steampipe-plugin-detectify

README

Detectify Plugin for Steampipe

Use SQL to query your security vulnerabilities from Detectify

• Get started →
• Documentation: Table definitions & examples
• Community: Join #steampipe on Slack →
• Get involved: Issues

Quick start

Install the plugin with Steampipe:

steampipe plugin install l-teles/detectify

Configure the API token in ~/.steampipe/config/detectify.spc:

connection "detectify" {
  plugin = "l-teles/detectify"

  # The base URL of Detectify. Required.
  # This can be set via the `DETECTIFY_URL` environment variable.
  # base_url = "https://api.detectify.com/rest"

  # The API token for API calls. Required.
  # This can also be set via the `DETECTIFY_API_TOKEN` environment variable.
  # token = "96d4y0631c31850v2g13e4rkqt50h1p8v"

  # The access secret for API calls. Required.
  # This can also be set via the `DETECTIFY_API_SECRET` environment variable.
  # secret = "zl/0kt4gvFsV43PQuhNJjZ-XSSIJKakoYY2pTax05zaY="

  # The access secret for v3 API calls. Required.
  # This can also be set via the `DETECTIFY_API_TOKEN_V3` environment variable.
  # token_v3 = "3cd16594-z302-4lgz-113e-b3a36xy2lt99"
}

Or through environment variables:

export DETECTIFY_URL="https://api.detectify.com/rest"
export DETECTIFY_API_TOKEN="96d4y0631c31850v2g13e4rkqt50h1p8v"
export DETECTIFY_API_SECRET="zl/0kt4gvFsV43PQuhNJjZ-XSSIJKakoYY2pTax05zaY="
export DETECTIFY_API_TOKEN_V3="3cd16594-z302-4lgz-113e-b3a36xy2lt99"

Run a query:

select
  to_char(created_at, 'YYYY-MM-DD HH24:MI:SS') as "Creation Date",
  date_part('day', NOW() - created_at) AS "Days Open",
  status as "Status",
  cvss_scores -> 'cvss_3_1' ->> 'severity' as "Severity",
  host as "Asset",
  title as "Title",
  case
    when source ->> 'value' = 'surface-monitoring' then 'EASM'
    else 'WebApp Scan'
  end as "Source",
  location as "URL",
  definition ->> 'description' as "Description"
from
  detectify_finding
where
  status not in ('accepted_risk','patched','false_positive');

+--------+-------------+---------------------+-----------------------------------------------+-------------+----------------------------------+
| Status | Severity    | Asset               | Title                                         | Source      | URL                              |
+--------+-------------+---------------------+-----------------------------------------------+-------------+----------------------------------+
| active | medium      | gateway.example.com | Express Stack Trace                           | EASM        | https://gateway.example.com/%ff  |
| active | information | customer.example.com| Deprecated Security Header / X-XSS-Protection | WebApp Scan | https://customer.example.com/    |
+--------+-------------+---------------------+-----------------------------------------------+-------------+----------------------------------+

Development

Prerequisites:

• Steampipe
• Golang

Clone:

git clone https://github.com/l-teles/steampipe-plugin-detectify.git
cd steampipe-plugin-detectify

Build, which automatically installs the new version to your ~/.steampipe/plugins directory:

make

Configure the plugin:

cp config/* ~/.steampipe/config
vi ~/.steampipe/config/detectify.spc

Try it!

steampipe query
> .inspect detectify

Further reading:

• Writing plugins
• Writing your first table

Contributing

Please see the contribution guidelines and our code of conduct. All contributions are subject to the Apache 2.0 open source license.

help wanted issues:

• Steampipe
• Detectify Plugin