evidentia-collectors

Evidence collectors for Evidentia, the open-source compliance-as-code engine. Collectors read source configuration and findings without changing the source system. Results include SecurityFinding records and a collection manifest; available control mappings and coverage depend on the collector. Configuration observations alone do not establish compliance.

Collectors

Four importers read exports or feeds: collect ocsf for OCSF Compliance and Detection Findings ([ocsf]), collect nessus and collect greenbone for vulnerability-scan exports, and collect scap for selected XCCDF 1.2 or OVAL 5.8, 5.11.2 and 5.12.3 core results ([scan] for XML importers).

Install

pip install evidentia-collectors            # the httpx-based collectors and importers
pip install 'evidentia-collectors[aws]'     # add one provider's driver
pip install 'evidentia-collectors[all]'     # every optional driver

Credentials come from environment references documented for each collector. Enterprise retention resolves the token reference in its authorized profile; its --help names the registry environment variable. No collector accepts a secret as a flag or in a request body. Outbound hosts pass an SSRF guard by default.

Entra/M365 returns a full result envelope with nine capability states, counts, source provenance and a manifest. Prefer EntraM365Collector.collect_v2(request) in Python; collect(request) returns findings only. Graph access uses pre-minted tokens from ENTRA_M365_ACCESS_TOKEN and a separate delegated ENTRA_M365_RETENTION_ACCESS_TOKEN. ENTRA_M365_AUTH_MODE declares the primary token mode. DLP-only ingestion needs no token. Partial or unavailable evidence is explicit and never proves tenant-wide compliance. Tests use labeled synthetic Graph responses and a selected recorded CISA DLP export; live-tenant acceptance remains unverified.

Operator guide: Run evidence collectors.

Storage retention accepts a bounded JSON request selecting one provider and 1 through 20 resources. StorageRetentionCollector.collect_v2(request) and the CLI, API and console retain every resource and component, including partial and unavailable evidence. Native days, years, quoted seconds and source timestamp text remain distinct. Results describe configuration, with unknown compliance and no object-enforcement or recordset-completeness claim. Credentials use fixed server-side references, without SDK discovery or refresh. Tests use 24 labeled synthetic provider-response fixtures; live cloud acceptance is unverified. See the storage design.

Enterprise retention requires an administrator-configured profile and a separate explicit grant for each API principal or local CLI use. Full results preserve the unique read ledger, native values, partial/unavailable states and informational findings with unknown compliance. The console and API share the strict request and result contract; live-provider acceptance remains unverified. See the enterprise design and the operator guide above.

Public registry requests select one typed target and an optional scope label. RegistryCollector.collect_v2(request) preserves the complete result; collect(request) returns findings only. TLS, RDAP, GLEIF and security.txt use fixed verified transport policies. SAM reads EVIDENTIA_REGISTRY_SAM_API_KEY on the server. FedRAMP, CMVP and FCC use packaged reviewed snapshots. InCommon requires pip install 'evidentia-collectors[registries]'; the GUI extra alone does not install its verifier. SSL Labs live access is disabled before all I/O. Source evidence does not establish eligibility, ownership, applicability or compliance. See the registry design for exact source, timestamp, trust and approved publisher-data preservation rules.

Incident clocks require a trusted profile with exact record, workflow and principal grants; local CLI permission is separate. IncidentClockCollector.collect_v2(request) uses an issued selection and returns the full source/clock result. Current ServiceNow date columns, Jira changelog transitions and PagerDuty log entries retain their native operational meanings. Complete, incomplete and unavailable sources remain distinct from computed, unresolved and reversed clocks. Tests and console examples are synthetic; live permissions, entitlement and workflow correctness require operator validation. See the incident clock design and operator guide.

SCAP imports preserve the complete native graph, exact source hash, selected assessment and completion provenance. An artifact can be unavailable even when the full import succeeds. The CLI and console require explicit profile and assessment selection; import does not run a scanner or save evidence. Source URLs and embedded instructions remain inert. See the SCAP operator guide for completion assertions, finite limits, downloads and separate persistence.

Release cadence fixes the unauthenticated public GitHub Releases profile and returns a complete bounded PollResult. collect_release_cadence(request) is the Python entrypoint; poll_release_bytes(request) returns the accepted full JSON bytes. Polling does not open the evidence store unless persist is true. Core's evaluate_release_series reads saved publication families offline under an explicit window and spacing policy. Source observations preserve later fact changes without inflating publication counts. These results do not establish patch installation, remediation or compliance. See the release-cadence guide for authentication, source limits, storage outcomes and console downloads.

License: Apache 2.0