ThreatMapper
ThreatMapper copied to clipboard
Mask repeating CVE as they are discovered
Is your feature request related to a problem? Please describe. Present implementation of CVE masking masks only the one which are already present in the system, future discovered CVE's which are repeated are not masked
Describe the solution you'd like Use reportHandler which pulls data from kafka to check for repeated CVE's and mask them if required
Components/Services
- [ ] UI/Frontend
- [x] API/Backend
- [ ] Agent
- [ ] Deployment/YAMLs
- [ ] CI/CD Integration
- [ ] Other (specify)
- Masked Cve's are not persisted and are lost on restart
- Add new table maskcve in postgres db
- table design
cve_id pk
nodes {
node_name: node_type,
node_name: node_type,
}
example : cve-2020-2020
{
"redis:latest": "container_image",
"dev1": "host",
"libc-bin:2.31-13+deb11u3": "package"
}
- report handler has to load maked cves form this table first
- when user masks a new cve they are masked in the ElasticSearch and publish the document & index to channel maskcve on redis
- report handler receives the message from redis subscription
- add newly masked cve to in memory cache and also save it to database