SARIF Manager - NightVision

A simple CLI tool to assist with integrating NightVision DAST output to different providers. This CLI tool parses SARIF files generated by the NightVision CLI and output the results for different providers, like Azure DevOps, Slack, etc.

Currently supported providers:

• Azure DevOps
• Slack Notifications
• PDF Report Generation

Roadmap:

• GitLab CI/CD
• Jenkins

Note: GitHub Actions is supported natively by NightVision. See the documentation here.

Installation

pip install sarif-manager

Usage

sarif-manager --help

Example

Azure DevOps

Write logs in a pipeline:

azure write-logs \
    example.sarif \
    --org nightvision1 \
    --project temporary

Create work items:

sarif-manager azure create-work-items \
    example.sarif \
    --org nightvision1 \
    --project temporary

Slack

See the Slack Integration instructions on how to create an app and generate a token.

You can run the command with the token and channel declared as environment variables (recommended):

export SLACK_CHANNEL=channel_id
export SLACK_BOT_TOKEN=my_token

sarif-manager slack send example.sarif

You can attach a PDF report to the Slack message:

sarif-manager slack send example.sarif --attach-pdf

You can also run the command with the token and channel inline:

sarif-manager slack send \
  example.sarif \
  --channel <channel_id> \
  --token <token_value

PDF Generation

Generate a PDF report from a SARIF file:

sarif-manager pdf generate example.sarif example.pdf --target-name "Example report" --target-url "https://example.com"

# You don't have to include the target-name and target-url if you don't want to
sarif-manager pdf generate example.sarif example.pdf