README
¶
Dracon
By Ocurity Security scanning,results unification and enrichment tool (ASOC)
Security pipelines on Kubernetes. The purpose of this project is to provide a scalable and flexible framework to execute arbitrary security scanning tools on code and infrastructure while processing the results in a versatile way.
flowchart LR
S["Code Setup & Build"]
P_GoSec["Producer - GoSec (Golang)"]
P_SecBugs["Producer - SpotBugs (Java)"]
P_Bandit["Producer - Bandit (Python)"]
P_TFSec["Producer - TFSec (Terraform)"]
P_Aggregator["Producer - Results Aggregation"]
E_Deduplication["Enricher - Deduplication"]
E_Policy["Enricher - Policy"]
E_Aggregator["Enricher - Enriched Results Aggregator"]
C_Slack["Consumer - Slack"]
C_Elasticsearch["Consumer - Elasticsearch"]
C_Jira["Consumer - Jira"]
S-->P_TFSec
S-->P_GoSec
S-->P_SecBugs
S-->P_Bandit
P_TFSec-->P_Aggregator
P_GoSec-->P_Aggregator
P_SecBugs-->P_Aggregator
P_Bandit-->P_Aggregator
P_Aggregator-->E_Deduplication
P_Aggregator-->E_Policy
E_Policy-->E_Aggregator
E_Deduplication-->E_Aggregator
E_Aggregator-->C_Slack
E_Aggregator-->C_Elasticsearch
E_Aggregator-->C_Jira
Getting Started
The Getting Started tutorial explains how to get started with Dracon. You can also access our community contributed pipelines here.
Announcements
This version of Dracon was announced at OWASP Appsec Dublin in 2023. Check out the slides and the video of the presentation.
Support
If you have questions, reach out to us by opening a new issue on GitHub.
You can also get support on our Discord server.
Development & Contributing
Contributions are welcome, see the developing and releasing guides on how to get started.
License
Dracon is under the Apache 2.0 license. See the LICENSE file for details.
Directories
¶
| Path | Synopsis |
|---|---|
|
api
|
|
|
cmd
|
|
|
draconctl
command
|
|
|
consumers
Package consumers provides helper functions for working with Dracon compatible outputs as a Consumer.
|
Package consumers provides helper functions for working with Dracon compatible outputs as a Consumer. |
|
consumers/arangodb
command
|
|
|
consumers/aws-s3
command
Package main of the aws-s3 consumer implements a simple consumer for uploading dracon results to the S3 bucket passed as an argument the consumer expects the environment variables AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY to be set
|
Package main of the aws-s3 consumer implements a simple consumer for uploading dracon results to the S3 bucket passed as an argument the consumer expects the environment variables AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY to be set |
|
consumers/bigquery
command
Package main of the bigquery consumer puts dracon issues into the target bigquery dataset, it will create teh dataset and the schema if one does not exist
|
Package main of the bigquery consumer puts dracon issues into the target bigquery dataset, it will create teh dataset and the schema if one does not exist |
|
consumers/defectdojo
command
|
|
|
consumers/dependency-track
command
|
|
|
consumers/elasticsearch
command
|
|
|
consumers/jira
command
|
|
|
consumers/mongodb
command
|
|
|
consumers/pdf
command
Package main of the pdf consumer implements a simple consumer for applying a go-template to a dracon scan, converting the result to pdf and then uploading the result to the S3 bucket passed as an argument the consumer expects the environment variables AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY to be set along with the "bucket" and "region" arguments to be passed
|
Package main of the pdf consumer implements a simple consumer for applying a go-template to a dracon scan, converting the result to pdf and then uploading the result to the S3 bucket passed as an argument the consumer expects the environment variables AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY to be set along with the "bucket" and "region" arguments to be passed |
|
consumers/slack
command
|
|
|
consumers/stdout-json
command
|
|
|
enrichers
Package enrichers provides helper functions for writing Dracon compatible enrichers that enrich dracon outputs.
|
Package enrichers provides helper functions for writing Dracon compatible enrichers that enrich dracon outputs. |
|
enrichers/aggregator
command
|
|
|
enrichers/codeowners
command
Package main of the codeowners enricher handles enrichment of individual issues with the groups/usernames listed in the github repository CODEOWNERS files.
|
Package main of the codeowners enricher handles enrichment of individual issues with the groups/usernames listed in the github repository CODEOWNERS files. |
|
enrichers/custom-annotation
command
Package main of the codeowners enricher handles enrichment of individual issues with the groups/usernames listed in the github repository CODEOWNERS files.
|
Package main of the codeowners enricher handles enrichment of individual issues with the groups/usernames listed in the github repository CODEOWNERS files. |
|
enrichers/deduplication
command
|
|
|
enrichers/depsdev
command
|
|
|
enrichers/policy
command
|
|
|
enrichers/reachability
command
|
|
|
producers
Package producers provides helper functions for writing Dracon compatible producers that parse tool outputs.
|
Package producers provides helper functions for writing Dracon compatible producers that parse tool outputs. |
|
producers/aggregator
command
|
|
|
producers/brakeman
command
|
|
|
producers/cdxgen
command
Package main of the cdxgen producer parses the CycloneDX output of cdxgen and create a singular Dracon issue from it
|
Package main of the cdxgen producer parses the CycloneDX output of cdxgen and create a singular Dracon issue from it |
|
producers/checkov
command
|
|
|
producers/dependency-check
command
|
|
|
producers/dependency-track
command
Package main of the dependency track producer reads a dependency track export and translates it to dracon format
|
Package main of the dependency track producer reads a dependency track export and translates it to dracon format |
|
producers/docker-trivy
command
|
|
|
producers/github-code-scanning
command
|
|
|
producers/golang-gosec
command
|
|
|
producers/golang-nancy
command
|
|
|
producers/java-findsecbugs
command
|
|
|
producers/kics
command
|
|
|
producers/ossf-scorecard
command
|
|
|
producers/python-bandit
command
|
|
|
producers/python-pip-safety
command
|
|
|
producers/semgrep
command
|
|
|
producers/snyk-docker
command
|
|
|
producers/terraform-tfsec
command
|
|
|
producers/testsslsh
command
|
|
|
producers/trufflehog
command
Package main implements the binary for parsing trufflehog results into the dracon format
|
Package main implements the binary for parsing trufflehog results into the dracon format |
|
producers/typescript-eslint
command
|
|
|
producers/typescript-yarn-audit
command
|
|
|
producers/zaproxy
command
|
|
|
sources/dependency
command
|
|
|
docs
|
|
|
extending/example-producer
command
|
|
|
pkg
|
|
|
context
Package context offers a set of methods which permit components to
|
Package context offers a set of methods which permit components to |
|
enumtransformers
Package enumtransformers transforms from dracon internal enums to text and back
|
Package enumtransformers transforms from dracon internal enums to text and back |
|
templating
Package templating includes helper methods that apply go templates to Dracon Raw and Enriched Issues and return the resulting str
|
Package templating includes helper methods that apply go templates to Dracon Raw and Enriched Issues and return the resulting str |
|
testutil
Package testutil contains helper functions and subpackages to make testing the project easier
|
Package testutil contains helper functions and subpackages to make testing the project easier |
Click to show internal directories.
Click to hide internal directories.