Documentation
¶
Overview ¶
Package connector delivers a finished Report to an external destination (webhook, chat, CI artifact, …). A Connector is an outbound adapter: it takes the shared Report model and pushes it somewhere. Adding an integration means implementing this one interface.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type GitHubCodeScanning ¶
type GitHubCodeScanning struct {
APIBase string // default https://api.github.com (override for GitHub Enterprise)
Owner string
Repo string
Token string
CommitSHA string
Ref string // e.g. "refs/heads/main"
Client *http.Client
}
GitHubCodeScanning uploads the report as SARIF to GitHub's code-scanning API (POST /repos/{owner}/{repo}/code-scanning/sarifs). GitHub requires the SARIF gzipped then base64-encoded, tied to a commit and ref. This surfaces findings in the repo's Security tab and on pull requests.
func NewGitHubCodeScanning ¶
func NewGitHubCodeScanning(owner, repo, token, commitSHA, ref string) *GitHubCodeScanning
NewGitHubCodeScanning builds a code-scanning uploader with API defaults.
func (*GitHubCodeScanning) Name ¶
func (g *GitHubCodeScanning) Name() string
type Jira ¶
type Jira struct {
BaseURL string // e.g. https://acme.atlassian.net
ProjectKey string // e.g. "SEC"
Email string
Token string
IssueType string // default "Task"
// MinSeverity suppresses issue creation unless a finding at or above this
// level exists. SeverityUnknown means "always create".
MinSeverity engine.Severity
Client *http.Client
}
Jira opens a tracking issue for a scan by calling the Jira Cloud REST API (POST /rest/api/2/issue). It creates a single summary issue describing the run, gated by MinSeverity so a clean scan does not spam the backlog. Auth is HTTP basic with an account email and an API token, per Jira Cloud.
type MCPPush ¶
type MCPPush struct {
Endpoint string // MCP HTTP endpoint, e.g. http://agent-host:7423/mcp
// Method is the JSON-RPC notification method; defaults to
// "notifications/scan_completed".
Method string
Client *http.Client
}
MCPPush notifies a Model Context Protocol endpoint that a scan completed, delivering the report as a JSON-RPC 2.0 notification. It lets an agent runtime react to fresh scan results (open a ticket, kick off triage) without polling. It is a notification, not a request: fire-and-forget fits an outbound connector, and any 2xx (including 204 No Content) counts as delivered.
func NewMCPPush ¶
NewMCPPush builds an MCP push connector with defaults.
type SARIFFile ¶
type SARIFFile struct {
Path string
}
SARIFFile writes the report as a SARIF file, e.g. for upload as a CI artifact or to GitHub code scanning.
func NewSARIFFile ¶
NewSARIFFile builds a SARIF-file connector targeting path.
type SIEM ¶
type SIEM struct {
URL string
APIKey string // sent as "Authorization: <APIKey>" when non-empty
Source string // event.provider label; default "docker-security"
Client *http.Client
}
SIEM ships each finding as a structured event to a generic HTTP collector (Splunk HEC, Elastic, a Logstash HTTP input, a custom SOC webhook). Events are newline-delimited JSON in an ECS-flavored shape, which most SIEMs ingest directly. It is intentionally vendor-neutral: point it at any endpoint that accepts a POST of NDJSON.
type Slack ¶
type Slack struct {
WebhookURL string
Client *http.Client
// MaxFindings caps how many individual findings are listed (0 = summary only).
MaxFindings int
}
Slack posts a summary message to a Slack incoming-webhook URL.
type Webhook ¶
Webhook POSTs the full JSON report to an arbitrary URL.
func NewWebhook ¶
NewWebhook builds a Webhook connector with a sane default timeout.