kubescape report

[iman4000]

kubescape
Kubescape is a K8s open-source tool providing a Kubernetes single pane of glass, including risk analysis, security compliance, RBAC visualizer, and image vulnerability scanning. Kubescape scans K8s clusters, YAML files, and HELM charts, detecting misconfigurations according to multiple frameworks (such as the NSA-CISA, MITRE ATT&CK®), software vulnerabilities, and RBAC (role-based-access-control) violations at early stages of the CI/CD pipeline, calculates risk score instantly and shows risk trends over time.

Sample File
it support json and junit xml format file

[mtesauro]

Do you have an example output file from that tool that you can share? It can be of something that isn't 'real' or feel free to anonymize the data in an example file. That's a crucial part of adding support for a tool in DefectDojo.

Ideally, you could add the example file to this repo: https://github.com/DefectDojo/sample-scan-files or adding it to his issue works as well.

[iman4000]

sure!
I used this command for making sample result:
kubescape scan https://github.com/kubescape/kubescape --format json --format-version=v2 --output results.json
and I did pull request for it's result in json format in sample-scan-files repo

[mtesauro]

Saw the PR and just merged it. Thanks!

@damiencarol @Maffooch Thoughts on this new parser?

Sample file is here: https://github.com/DefectDojo/sample-scan-files/blob/master/kubescape.json

[mschmieder]

Any update on this parser? We would love to have the results integrated in our dojo as well.

[damiencarol]

Taking this one, should be fun as it's seems to be a meta format.

[reddybhaskarvengala]

Hi @damiencarol any update on this parser?

[teyhouse]

bump - Hi @damiencarol any updates on this? Would be extremely helpful to have this.
Maybe as an early Christmas gift or the last good deed this year? :D

Thanks!

[Hoffi-Flex]

Yeah, this would awesome to have!

[manuel-sommer]

I am in a process of implementing the parser. Could you give me more info?

• I need a sample file with 0 findings
• Can you always find the same resourceIDs in both results and resources?

[manuel-sommer]

I felt free to implement this @damiencarol as there was no response since about a year.

[manuel-sommer]

I am in a process of implementing the parser. Could you give me more info?

* I need a sample file with 0 findings

* Can you always find the same resourceIDs in both results and resources?

@teyhouse @Hoffi-Flex if you provide the mentioned information fast, we might get this PR in into the next release in February.

[teyhouse]

kubescape.zip
@manuel-sommer Hopefully this will help you - results.json is an example of a scanned nginx.yaml done this way:
kubescape scan nginx.yaml --format json --format-version v2 --output results.json

I guess you want to check for failedResources, which is 0 for all test-cases. I have also attached a Version with failures (failedResources":1), called results_with_failure.json.
I don't know much about the Ressource-IDs as they should not matter if you scan your Kubernetes-YAMLs before you deploy them (I have not scanned within a running K8S-Cluster).

Thank you for taking this further.

[manuel-sommer]

Thank you.
another question @teyhouse :
Some controls do not have a severity attached. By default the severity of Kubescape is Low, Medium, High. It is refered with scores 1 to 3
Should we do the mapping like this:

• No severity --> Info
• score 1 --> Low
• score 2 --> Medium
• score 3 --> High
  or like this:
• No severity --> Low
• score 1 --> Medium
• score 2 --> High
• score 3 --> Critical

[teyhouse]

@manuel-sommer
Thanks for the fast reply, I think that sounds like a good idea, let's do it like you proposed (First Version).

[manuel-sommer]

You can test the PR @teyhouse

[teyhouse]

You can test the PR @teyhouse

I will see if that is possible during the next couple of days since I am deploying on Kubernetes, I would need to build a new Image-Version with your PR. Maybe with a local Test-Instance, let me see once I get to it.

[teyhouse]

@manuel-sommer

I just did some testing, looks good in general - please have a look at the attached Screenshots:

finding_list_info.png => imported from results.json with zero findings, works as expected
finding_list.png => imported from results_results_with_failure.json, works as expected

The only thing that could be improved is the Naming of the Findings, its to long.
Maybe you can short it to the C-Codes? Check finding_list_hover.png for an example.
So the Name would not be Path=966824446/api=apps/v1//Deployment/nginx-Deployment_C-0014 but instead just C-0014.

Thanks!

[manuel-sommer]

Done

[manuel-sommer]

This can be closed @mtesauro