Skip to content

Commit d5f5813

Browse files
matheusfmmatheusfm
authored
docs: add commands to convert to CSV files into documentation (#319)
1 parent befcab5 commit d5f5813

File tree

2 files changed

+111
-1
lines changed

2 files changed

+111
-1
lines changed

‎docs/configuration/convert-to-csv.md

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Convert results to CSV
2+
3+
After a successful scan, the results (vulnerabilities and misconfigurations) are available in your cluster via CRDs,
4+
and you can transform them into CSV files using [jq](https://github.com/jqlang/jq){:target="_blank"}.
5+
6+
## Vulnerabilities
7+
8+
Vulnerability scan results are stored as instances of `VulnerabilityReport` CRD within your cluster.
9+
You can export summaries or detailed reports of these vulnerabilities to CSV format for further analysis.
10+
11+
### Images summary
12+
13+
To generate a summary report of vulnerabilities by image, run the following command:
14+
15+
```shell
16+
kubectl get vulnerabilityreports -n zora-system -o json | jq -r '
17+
["Image", "Image digest", "OS", "Distro", "Distro version", "Total", "Critical", "High", "Medium", "Low", "Unknown", "Scanned at"],
18+
(.items[] | [
19+
.spec.image, .spec.digest, .spec.os, .spec.distro.name, .spec.distro.version,
20+
.spec.summary.total, .spec.summary.critical, .spec.summary.high, .spec.summary.medium, .spec.summary.low, .spec.summary.unknown,
21+
.metadata.creationTimestamp
22+
]) | @csv' > images.csv
23+
```
24+
25+
This command will produce a CSV file, `images.csv`, with the following structure:
26+
27+
| Image | Image digest | OS | Distro | Distro version | Total | Critical | High | Medium | Low | Unknown | Scanned at |
28+
|-----------------------------------------------------|------------------------------------------------------------------------------------------------------------|-------|--------|----------------|-------|----------|------|--------|-----|---------|----------------------|
29+
| docker.io/istio/examples-bookinfo-reviews-v1:1.20.1 | istio/examples-bookinfo-reviews-v1@sha256:5b3c8ec2cb877b7a3c93fc340bb91633c3e51a6bc43a2da3ae7d72727650ec07 | linux | ubuntu | 22.04 | 45 | 0 | 0 | 25 | 20 | 0 | 2024-10-31T12:56:51Z |
30+
| nginx | nginx@sha256:28402db69fec7c17e179ea87882667f1e054391138f77ffaf0c3eb388efc3ffb | linux | debian | 12.7 | 95 | 2 | 10 | 24 | 59 | 0 | 2024-10-31T12:56:51Z |
31+
32+
### Full report: images and vulnerabilities
33+
34+
To create a detailed report of each vulnerability affecting images, use the following command:
35+
36+
```shell
37+
kubectl get vulnerabilityreports -n zora-system -o json | jq -r '
38+
["Image", "Image digest", "OS", "Distro", "Distro version", "Vulnerability ID", "Severity", "Score", "Title", "Package", "Type", "Version", "Status", "Fix version", "Scanned at"],
39+
(.items[] | . as $i | $i.spec.vulnerabilities[] as $vuln | $vuln.packages[] | [
40+
$i.spec.image, $i.spec.digest, $i.spec.os, $i.spec.distro.name, $i.spec.distro.version,
41+
$vuln.id, $vuln.severity, $vuln.score, $vuln.title,
42+
.package, .type, .version, .status, .fixVersion,
43+
$i.metadata.creationTimestamp
44+
]) | @csv' > vulnerabilities.csv
45+
```
46+
47+
This will generate a `vulnerabilities.csv` file with details for each vulnerability:
48+
49+
!!! note
50+
A single vulnerability can affect multiple packages within the same image,
51+
so you may see repeated entries for the same vulnerability.
52+
For instance, in the example below, `CVE-2024-7264` affects both `curl` and `libcurl4` packages in the same image.
53+
54+
| Image | Image digest | OS | Distro | Distro version | Vulnerability ID | Severity | Score | Title | Package | Type | Version | Status | Fix version | Scanned at |
55+
|-----------------------------------------------------|------------------------------------------------------------------------------------------------------------|-------|--------|----------------|------------------|----------|-------|----------------------------------------------------------------------------|----------|--------|--------------------|--------|--------------------|----------------------|
56+
| nginx | nginx@sha256:28402db69fec7c17e179ea87882667f1e054391138f77ffaf0c3eb388efc3ffb | linux | debian | 12.7 | CVE-2023-49462 | HIGH | 8.8 | libheif v1.17.5 was discovered to contain a segmentation violation via ... | libheif1 | debian | 1.15.1-1 | fixed | 1.15.1-1+deb12u1 | 2024-10-31T12:56:51Z |
57+
| docker.io/istio/examples-bookinfo-reviews-v1:1.20.1 | istio/examples-bookinfo-reviews-v1@sha256:5b3c8ec2cb877b7a3c93fc340bb91633c3e51a6bc43a2da3ae7d72727650ec07 | linux | ubuntu | 22.04 | CVE-2024-7264 | MEDIUM | 6.5 | curl: libcurl: ASN.1 date parser overread | curl | ubuntu | 7.81.0-1ubuntu1.15 | fixed | 7.81.0-1ubuntu1.17 | 2024-10-31T12:56:51Z |
58+
| docker.io/istio/examples-bookinfo-reviews-v1:1.20.1 | istio/examples-bookinfo-reviews-v1@sha256:5b3c8ec2cb877b7a3c93fc340bb91633c3e51a6bc43a2da3ae7d72727650ec07 | linux | ubuntu | 22.04 | CVE-2024-7264 | MEDIUM | 6.5 | curl: libcurl: ASN.1 date parser overread | libcurl4 | ubuntu | 7.81.0-1ubuntu1.15 | fixed | 7.81.0-1ubuntu1.17 | 2024-10-31T12:56:51Z |
59+
60+
## Misconfigurations
61+
62+
Misconfiguration scan results are represented as instances of `ClusterIssue` CRD within your cluster,
63+
and can also be parsed to CSV format.
64+
65+
### Misconfigurations summary
66+
67+
To generate a summary report of misconfigurations, you can run the following command:
68+
69+
```shell
70+
kubectl get misconfigurations -n zora-system -o json | jq -r '
71+
["ID", "Misconfiguration", "Severity", "Category", "Total resources", "Scanned at"],
72+
(.items[] | ([.spec.resources[] | length] | add) as $totalResources | [
73+
.spec.id, .spec.message, .spec.severity, .spec.category, $totalResources, .metadata.creationTimestamp
74+
]) | @csv' > misconfigurations.csv
75+
```
76+
77+
This command will create a `misconfigurations.csv` file with the following structure:
78+
79+
| ID | Misconfiguration | Severity | Category | Total resources | Scanned at |
80+
|-------|-------------------------------------------------------|----------|----------------|-----------------|----------------------|
81+
| M-102 | Privileged container | High | Security | 2 | 2024-10-31T17:45:08Z |
82+
| M-103 | Insecure capabilities | High | Security | 2 | 2024-10-31T17:45:08Z |
83+
| M-112 | Allowed privilege escalation | Medium | Security | 14 | 2024-10-31T17:45:08Z |
84+
| M-113 | Container could be running as root user | Medium | Security | 18 | 2024-10-31T17:45:08Z |
85+
| M-201 | Application credentials stored in configuration files | High | Security | 6 | 2024-10-31T17:45:08Z |
86+
| M-300 | Root filesystem write allowed | Low | Security | 29 | 2024-10-31T17:45:08Z |
87+
| M-400 | Image tagged latest | Medium | Best Practices | 2 | 2024-10-31T17:45:08Z |
88+
| M-403 | Liveness probe not configured | Medium | Reliability | 16 | 2024-10-31T17:45:08Z |
89+
| M-406 | Memory not limited | Medium | Reliability | 15 | 2024-10-31T17:45:08Z |
90+
91+
### Full report: misconfigurations and affected resources
92+
93+
A detailed CSV file containing the affected resources can be generated with the command below.
94+
95+
```shell
96+
kubectl get misconfigurations -n zora-system -o json | jq -r '
97+
["ID", "Misconfiguration", "Severity", "Category", "Resource Type", "Resource", "Scanned at"],
98+
(.items[] as $i | $i.spec.resources | to_entries[] as $resource | $resource.value[] as $affectedResource | [
99+
$i.spec.id, $i.spec.message, $i.spec.severity, $i.spec.category, $resource.key, $affectedResource, $i.metadata.creationTimestamp
100+
]) | @csv' > misconfigurations_full.csv
101+
```
102+
103+
This command will generate the `misconfigurations_full.csv` file with the following structure:
104+
105+
| ID | Misconfiguration | Severity | Category | Resource Type | Resource | Scanned at |
106+
|-------|---------------------|----------|----------------|---------------|---------------|----------------------|
107+
| M-400 | Image tagged latest | Medium | Best Practices | v1/pods | default/test | 2024-10-31T18:45:06Z |
108+
| M-400 | Image tagged latest | Medium | Best Practices | v1/pods | default/nginx | 2024-10-31T18:45:06Z |
109+

‎mkdocs.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -87,11 +87,12 @@ nav:
8787
- Compute resources: configuration/resources.md
8888
- Suspending scans: configuration/suspend-scan.md
8989
- Retain issues: configuration/retain-issues.md
90+
- Convert to CSV: configuration/convert-to-csv.md
9091
- HTTPS proxy: configuration/https-proxy.md
9192
- Ignore unfixed vulnerabilities: plugins/trivy/#large-vulnerability-reports
9293
- Vulnerability scan timeout: plugins/trivy/#scan-timeout
93-
- Authenticated registries: configuration/authenticated-registries.md
9494
- Vulnerability database persistence: configuration/vulnerability-database-persistence.md
95+
- Authenticated registries: configuration/authenticated-registries.md
9596
- Private registries:
9697
- AWS ECR: configuration/private-registries/ecr.md
9798
- Azure ACR: configuration/private-registries/acr.md

0 commit comments

Comments
 (0)