Skip to content
This repository was archived by the owner on Aug 13, 2025. It is now read-only.

Commit 73b912e

Browse files
rohitbaryha1rohitbaryha1
authored
feat: Add support for AWS Security Hub (#75)
1 parent 34bf929 commit 73b912e

File tree

4 files changed

+137
-0
lines changed

4 files changed

+137
-0
lines changed

‎FortifyVulnerabilityExporter-plugin-to-json/src/main/resources/pluginConfig/json-aws-fod-sast.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
spring.config.activate.on-loader-plugin: fod
3+
4+
json.awshub.sast.filter.expr: vuln.scantype=='Static'
5+
json.awshub.sast.format:
6+
fields:
7+
issues: $[vulnerabilityMappers.issue.get()]
8+
vulnerabilityMappers.issue.fields:
9+
SchemaVersion: 2018-10-08
10+
Id: $[vuln.releaseId]-$[vuln.id]
11+
ProductArn: '--'
12+
GeneratorId: '--'
13+
ProductName: 'Fortify SAST'
14+
CompanyName: OpenText
15+
Types: "[ 'Software and Configuration Checks/Vulnerabilities/CVE' ]"
16+
CreatedAt: $[#formatDateTimewithZoneIdAsUTC("yyyy-MM-dd'T'HH:mm:ss.SSSSSS'Z'", release.staticScanDate?:'1970-01-01T00:00:00', release.serverZoneId)]
17+
UpdatedAt: $[#formatDateTimewithZoneIdAsUTC("yyyy-MM-dd'T'HH:mm:ss.SSSSSS'Z'", release.staticScanSummary?.completedDateTime?:'1970-01-01T00:00:00', release.serverZoneId)]
18+
Severity:
19+
Original: $[vuln.severityString]
20+
Normalized: $[{Critical:10.0,High:8.9,Medium:6.9,Low:3.9}.get(vuln.severityString)+'']
21+
Title: $[vuln.category]
22+
Description: $[#abbreviate(#htmlToText(vuln.all_data.details.summary).replaceAll(" ", " "),510)]
23+
Remediation:
24+
Recommendation:
25+
Text: $[#abbreviate(#htmlToText(vuln.all_data.recommendations?.recommendations).replaceAll(" ", " "),510)]
26+
Url: $[vuln.deepLink]
27+
ProductFields:
28+
Product Name: 'Fortify SAST'
29+
Resources:
30+
Type: Application
31+
Id: $[vuln.releaseId]-$[vuln.id]
32+
Partition: aws
33+
Region: '--'
34+
details:
35+
Other:
36+
APPLICATION: '$[vuln.releaseId]'
37+
APPLICATION NAME: $[vuln.release.applicationName]
38+
APPLICATION VERSION: $[vuln.release.releaseName]
39+
PRIMARY LOCATION: $[vuln.primaryLocationFull]
40+
LINE NUMBER: '$[vuln.lineNumber==0?1:vuln.lineNumber]'
41+
INSTANCE ID: "$[vuln.instanceId]"
42+
RecordState: ACTIVE

‎FortifyVulnerabilityExporter-plugin-to-json/src/main/resources/pluginConfig/json-aws-ssc-sast.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
spring.config.activate.on-loader-plugin: ssc
3+
4+
json.awshub.sast.filter.expr: vuln.engineType=='SCA'
5+
json.awshub.sast.format:
6+
fields:
7+
issues: $[vulnerabilityMappers.vulnerability.get()]
8+
vulnerabilityMappers.vulnerability.fields:
9+
SchemaVersion: 2018-10-08
10+
Id: $[vuln.projectVersionId]-$[vuln.id]
11+
ProductArn: '--'
12+
GeneratorId: '--'
13+
ProductName: 'Fortify SAST'
14+
CompanyName: OpenText
15+
Types: "[ 'Software and Configuration Checks/Vulnerabilities/CVE' ]"
16+
CreatedAt: $[#formatDateTime("yyyy-MM-dd'T'HH:mm:ss", applicationVersion.currentStaticScan?.uploadDate?:'1970-01-01T00:00:00')]
17+
UpdatedAt: $[#formatDateTime("yyyy-MM-dd'T'HH:mm:ss", applicationVersion.currentStaticScan?.uploadDate?:'1970-01-01T00:00:00')]
18+
Severity:
19+
Original: $[vuln.friority]
20+
Normalized: $[{Critical:10.0,High:8.9,Medium:6.9,Low:3.9}.get(vuln.friority)+'']
21+
Title: $[vuln.issueName]
22+
Description: $[#abbreviate(#htmlToText(vuln.details?.brief).replaceAll(" ", " "),510)]
23+
Remediation:
24+
Recommendation:
25+
Text: $[#abbreviate(#htmlToText(vuln.details?.recommendation).replaceAll(" ", " "),510)]
26+
Url: $[vuln.deepLink]
27+
ProductFields:
28+
Product Name: 'Fortify SAST'
29+
Resources:
30+
Type: Application
31+
Id: $[vuln.projectVersionId]-$[vuln.id]
32+
Partition: aws
33+
Region: '--'
34+
details:
35+
Other:
36+
APPLICATION: '$[vuln.projectVersionId]'
37+
APPLICATION NAME: $[vuln.applicationVersion.project.name]
38+
APPLICATION VERSION: $[vuln.applicationVersion.name]
39+
PRIMARY LOCATION: $[vuln.fullFileName]
40+
LINE NUMBER: '$[vuln.lineNumber==0?1:vuln.lineNumber]'
41+
INSTANCE ID: "$[vuln.instanceId]"
42+
RecordState: ACTIVE
43+
vulnerabilityMappers.vulnerability.value: $[vuln]

‎config/FoDToAWS.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# See FortifyVulnerabilityExporter documentation for FoD connection settings and release selection
2+
3+
export:
4+
from: fod
5+
to: json.awshub.sast
6+
7+
fod:
8+
release:
9+
embed: # Load static and dynamic scan summaries if available
10+
- propertyName: staticScanSummary
11+
uri: /api/v3/scans/{currentStaticScanId}/summary
12+
embedIf: currentStaticScanId!=null
13+
vulnerability:
14+
filterParam: scantype:Static # Have FoD return only static issues
15+
embed: # Load extra data, depending on what data you want to include in output
16+
- subEntity: all-data
17+
18+
export.dir: ${CI_PROJECT_DIR:${export.default.dir}} # Unless overridden, use CI_PROJECT_DIR if defined, otherwise default export dir
19+
json.awshub.sast.output:
20+
stdout: false # Useful for debugging, disabled for optimal performance
21+
pretty: true # Useful for debugging, disable for optimal performance
22+
file: ${export.dir}/awshub-fortify-sast.json

‎config/SSCToAWS.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# See FortifyVulnerabilityExporter documentation for SSC connection settings and application version selection
2+
3+
export:
4+
from: ssc
5+
to: json.awshub.sast
6+
7+
ssc:
8+
version:
9+
embed: # Load static and dynamic scan summaries if available
10+
- subEntity: currentStaticScan
11+
onError: LOG_INFO
12+
- propertyName: issueCountsSCA
13+
subEntity: issueGroups
14+
params:
15+
filter: ISSUE[11111111-1111-1111-1111-111111111151]:SCA
16+
groupingtype: 11111111-1111-1111-1111-111111111150
17+
- propertyName: issueCounts
18+
subEntity: issueGroups
19+
params:
20+
groupingtype: 11111111-1111-1111-1111-111111111150
21+
vulnerability:
22+
filterParam: ISSUE[11111111-1111-1111-1111-111111111151]:SCA # Have SSC return only SCA issues
23+
embed: # Also load details as required for GitHub output
24+
- subEntity: details
25+
26+
export.dir: ${CI_PROJECT_DIR:${export.default.dir}} # Unless overridden, use CI_PROJECT_DIR if defined, otherwise default export dir
27+
json.awshub.sast.output:
28+
stdout: false # Useful for debugging, disabled for optimal performance
29+
pretty: true # Useful for debugging, disable for optimal performance
30+
file: ${export.dir}/awshub-fortify-sast.json

0 commit comments

Comments
 (0)