Directories
¶
| Path | Synopsis |
|---|---|
|
Package adapters provides a registry for scanner output adapters.
|
Package adapters provides a registry for scanner output adapters. |
|
betterleaks
Package betterleaks provides an adapter to convert Betterleaks (v1) JSON reports to CTIS.
|
Package betterleaks provides an adapter to convert Betterleaks (v1) JSON reports to CTIS. |
|
nuclei
Package nuclei provides an adapter to convert Nuclei JSONL output to CTIS.
|
Package nuclei provides an adapter to convert Nuclei JSONL output to CTIS. |
|
sarif
Package sarif provides an adapter to convert SARIF format to CTIS.
|
Package sarif provides an adapter to convert SARIF format to CTIS. |
|
semgrep
Package semgrep provides an adapter to convert Semgrep JSON output to CTIS.
|
Package semgrep provides an adapter to convert Semgrep JSON output to CTIS. |
|
trivy
Package trivy provides an adapter to convert Trivy JSON output to CTIS.
|
Package trivy provides an adapter to convert Trivy JSON output to CTIS. |
|
vuls
Package vuls provides an adapter to convert Vuls JSON output to CTIS.
|
Package vuls provides an adapter to convert Vuls JSON output to CTIS. |
|
Package audit provides structured audit logging for sensor operations.
|
Package audit provides structured audit logging for sensor operations. |
|
Package chunk splits a large CTIS report into protocol v2 segments (api RFC-026 §3.5): SplitSegments returns complete CTIS documents, each with the report's tool and metadata and the assets its findings reference, within the platform's per-segment limits.
|
Package chunk splits a large CTIS report into protocol v2 segments (api RFC-026 §3.5): SplitSegments returns complete CTIS documents, each with the report's tool and metadata and the assets its findings reference, within the platform's per-segment limits. |
|
Package client provides the OpenCTEM API client.
|
Package client provides the OpenCTEM API client. |
|
Package compress provides compression utilities for large payloads.
|
Package compress provides compression utilities for large payloads. |
|
Package conformance is the sensor protocol conformance suite (RFC-026 WP-S3, RFC-023 D23), starting with results ingest.
|
Package conformance is the sensor protocol conformance suite (RFC-026 WP-S3, RFC-023 D23), starting with results ingest. |
|
Package connectors provides base implementations and utilities for external system connectors.
|
Package connectors provides base implementations and utilities for external system connectors. |
|
github
Package github provides a GitHub connector for the OpenCTEM SDK.
|
Package github provides a GitHub connector for the OpenCTEM SDK. |
|
Package core provides the core interfaces and base implementations for the OpenCTEM Scanner SDK.
|
Package core provides the core interfaces and base implementations for the OpenCTEM Scanner SDK. |
|
Package credentials provides credential management for the OpenCTEM SDK.
|
Package credentials provides credential management for the OpenCTEM SDK. |
|
Package ctis is the SDK's name for the CTIS data model (github.com/openctemio/ctis).
|
Package ctis is the SDK's name for the CTIS data model (github.com/openctemio/ctis). |
|
internal/genalias
command
Command genalias writes pkg/ctis/zz_generated_aliases.go: one type alias, constant, variable or wrapper function in package ctis for every exported identifier of the root package of github.com/openctemio/ctis, at the version go.mod requires.
|
Command genalias writes pkg/ctis/zz_generated_aliases.go: one type alias, constant, variable or wrapper function in package ctis for every exported identifier of the root package of github.com/openctemio/ctis, at the version go.mod requires. |
|
enrichers
|
|
|
epss
Package epss provides EPSS (Exploit Prediction Scoring System) enrichment for CVEs.
|
Package epss provides EPSS (Exploit Prediction Scoring System) enrichment for CVEs. |
|
kev
Package kev provides KEV (Known Exploited Vulnerabilities) enrichment.
|
Package kev provides KEV (Known Exploited Vulnerabilities) enrichment. |
|
Package errors provides custom error types for the OpenCTEM SDK.
|
Package errors provides custom error types for the OpenCTEM SDK. |
|
Package gitenv provides auto-detection and abstraction for CI/CD environments.
|
Package gitenv provides auto-detection and abstraction for CI/CD environments. |
|
Package health provides health check endpoints for the OpenCTEM SDK.
|
Package health provides health check endpoints for the OpenCTEM SDK. |
|
Package httpsec provides SSRF-safe URL validation and HTTP client construction for the OpenCTEM SDK.
|
Package httpsec provides SSRF-safe URL validation and HTTP client construction for the OpenCTEM SDK. |
|
Package importtool is the file importer as a parser-class tool of the tool contract (pkg/tool): it converts files other security tools export (Nessus v2 XML, Qualys detection XML with its KnowledgeBase, DefectDojo Generic Findings JSON, CycloneDX, SPDX, osv-scanner results, CSAF and OpenVEX) into CTIS with the ctis importer package, so the conversion runs in the tool sandbox of a sensor instead of on the platform.
|
Package importtool is the file importer as a parser-class tool of the tool contract (pkg/tool): it converts files other security tools export (Nessus v2 XML, Qualys detection XML with its KnowledgeBase, DefectDojo Generic Findings JSON, CycloneDX, SPDX, osv-scanner results, CSAF and OpenVEX) into CTIS with the ctis importer package, so the conversion runs in the tool sandbox of a sensor instead of on the platform. |
|
internal
|
|
|
assetctx
Package assetctx gives the SDK's converters the asset their findings belong to.
|
Package assetctx gives the SDK's converters the asset their findings belong to. |
|
cirepo
Package cirepo reads the repository a CI job is building from the CI environment (GitHub Actions, GitLab CI), for converters that must name the repository their findings belong to when the caller did not.
|
Package cirepo reads the repository a CI job is building from the CI environment (GitHub Actions, GitLab CI), for converters that must name the repository their findings belong to when the caller did not. |
|
importbridge
Package importbridge runs the deprecated tool adapters (pkg/adapters) on the one conversion entry point, github.com/openctemio/ctis/importer, so the SDK, the platform and the sensor convert a tool's output the same way and under the same hostile-input limits.
|
Package importbridge runs the deprecated tool adapters (pkg/adapters) on the one conversion entry point, github.com/openctemio/ctis/importer, so the SDK, the platform and the sensor convert a tool's output the same way and under the same hostile-input limits. |
|
Package metrics provides metrics collection and reporting for the OpenCTEM SDK.
|
Package metrics provides metrics collection and reporting for the OpenCTEM SDK. |
|
Package mocks provides mock implementations for testing.
|
Package mocks provides mock implementations for testing. |
|
Package options provides functional options pattern for SDK configuration.
|
Package options provides functional options pattern for SDK configuration. |
|
Package outbox is the sensor's durable, write-ahead queue of results waiting for the platform.
|
Package outbox is the sensor's durable, write-ahead queue of results waiting for the platform. |
|
Package pipeline provides async pipeline for separating scan and upload.
|
Package pipeline provides async pipeline for separating scan and upload. |
|
Package platform provides components for running sensors in platform mode.
|
Package platform provides components for running sensors in platform mode. |
|
politeness
module
|
|
|
providers
|
|
|
github
Package github provides a GitHub provider for the OpenCTEM SDK.
|
Package github provides a GitHub provider for the OpenCTEM SDK. |
|
Package resource provides system resource monitoring and control.
|
Package resource provides system resource monitoring and control. |
|
Package retry provides persistent retry queue functionality for failed API operations.
|
Package retry provides persistent retry queue functionality for failed API operations. |
|
scanners
|
|
|
tenable
Package tenable converts Tenable Nessus / Tenable.sc ".nessus" XML exports into a CTIS report and provides a REST client for launching/exporting scans.
|
Package tenable converts Tenable Nessus / Tenable.sc ".nessus" XML exports into a CTIS report and provides a REST client for launching/exporting scans. |
|
Package sdk identifies this SDK: its name and release version.
|
Package sdk identifies this SDK: its name and release version. |
|
Package sensorkit is everything a sensor needs to work with the OpenCTEM platform, in one call: a sensor implements its tools, the kit runs the rest.
|
Package sensorkit is everything a sensor needs to work with the OpenCTEM platform, in one call: a sensor implements its tools, the kit runs the rest. |
|
executor
Package executor runs one task (one tool invocation) for a sensor, in a sandbox.
|
Package executor runs one task (one tool invocation) for a sensor, in a sandbox. |
|
identity
Package identity is a key-bound sensor's identity on disk and the interactive pairing that creates it (api RFC-052): the sensor makes its own Ed25519 key, pairs with the platform (an administrator compares the short authentication string and approves), and from then on signs every request with that key.
|
Package identity is a key-bound sensor's identity on disk and the interactive pairing that creates it (api RFC-052): the sensor makes its own Ed25519 key, pairs with the platform (an administrator compares the short authentication string and approves), and from then on signs every request with that key. |
|
settings
Package settings is the sensor settings registry: every setting a sensor reads, declared once with its name, type, whether it is required, its default, whether it is a secret, a description, a docs link and a validation.
|
Package settings is the sensor settings registry: every setting a sensor reads, declared once with its name, type, whether it is required, its default, whether it is a secret, a description, a docs link and a validation. |
|
toolhost
Package toolhost is the runtime side of the tool contract: it runs one task of a tool (pkg/tool) out of process, inside the Executor sandbox (pkg/sensorkit/executor), and turns what the tool reports into a checked, stamped CTIS report.
|
Package toolhost is the runtime side of the tool contract: it runs one task of a tool (pkg/tool) out of process, inside the Executor sandbox (pkg/sensorkit/executor), and turns what the tool reports into a checked, stamped CTIS report. |
|
sensorproto
|
|
|
legacyv1
Package legacyv1 is the only place the SDK still spells the pre-sensor "agent" vocabulary (RFC-023 §9.5).
|
Package legacyv1 is the only place the SDK still spells the pre-sensor "agent" vocabulary (RFC-023 §9.5). |
|
pairing
Package pairing is the interactive sensor pairing protocol (api RFC-052): a sensor that has only the platform URL creates its own Ed25519 key, asks the platform to pair, and an administrator approves it after comparing a short authentication string (SAS) shown on both sides.
|
Package pairing is the interactive sensor pairing protocol (api RFC-052): a sensor that has only the platform URL creates its own Ed25519 key, asks the platform to pair, and an administrator approves it after comparing a short authentication string (SAS) shown on both sides. |
|
v2
Package v2 is the client side of sensor protocol v2 results ingest (RFC-026, api docs/rfcs/RFC-026-sensor-results-ingest.md): the paths, media type, headers, problem types, status resource, hello document and the Content-Digest the SDK sends.
|
Package v2 is the client side of sensor protocol v2 results ingest (RFC-026, api docs/rfcs/RFC-026-sensor-results-ingest.md): the paths, media type, headers, problem types, status resource, hello document and the Content-Digest the SDK sends. |
|
Package sensorsig is the HTTP message signature profile a key-bound sensor uses on every platform request (api RFC-032 E5, api RFC-052): RFC 9421 signatures with the sensor's Ed25519 key and an RFC 9530 Content-Digest over the body.
|
Package sensorsig is the HTTP message signature profile a key-bound sensor uses on every platform request (api RFC-032 E5, api RFC-052): RFC 9421 signatures with the sensor's Ed25519 key and an RFC 9530 Content-Digest over the body. |
|
shared
|
|
|
fingerprint
Package fingerprint provides unified fingerprint generation algorithms for deduplication of security findings across SDK and Backend.
|
Package fingerprint provides unified fingerprint generation algorithms for deduplication of security findings across SDK and Backend. |
|
severity
Package severity provides unified severity level definitions and mappings for security findings across SDK and Backend.
|
Package severity provides unified severity level definitions and mappings for security findings across SDK and Backend. |
|
Package testkit runs a tool (pkg/tool) in-process for tests, with the rules the runtime applies in production: the manifest must be valid, the configuration must match its schema, only declared credentials are delivered, every record is checked (CTIS validity, declared output types, size and count limits, control characters), and the report is assembled and stamped as the runtime does.
|
Package testkit runs a tool (pkg/tool) in-process for tests, with the rules the runtime applies in production: the manifest must be valid, the configuration must match its schema, only declared credentials are delivered, every record is checked (CTIS validity, declared output types, size and count limits, control characters), and the report is assembled and stamped as the runtime does. |
|
Package tool is the one contract for every workload a sensor runs: a target scanner, a connector to a vendor API, a parser of a file or an enricher of findings.
|
Package tool is the one contract for every workload a sensor runs: a target scanner, a connector to a vendor API, a parser of a file or an enricher of findings. |
|
adapter
Package adapter runs a tool (pkg/tool) as an adapter process: the tool's side of adapter protocol v1, newline-delimited JSON on stdin and stdout, one task per process (docs/rfcs/sensor-sdk-v2.md, D.4.2).
|
Package adapter runs a tool (pkg/tool) as an adapter process: the tool's side of adapter protocol v1, newline-delimited JSON on stdin and stdout, one task per process (docs/rfcs/sensor-sdk-v2.md, D.4.2). |
|
toolcompat
Package toolcompat runs code written against the older interfaces (core.Scanner, core.Collector) as tools of the tool contract (pkg/tool), so it gets the contract's runtime without a rewrite: out-of-process execution in the task sandbox, admission against the policy, declared credentials only, checked and stamped output.
|
Package toolcompat runs code written against the older interfaces (core.Scanner, core.Collector) as tools of the tool contract (pkg/tool), so it gets the contract's runtime without a rewrite: out-of-process execution in the task sandbox, admission against the policy, declared credentials only, checked and stamped output. |
|
transport
|
|
|
grpc
Package grpc provides a gRPC transport layer for the OpenCTEM SDK client.
|
Package grpc provides a gRPC transport layer for the OpenCTEM SDK client. |
|
Package useragent builds the User-Agent the SDK sends to the platform and to the services its collectors and enrichers call:
|
Package useragent builds the User-Agent the SDK sends to the platform and to the services its collectors and enrichers call: |
Click to show internal directories.
Click to hide internal directories.