Tool for DevSecOps strategy
Project description
DevSecOps Engine Tools
Objective
Tool that unifies the evaluation of the different devsecops practices being agnostic to the devops platform, using both open source and market tools.
Component
📦 tools: DevSecOps Practice Modules
Communications channel
Here are the channels we use to communicate about the project:
1. Mailing list: You can join our mailing list to always be informed at the following link: CommunityDevsecopsEngine
2. Email: You can write to us by email: MaintainersDevsecopsEngine@googlegroups.com
Getting started
Requirements
- Python >= 3.8
Installation
pip3 install devsecops-engine-tools
Scan running - flags (CLI)
devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container"] --folder_path ["Folder path scan engine_iac"] --platform ["k8s","cloudformation","docker", "openapi"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --xray_mode ["scan", "audit"]
Structure Remote Config
📦Remote_Config
┣ 📂engine_core
┃ ┗ 📜ConfigTool.json
┣ 📂engine_sast
┃ ┗ 📂engine_iac
┃ ┗ 📜ConfigTool.json
┃ ┗ 📜Exclusions.json
┃ ┗ 📂engine_secret
┃ ┗ 📜ConfigTool.json
┣ 📂engine_sca
┃ ┗ 📂engine_container
┃ ┗ 📜ConfigTool.json
┃ ┗ 📜Exclusions.json
┃ ┗ 📂engine_dependencies
┃ ┗ 📜ConfigTool.json
┃ ┗ 📜Exclusions.json
Tools available for the modules (Configuration engine_core/ConfigTool.json)
Module | Tool | Type |
---|---|---|
ENGINE_IAC | CHECKOV | Free |
KUBESCAPE | Free | |
KICS | Free | |
ENGINE_DAST | NUCLEI | Free |
ENGINE_SECRET | TRUFFLEHOG | Free |
ENGINE_CONTAINER | PRISMA | Paid |
TRIVY | Free | |
ENGINE_DEPENDENCIES | XRAY | Paid |
Scan running sample (CLI) - Local
Complete the value in .envdetlocal file a set in execution environment
$ set -a
$ source .envdetlocal
$ set +a
devsecops-engine-tools --platform_devops local --remote_config_repo DevSecOps_Remote_Config --tool engine_iac
Scan running sample - Azure Pipelines
The remote config should be in a Azure Devops repository.
Note: By default the tool gets the token from the SYSTEM_ACCESSTOKEN variable to get the remote configuration repository. You must ensure that this token has permission to access this resource.
name: $(Build.SourceBranchName).$(date:yyyyMMdd)$(rev:.r)
trigger:
branches:
include:
- trunk
- feature/*
stages:
- stage: engine_tools
displayName: Example Engine Tools
jobs:
- job: engine_tools
pool:
name: Azure Pipelines
steps:
- script: |
# Install devsecops-engine-tools
pip3 install -q devsecops-engine-tools
devsecops-engine-tools --platform_devops azure --remote_config_repo remote_config --tool engine_iac
displayName: "Engine Tools"
env:
SYSTEM_ACCESSTOKEN: $(System.AccessToken)
Scan running sample - Github Actions
The remote config should be in a GitHub repository, either public or private.
If the repository is public:
- The yml file containing the workflow should be configured using the default secret GITHUB_TOKEN. For more information, refer to Automatic token authentication.
If the repository is private:
-
Create a personal access token with the necessary permissions to access the repository.
-
Add the token as a secret in the GitHub repository.
-
Configure the yml file containing the workflow using the created secret.
Example of the workflow yml:
name: DevSecOps Engine Tools
on:
push:
branches:
- feature/*
env:
GITHUB_ACCESS_TOKEN: ${{ secrets.GH_ACCESSTOKEN }} #In this case, the remote config repository is private
# When the remote config repository is public, the secret should be like this: ${{ secrets.GITHUB_TOKEN }}
jobs:
release:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Set up Python
run: |
# Install devsecops-engine-tools
pip3 install -q devsecops-engine-tools
output=$(devsecops-engine-tools --platform_devops github --remote_config_repo remote_config --tool engine_iac)
echo "$output"
if [[ $output == *"✘Failed"* ]]; then
exit 1
fi
Metrics
With the flag --send_metrics true and the configuration of the AWS-METRICS_MANAGER driven adapter in ConfigTool.json of the engine_core the tool will send the report to bucket s3. In the metrics folder you will find the base of the cloud formation template to deploy the infra and dashboard in grafana.
How can I help?
Review the issues, we hear new ideas. Read more Contributing
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for devsecops_engine_tools-1.7.34.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | b8fffeafad35c0c1606e9fdb527c2a48af91c271459f1cdead55994f316c4a46 |
|
MD5 | 4b20f8c7befa97deb18eab8fae6c5885 |
|
BLAKE2b-256 | 69dfcff4f7b370536750f3e33b044b6e7f0b17973c1c4443869edefc1ab0a290 |
Hashes for devsecops_engine_tools-1.7.34-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 60583897d2886eb4cc7d8e69c49468a3a91ef71096daf0df194a6f35a13503b3 |
|
MD5 | 733a3d5ff0132297a1df7977bbe4468a |
|
BLAKE2b-256 | 883f105db52a29fd9f2acbccfecc42904b145b7b64c075bf8ade12a7911e59b9 |