hubblestack / hubble

Hubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event notifications, alerting, and reporting.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Rewrite nova

basepi opened this issue · comments

Offload all of the processing code to the core audit module for DRY and consistency reasons. This will also allow us to drastically reduce the complexity of the profiles themselves.

Not sure if you are up for requests at this point but having a utility to convert existing audit files to the new format would be nice(whatever that may be).

Yep, I will definitely handle the conversion. I'll probably have to write a slightly different routine for each audit module, but that will be way easier than rewriting the profiles from scratch.

Cool. I wrote up something that will convert the yaml to csv then another script to read in the csv. The second stage uses pandas to read the csv and update a sqlite db. I'll attach the first stage py script if it might be helpful in anyway. Feel free to use it or not. The one thing I didn't do was split up the list of checks. I decided to just store that as a json blob.

Also, don't laugh since I'm not a programmer ;)
nova_audit_csv_prep.txt

Thanks for the link! I'll keep it in mind. And I promise no judgment. :)