mtnmunuklu / bavul

Collects and stores vulnerability information

Bavul _{(Be aware of vulnerabilities)}

Bavul is a project that collects and stores vulnerability information. It utilizes Golang, Docker, Kubernetes, Fiber, Traefik, gRPC, and Protocol Buffers technologies.

Table of Contents

• Features
• Setup
• Usage
• Sponsors
• License

Features

Bavul offers the following features:

• Collect and store vulnerability information from various sources
• API service for retrieving vulnerability information
• Authentication service for user access and management
• Vulnerability service for handling and analyzing security vulnerabilities

Setup

To set up bavul, follow these steps:

1. Download the latest version:

   LATEST_VERSION=$(wget -qO - https://api.github.com/repos/mtnmunuklu/bavul/releases/latest \
   | grep tag_name \
   | cut -d  '"' -f 4)
   
   curl -LJO https://github.com/mtnmunuklu/bavul/archive/refs/tags/$LATEST_VERSION.tar.gz
   

2. Extract the downloaded file:

   FILE_NAME=bavul-$(echo $LATEST_VERSION | cut -d 'v' -f 2)
   tar -xvf $FILE_NAME.tar.gz
   

3. Execute the setup scripts:

   cd $FILE_NAME/scripts
   # Execute on worker and control plane servers.
   bash tools/setup_tools.sh
   bash k8s/setup_k8s.sh
   # Execute only on the first control plane server.
   # It will create setup_k8s_control_plane.sh and setup_k8s_worker.sh files.
   # Control plane and worker scripts are for joining the Kubernetes cluster.
   # You can use these scripts on new nodes when you add new nodes as control plane or worker.
   bash k8s/cp/setup_k8s_first_control_plane.sh
   # Execute only on first control plane server.
   bash setup_bavul.sh
   

Usage

Bavul consists of 4 different services: vulnerability, authentication, api, and web. Unlike the other services, incoming requests to the web service are directly routed without passing through the API service. The requested URL plays a role in the decision-making process.

To understand the features of each service, the available endpoints, how to make requests, and the expected responses, refer to the swagger.yml file under the docs folder.

You can also access the documents describing the software structure of each service under the docs folder.

Sponsors

We would like to express our gratitude to the following sponsors for their generous support:

If you are interested in becoming a sponsor, please visit our GitHub Sponsors page.

License

Bavul is licensed under the MIT License. See LICENSE for the full text of the license.

bavul's Issues

SearchCVE Issue

Issue Description

As a user, I would like to be able to search for CVEs using specific criteria to filter and find relevant information.

Expected Behavior

I expect the SearchCVE feature to allow me to search for CVEs based on cve id, severity, product, vendor, and other relevant criteria. The results should be accurate and provide the information I need.

Additional Information

This feature would be particularly useful for security analysts and administrators who need to quickly identify and address vulnerabilities in their systems.

Implementation Suggestions (if applicable)

It would be beneficial if the search functionality includes options for date range filtering and supports case-insensitive matching for product and vendor names.

Additional Notes

This feature would greatly improve the usability of the application, and I believe it aligns well with the needs of users who regularly work with CVE data.