Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 6 Packages Projects Releases Wiki Activity

improve vuln cpe matching on macos (#6985)

Browse Source 
* add cpe translations
* fix matching on target_sw
This commit is contained in:
Michal Nicpon
2022-09-01 10:02:07 -06:00
committed by GitHub
parent 93e684d524
commit 0709d1bc5c
17 changed files with 830 additions and 194 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/Deploying/Configuration.md
+25 -3
View File
@@ -2056,7 +2056,10 @@ How often vulnerabilities are checked. This is also the interval at which the co
##### cpe_database_url
URL to fetch the CPE dictionary database from. Some users want to control where Fleet gets its database from. When Fleet sees this value defined, it downloads the file directly. It expects a file in the same format as can be found in https://github.com/fleetdm/nvd/releases. If this value is not defined, Fleet checks for the latest release in Github and only downloads it if needed.
You can fetch the CPE dictionary database from this URL. Some users want to control where Fleet gets its database.
When Fleet sees this value defined, it downloads the file directly.
It expects a file in the same format that can be found in https://github.com/fleetdm/nvd/releases.
If this value is not defined, Fleet checks for the latest release in Github and only downloads it if needed.
- Default value: `""`
- Environment variable: `FLEET_VULNERABILITIES_CPE_DATABASE_URL`
@@ -2066,16 +2069,35 @@ URL to fetch the CPE dictionary database from. Some users want to control where
cpe_database_url: ""
```
##### cpe_translations_url
You can fetch the CPE translations from this URL.
Translations are used when matching software to CPE entries in the CPE database that would otherwise be missed for various reasons.
When Fleet sees this value defined, it downloads the file directly.
It expects a file in the same format that can be found in https://github.com/fleetdm/nvd/releases.
If this value is not defined, Fleet checks for the latest release in Github and only downloads it if needed.
- Default value: `""`
- Environment variable: `FLEET_VULNERABILITIES_CPE_TRANSLATIONS_URL`
- Config file format:
```
vulnerabilities:
cpe_translations_url: ""
```
##### cve_feed_prefix_url
Similarly to the CPE dictionary, we allow users to define where to get the CVE feeds from. In this case, the url should be a host that serves the files in the path /feeds/json/cve/1.1/. Fleet expects to find there all the JSON Feeds that can be found in https://nvd.nist.gov/vuln/data-feeds. When not defined, Fleet downloads from the nvd.nist.gov host.
Like the CPE dictionary, we allow users to define where to get the CVE feeds.
In this case, the URL should be a host that serves the files in the path /feeds/json/cve/1.1/.
Fleet expects to find all the JSON Feeds that can be found in https://nvd.nist.gov/vuln/data-feeds.
When not defined, Fleet downloads from the nvd.nist.gov host.
- Default value: `""`
- Environment variable: `FLEET_VULNERABILITIES_CVE_FEED_PREFIX_URL`
- Config file format:
```
vulnerabilities:
cve_database_url: ""
cve_feed_prefix_url: ""
```
##### current_instance_checks