Skip to content

Commit 6d9ef09

Browse files
airadierairadier
authored
add a script to run and convert to CSV and HTML (#14)
* add a script to run and convert to CSV and HTML * Add README * Update README * Simpler script
1 parent dbf3c2b commit 6d9ef09

File tree

2 files changed

+103
-0
lines changed

2 files changed

+103
-0
lines changed

‎output-format/README.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Run inline-scan and convert to other formats
2+
3+
This [example script](run-inline-scan.sh) shows how to execute the inline-scan container using the `--format=JSON` flag, and then convert the vulnerability report to CSV and HTML using mustache tempaltes.
4+
5+
It mounts the docker socket at /var/run/docker.sock and scans an image locally available in the Docker daemon. So you need to either build the image, or pull it (`docker pull <image-to-scan>).
6+
7+
You might need to run as root (i.e. using `sudo`) or adjust the docker.sock permissions.
8+
9+
How to use:
10+
11+
* Set SECURE_API_TOKEN environment variable with your Sysdig token value
12+
* Execute `./run-inline-scan-sh <image-to-scan>`

‎output-format/run-inline-scan.sh‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
#!/bin/bash
2+
#SECURE_API_TOKEN environment variable must be defined
3+
4+
IMAGE=$1
5+
6+
### Use this block to get JSON output in output.json, as well as "human readable output"
7+
### Begin - no human readable output execution ###
8+
docker run -v /var/run/docker.sock:/var/run/docker.sock -e SYSDIG_API_TOKEN=$SECURE_API_TOKEN quay.io/sysdig/secure-inline-scan:2 $IMAGE --format=JSON > output.json
9+
### End - no human readable output execution ###
10+
11+
### Use this block to get JSON output in output.json, as well as "human readable output" in stdout
12+
### Begin - add human readable output execution ###
13+
# CONTAINER_ID=$(docker run -d --entrypoint /bin/cat -ti -v /var/run/docker.sock:/var/run/docker.sock -e SYSDIG_API_TOKEN=$SECURE_API_TOKEN quay.io/sysdig/secure-inline-scan:2)
14+
# docker exec $CONTAINER_ID mkdir -p /tmp/sysdig-inline-scan/logs/
15+
# docker exec $CONTAINER_ID touch /tmp/sysdig-inline-scan/logs/info.log
16+
# docker exec $CONTAINER_ID tail -f /tmp/sysdig-inline-scan/logs/info.log &
17+
# docker exec $CONTAINER_ID /sysdig-inline-scan.sh $IMAGE --format=JSON > output.json
18+
# exit_status=$?
19+
# sleep 1
20+
# docker stop $CONTAINER_ID -t 0 > /dev/null && docker rm $CONTAINER_ID > /dev/null
21+
### End - add human readable output execution ###
22+
23+
# Check exit status. 0 or 1 is ok to continue (pass or fail policy). Otherwise, report error
24+
25+
exit_status=$?
26+
if [ $exit_status -gt 1 ]; then
27+
cat output.json
28+
exit $exit_status
29+
fi
30+
31+
echo "Scan finished. Generating reports"
32+
33+
# Create CSV report using mustache
34+
cat <<EOF | docker run -v $(pwd)/output.json:/output.json --rm -i toolbelt/mustache /output.json - > vulns.csv
35+
sep=;
36+
Vuln;Severity;Package;Package_Type;Fix;Url
37+
{{#vulnsReport.vulnerabilities}}
38+
{{vuln}};{{severity}};{{package}};{{package_type}};{{fix}};{{url}}
39+
{{/vulnsReport.vulnerabilities}}
40+
EOF
41+
42+
echo "vulns.csv generated"
43+
44+
# Create HTML report using mustache
45+
cat <<EOF | docker run -v $(pwd)/output.json:/output.json --rm -i toolbelt/mustache /output.json - > vulns.html
46+
<html>
47+
<head>
48+
<title>Vuln report</title>
49+
<style>
50+
body {
51+
font-family: Arial, Helvetica, sans-serif;
52+
}
53+
table {
54+
border-collapse: collapse;
55+
}
56+
td, th {
57+
border: 1px solid black;
58+
padding: 2px;
59+
}
60+
</style>
61+
</head>
62+
<body>
63+
<table>
64+
<thead>
65+
<tr>
66+
<th>Vuln</th>
67+
<th>Severity</th>
68+
<th>Package</th>
69+
<th>Package_Type</th>
70+
<th>Fix</th>
71+
<th>Url</th>
72+
</tr>
73+
</thead>
74+
<tbody>
75+
{{#vulnsReport.vulnerabilities}}
76+
<tr>
77+
<td>{{vuln}}</td>
78+
<td>{{severity}}</td>
79+
<td>{{package}}</td>
80+
<td>{{package_type}}</td>
81+
<td>{{fix}}</td>
82+
<td><a href="{{url}}">{{url}}</a></td>
83+
</tr>
84+
{{/vulnsReport.vulnerabilities}}
85+
</tbody>
86+
</table>
87+
</body>
88+
</html>
89+
EOF
90+
91+
echo "vulns.html generated"

0 commit comments

Comments
 (0)