pipeline, Registry and Runtime reports created from the UI
-
 More information available at [our reporting docs page](https://docs.sysdig.com/en/docs/sysdig-secure/vulnerabilities/reporting)
 
+Vulnerability Management Engine:
+Import CSV and JSON files creared by Sysdig CLI scanner.
+
+
 ### Sample Scan Data
 Sample Sysdig Vulnerability Reports scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/sysdig_reports).

dojo/tools/sysdig_reports/parser.py

@@ -18,7 +18,7 @@ def get_label_for_scan_types(self, scan_type):
         return "Sysdig Vulnerability Report Scan"
 
     def get_description_for_scan_types(self, scan_type):
-        return "Legacy scanner: Import of Sysdig Pipeline, Registry and Runtime Vulnerability Report Scans in CSV format or a Sysdig UI JSON Report"
+        return "Import of Sysdig Pipeline, Registry and Runtime Vulnerability Report Scans in CSV format or a Sysdig UI JSON Report"
 
     def get_findings(self, filename, test):
         if filename is None:
@@ -32,10 +32,18 @@ def get_findings(self, filename, test):
                 data = json.loads(str(scan_data, "utf-8"))
             except Exception:
                 data = json.loads(scan_data)
-            return self.parse_json(data=data, test=test)
+
+                if "data" in data:
+                    return self.parse_json_legacy(data=data, test=test)
+
+                if "result" in data:
+                    return self.parse_json(data=data, test=test)
+
+                msg = "JSON file is not in the expected format, expected data element or result element"
+                raise ValueError(msg)
         return ()
 
-    def parse_json(self, data, test):
+    def parse_json_legacy(self, data, test):
         vulnerability = data.get("data", None)
         if not vulnerability:
             return []
@@ -66,6 +74,7 @@ def parse_json(self, data, test):
             packageVersion = item.get("packageVersion", "")
             packageSuggestedFix = item.get("packageSuggestedFix", "")
             k8sPodCount = item.get("k8sPodCount", "")
+
             description = ""
             description += "imageId: " + imageId + "\n"
             description += "imagePullString: " + imagePullString + "\n"
@@ -87,9 +96,12 @@ def parse_json(self, data, test):
             description += "packageVersion: " + packageVersion + "\n"
             description += "packageSuggestedFix: " + packageSuggestedFix + "\n"
             description += "k8sPodCount: " + str(k8sPodCount) + "\n"
+
             mitigation = ""
             mitigation += "vulnFixAvailable: " + str(vulnFixAvailable) + "\n"
             mitigation += "vulnFixVersion: " + vulnFixVersion + "\n"
+            mitigation += "suggestedFix: " + packageSuggestedFix + "\n"
+
             find = Finding(
                 title=vulnName + "_" + vulnFixVersion,
                 test=test,
@@ -107,6 +119,79 @@ def parse_json(self, data, test):
             findings.append(find)
         return findings
 
+    def parse_json(self, data, test):
+        findings = []
+        packages = data.get("result", {}).get("packages", [])
+
+        for package in packages:
+            # print(package)
+            packageName = package.get("name", "")
+            packageType = package.get("type", "")
+            packagePath = package.get("path", "")
+            packageVersion = package.get("version", "")
+            packageSuggestedFix = package.get("suggestedFix", "")
+            layerDigest = package.get("layerDigest", "")
+
+            vulns = package.get("vulns", [])
+            # print("vulns: %s" % vulns)
+            for item in vulns:
+                # print("item: %s" % item)
+                vulnName = item.get("name", "")
+                vulnSeverity = item.get("severity", {}).get("value", "")
+                vulnCvssScore = item.get("cvssScore", {}).get("value", {}).get("score", "")
+                vulnCvssVersion = item.get("cvssScore", {}).get("value", {}).get("version", "")
+                vulnCvssVector = item.get("cvssScore", {}).get("value", {}).get("vector", "")
+                vulnDisclosureDate = item.get("disclosureDate", "")
+                vulnSolutionDate = item.get("solutionDate", "")
+                vulnPublishedByVendorDate = item.get("publishDateByVendor", {}).get("nvd", "")
+                vulnExploitable = item.get("exploitable", "")
+                vulnFixVersion = item.get("fixedInVersion", "")
+
+                description = ""
+                description += "vulnCvssVersion: " + vulnCvssVersion + "\n"
+                description += "vulnCvssScore: " + str(vulnCvssScore) + "\n"
+                description += "vulnCvssVector: " + vulnCvssVector + "\n"
+                description += "vulnDisclosureDate: " + vulnDisclosureDate + "\n"
+                description += "vulnPublishedByVendorDate: " + vulnPublishedByVendorDate + "\n"
+                description += "vulnSolutionDate: " + vulnSolutionDate + "\n"
+                description += "vulnExploitable: " + str(vulnExploitable) + "\n"
+                description += "packageName: " + packageName + "\n"
+                description += "packageType: " + packageType + "\n"
+                description += "packagePath: " + packagePath + "\n"
+                description += "packageVersion: " + packageVersion + "\n"
+                description += "packageSuggestedFix: " + packageSuggestedFix + "\n"
+                description += "layerDigest: " + layerDigest + "\n"
+
+                mitigation = ""
+                mitigation += "vulnFixVersion: " + vulnFixVersion + "\n"
+                mitigation += "suggestedFix: " + packageSuggestedFix + "\n"
+
+                finding = Finding(
+                    title=vulnName + " - " + packageName + " - " + vulnFixVersion,
+                    test=test,
+                    description=description,
+                    severity=vulnSeverity,
+                    mitigation=mitigation,
+                    static_finding=True,
+                    component_name=packageName,
+                    component_version=packageVersion,
+                )
+
+                try:
+                    if float(vulnCvssVersion) >= 3 and float(vulnCvssVersion) < 4:
+                        finding.cvssv3_score = vulnCvssScore
+                        vectors = cvss.parser.parse_cvss_from_text(vulnCvssVector)
+                        if len(vectors) > 0 and isinstance(vectors[0], CVSS3):
+                            finding.cvss = vectors[0].clean_vector()
+                except ValueError:
+                    continue
+
+                if vulnName != "":
+                    finding.unsaved_vulnerability_ids = []
+                    finding.unsaved_vulnerability_ids.append(vulnName)
+                findings.append(finding)
+        return findings
+
     def parse_csv(self, arr_data, test):
         if len(arr_data) == 0:
             return ()
@@ -203,8 +288,8 @@ def parse_csv(self, arr_data, test):
                 finding.description += f"\n - **Registry Name:** {row.registry_name}"
                 finding.description += f"\n - **Registy Image Repository:** {row.registry_image_repository}"
             try:
-                if float(row.cvss_version) >= 3:
-                    finding.cvssv3_score = row.cvss_score
+                if float(row.cvss_version) >= 3 and float(row.cvss_version) < 4:
+                    finding.cvssv3_score = float(row.cvss_score)
                     vectors = cvss.parser.parse_cvss_from_text(row.cvss_vector)
                     if len(vectors) > 0 and isinstance(vectors[0], CVSS3):
                         finding.cvss = vectors[0].clean_vector()
@@ -219,3 +304,5 @@ def parse_csv(self, arr_data, test):
             # finally, Add finding to list
             sysdig_report_findings.append(finding)
         return sysdig_report_findings
+
+

dojo/tools/sysdig_reports/sysdig_data.py

@@ -57,4 +57,4 @@ def __init__(self):
         self.cloud_provider_name: str = ""
         self.cloud_provider_account_id: str = ""
         self.cloud_provider_region: str = ""
-        self.epss_score: float = 0
+        self.epss_score: float = None