search

intelops / scsctl

Tool for automating Vulnerability Risk Management and Software Supply Chain Security Measures
Apache License 2.0
4 stars 2 forks source link

readme

scsctl

We are continuously adding the listed features

CLI/CI Tool for Automating Vulnerability Management for Enhancing Software Supply Chain Security Measures.

Features

Future goals:

Usage

Before starting, make sure you have the following installed and configured:

  1. Docker - Make sure docker is running, and the image you want to scan is present in the docker daemon
  2. Trivy - Trivy will be automatically installed if not present
  3. Pyroscope - Pyroscope is up and running, and profiling data is being collected from the application you want to scan. You also need the Pyroscope server URL and the application name

  4. ClickHouse (optional) - If you want to save the data collected by SCSCTL for historical analysis purpose, then make sure ClickHouse is up and running and you have the ClickHouse server URL and the database details

    If you don't want to save the data, then you can skip this step.

    If you want to save the data, then please set the following environment variables: The database name will be scsctl

    • CLICKHOUSE_HOST - The URL of the ClickHouse server
    • CLICKHOUSE_USER - The username of the ClickHouse server
    • CLICKHOUSE_PASSWORD - The password of the ClickHouse server
    • CLICKHOUSE_PORT - The port of the ClickHouse server

Running the tool

  1. Clone the repo
  2. pip install -r requirements.txt
  3. python setup.py bdist_wheel --universal (This will create a wheel file in the dist folder)
  4. Install the wheel file using pip install
  5. Run the tool using scsctl command
  6. You can also run the tool using python app.py without building the wheel file
  7. After scanning, you can see the reports or rebuild the docker image from the menu

Commands

scsctl has the following commands:

This command will scan the docker image and generate the reports

scsctl scan --pyroscope_app_name <pyroscope_app_name> --docker_image_name <docker_image_name> --pyroscope_url <pyroscope_url> --docker_file_folder_path <docker_file_folder_path> --falco_pod_name <falco_pod_name> --falco_target_deployment_name <app> --falco_enabled

Example:

scsctl scan --pyroscope_app_name dagflow-api --docker_image_name dagflow-app-with-db-url:latest --pyroscope_url http://localhost:4040 --docker_file_folder_path /home/jegath/Documents/intelops/sps/dagflow/app/ --falco_pod_name falco-mvnmt --falco_target_deployment_name app --falco_enabled

There is also an option to pass a yaml as a config file.

scsctl scan --config_file ./test.yaml

Sample yaml file

pyroscope_app_name: dagflow-api
docker_image_name: dagflow-app-with-db-url:latest
pyroscope_url: http://localhost:4040
falco_pod_name: falco-mvnmt
falco_target_deployment_name: app
db_enabled: true
falco_enabled: true
docker_file_folder_path: /home/jegath/Documents/intelops/sps/dagflow/app/

Running the tool in ci/cd environment

To run scsctl in ci/cd environment,

  1. Install scsctl from pypi
  2. Run the tool

Example

name: scsctl_test
on:
  push:
    branches: [ main ]
jobs:
  container-test-job:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3

    - name: Pull pyroscope/pyroscope:latest image 
      run: docker pull pyroscope/pyroscope:latest

    - name: Install a python cli tool from test pypi  and run it
      run: |
        python -m pip install --upgrade pip
        python -m pip install --upgrade build
        python -m pip install scsctl

    - name: run scsctl tool
      run: |
        scsctl scan --pyroscope_app_name pyroscope.server --docker_image_name pyroscope/pyroscope:latest --pyroscope_url https://369d-111-92-44-131.ngrok-free.app --non_interactive