Documentation
¶
Overview ¶
Package scanners holds Draugr's built-in scanners, which wrap individual security tools and normalize their output to SARIF.
See docs/ARCHITECTURE.md.
Index ¶
- func NewGitleaks() plugin.Scanner
- func NewGosec() plugin.Scanner
- func NewHTTPHeaders() plugin.Scanner
- func NewK8sPolicies() plugin.Scanner
- func NewKubeBench() plugin.Scanner
- func NewKubeBenchJob() plugin.Scanner
- func NewNuclei() plugin.Scanner
- func NewSemgrep() plugin.Scanner
- func NewTLSProbe() plugin.Scanner
- func NewTrivy() plugin.Scanner
- func NewTrivyConfig() plugin.Scanner
- func NewTrivyFS() plugin.Scanner
- func NewTrivyLicense() plugin.Scanner
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewGitleaks ¶ added in v0.2.0
NewGitleaks returns a Scanner that runs Gitleaks over a checked-out repository to detect leaked secrets (credentials, tokens, keys). It serves the "secrets" control.
func NewGosec ¶ added in v0.14.0
NewGosec returns a Scanner that runs gosec, a Go-specialized static analyzer, over a checked-out repository. It is an optional second scanner for the "sast" control (alongside Semgrep); it only makes sense on Go components, so it is opt-in via controllers.sast.scanners.
func NewHTTPHeaders ¶ added in v0.9.0
NewHTTPHeaders returns the native HTTP security-header scanner.
func NewK8sPolicies ¶ added in v0.47.0
NewK8sPolicies returns a Scanner that reads the CIS policies section through the Kubernetes API.
func NewKubeBench ¶ added in v0.45.0
NewKubeBench returns a Scanner for the "infrastructure" control.
func NewKubeBenchJob ¶ added in v0.46.0
NewKubeBenchJob returns a Scanner that runs the CIS benchmark inside the cluster.
func NewNuclei ¶ added in v0.28.0
NewNuclei returns a Scanner that runs Nuclei for the "dast" control. Nuclei is a single Go binary that probes a live endpoint with a large community template library; Draugr parses its JSONL output rather than its SARIF export, so severity, the matched URL, and CWEs map cleanly onto Draugr's model.
func NewSemgrep ¶ added in v0.3.0
NewSemgrep returns a Scanner that runs Semgrep over a checked-out repository for static application security testing (SAST). It serves the "sast" control.
func NewTLSProbe ¶ added in v0.31.0
NewTLSProbe returns the native TLS configuration scanner.
func NewTrivy ¶
NewTrivy returns a Scanner that runs Aqua Trivy against container images and returns its native SARIF output. It serves the "images" control.
func NewTrivyConfig ¶ added in v0.4.0
NewTrivyConfig returns a Scanner that runs Trivy's misconfiguration scanner over a checked-out repository to find insecure Infrastructure-as-Code (Terraform, Kubernetes manifests, Dockerfiles, Helm, …). It serves the "iac" control.
func NewTrivyFS ¶
NewTrivyFS returns a Scanner that runs Trivy in filesystem mode over a checked-out repository to find dependency vulnerabilities (SCA). It serves the "sca" control. (License findings are not included in Trivy's SARIF output and are tracked separately.)
func NewTrivyLicense ¶ added in v0.43.0
NewTrivyLicense returns a Scanner that reports dependency licences carrying an obligation.
Types ¶
This section is empty.
Source Files