-
Notifications
You must be signed in to change notification settings - Fork 13
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add a ruletype that checks for the presence of a file header #239
base: main
Are you sure you want to change the base?
Conversation
Signed-off-by: Radoslav Dimitrov <[email protected]>
2a7ab69
to
305ceb2
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A few minor questions, but this seems handy. It would be doubly-handy on PRs, but we can add that later.
The header to check for in the file. | ||
|
||
This is the expected content that should be present in the beginning of the file. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do you want to support date-matching here, or keep this exact match?
# Defines the configuration for alerting on the rule | ||
alert: | ||
type: security_advisory | ||
security_advisory: {} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think you want a security advisory for this.
It does seem worthwhile to think about what a remediation rule for this would look like, in the context of broader remediations, but this example seems a bit too limited on its own to recommend a remediation.
The following PR adds a ruletype that checks for the presence of a file header.
It accepts a filter input which is a regex for filtering out files and also the content of the header to check for. Both are required fields.
Example usages: