Skip to content

Latest commit

 

History

History
171 lines (111 loc) · 6.87 KB

USAGE.md

File metadata and controls

171 lines (111 loc) · 6.87 KB
Raw

Fortify SSC Parser Plugin for Clair (Yair client) - Usage

Introduction

Fortify Application Security provides your team with solutions to empower DevSecOps practices, enable cloud transformation, and secure your software supply chain. As the sole Code Security solution with over two decades of expertise and acknowledged as a market leader by all major analysts, Fortify delivers the most adaptable, precise, and scalable AppSec platform available, supporting the breadth of tech you use and integrated into your preferred toolchain. We firmly believe that your great code demands great security, and with Fortify, go beyond 'check the box' security to achieve that.

This Fortify SSC parser plugin allows for importing scan results from Clair (Vulnerability Static Analysis for Containers).

Clair itself doesn't provide any file-based reports; as such this parser plugin parses reports generated by the Yair command line interface for Clair.

Plugin Installation

These sections describe how to install, upgrade and uninstall the parser plugin in SSC.

Install & Upgrade

Uninstall

  • In Fortify Software Security Center:
    • Navigate to Administration->Plugins->Parsers
    • Select the parser plugin that you want to uninstall
    • Click the DISABLE button
    • Click the REMOVE button

Obtain results

Please see the Yair documentation for detailed usage instructions. Note that the SSC parser plugin for Yair expects a JSON file as input, so Yair will need to be configured to generate reports in JSON format.

As an example, the following Linux/bash commands were used to generate the src/test/resources/node_10.14.2-jessie.yair.json file:

# Generate Yair configuration file
cat <<'EOF' > $PWD/yair.config
---
registry:
  host: "registry.hub.docker.com"

clair:
  host: "clair:6060"

output:
  format: json

fail_on:
  score: 0
  big_vulnerability: false
EOF

# Analyze the node:10.14.2-jessie image and save results in JSON file
docker run -v $PWD/yair.config:/opt/yair/config/config.yaml:ro --link clair:clair yfoelling/yair node:10.14.2-jessie > node_10.14.2-jessie.yair.json

The example above assumes that you want to scan images from the Docker Hub registry, and that Clair is running inside another Docker container named clair. For completeness, the following Linux/bash commands were used to set up such a Clair container for testing and demonstration purposes:

# Start Postgres DB without superuser password (for testing only)
docker run -e POSTGRES_HOST_AUTH_METHOD=trust --name postgres -p 5432:5432 -d postgres

# Check Postgres started OK
docker logs postgres

# Create and navigate into clair directory
mkdir clair
cd clair

# Get sample config, save as clair.config
curl -L https://raw.githubusercontent.com/coreos/clair/master/config.yaml.sample -o $PWD/clair.config

# Update config file to use postgres docker container
sed -i 's/source: host=localhost/source: host=postgres/g' $PWD/clair.config

# Run clair as dameon
docker run --name clair --link postgres:postgres -p 6060:6060 -p 6061:6061 -v $PWD/clair.config:/config/config.yaml -d quay.io/coreos/clair:latest -config=/config/config.yaml

# Check Clair started OK
docker logs clair

Upload results

Results can be uploaded through the SSC web interface, REST API, or SSC client utilities like FortifyClient or fcli. The SSC web interface, FortifyClient and most other Fortify clients require the raw results to be packaged into a zip-file; REST API and fcli allow for uploading raw results directly.

To upload results through the SSC web interface or most clients:

  • Create a scan.info file containing a single line as follows:
    engineType=CLAIR_YAIR
  • Create a zip file containing the following:
    • The scan.info file generated in the previous step
    • The raw results file as obtained from the target system (see Obtain results section above)
  • Upload the zip file generated in the previous step to SSC
    • Using any SSC client, for example FortifyClient or Maven plugin
    • Or using the SSC web interface
    • Similar to how you would upload an FPR file

Both SSC REST API and fcli provide options for specifying the engine type directly, and as such it is not necessary to package the raw results into a zip-file with accompanying scan.info file. For example, fcli allows for uploading raw scan results using a command like the following:

fcli ssc artifact upload -f <raw-results-file> --appversion MyApp:MyVersion --engine-type CLAIR_YAIR

This document was auto-generated from USAGE.template.md; do not edit by hand