Skip to content

Commit c5c285d

Browse files
temblekingtembleking
committed
docs: update documentation
1 parent 4018d4f commit c5c285d

File tree

2 files changed

+117
-28
lines changed

2 files changed

+117
-28
lines changed

‎sysdig/resource_sysdig_secure_vulnerability_rule_bundle.go‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111

1212
"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
1313
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
14+
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
1415
)
1516

1617
func vulnerabilityRuleSchemaImageConfigLabel() *schema.Schema {
@@ -126,14 +127,16 @@ func vulnerabilityRuleSchemaSeveritiesAndThreats() *schema.Schema {
126127
Description: "Internal identifier for the severities and threats rule block.",
127128
},
128129
"severity_at_least": {
129-
Type: schema.TypeString,
130-
Optional: true,
131-
Description: "Vulnerability severity must be at least this level (critical, high, medium, low, negligible).",
130+
Type: schema.TypeString,
131+
Optional: true,
132+
Description: "Vulnerability severity must be at least this level (critical, high, medium, low, negligible).",
133+
ValidateFunc: validation.StringInSlice([]string{"critical", "high", "medium", "low", "negligible"}, false),
132134
},
133135
"severity_equals": {
134-
Type: schema.TypeString,
135-
Optional: true,
136-
Description: "Vulnerability severity must be exactly this level.",
136+
Type: schema.TypeString,
137+
Optional: true,
138+
Description: "Vulnerability severity must be exactly this level.",
139+
ValidateFunc: validation.StringInSlice([]string{"critical", "high", "medium", "low", "negligible"}, false),
137140
},
138141
"cvss_at_least": {
139142
Type: schema.TypeFloat,
@@ -166,9 +169,10 @@ func vulnerabilityRuleSchemaSeveritiesAndThreats() *schema.Schema {
166169
},
167170
},
168171
"package_type": {
169-
Type: schema.TypeString,
170-
Optional: true,
171-
Description: "Type of the package (e.g., 'os', 'npm', 'maven').",
172+
Type: schema.TypeString,
173+
Optional: true,
174+
Description: "Type of the package.",
175+
ValidateFunc: validation.StringInSlice([]string{"os", "nonOs"}, false),
172176
},
173177
"in_use": {
174178
Type: schema.TypeBool,

‎website/docs/r/secure_vulnerability_rule_bundle.md‎

Lines changed: 104 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -3,33 +3,42 @@ subcategory: "Sysdig Secure"
33
layout: "sysdig"
44
page_title: "Sysdig: sysdig_secure_vulnerability_rule_bundle"
55
description: |-
6-
Creates a Sysdig Secure Vulnerability Rule Bundle.
6+
Creates a Sysdig Secure Vulnerability Rule Bundle for defining custom vulnerability management rules.
77
---
88

99
# Resource: sysdig_secure_vulnerability_rule_bundle
1010

11-
Creates a Sysdig Secure Vulnerability Rule Bundle to define custom rules for vulnerability management, supporting various types of rules.
11+
Creates a Sysdig Secure Vulnerability Rule Bundle.
12+
13+
A **Rule Bundle** is a collection of rules that can be reused across multiple [Vulnerability Policies](https://docs.sysdig.com/en/docs/sysdig-secure/policies/vulnerability_policies/). Rule bundles allow you to define a standardized set of conditions for evaluating vulnerabilities, which can then be applied consistently to different policies. For more details, see the official documentation on [Rule Bundles](https://docs.sysdig.com/en/sysdig-secure/vm_policies/rule_bundles/).
1214

1315
-> **Note:** Sysdig Terraform Provider is under rapid development at this point. If you experience any issue or discrepancy while using it, please make sure you have the latest version. If the issue persists, or you have a Feature Request to support an additional set of resources, please open a [new issue](https://github.com/sysdiglabs/terraform-provider-sysdig/issues/new) in the GitHub repository.
1416

1517
## Example Usage
1618

19+
### Image Label Example
20+
21+
This example defines a rule bundle that checks for the presence or absence of specific image labels.
22+
1723
```terraform
18-
resource "sysdig_secure_vulnerability_rule_bundle" "example" {
19-
name = "Example Rule Bundle"
24+
resource "sysdig_secure_vulnerability_rule_bundle" "example_image_label" {
25+
name = "Example Rule Bundle - Image Label"
2026
27+
# Rule to ensure a specific label exists
2128
rule {
2229
image_label {
2330
label_must_exist = "required-label"
2431
}
2532
}
2633
34+
# Rule to ensure a specific label does not exist
2735
rule {
2836
image_label {
2937
label_must_not_exist = "forbidden-label"
3038
}
3139
}
3240
41+
# Rule to ensure a label exists and has a specific value
3342
rule {
3443
image_label {
3544
label_must_exist_and_contain_value {
@@ -41,38 +50,114 @@ resource "sysdig_secure_vulnerability_rule_bundle" "example" {
4150
}
4251
```
4352

44-
## Argument Reference
53+
### Severities and Threats Example
4554

46-
* `name` - (Required) The name of the vulnerability rule bundle.
55+
This example creates a comprehensive rule bundle that evaluates vulnerabilities based on severity, threat intelligence, and other risk factors.
4756

48-
* `description` - (Optional) A description for the rule bundle.
57+
```terraform
58+
resource "sysdig_secure_vulnerability_rule_bundle" "example_severities" {
59+
name = "Example Rule Bundle - Severities & Threats"
60+
description = "Bundle with rules for high-priority vulnerabilities"
61+
62+
rule {
63+
severities_and_threats {
64+
# Severity and disclosure criteria
65+
severity_at_least = "high"
66+
disclosure_older_than_days = 90
67+
68+
# Package and runtime context
69+
package_type = "os"
70+
in_use = true # Only trigger if the package is loaded in memory
71+
72+
# Fix and exploitability status
73+
fix_available_since_days = 30
74+
public_exploit_available_since_days = 15
75+
76+
# Exploit characteristics (CVSS vector)
77+
exploit_no_admin_privileges = true
78+
exploit_no_user_interaction = true
79+
exploit_network_attack_vector = true
80+
81+
# CISA KEV (Known Exploited Vulnerabilities) intelligence
82+
cisa_kev_in_ransomware_campaign = true
83+
cisa_kev_available_since_days = 10
84+
cisa_kev_due_date_in_days = 21
85+
86+
# EPSS (Exploit Prediction Scoring System) scores
87+
epss_score_at_least_percentage = 80
88+
epss_percentile_at_least_percentage = 90
89+
}
90+
}
91+
}
92+
```
4993

50-
* `rule` - (Required) List of rule definitions. Each rule supports multiple types (e.g., `image_label`). Each type may have different required attributes:
94+
## Argument Reference
5195

52-
### Rule Types
96+
* `name` - (Required) The name of the vulnerability rule bundle.
5397

54-
#### image_label
98+
* `description` - (Optional) A description for the rule bundle.
5599

56-
Defines label-based matching rules for image configuration. Only one of the following attributes must be specified:
100+
* `rule` - (Required) A list of rule definitions. Each `rule` block must define exactly one of the available rule types. For more details on rule types, see the [Rules documentation](https://docs.sysdig.com/en/sysdig-secure/policies/vulnerability_policies/rules).
57101

58-
* `label_must_exist` - (Optional) Label key that must exist in the image configuration.
59-
* `label_must_not_exist` - (Optional) Label key that must not exist in the image configuration.
60-
* `label_must_exist_and_contain_value` - (Optional) List of required label-value pairs, each containing:
102+
---
61103

62-
* `required_label` - (Required) Label key required in the image configuration.
63-
* `required_value` - (Required) Value that the label must contain.
104+
### `rule` block
105+
106+
Each `rule` block defines a single condition. A bundle can contain multiple rules.
107+
108+
#### `image_label`
109+
110+
Defines rules based on image labels to evaluate image configuration. Only one of the following attributes can be specified within a single `image_label` block.
111+
112+
* `label_must_exist` - (Optional) The rule matches if an image contains a label with this key.
113+
* `label_must_not_exist` - (Optional) The rule matches if an image does not contain a label with this key.
114+
* `label_must_exist_and_contain_value` - (Optional) A block specifying a label key and value that must exist in the image configuration.
115+
* `required_label` - (Required) The label key that must exist.
116+
* `required_value` - (Required) The expected value for the given label key.
117+
118+
#### `severities_and_threats`
119+
120+
Defines rules based on vulnerability severity, threat intelligence, and other risk factors.
121+
122+
* `severity_at_least` - (Optional) Matches if the vulnerability severity is at least this level. Valid values: `critical`, `high`, `medium`, `low`, `negligible`.
123+
* `severity_equals` - (Optional) Matches if the vulnerability severity is exactly this level. Valid values: `critical`, `high`, `medium`, `low`, `negligible`.
124+
* `cvss_at_least` - (Optional) Matches if the vulnerability's CVSS score is at least this value (e.g., `7.5`).
125+
* `disclosure_older_than_days` - (Optional) Matches if the vulnerability was publicly disclosed more than this number of days ago.
126+
* `disclosure_date` - (Optional) A block specifying that the vulnerability was disclosed within a specific date range.
127+
* `from` - (Required) Start of the date range in `YYYY-MM-DD` format.
128+
* `to` - (Required) End of the date range in `YYYY-MM-DD` format.
129+
* `package_type` - (Optional) Matches if the vulnerability is in a package of this type. Valid values: `os`, `nonOs`.
130+
* `in_use` - (Optional) If `true`, the rule matches only if the vulnerable package is loaded in memory at runtime.
131+
* `fix_available` - (Optional) If `true`, a fix is available for the vulnerability.
132+
* `fix_available_since_days` - (Optional) Matches if a fix has been available for at least this number of days.
133+
* `public_exploit_available` - (Optional) If `true`, a public exploit is known to exist for the vulnerability.
134+
* `public_exploit_available_since_days` - (Optional) Matches if a public exploit has been available for at least this number of days.
135+
* `exploit_no_admin_privileges` - (Optional) If `true`, the exploit does not require administrator privileges.
136+
* `exploit_no_user_interaction` - (Optional) If `true`, the exploit does not require user interaction.
137+
* `exploit_network_attack_vector` - (Optional) If `true`, the exploit has a network attack vector.
138+
* `cisa_kev_in_ransomware_campaign` - (Optional) If `true`, the vulnerability is part of a CISA KEV (Known Exploited Vulnerabilities) ransomware campaign.
139+
* `cisa_kev_available_since_days` - (Optional) Matches if the vulnerability has been in the CISA KEV catalog for at least this number of days.
140+
* `cisa_kev_due_date_in_days` - (Optional) Matches if the CISA KEV remediation due date is within this number of days.
141+
* `epss_score_at_least_percentage` - (Optional) Matches if the EPSS (Exploit Prediction Scoring System) score is at least this percentage (0-100).
142+
* `epss_percentile_at_least_percentage` - (Optional) Matches if the EPSS percentile is at least this percentage (0-100).
143+
144+
-> **Note on mutually exclusive fields:**
145+
> - Within a `severities_and_threats` block, only one of `severity_at_least`, `severity_equals`, or `cvss_at_least` can be set.
146+
> - `disclosure_older_than_days` and `disclosure_date` are mutually exclusive.
147+
> - `public_exploit_available` and `public_exploit_available_since_days` are mutually exclusive.
148+
> - `fix_available` and `fix_available_since_days` are mutually exclusive.
64149
65150
## Attributes Reference
66151

67152
In addition to all arguments above, the following attributes are exported:
68153

69-
* `identifier` - External identifier computed after creation. Not to be used with the `secure_vulnerability_policy.bundles` field, use `id` for that.
154+
* `id` - The internal identifier of the vulnerability rule bundle. This is the ID to be used in the `sysdig_secure_vulnerability_policy.bundles` field.
155+
* `identifier` - The external identifier of the vulnerability rule bundle.
70156

71157
## Import
72158

73159
Vulnerability rule bundles can be imported using their bundle ID, for example:
74160

75161
```shell
76-
$ terraform import sysdig_secure_vulnerability_rule_bundle.example bundle_123456
162+
$ terraform import sysdig_secure_vulnerability_rule_bundle.example 12345
77163
```
78-

0 commit comments

Comments
 (0)