Scott Gress
c370a9672b
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #44746 # Details * Adds the ability to filter historical CVE data by software type, EPSS, CVSS, CVE ID (exclude only) and "has known exploit" * Hard-codes the CVSS filter to 9.0+ for now, since that's the only data that's been collected thus far * Un-gates the collection code so that it will collect CVE data for _all_ severities (but still in the restricted set of software) Related PRs [update the front-end](https://github.com/fleetdm/fleet/pull/47674) to allow sending these filters, and [update GitOps](https://github.com/fleetdm/fleet/pull/47634) to allow changing the default filters. # Checklist for submitter If some of the following don't apply, delete the relevant line. - [X] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [X] Added/updated automated tests - [X] QA'd all new/changed functionality manually ### Manual test plan — CVE chart filtering (backend smoke test) #### Setup - Premium dev server running with a few hosts carrying vulnerable software (so `cve_meta` / `software_cve` / `operating_system_vulnerabilities` are populated) - Chart data present — collector ran once, or seeded: `go run ./tools/charts-backfill --dataset cve --use-tracked-cves --days 7` - API token exported and helper set: ```bash BASE=https://localhost:8080/api/v1/fleet/charts peak() { curl -sk -H "Authorization: Bearer $TOKEN" "$BASE/$1" | jq '[.data[].value] | max'; } #### Checks (compare against the no-filter baseline) - [x] Baseline returns data — GET /charts/cve?days=7 returns a data series; .filters is empty/default - [x] Severity force-pinned to critical — cve?days=7 and cve?days=7&severity_min=0&severity_max=10 give identical peaks (no low-severity leak; client severity ignored) - [x] Category narrowing — software_categories=browsers ≤ baseline; software_categories=os,browsers,office,adobe == baseline - [x] OS category includes kernel — software_categories=os returns OS-vuln + Linux-kernel CVE counts - [x] Known-exploit narrowing — known_exploit=true ≤ baseline - [x] EPSS narrowing — epss_min=0.9 ≤ baseline; epss_min=0&epss_max=1 == baseline (EPSS is 0.0–1.0 on the API) - [x] Exclude is subtractive + tolerant — excluding a visible CVE lowers/keeps counts; exclude_cves=CVE-0000-00000 == baseline (no-op) - [x] Filters echo back — filtered requests return applied values under .filters - [x] Uptime untouched — GET /charts/uptime?days=7 returns its normal series - [x] Free-tier safety (optional) — on non-Premium, /charts/cve returns an empty series, no error - [x] > 0 rows from: SELECT COUNT(DISTINCT scd.entity_id) AS below_critical FROM host_scd_data scd JOIN cve_meta cm ON cm.cve = scd.entity_id WHERE scd.dataset='cve' AND cm.cvss_score < 9.0; - (confirms lower-severity CVEs are stored) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary of changes * **New Features** * Added advanced CVE chart request filters: software categories, known-exploit flag, EPSS min/max, severity min/max, and excluded CVEs. * Expanded CVE chart coverage to use the full “collectible” CVE set, with filtering applied when serving chart data. * **Tests** * Added coverage for collecting collectible CVEs and resolving chart entities based on filter combinations and exclusions. * **Chores** * Updated CVE chart backfill to use collectible CVE discovery. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
63 lines
2.1 KiB
Go
63 lines
2.1 KiB
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/fleetdm/fleet/v4/pkg/str"
|
|
"github.com/fleetdm/fleet/v4/server/chart/api"
|
|
api_http "github.com/fleetdm/fleet/v4/server/chart/api/http"
|
|
eu "github.com/fleetdm/fleet/v4/server/platform/endpointer"
|
|
platform_http "github.com/fleetdm/fleet/v4/server/platform/http"
|
|
"github.com/go-kit/kit/endpoint"
|
|
kithttp "github.com/go-kit/kit/transport/http"
|
|
"github.com/gorilla/mux"
|
|
)
|
|
|
|
// GetRoutes returns a function that registers chart routes on the router using the provided
|
|
// authMiddleware.
|
|
func GetRoutes(svc api.Service, authMiddleware endpoint.Middleware) eu.HandlerRoutesFunc {
|
|
return func(r *mux.Router, opts []kithttp.ServerOption) {
|
|
attachFleetAPIRoutes(r, svc, authMiddleware, opts)
|
|
}
|
|
}
|
|
|
|
func attachFleetAPIRoutes(r *mux.Router, svc api.Service, authMiddleware endpoint.Middleware, opts []kithttp.ServerOption) {
|
|
apiVersions := []string{"v1", "2022-04"}
|
|
ue := newChartEndpointer(svc, authMiddleware, opts, r, apiVersions...)
|
|
ue.GET("/api/_version_/fleet/charts/{metric}", getChartDataEndpoint, api_http.GetChartDataRequest{})
|
|
}
|
|
|
|
func getChartDataEndpoint(ctx context.Context, request any, svc api.Service) (platform_http.Errorer, error) {
|
|
req := request.(*api_http.GetChartDataRequest)
|
|
|
|
days := req.Days
|
|
if days == 0 {
|
|
days = 7
|
|
}
|
|
|
|
opts := api.RequestOpts{
|
|
Days: days,
|
|
Resolution: req.Resolution,
|
|
TZOffsetMinutes: req.TZOffset,
|
|
TeamID: req.TeamID,
|
|
LabelIDs: str.ParseUintList(req.LabelIDs),
|
|
Platforms: str.ParseStringList(req.Platforms),
|
|
IncludeHostIDs: str.ParseUintList(req.IncludeHostIDs),
|
|
ExcludeHostIDs: str.ParseUintList(req.ExcludeHostIDs),
|
|
|
|
SoftwareFilters: str.ParseStringList(req.SoftwareFilters),
|
|
KnownExploit: req.KnownExploit,
|
|
EPSSMin: req.EPSSMin,
|
|
EPSSMax: req.EPSSMax,
|
|
SeverityMin: req.SeverityMin,
|
|
SeverityMax: req.SeverityMax,
|
|
ExcludeCVEs: str.ParseStringList(req.ExcludeCVEs),
|
|
}
|
|
|
|
resp, err := svc.GetChartData(ctx, req.Metric, opts)
|
|
if err != nil {
|
|
return api_http.GetChartDataResponse{Err: err}, nil
|
|
}
|
|
return api_http.GetChartDataResponse{Response: resp}, nil
|
|
}
|