From 48a8868ebca8f271f79d087ec84e02ed895c96f5 Mon Sep 17 00:00:00 2001 From: nikpivkin Date: Wed, 30 Oct 2024 12:21:06 +0600 Subject: [PATCH 1/2] docs: add example of creating whitelist of checks Signed-off-by: nikpivkin --- docs/docs/configuration/filtering.md | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/docs/docs/configuration/filtering.md b/docs/docs/configuration/filtering.md index 22fbe2d7a24d..bdd4d35207c8 100644 --- a/docs/docs/configuration/filtering.md +++ b/docs/docs/configuration/filtering.md @@ -483,7 +483,25 @@ trivy image --ignore-policy contrib/example_policy/basic.rego centos:7 For more advanced use cases, there is a built-in Rego library with helper functions that you can import into your policy using: `import data.lib.trivy`. More info about the helper functions are in the library [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go). -You can find more example checks [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go) +You can find more example checks [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/contrib/example_policy). + +You can also create a whitelist of checks using Rego. The policy below ignores all checks that are not allowed: + +```rego +package trivy + +import rego.v1 + +allowed_checks := { + "AVD-AWS-0089" +} + +default ignore := false + +ignore if not is_check_allowed + +is_check_allowed if input.AVDID in allowed_checks +``` ### By Vulnerability Exploitability Exchange (VEX) | Scanner | Supported | From 3e723711e8ebff02f56d8da1984d52c3ac08dd03 Mon Sep 17 00:00:00 2001 From: nikpivkin Date: Thu, 31 Oct 2024 13:29:11 +0600 Subject: [PATCH 2/2] move example to file Signed-off-by: nikpivkin --- docs/docs/configuration/filtering.md | 22 ++----------------- .../ignore-policies}/advanced.rego | 0 .../ignore-policies}/basic.rego | 0 examples/ignore-policies/whitelist.rego | 13 +++++++++++ 4 files changed, 15 insertions(+), 20 deletions(-) rename {contrib/example_policy => examples/ignore-policies}/advanced.rego (100%) rename {contrib/example_policy => examples/ignore-policies}/basic.rego (100%) create mode 100644 examples/ignore-policies/whitelist.rego diff --git a/docs/docs/configuration/filtering.md b/docs/docs/configuration/filtering.md index bdd4d35207c8..095e5c3bb559 100644 --- a/docs/docs/configuration/filtering.md +++ b/docs/docs/configuration/filtering.md @@ -477,31 +477,13 @@ ignore { ``` ```bash -trivy image --ignore-policy contrib/example_policy/basic.rego centos:7 +trivy image --ignore-policy examples/ignore-policies/basic.rego centos:7 ``` For more advanced use cases, there is a built-in Rego library with helper functions that you can import into your policy using: `import data.lib.trivy`. More info about the helper functions are in the library [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go). -You can find more example checks [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/contrib/example_policy). - -You can also create a whitelist of checks using Rego. The policy below ignores all checks that are not allowed: - -```rego -package trivy - -import rego.v1 - -allowed_checks := { - "AVD-AWS-0089" -} - -default ignore := false - -ignore if not is_check_allowed - -is_check_allowed if input.AVDID in allowed_checks -``` +You can create a whitelist of checks using Rego, see the detailed [example](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/examples/ignore-policies/whitelist.rego). Additional examples are available [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/examples/ignore-policies). ### By Vulnerability Exploitability Exchange (VEX) | Scanner | Supported | diff --git a/contrib/example_policy/advanced.rego b/examples/ignore-policies/advanced.rego similarity index 100% rename from contrib/example_policy/advanced.rego rename to examples/ignore-policies/advanced.rego diff --git a/contrib/example_policy/basic.rego b/examples/ignore-policies/basic.rego similarity index 100% rename from contrib/example_policy/basic.rego rename to examples/ignore-policies/basic.rego diff --git a/examples/ignore-policies/whitelist.rego b/examples/ignore-policies/whitelist.rego new file mode 100644 index 000000000000..51a75c37c72f --- /dev/null +++ b/examples/ignore-policies/whitelist.rego @@ -0,0 +1,13 @@ +package trivy + +import rego.v1 + +allowed_checks := { + "AVD-AWS-0089" +} + +default ignore := false + +ignore if not is_check_allowed + +is_check_allowed if input.AVDID in allowed_checks \ No newline at end of file