microsoft / AttackSurfaceAnalyzer

Attack Surface Analyzer can help you analyze your operating system's security configuration for changes during software installation.
MIT License
2.68k stars 271 forks source link

Analyze scan from 2 different machines. #689

Closed SavithaJagadish closed 1 year ago

SavithaJagadish commented 1 year ago

Is your feature request related to a problem? Please describe. In the older version of the tool, I can run the tool on different machines which produces cab file and I'd be able to generate report using the cabs. I don't see that option available in the new tool.

Describe the solution you'd like I would like to, run the scan on Machine 1 run the scan on Machine 2 generate a report comparing the result from the 2 machines.

Describe alternatives you've considered If there is a way to import a scanid to the machine, I would be able to run using the scan id's, but there is no option to import a scan result from another machine as well.

System Configuration (please complete the following information): Windows OS Version: Windows 11 ASA 2.3.297 CLI or GUI

gfs commented 1 year ago

I think you can do something similar with the the current version. As ASA runs it saves the data collected into an SQLite database, you can move that database to the other machine and run another collection.

For example:

On machine 1:

  1. Run your collection scan
  2. Copy all of the SQLite db shards (or set sharding factor to 1, so there's only one file to copy) to the second machine Then, on machine 2:
  3. Run the collection scan, using the same database you created in 1.

Then, take that database with records from both scans and on any machine with the db that contains both results:

  1. Run export-collect to do the comparison
SavithaJagadish commented 1 year ago

Thank you for the quick response! Need some clarification with the command for the steps (especially #3 and #4),

  1. On Machine 1, run "Asa.exe collect -a --databasefilename scan.sqllite --shards 1"
  2. Copy scan.sqllite to Machine 2 to the path where asa.exe tool will run from
  3. On Machine 2, run "Asa.exe collect -a --databasefilename scan.sqllite --shards 1"
  4. asa.exe export-collect <how to pass the database file as input?>
gfs commented 1 year ago

That looks correct to me. The argument for export collect should be the same —databasefilename argument.

By default, if no run ids are provided to export collect it will export a comparison of the last two collection runs. If you don't want that behavior it's best to set run ids on the collect command and reference those with the export command.

A note: There’s a trade off here between collection performance and ease of transfer with choosing a single shard or multiple. In my testing (shown in the benchmarks in the repo if you want to check in your environment) collection performance is much higher with multiple shards, but it does mean you need to copy all the shards to the new location(s) if you want to use the db somewhere else.

gfs commented 1 year ago

Considering this closed with moving the database. Please reach out again or reopen if you encounter any other issues.