Compliance Airgap avec l’API en PowerShell

Les scripts de Compliance Airgap nécessite de s’authentifier en suivant cette procédure.

N.B Compliance Airgap ne fonctionne qu’avec des actifs déjà existant dans Cyberwatch.

Dans le cas où le certificat TLS du serveur Cyberwatch ne peut être reconnu par la machine sur laquelle est exécuté ce script, il est nécessaire d’exécuter le snippet de code suivant en amont dans le script :

add-type @"
    using System.Net;
    using System.Security.Cryptography.X509Certificates;
    public class TrustAllCertsPolicy : ICertificatePolicy {
        public bool CheckValidationResult(
            ServicePoint srvPoint, X509Certificate certificate,
            WebRequest request, int certificateProblem) {
            return true;
        }
    }
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy

Scripts Compliance Airgap + Fonctionnement

Récupérer le script de téléchargement Compliance Airgap et le script de Upload, remplir les variables $API_URL et $CREDENTIALS.
Après avoir exécuté le script de téléchargement, un dossier compliance_scripts est créé qui contient les scripts pour générer des résultats.
Pour exécuter les scripts, vous devez déplacer le dossier lui-même vers l’actif que vous souhaitez analyser et exécuter le script run. Pour éviter tout risque d’exécution d’un script indésirable, prenez le dossier lui-même, et pas seulement son contenu.
Linux: bash ./compliance.sh > result.txt
PowerShell: .\compliance.ps1 | Out-File -Encoding ASCII -FilePath result.txt
N.B Cela créera un fichier result.txt avec le résultat. Ensuite, déplacez result.txt vers un dossier uploads sur le système avec le script d’upload.
Envoyer les résultats des scripts présents dans le dossier uploads avec le script de Upload.

Script de téléchargement Compliance Airgap

# -------------------------------------
# CONFIGURATION
# Please check and complete these items
# -------------------------------------

$API_URL = ""
$CREDENTIALS = "access_key:secret_key"

# -------------------------
# RUN
# -------------------------

$encodedCreds = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes($CREDENTIALS))

$os = Read-Host -Prompt "Input the OS for scripts (from $API_URL/cbw_assets/os), ex : 'windows_10_21h1_64'"
$repository = Read-Host -Prompt "Input one Repository to fetch, ex : 'CIS_Benchmark'"
Function FetchImporterScripts {
  <#
.SYNOPSIS
        Example script to fetch Compliance Airgap scripts
#>

  Write-Output "-------------------------------------------"
  Write-Output "Cyberwatch - Fetch Compliance Airgap scripts"
  Write-Output "-------------------------------------------"

  # Test the client connection
  Write-Output "INFO: Checking API connection and credentials..."
  try {
    $response = Invoke-WebRequest -URI $API_URL/api/v3/ping -Method Get -Headers @{
      "Accept"      = "application/json; charset=utf-8"
      Authorization = "Basic $encodedCreds"
    }

    $response.Content
  }
  catch {
    Write-Output "ERROR: Connection failed. Please check the following error message : '$_'"
    Return
  }

  # Clean old files
  Write-Output "INFO: Cleaning old files..."
  Remove-Item -LiteralPath ".\compliance_scripts" -Force -Recurse -ErrorAction Ignore
  Write-Output "INFO: Done."

  # Create the base folders
  New-Item -path ".\compliance_scripts" -Force -ItemType Directory | Out-Null
  New-Item -path ".\uploads" -Force -ItemType Directory | Out-Null

  # Fetch available scanning scripts from the API
  Write-Output "INFO: Fetching filtered compliance scripts..."
  Write-Output "$API_URL/api/v2/compliances/scripts?os=$os&repositories%5B%5D=$repository"
  $response = Invoke-RestMethod -URI "$API_URL/api/v2/compliances/scripts?os=$os&repositories%5B%5D=$repository" -Method Get -Headers @{
    "Accept"      = "application/json; charset=utf-8"
    Authorization = "Basic $encodedCreds"
  }

  # Fetch content of each scripts and attachments
  $response | ForEach-Object {
    Write-Output "INFO: Fetching content for '$($_.code)' ..."
    $scanning_script = ($_)
    $scanning_script_path = ".\compliance_scripts\"+$scanning_script.filename.ToLower().replace("::", "\")
    Write-Output $scanning_script.filename
    $scanning_script.script_content | New-Item -path $scanning_script_path -Force -ItemType File | Out-Null 
    Write-Output "INFO: Script saved at $($(Resolve-Path -Path $scanning_script_path).Path)."
  }

  Write-Output "---------------------------------------------------------------------"
  Write-Output "Script completed!"
  Write-Output "To continue, please now:"
  Write-Output "1) Run the fetched scripts with 'compliance.ps1' or 'compliance.sh' on the targeted systems"
  Write-Output "2) Put the results of the scripts as TXT files in the 'upload' folder"
  Write-Output "3) Run the compliance 'upload' script"
  Write-Output "---------------------------------------------------------------------"

}

FetchImporterScripts

Script d’upload Compliance Airgap

# -------------------------------------
# CONFIGURATION
# Please check and complete these items
# -------------------------------------

$API_URL = ""
$CREDENTIALS = "access_key:secret_key"

# -------------------------
# RUN
# -------------------------

Write-Output "-------------------------------------------"
Write-Output "Cyberwatch - Send Compliance Airgap results for analysis"
Write-Output "-------------------------------------------"

$encodedCreds = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes($CREDENTIALS))

Function SendResultsImporter {
    <#
.SYNOPSIS
        Example script to send Compliance Airgap scripts results
#>

    try {
        $response = Invoke-WebRequest -URI $API_URL/api/v3/ping -Method Get -Headers @{
            "Accept"      = "application/json; charset=utf-8"
            Authorization = "Basic $encodedCreds"
        }

        $response.Content
    }
    catch {
        Write-Output "ERROR: Connection failed. Please check the following error message : '$_'"
        Return
    }

    # Load results and send them to Cyberwatch
    Write-Output "INFO: Searching for available results..."
    $available_results = Get-ChildItem -Recurse -File -Path ".\uploads"
    Write-Output "INFO: Done. Found $($available_results.count) results to be processed and sent for analysis."

    $available_results | ForEach-Object {
        Write-Output "INFO: Reading $($_.FullName) content..."
        $content = [IO.File]::ReadAllText($_.FullName)
        Write-Output "INFO: Sending $($_.FullName) content to the API..."
        $body_content = @{ output = $content } | ConvertTo-Json
        $response = Invoke-WebRequest -URI $API_URL/api/v2/compliances/scripts -Method POST -Body $body_content -Headers @{
            "Accept"      = "application/json; charset=utf-8"
            "Content-Type" = "application/json"
            Authorization = "Basic $encodedCreds"
        }
        Write-Output "INFO: Done."
    }

    Write-Output "---------------------------------------------------------------------"
    Write-Output "Script completed!"
    Write-Output "Your scans are now being processed by your Cyberwatch nodes."
    Write-Output "Please log on $API_URL to see the results."
    Write-Output "---------------------------------------------------------------------"

}

SendResultsImporter