8000 Added Timestamps to Findings JSON File by JohannesZahn · Pull Request #492 · secureCodeBox/secureCodeBox · GitHub
[go: up one dir, main page]
Skip to content

Added Timestamps to Findings JSON File #492

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
rfelber merged 4 commits into from
Jun 24, 2021
Merged

Added Timestamps to Findings JSON File #492

rfelber merged 4 commits into from
Jun 24, 2021

Conversation

@JohannesZahn
Copy link
Contributor
@JohannesZahn JohannesZahn commented Jun 10, 2021 •
edited
Loading

Signed-off-by: JohannesZahn johannes_zahn@nc-online.de

Description

The findings.json now contains a timestamp in ISO8601 format (UTC time).

An example Scan on juice-shop produced the results attached.

Checklist

  • Test your changes as thoroughly as possible before you commit them. Preferably, automate your test by unit/integration tests.
  • Make sure npm test runs for the whole project.
  • Make codeclimate checks happy

findings.zip

@rfelber rfelber added the enhancement New feature or request label Jun 10, 2021
@rfelber rfelber added this to the v3.0.0 milestone Jun 10, 2021
@JohannesZahn JohannesZahn self-assigned this Jun 11, 2021
This was linked to issues Jun 15, 2021
Validate, Enhance and Document Findings Format #439
Closed
Add Timestamp to Findings Json File #506
Closed
@J12934
Copy link
Member
J12934 commented Jun 21, 2021

I think it might be good to change the way the ElasticSearch hook deals with timestamps in this PR.
Otherwise the elasticsearch finding will have a timestamp and a @timestamp field.
With the @timestamp being a couple of seconds later as it is filled by the hook.

Also while were at it, is timestamp the best name for it?
I'd suggest to call it parsedAt and add another (nullable) field called identifiedAt to the finding data type which can be filled by the parser if the scanners result file can pin point to a more exact time of identification.

@JohannesZahn
Copy link
Contributor Author
JohannesZahn commented Jun 22, 2021

@J12934 so do you think we just drop the "@timestamp" field in elasticsearch then and include the "parsedAt" and "identifiedAt" fields? Or do we keep it for compatibility?

@rfelber
Copy link
Member
rfelber commented Jun 22, 2021

@JohannesZahn

  • Let's keep elasticsearch as is (with @timestamp) because it's a common pattern to use within elasticsearch data.
  • Add implment parsedAt as new general findings data
  • Document identifiedAt in the findings spec but leave the implementation open for the feature

@JohannesZahn
rename timestamp to parsed_at
c08e7b7 
Signed-off-by: Johannes Zahn <johannes.zahn@iteratec.com>
@JohannesZahn
Copy link
Contributor Author
JohannesZahn commented Jun 22, 2021 •
edited
Loading

@rseedorff @J12934 the parser now uses "parsed_at" instead of "timestamp" in scb findings conform snake case. Here an example and the complete findings.json attached.

{
    "name": "Retrieved access-control-allow-origin header: *",
    "description": null,
    "category": "Nikto Finding",
    "location": "http://juice-shop/",
    "osi_layer": "NETWORK",
    "severity": "INFORMATIONAL",
    "attributes": {
        "ip_address": "10.96.193.17",
        "hostname": "juice-shop",
        "banner": "",
        "method": "GET",
        "port": 3000,
        "niktoId": 999986
    },
    "id": "370bebe5-54df-471b-a26c-a574cd465dd0",
    "parsed_at": "2021-06-22T12:27:28.153Z"
}

findings.zip

@rfelber rfelber enabled auto-merge June 24, 2021 06:36
@JohannesZahn JohannesZahn mentioned this pull request Jun 24, 2021
Closed
9 tasks
@rfelber rfelber merged commit 64460e4 into main Jun 24, 2021
@rfelber rfelber deleted the add-timestamp-to-findings branch June 24, 2021 06:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rfelber rfelber rfelber approved these changes

Assignees

@JohannesZahn JohannesZahn

Labels

enhancement New feature or request

Projects

None yet

Milestone

v3.0.0

Development

Successfully merging this pull request may close these issues.

Add Timestamp to Findings Json File Validate, Enhance and Document Findings Format

4 participants

@JohannesZahn @J12934 @rfelber
0