Skip to content

Commit 637c87e

Browse files
tejakummarikuntlatejakummarikuntla
authored
STO: Document ModelScan Step (#11575)
* Document ModelScan * Add Ingestion mode * Add limitations * Add ModelScan to Scanners list
1 parent 811df1f commit 637c87e

File tree

8 files changed

+144
-4
lines changed

8 files changed

+144
-4
lines changed

‎docs/security-testing-orchestration/set-up-scans/shared/ai-scanners.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
1. **[ModelScan](/docs/security-testing-orchestration/sto-techref-category/modelscan)**

‎docs/security-testing-orchestration/sto-techref-category/github-advanced-security.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,14 @@ import StoSettingScanTypeRepo from './shared/step-palette/target/type/repo.md';
8383

8484
<StoSettingScanTypeRepo />
8585

86+
#### Target and variant detection
87+
88+
import StoSettingScanTypeAutodetectRepo from './shared/step-palette/target/auto-detect/code-repo.md';
89+
import StoSettingScanTypeAutodetectNote from './shared/step-palette/target/auto-detect/note.md';
90+
91+
<StoSettingScanTypeAutodetectRepo/>
92+
<StoSettingScanTypeAutodetectNote/>
93+
8694
#### Name
8795
import StoSettingTargetName from './shared/step-palette/target/name.md';
8896

‎docs/security-testing-orchestration/sto-techref-category/modelscan.md‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
---
2+
title: ModelScan Step Configuration
3+
description: Scan machine learning models with ModelScan.
4+
sidebar_label: ModelScan Step Configuration
5+
sidebar_position: 240
6+
---
7+
8+
<DocsTag text="Code repo scanners" backgroundColor="#cbe2f9" textColor="#0b5cad" link="/docs/security-testing-orchestration/whats-supported/scanners?view-by=target-type#code-repo-scanners" />
9+
<DocsTag text="Orchestration" backgroundColor="#e3cbf9" textColor="#5c0bad" link="/docs/security-testing-orchestration/get-started/key-concepts/run-an-orchestrated-scan-in-sto" />
10+
<DocsTag text="Ingestion" backgroundColor="#e3cbf9" textColor="#5c0bad" link="/docs/security-testing-orchestration/get-started/key-concepts/ingest-scan-results-into-an-sto-pipeline" />
11+
<br/>
12+
<br/>
13+
14+
The **ModelScan** step in Harness STO uses the open-source scanner [ModelScan](https://github.com/protectai/modelscan) to scan your machine learning (ML) models for security vulnerabilities. You can perform **ModelScan** scans in both **[Orchestration](#scan-mode)** and **[Ingestion](#scan-mode)** modes. This document will guide you through configuring the **ModelScan** step in your STO pipeline.
15+
16+
:::info
17+
- To run scans as a non-root user, you can use custom STO scan images and pipelines. See [Configure your pipeline to use STO images from private registry](/docs/security-testing-orchestration/use-sto/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry).
18+
- STO supports multiple workflows for loading self-signed certificates. See [Run STO scans with custom SSL certificates](/docs/security-testing-orchestration/use-sto/secure-sto-pipelines/ssl-setup-in-sto/#supported-workflows-for-adding-custom-ssl-certificates).
19+
:::
20+
21+
### Supported ML Libraries and Formats
22+
23+
The following table lists the ML libraries and serialization formats, along with their support status in the **ModelScan** step.
24+
25+
| ML Library | Serialization Format | Support Status |
26+
| :------------------------------------------- | :----------------------------------- | :--------------- |
27+
| Pytorch | Pickle | ✅ Supported |
28+
| Keras | HD5 (Hierarchical Data Format) | ✅ Supported |
29+
| Classic ML Libraries (Sklearn, XGBoost, etc.) | Pickle, Cloudpickle, Dill, Joblib | ✅ Supported |
30+
| TensorFlow | Protocol Buffer | ❌ Not Supported |
31+
| Keras | Keras V3 (Hierarchical Data Format) | ❌ Not Supported |
32+
33+
Scanning ML models in **binary files** is not supported. Your models must be in one of the supported formats listed above.
34+
35+
## ModelScan step settings
36+
37+
The recommended workflow is to add a **ModelScan** step to a **Security** or **Build** stage and then configure it as described below.
38+
39+
### Scan Mode
40+
41+
- **Orchestration mode**: In this mode, the step executes the scan, then processes the results by normalizing and deduplicating them.
42+
- **Ingestion mode**: In this mode, the **ModelScan** step ingests scan results from a specified file. The scan results file must be in JSON format.
43+
44+
### Scan Configuration
45+
46+
import StoSettingProductConfigName from './shared/step-palette/scan/config-name.md';
47+
48+
<StoSettingProductConfigName />
49+
50+
### Target
51+
52+
#### Type
53+
54+
import StoSettingScanTypeRepo from './shared/step-palette/target/type/repo.md';
55+
56+
<StoSettingScanTypeRepo />
57+
58+
You can also scan models stored in **Hugging Face** repositories by using the [Harness GitHub connector](/docs/platform/connectors/code-repositories/connect-to-code-repo), configured to connect to your Hugging Face account.
59+
60+
#### Target and variant detection
61+
62+
import StoSettingScanTypeAutodetectRepo from './shared/step-palette/target/auto-detect/code-repo.md';
63+
import StoSettingScanTypeAutodetectNote from './shared/step-palette/target/auto-detect/note.md';
64+
65+
<StoSettingScanTypeAutodetectRepo/>
66+
<StoSettingScanTypeAutodetectNote/>
67+
68+
#### Name
69+
70+
import StoSettingTargetName from './shared/step-palette/target/name.md';
71+
72+
<StoSettingTargetName />
73+
74+
#### Variant
75+
76+
import StoSettingTargetVariant from './shared/step-palette/target/variant.md';
77+
78+
<StoSettingTargetVariant />
79+
80+
#### Workspace
81+
82+
import StoSettingTargetWorkspace from './shared/step-palette/target/workspace.md';
83+
84+
<StoSettingTargetWorkspace />
85+
86+
### Ingestion File
87+
88+
import StoSettingIngestionFile from './shared/step-palette/ingest/file.md';
89+
90+
<StoSettingIngestionFile />
91+
92+
The ingestion file must be in `JSON` format.
93+
94+
### Log Level
95+
96+
import StoSettingLogLevel from './shared/step-palette/all/log-level.md';
97+
98+
<StoSettingLogLevel />
99+
100+
### Fail on Severity
101+
102+
import StoSettingFailOnSeverity from './shared/step-palette/all/fail-on-severity.md';
103+
104+
<StoSettingFailOnSeverity />
105+
106+
### Additional Configuration
107+
108+
import ScannerRefAdditionalConfigs from './shared/additional-config.md';
109+
110+
<ScannerRefAdditionalConfigs />
111+
112+
### Advanced settings
113+
114+
import ScannerRefAdvancedSettings from './shared/advanced-settings.md';
115+
116+
<ScannerRefAdvancedSettings />
117+
118+
## Proxy settings
119+
import ProxySettings from './shared/proxy-settings.md';
120+
121+
<ProxySettings />

‎docs/security-testing-orchestration/sto-techref-category/shared/step-palette/ingest/file.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
The path to your scan results when running an [Ingestion scan](/docs/security-testing-orchestration/get-started/key-concepts/ingest-scan-results-into-an-sto-pipeline), for example `/shared/scan_results/myscan.latest.sarif`.
22

3-
- The data file must be in a [supported format](/docs/security-testing-orchestration/sto-techref-category/security-step-settings-reference#ingestion-formats-supported-by-sto) for the scanner.
3+
- The data file must be in a [supported format](/docs/security-testing-orchestration/whats-supported/scanners#supported-ingestion-formats) for the scanner.
44

55
- The data file must be accessible to the scan step. It's good practice to save your results files to a [shared path](/docs/continuous-integration/get-started/key-concepts#stages) in your stage. In the visual editor, go to the stage where you're running the scan. Then go to **Overview** > **Shared Paths**. You can also add the path to the YAML stage definition like this:
66

‎docs/security-testing-orchestration/sto-techref-category/shared/step-palette/target/auto-detect/note.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
Note the following:
2-
- **Auto** is not available when the **Scan Mode** is **Ingestion**.
3-
- **Auto** is the default selection for new pipelines. Manual is the default for old pipelines, but you might find that neither radio button is selected in the UI.
2+
- **Auto** is not available when the **Scan Mode** is **Ingestion**.
3+
- By default, **Auto** is selected when you add the step. You can change this setting if needed.

‎docs/security-testing-orchestration/sto-techref-category/shared/sto-supported-ingestion-formats.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ Harness recommends that you publish and ingest using the scanner-specific JSON f
2929
- **HQL AppScan** — XML
3030
- **Grype** — JSON
3131
- **Mend _(formerly Whitesource)_** — JSON
32+
- **ModelScan** — JSON
3233
- **Nessus** — XML
3334
- **Nexus** — JSON
3435
- **Nikto** — XML

‎docs/security-testing-orchestration/sto-techref-category/shared/sto-supported-scanners.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,13 @@ A code scanner can detect one or more of the following issue types in your sourc
2727
<tr>
2828
<td valign="top">
2929
<ul>
30-
<li><a href="/docs/security-testing-orchestration/sto-techref-category/trivy/aqua-trivy-scanner-reference">Aqua Trivy</a> Orchestration, Ingestion </li>
30+
<li><a href="/docs/security-testing-orchestration/sto-techref-category/aqua-trivy-scanner-reference">Aqua Trivy</a> Orchestration, Ingestion </li>
3131
<li><a href="/docs/security-testing-orchestration/sto-techref-category/bandit-scanner-reference">Bandit</a> Orchestration, Ingestion </li>
3232
<li><a href="/docs/security-testing-orchestration/sto-techref-category/brakeman-scanner-reference">Brakeman</a> Orchestration, Ingestion </li>
3333
<li><a href="/docs/security-testing-orchestration/sto-techref-category/coverity-scanner-reference">Coverity</a> Ingestion </li>
3434
<li><a href="/docs/security-testing-orchestration/sto-techref-category/gitleaks-scanner-reference">Gitleaks</a> Orchestration, Ingestion </li>
3535
<li><a href="/docs/security-testing-orchestration/sto-techref-category/grype/grype-scanner-reference">Grype</a> Orchestration, Ingestion </li>
36+
<li><a href="/docs/security-testing-orchestration/sto-techref-category/modelscan">ModelScan</a> Orchestration, Ingestion </li>
3637
<li><a href="/docs/security-testing-orchestration/sto-techref-category/osv-scanner-reference">Open Source Vulnerabilities (OSV)</a> Orchestration, Ingestion </li>
3738
<li><a href="/docs/security-testing-orchestration/sto-techref-category/owasp-scanner-reference">OWASP Dependency Check</a> Orchestration, Ingestion</li>
3839
<li><a href="/docs/security-testing-orchestration/sto-techref-category/reapsaw-scanner-reference">Reapsaw</a> Ingestion</li>

‎docs/security-testing-orchestration/whats-supported/scanners.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ Here are the list of scanners supported by STO by scan type.
3737
- [Container Scanners](#container-scanners)
3838
- [Dynamic Application Security Testing - DAST Scanners](#dynamic-application-security-testing---dast-scanners)
3939
- [Infrastructure as Code - IaC Scanners](#infrastructure-as-code---iac-scanners)
40+
- [AI Scanners](#ai-scanners)
4041

4142
In addition to the listed supported scanners, the [Custom Scan step](/docs/security-testing-orchestration/custom-scanning/custom-scan-reference) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step).
4243

@@ -100,6 +101,13 @@ import IacScanners from '/docs/security-testing-orchestration/set-up-scans/share
100101

101102
<IacScanners />
102103

104+
### AI Scanners
105+
AI Scanners are helps you to identify vulnerabilities in your ML models. To configure and run AI scanners, refer to [ModelScan](/docs/security-testing-orchestration/sto-techref-category/modelscan) step documentation.
106+
107+
<!-- import AiScanners from '/docs/security-testing-orchestration/set-up-scans/shared/ai-scanners.md';
108+
109+
<AiScanners /> -->
110+
103111
In addition to the listed supported scanners, the [Custom Scan step](/docs/security-testing-orchestration/custom-scanning/custom-scan-reference) allows the use of various other scanners. For a complete list of supported scanners, refer to [Scanners Supported with Custom Scan Step](#scanners-supported-with-custom-scan-step).
104112

105113
---

0 commit comments

Comments
 (0)