From f04b532fc9f412a6908b56d777be480106f63580 Mon Sep 17 00:00:00 2001 From: JohannesZahn Date: Tue, 15 Jun 2021 13:44:23 +0200 Subject: [PATCH 1/4] Add instructions how to run DD Hook locally Signed-off-by: JohannesZahn --- hooks/persistence-defectdojo/README.md.gotmpl | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/hooks/persistence-defectdojo/README.md.gotmpl b/hooks/persistence-defectdojo/README.md.gotmpl index 1878f45eb9..30c7d8153e 100644 --- a/hooks/persistence-defectdojo/README.md.gotmpl +++ b/hooks/persistence-defectdojo/README.md.gotmpl @@ -132,3 +132,23 @@ helm upgrade --install dd secureCodeBox/persistence-defectdojo \ ## Chart Configuration {{ template "chart.valuesTable" . }} + +## Running Locally from Source +For Development, it can be useful to run the Hook locally. You can do so by following these steps: + +1. Make sure you have access to a running [DefectDojo](https://github.com/DefectDojo/django-DefectDojo) Instance +2. [Run a Scan](https://docs.securecodebox.io/docs/getting-started/first-scans) of your choice. +3. Supply Download Links for the Scan Results (Raw Result and Findings.json). You can e.g., access them from the +included [Minio Instance](https://docs.securecodebox.io/docs/getting-started/installation/#accessing-the-included-minio-instance) +and upload them to a GitHub gist. + +4. Set the following environment variables + +- DEFECTDOJO_URL (e.g http://192.168.0.228:8080); +- DEFECTDOJO_USERNAME (e.g admin) +- DEFECTDOJO_APIKEY= (e.g. b09c.., can be fetched from the DefectDojo Settings) +- IS_DEV=true +- SCAN_NAME (e.g nmap-scanme.nmap.org) + +5. After running gradle build, start the DefectDojoPersistenceProvider with the following CLI Arguments: +{Raw Result Download URL} {Findings Download URL} {Raw Result Upload URL} {Findings Upload URL}. E.g. https://gist.githubusercontent.com/.../scanme-nmap-org.xml https://gist.githubusercontent.com/.../nmap-findings.json https://httpbin.org/put https://httpbin.org/put From f3dda6c5ad309cd3457261a9101f48cea6e3fc29 Mon Sep 17 00:00:00 2001 From: JohannesZahn Date: Tue, 15 Jun 2021 11:44:58 +0000 Subject: [PATCH 2/4] Updating Helm Docs Signed-off-by: JohannesZahn --- hooks/persistence-defectdojo/README.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/hooks/persistence-defectdojo/README.md b/hooks/persistence-defectdojo/README.md index 12e39ebe3b..6f8927fb6d 100644 --- a/hooks/persistence-defectdojo/README.md +++ b/hooks/persistence-defectdojo/README.md @@ -136,3 +136,23 @@ helm upgrade --install dd secureCodeBox/persistence-defectdojo \ | image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. More info: https://kubernetes.io/docs/concepts/containers/images#updating-images | | image.repository | string | `"docker.io/securecodebox/persistence-defectdojo"` | Hook image repository | | image.tag | string | `nil` | Container image tag | + +## Running Locally from Source +For Development, it can be useful to run the Hook locally. You can do so by following these steps: + +1. Make sure you have access to a running [DefectDojo](https://github.com/DefectDojo/django-DefectDojo) Instance +2. [Run a Scan](https://docs.securecodebox.io/docs/getting-started/first-scans) of your choice. +3. Supply Download Links for the Scan Results (Raw Result and Findings.json). You can e.g., access them from the +included [Minio Instance](https://docs.securecodebox.io/docs/getting-started/installation/#accessing-the-included-minio-instance) +and upload them to a GitHub gist. + +4. Set the following environment variables + +- DEFECTDOJO_URL (e.g http://192.168.0.228:8080); +- DEFECTDOJO_USERNAME (e.g admin) +- DEFECTDOJO_APIKEY= (e.g. b09c.., can be fetched from the DefectDojo Settings) +- IS_DEV=true +- SCAN_NAME (e.g nmap-scanme.nmap.org) + +5. After running gradle build, start the DefectDojoPersistenceProvider with the following CLI Arguments: +{Raw Result Download URL} {Findings Download URL} {Raw Result Upload URL} {Findings Upload URL}. E.g. https://gist.githubusercontent.com/.../scanme-nmap-org.xml https://gist.githubusercontent.com/.../nmap-findings.json https://httpbin.org/put https://httpbin.org/put From 34c2a0286961df304678c1c9fc5e5b1df72e7a2f Mon Sep 17 00:00:00 2001 From: JohannesZahn Date: Thu, 17 Jun 2021 09:43:17 +0200 Subject: [PATCH 3/4] integrate requested changes Signed-off-by: JohannesZahn --- hooks/persistence-defectdojo/README.md.gotmpl | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/hooks/persistence-defectdojo/README.md.gotmpl b/hooks/persistence-defectdojo/README.md.gotmpl index 30c7d8153e..5950110dde 100644 --- a/hooks/persistence-defectdojo/README.md.gotmpl +++ b/hooks/persistence-defectdojo/README.md.gotmpl @@ -148,7 +148,13 @@ and upload them to a GitHub gist. - DEFECTDOJO_USERNAME (e.g admin) - DEFECTDOJO_APIKEY= (e.g. b09c.., can be fetched from the DefectDojo Settings) - IS_DEV=true -- SCAN_NAME (e.g nmap-scanme.nmap.org) +- SCAN_NAME (e.g nmap-scanme.nmap.org, must be set exactly to the name of the scan used in step 2) -5. After running gradle build, start the DefectDojoPersistenceProvider with the following CLI Arguments: -{Raw Result Download URL} {Findings Download URL} {Raw Result Upload URL} {Findings Upload URL}. E.g. https://gist.githubusercontent.com/.../scanme-nmap-org.xml https://gist.githubusercontent.com/.../nmap-findings.json https://httpbin.org/put https://httpbin.org/put +5. Build the jar with gradle and run it with the following CLI arguments: {Raw Result Download URL} {Findings Download URL} {Raw Result Upload URL} {Findings Upload URL}. +See the code snippet below. You have to adjust the filename of the jar for other versions than the '0.1.0-SNAPSHOT'. +Also you will need to change the download URLs for the Raw Result and Findings to the ones from Step 3. + +```bash +./gradlew build +java -jar build/libs/defectdojo-persistenceprovider-0.1.0-SNAPSHOT.jar https://gist.githubusercontent.com/.../scanme-nmap-org.xml https://gist.githubusercontent.com/.../nmap-findings.json https://httpbin.org/put https://httpbin.org/put +``` From 9988596d317fedd4f6b118e8f7d6fc9718178502 Mon Sep 17 00:00:00 2001 From: JohannesZahn Date: Thu, 17 Jun 2021 07:44:25 +0000 Subject: [PATCH 4/4] Updating Helm Docs Signed-off-by: JohannesZahn --- hooks/persistence-defectdojo/README.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/hooks/persistence-defectdojo/README.md b/hooks/persistence-defectdojo/README.md index 6f8927fb6d..13aba57a01 100644 --- a/hooks/persistence-defectdojo/README.md +++ b/hooks/persistence-defectdojo/README.md @@ -152,7 +152,13 @@ and upload them to a GitHub gist. - DEFECTDOJO_USERNAME (e.g admin) - DEFECTDOJO_APIKEY= (e.g. b09c.., can be fetched from the DefectDojo Settings) - IS_DEV=true -- SCAN_NAME (e.g nmap-scanme.nmap.org) +- SCAN_NAME (e.g nmap-scanme.nmap.org, must be set exactly to the name of the scan used in step 2) -5. After running gradle build, start the DefectDojoPersistenceProvider with the following CLI Arguments: -{Raw Result Download URL} {Findings Download URL} {Raw Result Upload URL} {Findings Upload URL}. E.g. https://gist.githubusercontent.com/.../scanme-nmap-org.xml https://gist.githubusercontent.com/.../nmap-findings.json https://httpbin.org/put https://httpbin.org/put +5. Build the jar with gradle and run it with the following CLI arguments: {Raw Result Download URL} {Findings Download URL} {Raw Result Upload URL} {Findings Upload URL}. +See the code snippet below. You have to adjust the filename of the jar for other versions than the '0.1.0-SNAPSHOT'. +Also you will need to change the download URLs for the Raw Result and Findings to the ones from Step 3. + +```bash +./gradlew build +java -jar build/libs/defectdojo-persistenceprovider-0.1.0-SNAPSHOT.jar https://gist.githubusercontent.com/.../scanme-nmap-org.xml https://gist.githubusercontent.com/.../nmap-findings.json https://httpbin.org/put https://httpbin.org/put +```