mitre/saf

# Security Automation Framework CLI MITRE Security Automation Framework (SAF) Command Line Interface (CLI) 汇集了 MITRE 和安全社区开发的应用程序、技术、库和工具，旨在为系统和 DevOps 流程简化安全自动化 SAF CLI 是 [Heimdall Tools](https://github.com/mitre/heimdall_tools) 和 [InSpec Tools](https://github.com/mitre/inspec_tools) 的继任者。 ## 术语 - ["Heimdall"](https://github.com/mitre/heimdall2) - 所有安全结果数据的可视化工具 - ["OASIS Heimdall Data Format (OHDF) - aka HDF"](https://saf.mitre.org/#/normalize) - 一种用于保存和转换安全数据的通用数据格式 ## 安装 * [通过 NPM](#installation-via-npm) * [通过 NPM 更新](#update-via-npm) * [通过 Brew](#installation-via-brew) * [通过 Brew 更新](#update-via-brew) * [通过 Docker](#installation-via-docker) * [通过 Docker 更新](#update-via-docker) * [通过 Windows 安装程序](#installation-via-windows-installer) * [通过 Windows 安装程序更新](#update-via-windows-installer) ## 开发者 有关 SAF 项目的开发、测试和贡献的详细信息，请参阅 [MITRE SAF Development](https://github.com/mitre/saf/blob/main/docs/contributors-guide.md) ## 用法 ### 认证 HDF 数据 * [认证](#attest) * [创建认证](#create-attestations) * [应用认证](#apply-attestations) ### [获取 Convert 命令帮助](#convert-command) ### 将 HDF 转换为其他格式 * [从 HDF 转换](#convert-from-hdf) * [HDF 转 ASFF](#hdf-to-asff) * [HDF 转 Splunk](#hdf-to-splunk) * [HDF 转 XCCDF Results](#hdf-to-xccdf-results) * [HDF 转 Checklist](#hdf-to-checklist) * [HDF 转 CSV](#hdf-to-csv) * [HDF 转 Condensed JSON](#hdf-to-condensed-json) ### 将其他格式转换为 HDF * [转换为 HDF](#convert-to-hdf) * [Anchore Grype 转 HDF](#anchore-grype-to-hdf) * [ASFF 转 HDF](#asff-to-hdf) * [AWS Config 转 HDF](#aws-config-to-hdf) * [Burp Suite 转 HDF](#burp-suite-to-hdf) * [CKL 转 POA&M](#ckl-to-poam) * [CycloneDX SBOM 转 HDF](#cyclonedx-sbom-to-hdf) * [DBProtect 转 HDF](#dbprotect-to-hdf) * [Dependency-Track 转 HDF](#dependency-track-to-hdf) * [Fortify 转 HDF](#fortify-to-hdf) * [gosec 转 HDF](#gosec-to-hdf) * [Ion Channel 转 HDF](#ion-channel-2-hdf) * [JFrog Xray 转 HDF](#jfrog-xray-to-hdf) * [Tenable Nessus 转 HDF](#tenable-nessus-to-hdf) * [Microsoft Secure Score 转 HDF](#msft_secure-to-hdf) * [Netsparker 转 HDF](#netsparker-to-hdf) * [NeuVector 转 HDF](#neuvector-to-hdf) * [Nikto 转 HDF](#nikto-to-hdf) * [Prisma 转 HDF](#prisma-to-hdf) * [Prowler 转 HDF](#prowler-to-hdf) * [Sarif 转 HDF](#sarif-to-hdf) * [Scoutsuite 转 HDF](#scoutsuite-to-hdf) * [Snyk 转 HDF](#snyk-to-hdf) * [SonarQube 转 HDF](#sonarqube-to-hdf) * [Splunk 转 HDF](#splunk-to-hdf) * [Trivy 转 HDF](#trivy-to-hdf) * [Trufflehog 转 HDF](#trufflehog-to-hdf) * [Twistlock 转 HDF](#twistlock-to-hdf) * [Veracode 转 HDF](#veracode-to-hdf) * [XCCDF Results 转 HDF](#xccdf-results-to-hdf) * [OWASP ZAP 转 HDF](#owasp-zap-to-hdf) ### eMASSer 客户端 * [eMASSer API CLI](#emasser-api-cli) ### 查看 HDF 摘要和数据 * [查看](#view) * [Heimdall](#heimdall) * [摘要](#summary) ### 验证 HDF 阈值 * [验证](#validate) * [阈值](#thresholds) ### 生成数据报告及更多 * [生成](#generate) * [Delta](#delta) * [Delta 支持命令](#delta-supporting-options) * [CKL 模板](#ckl-templates) * [InSpec 元数据](#inspec-metadata) * [Inspec Profile](#inspec-profile) * [阈值](#thresholds-1) * [电子表格 (csv/xlsx) 转 InSpec](#spreadsheet-csvxlsx-to-inspec) * [DoD Stub 与 CIS Stub 格式化](#dod-stub-vs-cis-stub-formatting) * [映射文件](#mapping-files) ### 增强和补充 HDF 数据 * [补充](#supplement) * [透传](#passthrough) * [读取](#read) * [写入](#write) * [目标](#target) * [读取](#read-1) * [写入](#write-1) ### 许可证和作者 * [许可证和作者](#license-and-author) ## 安装 ### 通过 NPM 安装 可以使用 `npm` 安装和更新 SAF CLI，`npm` 通常包含在大多数版本的 [NodeJS](https://nodejs.org/en/) 中。 ``` npm install -g @mitre/saf ``` #### 通过 NPM 更新 使用 `npm` 更新 SAF CLI： ``` npm update -g @mitre/saf ``` [返回顶部](#installation) ### 通过 Brew 安装 可以使用 `brew` 安装和更新 SAF CLI。 ``` brew install mitre/saf/saf-cli ``` #### 通过 Brew 更新 使用 `brew` 更新 SAF CLI： ``` brew upgrade mitre/saf/saf-cli ``` [返回顶部](#installation) ### 通过 Docker 安装 **在 Linux 和 Mac 上：** 下面的 docker 命令可用于一次性运行 SAF CLI，其中 `arguments` 包含您想要运行的命令和标志。例如：`--version` 或 `view summary -i hdf-results.json`。 ``` docker run -it -v$(pwd):/share mitre/saf ``` 要在一个持久化的 shell 中运行 SAF CLI 以执行一个或多个命令，请使用以下命令，然后运行每个完整的命令。例如：`saf --version` 或 `saf view summary -i hdf-results.json`。您可以更改希望使用的 entrypoint。例如，使用 `--entrypoint sh` 以在 shell 终端中打开。如果找不到指定的 entrypoint，请尝试使用路径，如 `--entrypoint /bin/bash`。 ``` docker run --rm -it --entrypoint bash -v$(pwd):/share mitre/saf ``` **在 Windows 上：** 下面的 docker 命令可用于一次性运行 SAF CLI，其中 `arguments` 包含您想要运行的命令和标志。例如：`--version` 或 `view summary -i hdf-results.json`。 ``` docker run -it -v%cd%:/share mitre/saf ``` 要在一个持久化的 shell 中运行 SAF CLI 以执行一个或多个命令，请使用以下命令，然后运行每个完整的命令。例如：`saf --version` 或 `saf view summary -i hdf-results.json`。您可以更改希望使用的 entrypoint。例如，使用 `--entrypoint sh` 以在 shell 终端中打开。如果找不到指定的 entrypoint，请尝试使用路径，如 `--entrypoint /bin/bash`。 ``` docker run --rm -it --entrypoint sh -v%cd%:/share mitre/saf ``` **注意：** 请根据需要使用 Docker CLI 标志来运行各种子命令。 例如，要运行 `emasser configure` 子命令，您需要传入一个包含您的证书并且可以存储生成的 .env 文件的卷 (volume)。此外，您需要传入用于启用伪 TTY 和交互性的标志。 ``` docker run -it -v "$(pwd)":/share mitre/saf emasser configure ``` 其他命令可能不需要 `-i` 或 `-t` 标志，而只需要绑定挂载的卷 (bind-mounted volume)，例如基于文件的 `convert`。 ``` docker run --rm -v "$(pwd)":/share mitre/saf convert -i test/sample_data/trivy/sample_input_report/trivy-image_golang-1.12-alpine_sample.json -o test.json ``` 还有其他标志用于开放网络端口或传递环境变量，因此请确保使用成功运行命令所需的任何标志。 #### 通过 Docker 更新 使用 `docker` 更新 SAF CLI： ``` docker pull mitre/saf:latest ``` [返回顶部](#installation) ### 通过 Windows 安装程序安装 要在 Windows 上安装最新版本的 SAF CLI，请从 [Releases](https://github.com/mitre/saf/releases) 🌬️ 页面下载并运行适合您系统架构的最新安装程序。 #### 通过 Windows 安装程序更新 要在 Windows 上更新 SAF CLI，请从系统中卸载任何现有版本，然后从 [Releases](https://github.com/mitre/saf/releases) 🌬️ 页面下载并运行适合您系统架构的最新安装程序。 [返回顶部](#installation) ## 用法 ### 认证 (Attest) 对“未审查”(Not Reviewed) 的控制进行认证：有时安全工具无法自动测试要求，因此需要人工审查，即某人通过采访人员或检查系统来确认（即认证）控制要求是否已满足。 #### 创建认证 ``` attest create Create attestation files for use with `saf attest apply` USAGE $ saf attest create -o [-i -t ] FLAGS -i, --input= (optional) An input HDF file to search for controls -o, --output= (required) The output filename -t, --format= [default: json] (optional) The output file type GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf attest create -o attestation.json -i hdf.json $ saf attest create -o attestation.xlsx -t xlsx ``` [返回顶部](#usage) #### 应用认证 ``` attest apply Apply one or more attestation files to one or more HDF results sets USAGE $ saf attest apply -i ... ... -o FLAGS -i, --input=... (required) Your input HDF and Attestation file(s) -o, --output= (required) Output file or folder (for multiple executions) GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf attest apply -i hdf.json attestation.json -o new-hdf.json $ saf attest apply -i hdf1.json hdf2.json attestation.xlsx -o outputDir ``` [返回顶部](#usage) ### Convert 命令 使用 `saf convert` 命令将数据转换为 Heimdall Data Format (HDF) 或从 HDF 转换。 想要推荐或帮助开发转换器？请参阅 [如何开始](https://github.com/mitre/saf/wiki/How-to-recommend-development-of-a-mapper) 📰 [返回顶部](#get-help-with-convert-command) ### 从 HDF 转换 [返回顶部](#convert-other-formats-to-hdf) #### Anchore Grype 转 HDF ``` convert anchoregrype2hdf Translate a Anchore Grype output file into an HDF results set USAGE $ saf convert anchoregrype2hdf -i -o [-h] [-w] FLAGS -i, --input= (required) Input Anchore Grype file -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw data from the input Anchore Grype file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert anchoregrype2hdf -i anchoregrype.json -o output-hdf-name.json ``` [返回顶部](#convert-hdf-to-other-formats) #### HDF 转 ASFF ***注意：*** 将发现结果上传到 AWS Security Hub 需要配置 AWS CLI，请参阅 👉 [AWS 文档](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html) 或通过 Docker 配置环境变量。 ``` convert hdf2asff Translate a Heimdall Data Format JSON file into AWS Security Findings Format JSON file(s) and/or upload to AWS Security Hub USAGE $ saf convert hdf2asff -a -r -i -t [-h] [-R] (-u [-I -C ] | [-o ]) FLAGS -C, --certificate= Trusted signing certificate file -I, --insecure Disable SSL verification, this is insecure. -R, --specifyRegionAttribute Manually specify the top-level `Region` attribute - SecurityHub populates this attribute automatically and prohibits one from updating it using `BatchImportFindings` or `BatchUpdateFindings` -i, --input= (required) Input HDF JSON File -o, --output= Output ASFF JSON Folder -r, --region= (required) SecurityHub Region -t, --target= (required) Unique name for target to track findings across time -u, --upload Upload findings to AWS Security Hub GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES Send output to local file system $ saf convert hdf2asff -i rhel7-scan_02032022A.json -a 123456789 -r us-east-1 -t rhel7_example_host -o rhel7.asff Upload findings to AWS Security Hub $ saf convert hdf2asff -i rds_mysql_i123456789scan_03042022A.json -a 987654321 -r us-west-1 -t Instance_i123456789 -u Upload findings to AWS Security Hub and Send output to local file system $ saf convert hdf2asff -i snyk_acme_project5_hdf_04052022A.json -a 2143658798 -r us-east-1 -t acme_project5 -o snyk_acme_project5 -u ``` [返回顶部](#convert-hdf-to-other-formats) #### HDF 转 Splunk **注意**：HDF 转 Splunk 需要在 Splunk 服务器上进行配置。请参阅 👉 [Splunk 配置](https://github.com/mitre/saf/wiki/Splunk-Configuration)。 ``` convert hdf2splunk Translate and upload a Heimdall Data Format JSON file into a Splunk server USAGE $ saf convert hdf2splunk -i -H -I [-h] [-P ] [-s http|https] [-u | -t ] [-p ] [-L info|warn|debug|verbose] FLAGS -H, --host= (required) Splunk Hostname or IP -I, --index= (required) Splunk index to import HDF data into -P, --port= [default: 8089] Splunk management port (also known as the Universal Forwarder port) -i, --input= (required) Input HDF file -p, --password= Your Splunk password -s, --scheme= [default: https] HTTP Scheme used for communication with splunk -t, --token= Your Splunk API Token -u, --username= Your Splunk username GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES User name/password Authentication $ saf convert hdf2splunk -i rhel7-results.json -H 127.0.0.1 -u admin -p Valid_password! -I hdf Token Authentication $ saf convert hdf2splunk -i rhel7-results.json -H 127.0.0.1 -t your.splunk.token -I hdf ``` 有关 HDF Splunk Schema 文档，请访问 👉 [Heimdall converter schemas](https://github.com/mitre/heimdall2/blob/master/libs/hdf-converters/src/converters-from-hdf/splunk/Schemas.md#schemas) **在 Splunk 中预览 HDF 数据：** 完整原始搜索查询示例： ``` index="<>" meta.subtype=control | stats values(meta.filename) values(meta.filetype) list(meta.profile_sha256) values(meta.hdf_splunk_schema) first(meta.status) list(meta.status) list(meta.is_baseline) values(title) last(code) list(code) values(desc) values(descriptions.*) values(id) values(impact) list(refs{}.*) list(results{}.*) list(source_location{}.*) values(tags.*) by meta.guid id | join meta.guid [search index="<>" meta.subtype=header | stats values(meta.filename) values(meta.filetype) values(meta.hdf_splunk_schema) list(statistics.duration) list(platform.*) list(version) by meta.guid] | join meta.guid [search index="<>" meta.subtype=profile | stats values(meta.filename) values(meta.filetype) values(meta.hdf_splunk_schema) list(meta.profile_sha256) list(meta.is_baseline) last(summary) list(summary) list(sha256) list(supports{}.*) last(name) list(name) list(copyright) list(maintainer) list(copyright_email) last(version) list(version) list(license) list(title) list(parent_profile) list(depends{}.*) list(controls{}.*) list(attributes{}.*) list(status) by meta.guid] ``` 格式化表格搜索查询示例： ``` index="<>" meta.subtype=control | stats values(meta.filename) values(meta.filetype) list(meta.profile_sha256) values(meta.hdf_splunk_schema) first(meta.status) list(meta.status) list(meta.is_baseline) values(title) last(code) list(code) values(desc) values(descriptions.*) values(id) values(impact) list(refs{}.*) list(results{}.*) list(source_location{}.*) values(tags.*) by meta.guid id | join meta.guid [search index="<>" meta.subtype=header | stats values(meta.filename) values(meta.filetype) values(meta.hdf_splunk_schema) list(statistics.duration) list(platform.*) list(version) by meta.guid] | join meta.guid [search index="<>" meta.subtype=profile | stats values(meta.filename) values(meta.filetype) values(meta.hdf_splunk_schema) list(meta.profile_sha256) list(meta.is_baseline) last(summary) list(summary) list(sha256) list(supports{}.*) last(name) list(name) list(copyright) list(maintainer) list(copyright_email) last(version) list(version) list(license) list(title) list(parent_profile) list(depends{}.*) list(controls{}.*) list(attributes{}.*) list(status) by meta.guid] | rename values(meta.filename) AS "Results Set", values(meta.filetype) AS "Scan Type", list(statistics.duration) AS "Scan Duration", first(meta.status) AS "Control Status", list(results{}.status) AS "Test(s) Status", id AS "ID", values(title) AS "Title", values(desc) AS "Description", values(impact) AS "Impact", last(code) AS Code, values(descriptions.check) AS "Check", values(descriptions.fix) AS "Fix", values(tags.cci{}) AS "CCI IDs", list(results{}.code_desc) AS "Results Description", list(results{}.skip_message) AS "Results Skip Message (if applicable)", values(tags.nist{}) AS "NIST SP 800-53 Controls", last(name) AS "Scan (Profile) Name", last(summary) AS "Scan (Profile) Summary", last(version) AS "Scan (Profile) Version" | table meta.guid "Results Set" "Scan Type" "Scan (Profile) Name" ID "NIST SP 800-53 Controls" Title "Control Status" "Test(s) Status" "Results Description" "Results Skip Message (if applicable)" Description Impact Severity Check Fix "CCI IDs" Code "Scan Duration" "Scan (Profile) Summary" "Scan (Profile) Version" ``` [返回顶部](#convert-hdf-to-other-formats) #### HDF 转 XCCDF Results ``` convert hdf2xccdf Translate an HDF file into an XCCDF XML USAGE $ saf convert hdf2xccdf -i -o [-h] FLAGS -i, --input= (required) Input HDF file -o, --output= (required) Output XCCDF XML File GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert hdf2xccdf -i hdf_input.json -o xccdf-results.xml ``` [返回顶部](#convert-hdf-to-other-formats) #### HDF 转 Checklist ``` convert hdf2ckl Translate a Heimdall Data Format JSON file into a DISA checklist file USAGE $ saf convert hdf2ckl -i -o [-h] [-m ] [--profilename ] [--profiletitle ] [--version ] [--releasenumber ] [--releasedate ] [--marking ] [-H ] [-I ] [-M ] [-F ] [--targetcomment ] [--role Domain Controller|Member Server|None|Workstation] [--assettype Computing|Non-Computing] [--techarea |Application Review|Boundary Security|CDS Admin Review|CDS Technical Review|Database Review|Domain Name System (DNS)|Exchange Server|Host Based System Security (HBSS)|Internal Network|Mobility|Other Review|Releasable Networks (REL)|Releaseable Networks (REL)|Traditional Security|UNIX OS|VVOIP Review|Web Review|Windows OS] [--stigguid ] [--targetkey ] [--webdbsite --webordatabase] [--webdbinstance ] [--vulidmapping gid|id] FLAGS -h, --help Show CLI help. -i, --input= (required) Input HDF file -o, --output= (required) Output CKL file CHECKLIST METADATA FLAGS -F, --fqdn= Fully Qualified Domain Name -H, --hostname= The name assigned to the asset within the network -I, --ip= IP address -M, --mac= MAC address -m, --metadata= Metadata JSON file, generate one with "saf generate ckl_metadata" --assettype= The category or classification of the asset --marking= A security classification or designation of the asset, indicating its sensitivity level --profilename= Profile name --profiletitle= Profile title --releasedate= Profile release date --releasenumber= Profile release number --role= The primary function or role of the asset within the network or organization --stigguid= A unique identifier associated with the STIG for the asset --targetcomment= Additional comments or notes about the asset --targetkey= A unique key or identifier for the asset within the checklist or inventory system --techarea= The technical area or domain to which the asset belongs --version= Profile version number --vulidmapping= Which type of control identifier to map to the checklist ID --webdbinstance= The specific instance of the web application or database running on the server --webdbsite= The specific site or application hosted on the web or database server --webordatabase Indicates whether the STIG is primarily for either a web or database server DESCRIPTION Translate a Heimdall Data Format JSON file into a DISA checklist file EXAMPLES $ saf convert hdf2ckl -i rhel7-results.json -o rhel7.ckl --fqdn reverseproxy.example.org --hostname reverseproxy --ip 10.0.0.3 --mac 12:34:56:78:90:AB $ saf convert hdf2ckl -i rhel8-results.json -o rhel8.ckl -m rhel8-metadata.json ``` [返回顶部](#convert-hdf-to-other-formats) #### HDF 转 CSV ``` convert hdf2csv Translate a Heimdall Data Format JSON file into a Comma Separated Values (CSV) file USAGE $ saf convert hdf2csv -i -o [-h] [-f ] [-t] FLAGS -f, --fields= [default: All Fields] Fields to include in output CSV, separated by commas -i, --input= (required) Input HDF file -o, --output= (required) Output CSV file -t, --noTruncate Don't truncate fields longer than 32,767 characters (the cell limit in Excel) GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES Running the CLI interactively $ saf convert hdf2csv --interactive Providing flags at the command line $ saf convert hdf2csv -i rhel7-results.json -o rhel7.csv --fields "Results Set,Status,ID,Title,Severity" ``` [返回顶部](#convert-hdf-to-other-formats) #### HDF 转 Condensed JSON ``` convert hdf2condensed Condensed format used by some community members to pre-process data for elasticsearch and custom dashboards USAGE $ saf convert hdf2condensed -i -o [-h] FLAGS -i, --input= (required) Input HDF file -o, --output= (required) Output condensed JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert hdf2condensed -i rhel7-results.json -o rhel7-condensed.json ``` [返回顶部](#convert-hdf-to-other-formats) ### 转换为 HDF #### ASFF 转 HDF 输出|用途|命令 ---|---|--- ASFF json|将输入到映射器的所有发现结果|aws securityhub get-findings > asff.json AWS SecurityHub 已启用标准 json|获取所有已启用的标准以便获取其标识符|aws securityhub get-enabled-standards > asff_standards.json AWS SecurityHub 标准控制 json|获取将输入到映射器的标准的所有控制|aws securityhub describe-standards-controls --standards-subscription-arn "arn:aws:securityhub:us-east-1:123456789123:subscription/cis-aws-foundations-benchmark/v/1.2.0" > asff_cis_standard.json ``` convert asff2hdf Translate a AWS Security Finding Format JSON into a Heimdall Data Format JSON file(s) USAGE $ saf convert asff2hdf -o [-h] (-i [--securityhub ]... | -a -r [-I | -C ] [-t ]) [-L info|warn|debug|verbose] FLAGS -C, --certificate= Trusted signing certificate file -I, --insecure Disable SSL verification, this is insecure -H, --securityHub= Additional input files to provide context that an ASFF file needs such as the CIS AWS Foundations or AWS Foundational Security Best Practices documents (in ASFF compliant JSON form) -a, --aws Pull findings from AWS Security Hub -i, --input= (required if not using AWS) Input ASFF JSON file -o, --output= (required) Output HDF JSON folder -r, --region= Security Hub region to pull findings from -t, --target=... Target ID(s) to pull from Security Hub (maximum 10), leave blank for non-HDF findings GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES Using ASFF JSON file $ saf convert asff2hdf -i asff-findings.json -o output-folder-name Using ASFF JSON file with additional input files $ saf convert asff2hdf -i asff-findings.json --securityhub ... --securityhub -o output-folder-name Using AWS to pull ASFF JSON findings $ saf convert asff2hdf --aws -o out -r us-west-2 --target rhel7 ``` [返回顶部](#convert-other-formats-to-hdf) #### AWS Config 转 HDF ***注意：*** 提取 AWS Config 结果数据需要配置 AWS CLI，请参阅 👉 [AWS 文档](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html) 或通过 Docker 配置环境变量。 ``` convert aws_config2hdf Pull Configuration findings from AWS Config and convert into a Heimdall Data Format JSON file USAGE $ saf convert aws_config2hdf -r -o [-h] [-a ] [-s ] [-t ] [-i] FLAGS -a, --accessKeyId= Access key ID -i, --insecure Disable SSL verification, this is insecure. -o, --output= (required) Output HDF JSON File -r, --region= (required) Region to pull findings from -s, --secretAccessKey= Secret access key -t, --sessionToken= Session token GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert aws_config2hdf -a ABCDEFGHIJKLMNOPQRSTUV -s +4NOT39A48REAL93SECRET934 -r us-east-1 -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### Burp Suite 转 HDF ``` convert burpsuite2hdf Translate a BurpSuite Pro XML file into a Heimdall Data Format JSON file USAGE $ saf convert burpsuite2hdf -i -o [-h] [-w] FLAGS -i, --input= (required) Input Burpsuite Pro XML File -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert burpsuite2hdf -i burpsuite_results.xml -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### CKL 转 POA&M 注意：包含的 CCI 到 NIST 映射是从 NIST.gov 提取的，针对 eMASS 的特定映射请使用[此](https://github.com/mitre/ckl2POAM/blob/main/resources/cci2nist.json)文件。 ``` convert ckl2POAM Translate DISA Checklist CKL file(s) to POA&M files USAGE $ saf convert ckl2POAM -i -o [-h] [-O ] [-d ] [-s ] FLAGS -O, --officeOrg= Default value for Office/org (prompts for each file if not set) -d, --deviceName= Name of target device (prompts for each file if not set) -i, --input=... (required) Path to the DISA Checklist File(s) -o, --output= (required) Path to output PO&M File(s) -s, --rowsToSkip= [default: 4] Rows to leave between POA&M Items for milestones GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) ALIASES $ saf convert ckl2poam EXAMPLES $ saf convert ckl2POAM -i checklist_file.ckl -o output-folder -d abcdefg -s 2 ``` [返回顶部](#convert-other-formats-to-hdf) #### CycloneDX SBOM 转 HDF 注意：目前，CycloneDX SBOM 转换命令仅官方支持 CycloneDX SBOM、VEX 和 HBOM 格式（像 SaaSBOM 这样的格式不受支持，会导致错误）。要转换其他非 CycloneDX SBOM 格式，请首先使用[其提供的工具](https://github.com/CycloneDX/cyclonedx-cli)将您当前的 SBOM 数据文件转换为 CycloneDX SBOM 数据格式，然后使用 `saf convert cyclonedx_sbom2hdf` 命令将 CycloneDX SBOM 文件转换为 OHDF。 例如）要使用 [CycloneDX CLI](https://github.com/CycloneDX/cyclonedx-cli) 将 SPDX SBOM 格式转换为 CycloneDX SBOM 格式，您可以执行以下操作： ``` cyclonedx-cli convert --input-file spdx-sbom.json --output-file cyclonedx-sbom.json --input-format spdxjson --output-format json ``` 然后使用生成的 CycloneDX SBOM 文件转换为 OHDF。 ``` convert cyclonedx_sbom2hdf Translate a CycloneDX SBOM report into an HDF results set USAGE $ saf convert cyclonedx_sbom2hdf -i -o [-h] [-w] FLAGS -i, --input= (required) Input CycloneDX SBOM File -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert cyclonedx_sbom2hdf -i cyclonedx_sbom.json -o output-hdf-name.json ``` [返回顶部]() #### DBProtect 转 HDF ``` convert dbprotect2hdf Translate a DBProtect report in "Check Results Details" XML format into a Heimdall Data Format JSON file USAGE $ saf convert dbprotect2hdf -i -o [-h] [-w] FLAGS -i, --input= (required) 'Check Results Details' XML File -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert dbprotect2hdf -i check_results_details_report.xml -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) ##### Dependency-Track 转 HDF ``` convert dependency_track2hdf Translate a Dependency-Track results JSON file into a Heimdall Data Format JSON file USAGE $ saf convert dependency_track2hdf -i -o [-h] [-w] FLAGS -h, --help Show CLI help. -i, --input= (required) Input Dependency-Track FPF file -o, --output= (required) Output HDF file -w, --with-raw GLOBAL FLAGS -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES saf convert dependency_track2hdf -i dt-fpf.json -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### Fortify 转 HDF ``` convert fortify2hdf Translate a Fortify results FVDL file into a Heimdall Data Format JSON file; the FVDL file is an XML that can be extracted from the Fortify FPR project file using standard file compression tools USAGE $ saf convert fortify2hdf -i -o [-h] [-w] FLAGS -i, --input= (required) Input FVDL File -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert fortify2hdf -i audit.fvdl -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### gosec 转 HDF ``` convert gosec2hdf Translate a gosec (Golang Security Checker) results file into a Heimdall Data Format JSON file USAGE $ saf convert gosec2hdf -i -o [-h] [-w] FLAGS -h, --help Show CLI help. -i, --input= (required) Input gosec Results JSON File -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert gosec2hdf -i gosec_results.json -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### Ion Channel 转 HDF ``` convert ionchannel2hdf Pull and translate SBOM data from Ion Channel into Heimdall Data Format USAGE $ saf convert ionchannel2hdf -o [-h] (-i | -a -t [--raw ] [-p ] [-A ]) [-L info|warn|debug|verbose] FLAGS -A, --allProjects Pull all projects available within your team -L, --logLevel= [default: info] -a, --apiKey= API Key from Ion Channel user settings -i, --input=... Input IonChannel JSON file -o, --output= (required) Output JSON folder -p, --project=... The name of the project(s) you would like to pull -t, --teamName= Your team name that contains the project(s) you would like to pull data from --raw Output Ion Channel raw data GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES Using Input IonChannel JSON file $ saf convert ionchannel2hdf -o output-folder-name -i ion-channel-file.json Using IonChannel API Key (pull one project) $ saf convert ionchannel2hdf -o output-folder-name -a ion-channel-apikey -t team-name -p project-name-to-pull --raw Using IonChannel API Key (pull all project) $ saf convert ionchannel2hdf -o output-folder-name -a ion-channel-apikey -t team-name -A --raw ``` [返回顶部](#convert-other-formats-to-hdf) #### JFrog Xray 转 HDF ``` convert jfrog_xray2hdf Translate a JFrog Xray results JSON file into a Heimdall Data Format JSON file USAGE $ saf convert jfrog_xray2hdf -i -o [-h] [-w] FLAGS -i, --input= (required) Input JFrog JSON File -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert jfrog_xray2hdf -i xray_results.json -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### Tenable Nessus 转 HDF ``` convert nessus2hdf Translate a Nessus XML results file into a Heimdall Data Format JSON file. The current iteration maps all plugin families except for 'Policy Compliance' A separate HDF JSON is generated for each host reported in the Nessus Report. USAGE $ saf convert nessus2hdf -i -o [-h] [-w] FLAGS -i, --input= (required) Input Nessus XML File -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert nessus2hdf -i nessus_results.xml -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### Microsoft Secure Score 转 HDF 输出|用途|命令 ---|---|--- Microsoft Secure Score JSON|此文件包含 `security/secureScore` 端点的 Graph API 响应|PowerShell$ `Get-MgSecuritySecureScore -Top 500` Microsoft Secure Score Control Profiles JSON|此文件包含 `security/secureScoreControlProfiles` 端点的 Graph API 响应|PowerShell$ `Get-MgSecuritySecureScoreControlProfile -Top 500` Combined JSON|合并 `security/secureScore` 和 `security/secureScoreControlProfiles` 端点的输出|`jq -s \'{"secureScore": .[0], "profiles": .[1]}\' secureScore.json secureScoreControlProfiles.json` ``` convert msft_secure2hdf Translate a Microsoft Secure Score report and Secure Score Control to a Heimdall Data Format JSON file USAGE $ saf convert msft_secure2hdf -p -r -o [-h] $ saf convert msft_secure2hdf -t -a -s -o [-h] $ saf convert msft_secure2hdf -i -o [-h] FLAGS -C, --certificate= Trusted signing certificate file -I, --insecure Disable SSL verification, this is insecure. -a, --appId= Azure application ID -i, --combinedInputs= JSON File combining the outputs from the Microsoft Graph API endpoints {secureScore: }, profiles: -o, --output= (required) Output HDF JSON file -p, --inputProfiles= Input Microsoft Graph API "GET /security/secureScoreControlProfiles" output JSON File -r, --inputScoreDoc= Input Microsoft Graph API "GET /security/secureScores" output JSON File -s, --appSecret= Azure application secret -t, --tenantId= Azure tenant ID -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES Using input files $ saf convert msft_secure2hdf -p secureScore.json -r secureScoreControlProfiles -o output-hdf-name.json [-w] Using Azure tenant ID $ saf convert msft_secure2hdf -t "12345678-1234-1234-1234-1234567890abcd" \ -a "12345678-1234-1234-1234-1234567890abcd" \ -s "aaaaa~bbbbbbbbbbbbbbbbbbbbbbbbb-cccccccc" \ -o output-hdf-name.json [-I | -C ] Using combined inputs $ saf convert msft_secure2hdf -i <(jq '{"secureScore": .[0], "profiles": .[1]}' secureScore.json secureScoreControlProfiles.json)> \ -o output-hdf-name.json [-w] ``` [返回顶部](#convert-other-formats-to-hdf) #### Netsparker 转 HDF ``` convert netsparker2hdf Translate a Netsparker XML results file into a Heimdall Data Format JSON file. The current iteration only works with Netsparker Enterprise Vulnerabilities Scan. USAGE $ saf convert netsparker2hdf -i -o [-h] [-w] FLAGS -i, --input= (required) Input Netsparker XML File -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert netsparker2hdf -i netsparker_results.xml -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### NeuVector 转 HDF ``` convert neuvector2hdf Translate a NeuVector results JSON to a Heimdall Data Format JSON file USAGE $ saf convert neuvector2hdf -i -o FLAGS -i, --input= (required) Input NeuVector Results JSON File -o, --output= (required) Output HDF JSON file -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert neuvector2hdf -i neuvector.json -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### Nikto 转 HDF ``` convert nikto2hdf Translate a Nikto results JSON file into a Heimdall Data Format JSON file. Note: Currently this mapper only supports single target Nikto Scans USAGE $ saf convert nikto2hdf -i -o [-h] [-w] FLAGS -i, --input= (required) Input Niktop Results JSON File -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert nikto2hdf -i nikto-results.json -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### Prisma 转 HDF ``` convert prisma2hdf Translate a Prisma Cloud Scan Report CSV file into Heimdall Data Format JSON files USAGE $ saf convert prisma2hdf -i -o [-h] FLAGS -i, --input= (required) Prisma Cloud Scan Report CSV -o, --output= (required) Output HDF JSON file GLOBAL FLAGS -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert prisma2hdf -i prismacloud-report.csv -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### Prowler 转 HDF ``` convert prowler2hdf Translate a Prowler-derived AWS Security Finding Format results from JSONL into a Heimdall Data Format JSON file USAGE $ saf convert prowler2hdf -i -o [-h] FLAGS -i, --input= (required) Input Prowler ASFF JSON File -o, --output= (required) Output HDF JSON Folder GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert prowler2hdf -i prowler-asff.json -o output-folder ``` [返回顶部](#convert-other-formats-to-hdf) #### Sarif 转 HDF ``` convert sarif2hdf Translate a SARIF JSON file into a Heimdall Data Format JSON file USAGE $ saf convert sarif2hdf -i -o [-h] [-w] FLAGS -i, --input= (required) Input SARIF JSON File -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) DESCRIPTION SARIF level to HDF impact mapping are: SARIF level error -> HDF impact 0.7 SARIF level warning -> HDF impact 0.5 SARIF level note -> HDF impact 0.3 SARIF level none -> HDF impact 0.1 SARIF level not provided -> HDF impact 0.1 as default EXAMPLES $ saf convert sarif2hdf -i sarif-results.json -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### Scoutsuite 转 HDF ``` convert scoutsuite2hdf Translate a ScoutSuite results from a Javascript object into a Heimdall Data Format JSON file Note: Currently this mapper only supports AWS USAGE $ saf convert scoutsuite2hdf -i -o [-h] [-w] FLAGS -i, --input= (required) Input ScoutSuite Results JS File -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert scoutsuite2hdf -i scoutsuite-results.js -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### Snyk 转 HDF ``` convert snyk2hdf Translate a Snyk results JSON file into a Heimdall Data Format JSON file A separate HDF JSON is generated for each project reported in the Snyk Report USAGE $ saf convert snyk2hdf -i -o [-h] FLAGS -i, --input= (required) Input Snyk Results JSON File -o, --output= (required) Output HDF JSON File GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert snyk2hdf -i snyk_results.json -o output-file-prefix ``` [返回顶部](#convert-other-formats-to-hdf) #### SonarQube 转 HDF 注意：从 SonarQube 实例拉取数据可能需要较长时间，具体取决于网络条件和所评估项目的规模。 注意：SonarQube 实例在正确返回其 API 的所有代码片段和规则之前可能需要“预热”，因此可能需要多次尝试此命令。 ``` convert sonarqube2hdf Pull SonarQube vulnerabilities for the specified project name and optional branch or pull/merge request ID name from an API and convert into a Heimdall Data Format JSON file USAGE $ saf convert sonarqube2hdf -n -u -a [ -b | -p ] -o FLAGS -a, --auth= (required) SonarQube API Key / User Token - please ensure that the user has permissions for the project (including seeing the code) -n, --projectKey= (required) SonarQube Project Key -o, --output= (required) Output HDF JSON File -u, --url= (required) SonarQube Base URL (excluding '/api') -b, --branch= Requires Sonarqube Developer Edition or above -p, --pullRequestID= Requires Sonarqube Developer Edition or above -g, --organization= SonarQube organization name - used as a default when necessary to access rule descriptions -w, --includeRaw Include raw input requests in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert sonarqube2hdf -n sonar_project_key -u http://sonar:9000 --auth abcdefg -p 123 -o scan_results.json -w ``` [返回顶部](#convert-other-formats-to-hdf) #### Splunk 转 HDF ``` convert splunk2hdf Pull HDF data from your Splunk instance back into an HDF file USAGE $ saf splunk2hdf -H -I [-h] [-P ] [-s http|https] (-u -p | -t ) [-L info|warn|debug|verbose] [-i -o ] FLAGS -H, --host= (required) Splunk Hostname or IP -I, --index= (required) Splunk index to query HDF data from -P, --port= [default: 8089] Splunk management port (also known as the Universal Forwarder port) -i, --input=... GUID(s) or Filename(s) of files from Splunk to convert -o, --output= Output HDF JSON Folder -p, --password= Your Splunk password -s, --scheme= [default: https] HTTP Scheme used for communication with splunk -t, --token= Your Splunk API Token -u, --username= Your Splunk username GLOBAL FLAGS -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert splunk2hdf -H 127.0.0.1 -u admin -p Valid_password! -I hdf -i some-file-in-your-splunk-instance.json -i yBNxQsE1mi4f3mkjtpap5YxNTttpeG -o output-folder ``` [返回顶部](#convert-other-formats-to-hdf) #### Trivy 转 HDF ``` convert trivy2hdf Translate a Trivy-derived AWS Security Finding Format results from JSONL into a Heimdall Data Format JSON file USAGE $ saf convert trivy2hdf -i -o FLAGS -i, --input= (required) Input Trivy ASFF JSON File -o, --output= (required) Output HDF JSON Folder GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) DESCRIPTION Note: Currently this mapper only supports the results of Trivy's `image` subcommand (featuring the CVE findings) while using the ASFF template format (which comes bundled with the repo). An example call to Trivy to get this type of file looks as follows: AWS_REGION=us-east-1 AWS_ACCOUNT_ID=123456789012 trivy image --no-progress --format template --template "@/absolute_path_to/git_clone_of/trivy/contrib/asff.tpl" -o trivy_asff.json golang:1.12-alpine EXAMPLES $ saf convert trivy2hdf -i trivy-asff.json -o output-folder ``` [返回顶部](#convert-other-formats-to-hdf) #### Trufflehog 转 HDF ``` convert trufflehog2hdf Translate a Trufflehog output file into an HDF results set USAGE $ saf convert trufflehog2hdf -i -o [-h] [-w] FLAGS -i, --input= (required) Input Trufflehog file -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert trufflehog2hdf -i trufflehog.json -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### Twistlock 转 HDF ``` convert twistlock2hdf Translate a Twistlock CLI output file into an HDF results set USAGE $ saf convert twistlock2hdf -i -o [-h] [-w] FLAGS -i, --input= (required) Input Twistlock file -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert twistlock2hdf -i twistlock.json -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### Veracode 转 HDF ``` convert veracode2hdf Translate a Veracode XML file into a Heimdall Data Format JSON file USAGE $ saf convert veracode2hdf -i -o [-h] FLAGS -i, --input= (required) Input Veracode XML File -o, --output= (required) Output HDF JSON File GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert veracode2hdf -i veracode_results.xml -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### XCCDF Results 转 HDF ***注意：*** `xccdf_results2hdf` 仅支持原生 OpenSCAP 和 SCC 输出。 ``` convert xccdf_results2hdf Translate a SCAP client XCCDF-Results XML report to a Heimdall Data Format JSON file USAGE $ saf convert xccdf_results2hdf -i -o [-h] [-w] FLAGS -i, --input= (required) Input XCCDF Results XML File -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert xccdf_results2hdf -i results-xccdf.xml -o output-hdf-name.json ``` [返回顶部](#convert-other-formats-to-hdf) #### OWASP ZAP 转 HDF ``` convert zap2hdf Translate a OWASP ZAP results JSON to a Heimdall Data Format JSON file USAGE $ saf convert zap2hdf -i -n -o [-h] [-w] FLAGS -i, --input= (required) Input OWASP Zap Results JSON File -n, --name= (required) Target Site Name -o, --output= (required) Output HDF JSON File -w, --includeRaw Include raw input file in HDF JSON file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf convert zap2hdf -i zap_results.json -n mitre.org -o scan_results.json ``` [返回顶部](#convert-other-formats-to-hdf) ### eMASSer API CLI SAF CLI 通过将 eMASSer CLI 整合到 SAF CLI 中来实现 eMASS REST API 功能。请参阅 [eMASSer Features](https://saf-cli.mitre.org/docs/emasser) 📜 获取更多信息 要获取顶层帮助，请执行以下命令： ``` $ saf emasser [-h or -help] [eMASS] The eMASS REST API implementation USAGE $ saf emasser COMMAND TOPICS emasser delete eMass REST API DELETE endpoint commands emasser get eMass REST API GET endpoint commands emasser post eMass REST API POST endpoint commands emasser put eMass REST API PUT endpoint commands COMMANDS emasser configure Generate a configuration file (.env) for accessing an eMASS instances. emasser version Display the eMASS API specification version the CLI implements. ``` [返回顶部](#emasser-client) ### 查看 (View) #### Heimdall 您可以使用 SAF CLI 启动本地 Heimdall Lite 实例来可视化您的发现结果。要启动实例，请使用 `saf view heimdall` 命令： ``` view heimdall Run an instance of Heimdall Lite to visualize your data USAGE $ saf view heimdall [-h] [-p ] [-f ] [-n] FLAGS -h, --help Show CLI help -f, --files=... File(s) to display in Heimdall -n, --noOpenBrowser Don't open the default browser automatically -p, --port= [default: 3000] Port To Expose Heimdall On (Default 3000) ALIASES $ saf heimdall EXAMPLES $ saf view heimdall -p 8080 ``` [返回顶部](#view-hdf-summaries-and-data) #### 摘要 (Summary) 要从一个 HDF 文件（按 profile name 分组）获取快速合规性摘要，请使用 `saf view summary` 命令： ``` view summary Get a quick compliance overview of an HDF file USAGE $ saf view summary -i <... [-o

] [-f json|yaml|markdown] [-s] [-r] [-t] [-l ] [-h] FORMATTING FLAGS -f, --format= [default: yaml] Specify output format -r, --[no-]print-pretty Enable human-readable data output -t, --[no-]title-table Add titles to the markdown table(s) HELP FLAGS -h, --help Show help information I/O FLAGS -i, --input=... (required) Specify input HDF file(s) -o, --output= Specify output file(s) -s, --[no-]stdout Enable printing to console DEBUGGING FLAGS -l, --logLevel= [default: info] Set log level ALIASES $ saf summary EXAMPLES Summarize 'input.hdf' single HDF file $ saf summary -i input.hdf Specify Formats $ saf summary -i input.hdf input.json --format=json Output GitHub Flavored Markdown Table, skip the console, and save to 'output.md $ saf summary -i input.hdf input.json --format=markdown --no-stdout -o output.md Summarize multiple HDF files $ saf summary --input input1.hdf --input input2.hdf $ saf summary --input input1.hdf input2.hdf Save summary to 'output.json' and print to the console $ saf summary -i input.hdf --output output.json Enable human-readable output $ saf summary --input input.hdf --pretty-print Useful for scripts or data-processing (RAW yaml/json/etc.) $ saf summary -i input.hdf --no-pretty-print ``` [返回顶部](#view-hdf-summaries-and-data) ### 验证 (Validate) #### 阈值 (Thresholds) 有关 👉 [模板文件](https://github.com/mitre/saf/wiki/Validation-with-Thresholds) 的更多信息，请参阅 wiki。 ``` validate threshold Validate the compliance and status counts of an HDF file USAGE $ saf validate threshold -i [-I | -T ] [-h] [-L info|warn|debug|verbose] FLAGS -i, --input= (required) The HDF JSON File to be validated by the threshold values -T, --templateFile= A threshold YAML file containing expected threshold values. Generate it using the "saf generate threshold" command -I, --templateInline= An inline (on the command line) flattened JSON containing the validation thresholds (Intended for backwards compatibility with InSpec Tools) GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES Providing a threshold template file $ saf validate threshold -i rhel7-results.json -T threshold.yaml Specifying the threshold inline $ saf validate threshold -i rhel7-results.json -I "{compliance.min: 80}, {passed.total.min: 18}, {failed.total.max: 2}" ``` [返回顶部](#validate-hdf-thresholds) ### 生成 (Generate) #### Delta 有关 👉 [Delta](https://github.com/mitre/saf/wiki/Delta) 的更多信息，请参阅 wiki。 ``` Update an existing InSpec profile with updated XCCDF guidance USAGE $ saf generate delta [-h] [-L info|warn|debug|verbose] [-J | --interactive] [-X | -U ] [-o | ] [-O | ] [-r | ] [-T rule|group|cis|version | ] [-M -c ] FLAGS -J, --inspecJsonFile= InSpec Profile Controls JSON summary file - can be generated using the "[cinc-auditor or inspec] json | jq . > profile.json" command -M, --runMapControls Run the approximate string matching process -O, --ovalXmlFile= The OVAL XML file containing definitions used in the new guidance - in the form of .xml file -T, --idType= [default: rule] Control ID Types: 'rule' - Vulnerability IDs (ex. 'SV-XXXXX'), 'group' - Group IDs (ex. 'V-XXXXX'), 'cis' - CIS Rule IDs (ex. C-1.1.1.1), 'version' - Version IDs (ex. RHEL-07-010020 - also known as STIG IDs) -U, --xccdfUrl= (required [-X or -U] or --interactive) The URL for the XCCDF package containing the new guidance (.zip, e.g., DISA STIG downloads) -X, --xccdfXmlFile= (required [-X or -U] or --interactive) The XCCDF File containing the new guidance (.xml or .zip) -c, --controlsDir= (required with -M or -J not provided) The InSpec profile directory containing the controls to update (controls Delta is processing) -o, --deltaOutputDir= (required if not --interactive) The output folder for the updated profile (this will contain the new controls modified by delta) - if it is not empty, it will be overwritten. -r, --reportFile= Output markdown report file - must have an extension of .md GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES Running the CLI interactively $ saf generate delta --interactive Providing a XCCDF (File), a Profile Controls Summary, and no Fuzzy matching) $ saf generate delta -X , -J -c -o , [options] Providing a XCCDF (URL), a Profile Controls Summary, and no Fuzzy matching) $ saf generate delta -U , -J -c -o , [options] Providing a XCCDF (File), a Profile Controls Summary, with Fuzzy matching) $ saf generate delta -X , -J -c -o , -M, [options] Providing a XCCDF (URL), a Profile Controls Summary, with Fuzzy matching) $ saf generate delta -U , -J -c -o , -M, [options] ``` [返回顶部](#generate-data-reports-and-more) #### Delta 支持选项 在运行 `generate delta` 之前使用此流程。该流程使用 XCCDF 指南提供的元数据更新控制，包括控制名称和编号。此外，它的格式化控制方式与 `generate delta` 相同。运行此流程可最大限度地减少 delta 输出内容，并有助于更好地可视化 Delta 流程提供的修改。 ``` USAGE $ saf generate update_controls4delta [-X | -U ] -c [-J ] [-P V|SV] [-g] [-f] [-b] [-h] [--interactive] [-L info|warn|debug|verbose] FLAGS -U, --xccdfUrl= (required [-X or -U]) The URL pointing to the XCCDF file containing the new guidance (DISA STIG downloads) -X, --xccdfXmlFile= (required [-X or -U]) The XCCDF XML file containing the new guidance - in the form of .xml file -c, --controlsDir= (required) The InSpec profile controls directory containing the profiles to be updated -J, --inspecJsonFile= Input execution/profile JSON file - can be generated using the "inspec json > profile.json" command. If not provided the `inspec` CLI must be installed -P, --controlPrefix= [default: V] Old control number prefix V or SV, default V -g, --[no-]useXccdfGroupId Use the XCCDF `Group Id` to rename the controls. Uses prefix V or SV based on controlPrefix option [default: false] -b, --[no-]backupControls Preserve modified controls in a backup directory (oldControls) inside the controls directory [default: true] -f, --[no-]formatControls Format control contents in the same way `generate delta` will write controls [default: true] GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES Providing an XCCDF File $ saf generate update_controls4delta -X ./the_xccdf_guidance_file.xml [-J ] [-c the_controls_directory --no-backupControls --no-formatControls -P -g -L debug] Providing an URL point to an ZIP XCCDF (from DISA STIG downloads) $ saf generate update_controls4delta -U [-J ] [-c the_controls_directory --no-backupControls --no-formatControls -P -g -L debug] ``` [返回顶部](#generate-data-reports-and-more) #### CKL 模板 Checklist 模板文件用于为 `saf convert hdf2ckl` 提供额外信息。 ``` generate ckl_metadata Generate a checklist metadata template for "saf convert hdf2ckl" USAGE $ saf generate ckl_metadata -o [-h] FLAGS -o, --output= (required) Output JSON File GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf generate ckl_metadata -o rhel_metadata.json ``` [返回顶部](#generate-data-reports-and-more) #### InSpec 元数据 InSpec 元数据文件用于为 `saf convert *2inspec_stub` 提供额外信息。 ``` generate inspec_metadata Generate an InSpec metadata template for "saf convert *2inspec_stub" USAGE $ saf generate inspec_metadata -o FLAGS -o, --output= (required) Output JSON File GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf generate inspec_metadata -o ms_sql_baseline_metadata.json ``` [返回顶部](#generate-data-reports-and-more) #### Inspec Profile ``` generate inspec_profile Generate a new skeleton profile based on a (STIG or CIS) XCCDF benchmark file USAGE $ saf generate inspec_profile -X [-O ] [-m ] [-T (rule|group|cis|version)] [-s] [-L (info|warn|debug|verbose)] [-h] [--interactive] FLAGS -X, --xccdfXmlFile= (required) Path to the XCCDF benchmark file -O, --ovalDefinitions= Path to an OVAL definitions file to populate profile elements that reference OVAL definitions -T, --idType= [default: rule] Control ID Types: 'rule' - Vulnerability IDs (ex. 'SV-XXXXX'), 'group' - Group IDs (ex. 'V-XXXXX'), 'cis' - CIS Rule IDs (ex. C-1.1.1.1), 'version' - Version IDs (ex. RHEL-07-010020 - also known as STIG IDs) -m, --metadata= Path to a JSON file with additional metadata for the inspec.yml The metadata Json is of the following format: {"maintainer": string, "copyright": string, "copyright_email": string, "license": string, "version": string} -o, --output= [default: profile] The output folder to write the generated InSpec content (defaults to profile if unable to translate xccdf title) -s, --singleFile Output the resulting controls as a single file GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) ALIASES $ saf generate xccdf_benchmark2inspec_stub EXAMPLES $ saf generate xccdf_benchmark2inspec_stub -X ./U_RHEL_6_STIG_V2R2_Manual-xccdf.xml -T group --logLevel debug -r rhel-6-update-report.md $ saf generate xccdf_benchmark2inspec_stub -X ./CIS_Ubuntu_Linux_18.04_LTS_Benchmark_v1.1.0-xccdf.xml -O ./CIS_Ubuntu_Linux_18.04_LTS_Benchmark_v1.1.0-oval.xml --logLevel debug ``` [返回顶部](#generate-data-reports-and-more) #### 阈值 (Thresholds) 阈值文件在持续集成 (CI) 中用于确保最低合规级别，并使用 `saf validate threshold` 验证控制严重性和状态 有关 👉 [模板文件](https://github.com/mitre/saf/wiki/Validation-with-Thresholds) 的更多信息，请参阅 wiki。 ``` generate threshold Generate a compliance template for "saf validate threshold". Default output states that you must have your current control counts or better (More Passes and/or less Fails/Skips/Not Applicable/No Impact/Errors) USAGE $ saf generate threshold -i [-o ] [-h] [-e] [-c] FLAGS -c, --generateControlIds Validate control IDs have the correct severity and status -e, --exact All counts should be exactly the same when validating, not just less than or greater than -i, --input= (required) Input HDF JSON File -o, --output= Output Threshold YAML File GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf generate threshold -i rhel7-results.json -e -c -o output.yaml ``` [返回顶部](#generate-data-reports-and-more) #### 电子表格 (csv/xlsx) 转 InSpec 您可以使用 `saf generate spreadsheet2inspec_stub` 从电子表格文件生成 InSpec profile stub。 ``` generate spreadsheet2inspec_stub Generate an InSpec profile stub from a CSV STIGs or CIS XLSX benchmarks USAGE $ saf generate spreadsheet2inspec_stub -i, --input= -o, --output=FOLDER OPTIONS -M, --mapping=mapping Path to a YAML file with mappings for each field, by default, CIS Benchmark fields are used for XLSX, STIG Viewer CSV export is used by CSV -c, --controlNamePrefix=controlNamePrefix Prefix for all control IDs -f, --format=cis|disa|general [default: general] -i, --input=input (required) -e, --encodingHeader Add the "# encoding: UTF-8" comment at the top of each control -l, --lineLength=lineLength [default: 80] Characters between lines within InSpec controls -m, --metadata=metadata Path to a JSON file with additional metadata for the inspec.yml file -o, --output=output (required) [default: profile] Output InSpec profile stub folder GLOBAL FLAGS -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES saf generate spreadsheet2inspec_stub -i spreadsheet.xlsx -o profile ``` [返回顶部](#generate-data-reports-and-more) ##### DoD Stub 与 CIS Stub 格式化 转换器支持 Stub 和 CIS 两种样式。`--format` 标志用于指定所需的输出格式。默认为 DoD Stub 格式。 - 将 `--format` 标志指定为 `cis` 或 `disa` 将分别根据 CIS Benchmark 导出和 DISA STIG 导出的标准格式解析输入电子表格。 - 您也可以使用 `general` 设置（默认值）来解析任意电子表格，但如果这样做，您必须通过 `--mapping` 标志提供一个映射文件，以便 `saf` 能够解析输入。 - 如果您提供非标准电子表格，则值的第一行将被假定为列标题。 [返回顶部](#generate-data-reports-and-more) #### 映射文件 映射文件是 YAML 文件，用于告诉 `saf` 应解析输入电子表格中的哪些列。映射文件的结构如下： ``` id: # Required - ID - "recommendation #" title: # Required - Title # You can give more than one column header as a value for an - title # attribute if you are not sure how it will be spelled in the input. desc: - Description - Discussion - description impact: 0.5 # If impact is set, its value will be used for every control desc.rationale: - Rationale - rationale statement desc.check: # Required - Audit - audit procedure desc.fix: - Remediation - remediation procedure desc.additional_information: # You can define arbitrary values under desc and tag - Additional Information # if you have extra fields to record desc.default_value: - Default Value ref: # InSpec keyword - saf will check this column for URLs (links to documentation) - References # and record each address as a ref attribute ``` 其中键（`title`）是 InSpec 控制属性，值（`- Title`）是输入电子表格中与该属性对应的列标题。 [返回顶部](#generate-data-reports-and-more) ### 补充 (Supplement) 补充（例如读取或修改）HDF 文件中提供上下文信息的元素，例如 `passthrough` 或 `target` #### Passthrough (透传) 补充（例如读取或修改）`passthrough` 元素，该元素在 Heimdall Data Format results JSON 文件中提供上下文信息 ``` EXAMPLE (combined read, modfication, and overwrite of the original file) $ saf supplement passthrough read -i hdf_with_passthrough.json | jq -rc '.key = "new value"' | xargs -0 -I{} saf supplement passthrough write -i hdf_with_passthrough.json -d {} ``` Passthrough 数据可以是任何上下文/结构。请参阅下面的示例或访问 👉 [使用附加信息补充 HDF 文件](https://github.com/mitre/saf/wiki/Supplement-HDF-files-with-additional-information-(ex.-%60passthrough%60,-%60target%60)) ``` { "CDM": { "HWAM": { "Asset_ID_Tattoo": "arn:aws:ec2:us-east-1:123456789012:instance/i-12345acbd5678efgh90", "Data_Center_ID": "1234-5678-ABCD-1BB1-CC12DD34EE56FF78", "FQDN": "i-12345acbd5678efgh90.ec2.internal", "Hostname": "i-12345acbd5678efgh90", "ipv4": "10.0.1.25", "ipv6": "none defined", "mac": "02:32:fd:e3:68:a1", "os": "Linux", "FISMA_ID": "ABCD2C21-7781-92AA-F126-FF987CZZZZ" }, "CSM": { "Server_Type": "member server", "source_tool": "InSpec" } } } ``` [返回顶部](#enhance-and-supplement-hdf-data) ##### 读取 ``` supplement passthrough read Read the `passthrough` attribute in a given Heimdall Data Format JSON file and send it to stdout or write it to a file USAGE $ saf supplement passthrough read -i [-o ] FLAGS -i, --input= (required) An input HDF file -o, --output= An output `passthrough` JSON file (otherwise the data is sent to stdout) GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf supplement passthrough read -i hdf.json -o passthrough.json ``` [返回顶部](#enhance-and-supplement-hdf-data) ##### 写入 ``` supplement passthrough write Overwrite the `passthrough` attribute in a given HDF file with the provided `passthrough` JSON data USAGE $ saf supplement passthrough write -i (-f | -d ) [-o ] FLAGS -d, --passthroughData= Input passthrough-data (can be any valid JSON); this flag or `passthroughFile` must be provided -f, --passthroughFile= An input passthrough-data file (can contain any valid JSON); this flag or `passthroughData` must be provided -i, --input= (required) An input Heimdall Data Format file -o, --output= An output Heimdall Data Format JSON file (otherwise the input file is overwritten) GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) DESCRIPTION Passthrough data can be any context/structure. See sample ideas at [https://github.com/mitre/saf/wiki/Supplement-HDF-files-with-additional-information-(ex.-%60passthrough%60,-%60target%60)#:~:text=Settings-,Supplement%20HDF%20files%20with%20additional%20information,-(ex.%20%60passthrough%60%2C%20%60target](https://github.com/mitre/saf/wiki/Supplement-HDF-files-with-additional-information-(ex.-%60passthrough%60,-%60target%60)) EXAMPLES Providing passthrough-data $ saf supplement passthrough write -i hdf.json -d '{"a": 5}' Using passthrough-data file $ saf supplement passthrough write -i hdf.json -f passthrough.json -o new-hdf.json ``` [返回顶部](#enhance-and-supplement-hdf-data) #### Target (目标) 补充（例如读取或修改）`target` 元素，该元素在 Heimdall Data Format results JSON 文件中提供上下文信息 ``` EXAMPLE (combined read, modfication, and overwrite of the original file) $ saf supplement target read -i hdf_with_target.json | jq -rc '.key = "new value"' | xargs -0 -I{} saf supplement target write -i hdf_with_target.json -d {} ``` Passthrough 数据可以是任何上下文/结构。请参阅下面的示例或访问 👉 [使用附加信息补充 HDF 文件](https://github.com/mitre/saf/wiki/Supplement-HDF-files-with-additional-information-(ex.-%60passthrough%60,-%60target%60)) ``` { "AWS":{ "Resources":[ { "Type":"AwsEc2Instance", "Id":"arn:aws:ec2:us-east-1:123456789012:instance/i-06036f0ccaa012345", "Partition":"aws", "Region":"us-east-1", "Details":{ "AwsEc2Instance":{ "Type":"t2.medium", "ImageId":"ami-0d716eddcc7b7abcd", "IpV4Addresses":[ "10.0.0.27" ], "KeyName":"rhel7_1_10152021", "VpcId":"vpc-0b53ff8f37a06abcd", "SubnetId":"subnet-0ea14519a4ddaabcd" } } } ] } } ``` [返回顶部](#enhance-and-supplement-hdf-data) ##### 读取 ``` supplement target read Read the `target` attribute in a given Heimdall Data Format JSON file and send it to stdout or write it to a file USAGE $ saf supplement target read -i [-o ] FLAGS -i, --input= (required) An input HDF file -o, --output= An output `target` JSON file (otherwise the data is sent to stdout) GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) EXAMPLES $ saf supplement target read -i hdf.json -o target.json ``` [返回顶部](#enhance-and-supplement-hdf-data) ##### 写入 ``` supplement target write Overwrite the `target` attribute in a given HDF file with the provided `target` JSON data USAGE $ saf supplement target write -i (-f | -d ) [-o ] FLAGS -d, --targetData= Input target-data (can be any valid JSON); this flag or `targetFile` must be provided -f, --targetFile= An input target-data file (can contain any valid JSON); this flag or `targetData` must be provided -i, --input= (required) An input Heimdall Data Format file -o, --output= An output Heimdall Data Format JSON file (otherwise the input file is overwritten) GLOBAL FLAGS -h, --help Show CLI help -L, --logLevel= [default: info] Specify level for logging (if implemented by the CLI command) --interactive Collect input tags interactively (not available on all CLI commands) DESCRIPTION Target data can be any context/structure. See sample ideas at https://github.com/mitre/saf/wiki/Supplement-HDF-files-with-additional-information-(ex.-%60passthrough%60,-%60target%60) EXAMPLES Providing target-data $ saf supplement target write -i hdf.json -d '{"a": 5}' Using target-data file $ saf supplement target write -i hdf.json -f target.json -o new-hdf.json ``` [返回顶部](#enhance-and-supplement-hdf-data) # 作者 - Author:: Will Dower [wdower](https://github.com/wdower) - Author:: Ryan Lin [Rlin232](https://github.com/rlin232) - Author:: Amndeep Singh Mann [Amndeep7](https://github.com/amndeep7) - Author:: Camden Moors [camdenmoors](https://github.com/camdenmoors) - Author:: Emily Rodriguez [em-c-rod](https://github.com/em-c-rod) - Author:: George Dias [georgedias](https://github.com/georgedias)

标签：Anchore, ASFF, Burp Suite, DevSecOps, GNU通用公共许可证, GPT, HDF, Heimdall, InSpec, MITM代理, MITRE, Node.js, Ruby, Web截图, XCCDF, 上游代理, 威胁建模, 安全可视化, 容器安全, 开源框架, 持续集成, 数据转换, 测试覆盖率, 漏洞管理, 知识库, 自动化攻击, 自动化攻击, 请求拦截