https://github.com/pluralsight/blackcat
Centralized reporting on GitHub dependency scanning outputs
https://github.com/pluralsight/blackcat
dependencies dependency-analysis devsecops github security security-automation security-scanner static-analysis
Last synced: 9 months ago
JSON representation
Centralized reporting on GitHub dependency scanning outputs
- Host: GitHub
- URL: https://github.com/pluralsight/blackcat
- Owner: pluralsight
- License: apache-2.0
- Archived: true
- Created: 2019-10-28T20:58:22.000Z (over 6 years ago)
- Default Branch: master
- Last Pushed: 2023-07-25T16:47:38.000Z (over 2 years ago)
- Last Synced: 2025-03-29T07:11:37.223Z (11 months ago)
- Topics: dependencies, dependency-analysis, devsecops, github, security, security-automation, security-scanner, static-analysis
- Language: Python
- Homepage:
- Size: 99.6 KB
- Stars: 4
- Watchers: 10
- Forks: 3
- Open Issues: 5
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
Awesome Lists containing this project
README
# BlackCat
🐈🎃 _Dependencies can be spooky!_ 🎃🐈
BlackCat is a tool for the centralization of github dependency scanning outputs, mainly through output to splunk, which allows for
better tracking and reporting at an organizational level using GitHub's dependency scanning functionality.
## Setup and Installation
### Configuration
Before you begin, There's a few pieces of information blackcat needs:
1. A github token for accessing dependencies. This will require `read:org` and `repo`
permissions on an account with visibility to your security vulnerabilities (likely an admin).
2. (Optional) A token for splunks' HTTP Event Collectors (HECs)
You should put these two items in the config.yml(see config.example.yml for reference) file, along with any other additional options
If you're using kubernetes, put these values in `k8s/secrets.yml` instead.
### Deployment Info
Now that you've configured BlackCat, it can be deployed in a few ways:
1. Using pythons' pipenv
2. Using Docker
3. Using kubernetes
#### Using Pipenv
1. Install pipenv: `pip install pipenv`
2. Install the dependencies (from within the project directory): `pipenv install`
3. Run the enable command (will enable dependency scans organization-wide, may be noisy):
`pipenv run python blackcat/main.py --enable`
3. Run: `pipenv run python blackcat/main.py`
#### Using Docker
1. Install docker
2. Build the image using `docker build -t blackcat:latest .`
3. Run the enable command (will enable dependency scans organization-wide, may be noisy):
`docker run blackcat:latest --enable`
4. Run the main command `docker run blackcat:latest`
#### Using Kubernetes
_This assumes a basic knowledge of kubernetes, as well as an existing cluster and registry._
1. Go through the steps described in the `Using Docker` section above and publish that image to your container registry
2. Modify `k8s-cron.spec` to run at whatever interval you want (Defaults to every day at 15:00:00)
3. Put your secrets in `secrets.yml` ([More Info](https://kubernetes.io/docs/concepts/configuration/secret/))
4. Run `kubectl apply -f ./k8s/secrets.yml`
5. Run `kubectl create -f ./k8s/k8s-cron.spec`
5. Run `kubectl create -f ./k8s/enabler-cron.spec`