Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

⭐ wire data queries to controls #841

Merged
merged 6 commits into from
Oct 18, 2023
Merged

⭐ wire data queries to controls #841

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
fd68be6
⭐ wire data queries to controls
arlimus Oct 15, 2023
979290e
Add a test with a TODO.
preslavgerchev Oct 17, 2023
f405c1b
add better data queries to test.
preslavgerchev Oct 17, 2023
376e64c
Add reporting jobs for data queries that feed into controls.
preslavgerchev Oct 17, 2023
fbec829
Feed datapoints into data query reporting jobs too.
preslavgerchev Oct 17, 2023
2ca5ca1
Simplify datapoint storage, fix tests. Add QueryPackDependencies.
preslavgerchev Oct 18, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion examples/compliance.mql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,10 @@ policies:
title: SSH config editing should be limited to admins
mql: sshd.config.file.permissions.mode == 0644
impact: 100
queries:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we need do add query pack dependencies to support this in the maps?

similar to policy_dependencies but for query packs instead

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh good point! I'm not sure on the wiring we are using internally, but essentially we just want to point people to the MRN of the policy or querypack they want to activate at the end of the day

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added a query_pack_dependencies field to the proto. We use the policy/pack deps when compiling the framework maps to ensure that the policies/packs are in the bundle.

Note that packs come back as policies in the bundle but we only reference them by uid so that should be fine

- uid: sshd-params
title: SSHd configuration
mql: sshd.config.params

frameworks:
- uid: compliance-x
Expand All @@ -27,7 +31,7 @@ frameworks:
- title: System hardening
controls:
- uid: compliance-x-01
title: Only use strong ciphers
title: Securely configure your SSH
- uid: compliance-x-02
title: Limit access to system configuration
- uid: compliance-x-03
Expand All @@ -46,6 +50,8 @@ framework_maps:
checks:
- uid: sshd-ciphers-01
- uid: sshd-ciphers-02
queries:
- uid: sshd-params
- uid: compliance-x-02
checks:
- uid: sshd-config-permissions
Expand Down
Loading