aquasecurity / community

Aqua Security's open source community

Welcome to the Aqua Open Source Community

The following section provides an overview of our community and resources as well as ways that you can get involved.

Please make sure that you follow the Code of Conduct in any interaction with the Aqua Open Source community, employees, and other stakeholder.

The Code of Conduct has been adopted from

Our main projects

Trivy is a comprehensive and versatile security scanner. Trivy supports different scanners (things is can find) as well as targets (things is can scan).

Tracee is a runtime security and forensics tool. It uses Linux eBPF technology to trace your system and give you insight into it's behavior.

While these are the top-level initiatives we have, contribution might be needed in supporting repositories. For example in trivy-db for Trivy or in libbpfgo for Tracee.

Office Hours

We are hosting monthly office hours. You can find more details under the following links:

• Trivy

How you can get involved

A good way to start is to first familiarize yourself with the project, take some time to assimilate within the community, and engage in issues and discussions. Contributions might be in the form of:

• Engaging with the community, asking ans answering questions, testing and providing feedback.
• Creating content, for example, improving documentation, creating tutorials, speaking and advocating about the projects elsewhere.
• Contributing code, fixing bugs and creating new features.

When you want to make a contribution, start by searching for existing issues or discussions which need help (look for the good-first-issue and help-wanted label), or create an issue if needed.
The documentation of Trivy and Tracee does have "contributing" sections for helping you get started with either project specifically.

Discuss and learn more

• GitHub Discussions: Ask for help and support, Discuss code development and ideation, read announcements. In any of the major repositories, you'll find a "Discussions" tab.
• GitHub Issues: Report Bugs, request features.
• Aqua Open Source Slack Channel: General discussion, engage with the community and maintainers, any topic you're unsure if or where to post. Aqua OSS Slack.
• Aqua Open Source YouTube Channel: We post regularly short videos covering feature highlights and tutorials. Please like/sub/comment Aqua OSS YouTube.
• Newsletter: We post a monthly newsletter covering news and updates about our open source projects. The update is originally posted on @itaysk's Twitter, and you can also subscribe to receive it in email.
• Twitter: Our team is on Twitter. Follow us to get a more personal connection and more insights about our work. Here's a list of maintainers and Twitter handles.

Contributor Highlights

🏛️ Hall of Fame

Our Contributors

Trivy

Tracee

tfsec

Made with contrib.rocks.

community's Issues

Simple Kubernetes vulnerability scanner based on Trivy

Does an issue related to this integration already exists in the project's repository? If so, please reuse the existing issue.

Is this integration generally valuable to the project and should be discussed in the project's repository? If so, please open the issue in the project's repository instead.

Please describe the integration you propose:
A simple tool named kubevscan which scans Kubernetes cluster's containers for vulnerabilities using Trivy.

What are you integrating with?

Please a link to the other party's repository or website:

Where are you going to implement this integration? please provide a link to the place where the code will reside (if this is going to be a PR to an Aqua project, then please open this issue there instead):
https://github.com/nonstandardlogic/kubevscan

Summarizing Trivy's findings with Pandas and Matplolib

Please describe the integration you propose:
This python scripts uses matplotlib and pandas to summarize trivy's output and produce a png file with a pie chart with findings grouped by severity.

What are you integrating with?
Matplotlib and Pandas (Python) to produce a pie chart of findings

Where are you going to implement this integration?
https://github.com/AlfredoPardo/python-for-devsecops/blob/main/analyzing-processing-transforming/process_data.py

Errors solved

What is the title of your production?

What category best describes this content? (see here for explanation)
Introduction / Review / Tutorial / Case study

What kind of media you are producing?
Written article (or blog post) / Video / Podcast / else (Detailed)

How will your work be viewable to the world? Where are you going to post it? (e.g YouTube, Medium, Company blog, Personal blog, twitch, etc.)

Additional information:

Submitting Kube-Bench Information to Apache Superset (PostgreSQL)

Please describe the integration you propose:
The purpose of this script is to parse Kube-bench's master and worker node outputs and submit them to a PostgreSQL Database to be used in Apache Superset

What are you integrating with?
Apache Superset

Please a link to the other party's repository or website:
The demo of this script in action can be seen here: https://youtu.be/Mp8ruNtx_HY?t=1949

Where are you going to implement this integration?
https://github.com/AlfredoPardo/devsecops/blob/master/kubernetes-configurations/kube-bench-to-superset.py

Review of Trivy compared to Anchor-Engine and Clair

What is the title of your production?
Docker Image Security: Static Analysis Tool Comparison – Anchore Engine vs Clair vs Trivy

What category best describes this content?
Review

What kind of media you are producing?
Written article

How will your work be viewable to the world?
It is currently in my personal blog: https://www.a10o.net/devsecops/docker-image-security-static-analysis-tool-comparison-anchore-engine-vs-clair-vs-trivy/

Additional information:
You can find additional information on how to run these tools in my GitHub: https://github.com/AlfredoPardo/devsecops/tree/master/container_static_analysis

Issues with links in contrib-content.md and contrib-integrations.md files

The initial contrib-content.md and contrib-integrations.md files have a few issues with broken links.

They are:

• The anchor link to the external contributions section of the readme is broken (it has an extra .md at the end of the link)
• The example links are to files that don't exist when they appear to be meant to link to the file being looked at
• The table header that links to the help section of the readme with the list of repositories to focus only has the last word ('projects') clickable as a link

Sending Trivy Information to Apache Superset (PostgreSQL)

Please describe the integration you propose:
The purpose of this script is to parse Trivy's output and submit it to a PostgreSQL Database to be used in Apache Superset

What are you integrating with?
Apache Superset

Please a link to the other party's repository or website:
The demo of this script in action can be seen here: https://youtu.be/Mp8ruNtx_HY?t=1917

Where are you going to implement this integration?
https://github.com/AlfredoPardo/python-for-devsecops/tree/main/centralizing-information

package starboard for nix/nixOS in nixpkgs

package starboard for nix/nixOS in nixpkgs

issue created as per aquasecurity/Hacktoberfest requirements

Is this integration generally valuable to the project and should be discussed in the project's repository? If so, please open the issue in the project's repository instead.

Resolved by NixOS/nixpkgs#99412

---

Starboard is now in nixpkgs on master, I'm happy to close the issue now or if you'd prefer we can close this once it hits unstable (a more commonly used release channel) or a stable release

Hacktoberfest at Aqua Security

Dear community, we appreciate you and your contribution to the success of our open source projects! In celebration of Hacktoberfest, we would like to extend our appreciation and reward your hard work. This repository is participating in Aqua Security 2020 Hacktoberfest campaign. For full details and guidelines please visit the official repo: Hacktoberfest at Aqua Security.

Adding badges in Readme.md

I would like to add some badges like hacktoberfest, opensource in readme,md to make it a bit more beautiful.

Producing an HTML Report from Trivy

Please describe the integration you propose:
The purpose of this script is to parse trivy's output and produce an HTML report using pyjade and jinja2

What are you integrating with?
Pyjade and Jinja2 for an HTML report

Please a link to the other party's repository or website:

Where are you going to implement this integration?
The script is hosted here and the template here