Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Finding Flowcharts To Feed Severity Ratings #121

Merged
merged 19 commits into from
Mar 2, 2024
Merged

Conversation

TrimarcJake
Copy link
Owner

In order to build out automated severity ratings, we need to know what the severities are first! Then we can build code to match. These should help.

Copy link

github-actions bot commented Feb 28, 2024

🦙 MegaLinter status: ⚠️ WARNING

Descriptor Linter Files Fixed Errors Elapsed time
⚠️ COPYPASTE jscpd yes 16 2.02s
⚠️ EDITORCONFIG editorconfig-checker 42 1 0.46s
⚠️ MARKDOWN markdownlint 9 22 1.37s
⚠️ MARKDOWN markdown-link-check 9 9 2.13s
✅ MARKDOWN markdown-table-formatter 9 0 0.28s
⚠️ POWERSHELL powershell 25 17 38.03s
✅ POWERSHELL powershell_formatter 25 0 24.92s
⚠️ REPOSITORY checkov yes 1 12.95s
✅ REPOSITORY gitleaks yes no 0.44s
✅ REPOSITORY git_diff yes no 0.01s
✅ REPOSITORY grype yes no 13.43s
✅ REPOSITORY secretlint yes no 0.94s
✅ REPOSITORY trivy yes no 5.14s
✅ REPOSITORY trivy-sbom yes no 1.47s
✅ REPOSITORY trufflehog yes no 7.19s
⚠️ SPELL cspell 43 287 9.46s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security

@SamErde
Copy link
Collaborator

SamErde commented Feb 29, 2024

Nice! The docs and visuals should help a lot. I haven't had a chance to review the actual flow for each severity evaluation yet, but the rest looks great.

One question: would it be worth creating a future-proof 'Docs' folder that contains 'Flowcharts' as well as any future documentation that is created (or generated with platyPS)?

@SamErde SamErde linked an issue Feb 29, 2024 that may be closed by this pull request
@TrimarcJake
Copy link
Owner Author

I think the flowcharts are just a starting point, so if you like the way they look, we should merge them. We can iterate on them as we build more subtle rating methods.

"Docs" does make more sense, tho! Maybe a structure like this:

Screenshot 2024-02-29 at 8 47 27 PM
~/iCloud Drive/Development/PowerShell/Locksmith/Docs finding-flowcharts* ⇣
❯ tree
.
└── Flowcharts
    ├── Auditing.md
    ├── ESC1.md
    ├── ESC2.md
    ├── ESC3.md
    ├── ESC4.md
    ├── ESC5.md
    ├── ESC6.md
    └── ESC8.md

@techspence
Copy link
Collaborator

Really nice work. I think these flowcharts are a great addition to the project! Question: Do we think having a key or a glossary to explain some of these terms may be useful to folks not super familiar with these concepts? Or maybe just clarify what we mean? Such as BuiltIn/PKI Admin, AD Admin. It may be utterly trivial, just thinking edge cases with terminology.

@TrimarcJake
Copy link
Owner Author

Really nice work. I think these flowcharts are a great addition to the project! Question: Do we think having a key or a glossary to explain some of these terms may be useful to folks not super familiar with these concepts? Or maybe just clarify what we mean? Such as BuiltIn/PKI Admin, AD Admin. It may be utterly trivial, just thinking edge cases with terminology.

Yeah, I think a glossary is a great idea now that we have a Docs folder! :D

@TrimarcJake TrimarcJake merged commit 188369d into testing Mar 2, 2024
3 checks passed
@TrimarcJake TrimarcJake deleted the finding-flowcharts branch March 2, 2024 15:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Establish Methodology for Criticality of Issues
3 participants