Comments (1)
Doing some reading and a complete assessment of how we run vulnerability scans
and lookup for vulnerability reports, I have the following proposal.
Implementation Details
By default, on-demand vulnerability scans are requested by providing the tag or digest
of an image, therefore we are going to make the vulnerability
command to be focused
in digest as much as possible. Though, we will provide a way to retrieve reports from
image IDs.
Here are some modifications we will make to the CLI.
Run on-demand scans
To run an on-demand scan, a user will need the following information:
<registry> container registry where the container image has been published
<repository> repository name that contains the container image
<tag|digest> either a tag or an image digest to scan (digest format: sha256:1ee...1d3b)
Note that we can't trigger scans with an image ID.
Review vulnerability reports
To review vulnerability reports from container image scans that run previously either
by the periodic scan mechanism that Lacework runs every hour, or a requested
on-demand vulnerability scan, a user will need to provide a SHA256 hash of a
container with format sha256:1ee...1d3b
.
Example:
$ lacework vul report sha256:8d8f5b08727272389bc2788561bd60a8f012d3c68675dccce7dd7ee2d47a9f4d
By default, this command treads the provided SHA256 as the image digest, when a
user is trying to lookup a report by its image ID, they can use the flag --image_id
that
will tread the provided SHA256 hash as an image ID.
Deprecations
The flag --digest
will be deprecated, and in fact, enabled by default for the command
lacework vulnerability report
.
from go-sdk.
Related Issues (20)
- CloudQuery Source Plugin?
- feat: Syntax Highlighting / LSP support for LQL language HOT 1
- bug: `lacework completion bash/fish/zsh` requires authentication HOT 1
- feat: More examples and "how to use" docs HOT 2
- Ability to manage compliance suppression from CLI HOT 2
- lacework configure command doesn't remove subaccount
- Running lacework cli command to scan package manifests is creating empty output file HOT 7
- GCP List Projects Limited Output HOT 2
- Container Assessments default end time might be slightly ahead of server time and will get rejected by LW API HOT 8
- Running install.ps1 for the second time fails
- Pass-through used profile for command recommendations HOT 1
- bug:fdsafsadfsd
- bug: missing AWS_CIS_14 and GCP_CIS_13 report type for PDF HOT 1
- bug: lacework agent list percentage counter infinitely increases. HOT 3
- feat: lacework agent list - does not show agent status. HOT 5
- bug: api.NewClient account format is confusing HOT 1
- bug: api.ListAllImages not returning all active images HOT 1
- feat(cli): CLI version tags for Docker image HOT 2
- bug: Create SSH `known_hosts` file if doesn't already exist HOT 1
- feat: add line length as a check in `make lint` HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from go-sdk.