ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 14:55:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Support setting entropy limit for detect-secrets from env

Browse Source
This commit is contained in:
Huang Yaming
2020-05-06 17:53:23 +08:00
parent 996f785af6
commit bc07c95bda
2 changed files with 27 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
README.md
View File

@@ -327,6 +327,16 @@ In order to remove noise and get only FAIL findings there is a `-q` flag that ma
./prowler -q -M csv -b ./prowler -q -M csv -b
``` ```
### Set the entropy limit for detect-secrets
Sets the entropy limit for high entropy base64 strings from environment variable `BASE64_LIMIT`. Value must be between 0.0 and 8.0, defaults is 4.5.
Sets the entropy limit for high entropy hex strings from environment variable `HEX_LIMIT`. Value must be between 0.0 and 8.0, defaults is 3.0.
```sh
export BASE64_LIMIT=4.5
export HEX_LIMIT=3.0
```
## Security Hub integration ## Security Hub integration
Since version v2.3, Prowler supports natively sending findings to [AWS Security Hub](https://aws.amazon.com/security-hub). This integration allows Prowler to import its findings to AWS Security Hub. With Security Hub, you now have a single place that aggregates, organizes, and prioritizes your security alerts, or findings, from multiple AWS services, such as Amazon GuardDuty, Amazon Inspector, Amazon Macie, AWS Identity and Access Management (IAM) Access Analyzer, and AWS Firewall Manager, as well as from AWS Partner solutions and now from Prowler. It is as simple as running the command below: Since version v2.3, Prowler supports natively sending findings to [AWS Security Hub](https://aws.amazon.com/security-hub). This integration allows Prowler to import its findings to AWS Security Hub. With Security Hub, you now have a single place that aggregates, organizes, and prioritizes your security alerts, or findings, from multiple AWS services, such as Amazon GuardDuty, Amazon Inspector, Amazon Macie, AWS Identity and Access Management (IAM) Access Analyzer, and AWS Firewall Manager, as well as from AWS Partner solutions and now from Prowler. It is as simple as running the command below:

18
include/secrets_detector
View File

@@ -24,16 +24,16 @@ secretsDetector(){
mkdir $SECRETS_TEMP_FOLDER mkdir $SECRETS_TEMP_FOLDER
fi fi
PYTHON_PIP_DETECTSECRETS_INSTALLED=1 PYTHON_PIP_DETECTSECRETS_INSTALLED=1
# Sets the entropy limit for high entropy base64 strings. Value # Sets the entropy limit for high entropy base64 strings from
# must be between 0.0 and 8.0, defaults is 4.5. # environment variable BASE64_LIMIT.
BASE64_LIMIT=3.0 # Value must be between 0.0 and 8.0, defaults is 4.5.
# Sets the entropy limit for high entropy hex strings. Value # Sets the entropy limit for high entropy hex strings from
# must be between 0.0 and 8.0, defaults is 3.0. # environment variable HEX_LIMIT.
HEX_LIMIT=3.0 # Value must be between 0.0 and 8.0, defaults is 3.0.
case $1 in case $1 in
file ) file )
# this is to scan a file # this is to scan a file
detect-secrets scan --hex-limit $HEX_LIMIT --base64-limit $BASE64_LIMIT $2 | \ detect-secrets scan --hex-limit ${HEX_LIMIT:-3.0} --base64-limit ${BASE64_LIMIT:-4.5} $2 | \
jq -r '.results[]|.[] | [.line_number, .type]|@csv' | wc -l jq -r '.results[]|.[] | [.line_number, .type]|@csv' | wc -l
#jq -r '.results[] | .[] | "\(.line_number)\t\(.type)"' #jq -r '.results[] | .[] | "\(.line_number)\t\(.type)"'
# this command must return values in two colums: # this command must return values in two colums:
@@ -41,12 +41,12 @@ secretsDetector(){
;; ;;
string ) string )
# this is to scan a given string # this is to scan a given string
detect-secrets scan --hex-limit $HEX_LIMIT --base64-limit $BASE64_LIMIT --string $2 | \ detect-secrets scan --hex-limit ${HEX_LIMIT:-3.0} --base64-limit ${BASE64_LIMIT:-4.5} --string $2 | \
grep True| wc -l grep True| wc -l
;; ;;
folder ) folder )
# this is to scan a given folder with all lambda files # this is to scan a given folder with all lambda files
detect-secrets scan --hex-limit $HEX_LIMIT --base64-limit $BASE64_LIMIT --all-files $2 | \ detect-secrets scan --hex-limit ${HEX_LIMIT:-3.0} --base64-limit ${BASE64_LIMIT:-4.5} --all-files $2 | \
jq -r '.results[]|.[] | [.line_number, .type]|@csv' | wc -l jq -r '.results[]|.[] | [.line_number, .type]|@csv' | wc -l
;; ;;
esac esac