From 074d3f599d33f2bf90d787e94365805588bf9e98 Mon Sep 17 00:00:00 2001 From: Christos Petsos Date: Thu, 14 Sep 2017 13:00:41 +0300 Subject: [PATCH 1/5] Resolved os_version mismatch. Reverted how os_version is getting value to, first osmajorrelease, then osrelease. When checking OSVersion from vulners compare with both osrelease and osmajorrelease, stringified because it looks like sometimes this value is returned as number, resulting to inexistence check with 'in'. --- hubblestack_nova/cve_scan_v2.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hubblestack_nova/cve_scan_v2.py b/hubblestack_nova/cve_scan_v2.py index 4bde6a2..b1ebd44 100644 --- a/hubblestack_nova/cve_scan_v2.py +++ b/hubblestack_nova/cve_scan_v2.py @@ -96,9 +96,9 @@ def audit(data_list, tags, debug=False, **kwargs): ''' Main audit function. See module docstring for more information on usage. ''' - os_version = __grains__.get('osrelease', None) + os_version = __grains__.get('osmajorrelease', None) if os_version is None: - os_version = __grains__.get('osmajorrelease', None) + os_version = __grains__.get('osrelease', None) os_name = __grains__['os'].lower() log.debug("os_version: %s, os_name: %s", os_version, os_name) @@ -269,7 +269,7 @@ def _get_cve_vulnerabilities(query_results, os_version): for pkg in report['_source']['affectedPackage']: #_source:affectedPackages - if pkg['OSVersion'] in ['any', os_version]: #Only use matching os + if pkg['OSVersion'] in ['any', str(__grains__.get('osmajorrelease', None)), str(__grains__.get('osrelease', None))]: #Only use matching os pkg_obj = VulnerablePkg(title, pkg['packageName'], pkg['packageVersion'], \ score, pkg['operator'], reporter, href, cve_list) if pkg_obj.pkg not in vulnerable_pkgs: From 07448a01af1eccc15e0f51a45381ec3b65cb4d34 Mon Sep 17 00:00:00 2001 From: Colton Myers Date: Tue, 26 Sep 2017 14:31:17 -0600 Subject: [PATCH 2/5] Add a note pointing people to hubble --- README.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/README.md b/README.md index 5a7bbbd..f46cbe6 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,15 @@ Please create any issues on the [Hubble](https://github.com/hubblestack/hubble) repo. +*NOTE FROM [@basepi](https://github.com/basepi)*: As we continue to add +features to hubble, I'm finding more and more instances where the flexibility +of not being tied to salt gives me the freedom to do more with hubble. As a +result, [hubble](https://github.com/hubblestack/hubble) is slowly surpassing +hubble-salt in available features. While I have no plans to deprecate +hubble-salt, I do recommend checking out +[hubble](https://github.com/hubblestack/hubble) if you're interested in these +additional features (such as support for topfiles in pulsar). + Table of Contents ================= From 3939448f4712ef046923db3430700b026c77d10c Mon Sep 17 00:00:00 2001 From: Christos Petsos Date: Wed, 27 Sep 2017 11:24:42 +0300 Subject: [PATCH 3/5] For os_version first check osrelease, then osmajorrelease. --- hubblestack_nova/cve_scan_v2.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/hubblestack_nova/cve_scan_v2.py b/hubblestack_nova/cve_scan_v2.py index b1ebd44..5a70282 100644 --- a/hubblestack_nova/cve_scan_v2.py +++ b/hubblestack_nova/cve_scan_v2.py @@ -96,9 +96,9 @@ def audit(data_list, tags, debug=False, **kwargs): ''' Main audit function. See module docstring for more information on usage. ''' - os_version = __grains__.get('osmajorrelease', None) + os_version = __grains__.get('osrelease', None) if os_version is None: - os_version = __grains__.get('osrelease', None) + os_version = __grains__.get('osmajorrelease', None) os_name = __grains__['os'].lower() log.debug("os_version: %s, os_name: %s", os_version, os_name) @@ -395,4 +395,3 @@ def get_report(self, profile): 'description': self.title, 'nova_profile': profile } - From 4d94e8610c76f420ad787f0c076f71e82d8cdf1c Mon Sep 17 00:00:00 2001 From: Colton Myers Date: Thu, 28 Sep 2017 11:12:37 -0600 Subject: [PATCH 4/5] Fix unicode issue in hubble.py --- _modules/hubble.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/_modules/hubble.py b/_modules/hubble.py index be4c1d3..0935bb5 100644 --- a/_modules/hubble.py +++ b/_modules/hubble.py @@ -453,7 +453,7 @@ def top(topfile='top.nova', # tag. data_by_tag = {} for data in top_data: - if isinstance(data, str): + if isinstance(data, basestring): if '*' not in data_by_tag: data_by_tag['*'] = [] data_by_tag['*'].append(data) @@ -466,7 +466,7 @@ def top(topfile='top.nova', if 'Errors' not in results: results['Errors'] = {} error_log = 'topfile malformed, list entries must be strings or '\ - 'dicts: {0}'.format(data) + 'dicts: {0} | {1}'.format(data, type(data)) results['Errors'][topfile] = {'error': error_log} log.error(error_log) continue From d525636432217cec3675a99c9cccdc201cf7c51f Mon Sep 17 00:00:00 2001 From: Colton Myers Date: Thu, 28 Sep 2017 11:13:08 -0600 Subject: [PATCH 5/5] Rev to v2017.9.1 --- README.md | 2 +- _beacons/pulsar.py | 2 +- _modules/hubble.py | 2 +- _modules/nebula_osquery.py | 2 +- _modules/win_pulsar.py | 2 +- _returners/slack_pulsar_returner.py | 2 +- _returners/splunk_nebula_return.py | 2 +- _returners/splunk_nova_return.py | 2 +- _returners/splunk_pulsar_return.py | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index f46cbe6..b774262 100644 --- a/README.md +++ b/README.md @@ -68,7 +68,7 @@ gitfs_remotes: - https://github.com/hubblestack/hubblestack_data.git: - root: '' - https://github.com/hubblestack/hubble-salt.git: - - base: v2017.9.0 + - base: v2017.9.1 - root: '' ``` diff --git a/_beacons/pulsar.py b/_beacons/pulsar.py index 8a22ac0..bccb6b3 100644 --- a/_beacons/pulsar.py +++ b/_beacons/pulsar.py @@ -39,7 +39,7 @@ DEFAULT_MASK = None __virtualname__ = 'pulsar' -__version__ = 'v2017.9.0' +__version__ = 'v2017.9.1' CONFIG = None CONFIG_STALENESS = 0 diff --git a/_modules/hubble.py b/_modules/hubble.py index 0935bb5..1163e00 100644 --- a/_modules/hubble.py +++ b/_modules/hubble.py @@ -35,7 +35,7 @@ from nova_loader import NovaLazyLoader __nova__ = {} -__version__ = 'v2017.9.0' +__version__ = 'v2017.9.1' def audit(configs=None, diff --git a/_modules/nebula_osquery.py b/_modules/nebula_osquery.py index 63c1e7b..375aed5 100644 --- a/_modules/nebula_osquery.py +++ b/_modules/nebula_osquery.py @@ -41,7 +41,7 @@ log = logging.getLogger(__name__) -__version__ = 'v2017.9.0' +__version__ = 'v2017.9.1' __virtualname__ = 'nebula' diff --git a/_modules/win_pulsar.py b/_modules/win_pulsar.py index 001489e..aed6f72 100644 --- a/_modules/win_pulsar.py +++ b/_modules/win_pulsar.py @@ -28,7 +28,7 @@ CONFIG = None CONFIG_STALENESS = 0 -__version__ = 'v2017.9.0' +__version__ = 'v2017.9.1' def __virtual__(): diff --git a/_returners/slack_pulsar_returner.py b/_returners/slack_pulsar_returner.py index 649633f..c76c895 100644 --- a/_returners/slack_pulsar_returner.py +++ b/_returners/slack_pulsar_returner.py @@ -69,7 +69,7 @@ # Import Salt Libs import salt.returners -__version__ = 'v2017.9.0' +__version__ = 'v2017.9.1' log = logging.getLogger(__name__) diff --git a/_returners/splunk_nebula_return.py b/_returners/splunk_nebula_return.py index 635d4ca..aad4a2c 100644 --- a/_returners/splunk_nebula_return.py +++ b/_returners/splunk_nebula_return.py @@ -50,7 +50,7 @@ import logging -__version__ = 'v2017.9.0' +__version__ = 'v2017.9.1' _max_content_bytes = 100000 http_event_collector_SSL_verify = False diff --git a/_returners/splunk_nova_return.py b/_returners/splunk_nova_return.py index a9ac994..e7f1298 100644 --- a/_returners/splunk_nova_return.py +++ b/_returners/splunk_nova_return.py @@ -49,7 +49,7 @@ import logging -__version__ = 'v2017.9.0' +__version__ = 'v2017.9.1' _max_content_bytes = 100000 http_event_collector_SSL_verify = False diff --git a/_returners/splunk_pulsar_return.py b/_returners/splunk_pulsar_return.py index d0ec7d6..d37e8fd 100644 --- a/_returners/splunk_pulsar_return.py +++ b/_returners/splunk_pulsar_return.py @@ -51,7 +51,7 @@ import logging -__version__ = 'v2017.9.0' +__version__ = 'v2017.9.1' _max_content_bytes = 100000 http_event_collector_SSL_verify = False