Documentation
¶
Overview ¶
Package scanners holds Draugr's built-in scanners, which wrap individual security tools and normalize their output to SARIF.
See docs/ARCHITECTURE.md.
Index ¶
- func NewGitleaks() plugin.Scanner
- func NewGosec() plugin.Scanner
- func NewHTTPHeaders() plugin.Scanner
- func NewK8sPolicies() plugin.Scanner
- func NewKubeBench() plugin.Scanner
- func NewKubeBenchJob() plugin.Scanner
- func NewMendLicenses() plugin.Scanner
- func NewMendSCA() plugin.Scanner
- func NewNuclei() plugin.Scanner
- func NewSemgrep() plugin.Scanner
- func NewTLSProbe() plugin.Scanner
- func NewTrivy() plugin.Scanner
- func NewTrivyConfig() plugin.Scanner
- func NewTrivyFS() plugin.Scanner
- func NewTrivyLicense() plugin.Scanner
- func NewURLhaus() plugin.Scanner
- func NewVirusTotal() plugin.Scanner
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewGitleaks ¶ added in v0.2.0
NewGitleaks returns a Scanner that runs Gitleaks over a checked-out repository to detect leaked secrets (credentials, tokens, keys). It serves the "secrets" control.
func NewGosec ¶ added in v0.14.0
NewGosec returns a Scanner that runs gosec, a Go-specialized static analyzer, over a checked-out repository. It is an optional second scanner for the "sast" control (alongside Semgrep); it only makes sense on Go components, so it is opt-in via controllers.sast.scanners.
func NewHTTPHeaders ¶ added in v0.9.0
NewHTTPHeaders returns the native HTTP security-header scanner.
func NewK8sPolicies ¶ added in v0.47.0
NewK8sPolicies returns a Scanner that reads the CIS policies section through the Kubernetes API.
func NewKubeBench ¶ added in v0.45.0
NewKubeBench returns a Scanner for the "infrastructure" control.
func NewKubeBenchJob ¶ added in v0.46.0
NewKubeBenchJob returns a Scanner that runs the CIS benchmark inside the cluster.
func NewMendLicenses ¶ added in v0.71.0
NewMendLicenses returns a Scanner for the "licenses" control backed by Mend.
func NewMendSCA ¶ added in v0.70.0
NewMendSCA returns a Scanner for the "sca" control backed by Mend.
func NewNuclei ¶ added in v0.28.0
NewNuclei returns a Scanner that runs Nuclei for the "dast" control. Nuclei is a single Go binary that probes a live endpoint with a large community template library; Draugr parses its JSONL output rather than its SARIF export, so severity, the matched URL, and CWEs map cleanly onto Draugr's model.
func NewSemgrep ¶ added in v0.3.0
NewSemgrep returns a Scanner that runs Semgrep over a checked-out repository for static application security testing (SAST). It serves the "sast" control.
func NewTLSProbe ¶ added in v0.31.0
NewTLSProbe returns the native TLS configuration scanner.
func NewTrivy ¶
NewTrivy returns a Scanner that runs Aqua Trivy against container images and returns its native SARIF output. It serves the "images" control.
func NewTrivyConfig ¶ added in v0.4.0
NewTrivyConfig returns a Scanner that runs Trivy's misconfiguration scanner over a checked-out repository to find insecure Infrastructure-as-Code (Terraform, Kubernetes manifests, Dockerfiles, Helm, …). It serves the "iac" control.
func NewTrivyFS ¶
NewTrivyFS returns a Scanner that runs Trivy in filesystem mode over a checked-out repository to find dependency vulnerabilities (SCA). It serves the "sca" control. (License findings are not included in Trivy's SARIF output and are tracked separately.)
func NewTrivyLicense ¶ added in v0.43.0
NewTrivyLicense returns a Scanner that reports dependency licences carrying an obligation.
func NewURLhaus ¶ added in v0.66.0
NewURLhaus returns the abuse.ch URLhaus threat-intelligence scanner.
func NewVirusTotal ¶ added in v0.66.0
NewVirusTotal returns the VirusTotal domain-reputation scanner.
Types ¶
This section is empty.
Source Files
¶
- cis_policies_catalogue.go
- csp.go
- doc.go
- gitleaks.go
- gosec.go
- headers.go
- k8s_policies.go
- kube_bench.go
- kube_bench_job.go
- lockretry.go
- mend_licenses.go
- mend_sca.go
- mend_schema.go
- mend_session.go
- mend_settings.go
- nuclei.go
- options.go
- repo.go
- schemas.go
- semgrep.go
- tls.go
- toolversion.go
- trivy-config.go
- trivy.go
- trivy_license.go
- trivy_version.go
- urlhaus.go
- virustotal.go