Convert Microsoft Secure Score to OHDF #6007

meme112233 · 2024-07-18T03:23:45Z

This PR introduces the converter for Microsoft SecureScore to OHDF.

Mapping is performed using the output of two Microsoft Graph API endpoints:

https://graph.microsoft.com/v1.0/security/secureScores
- This contains the report of the security assessment
https://graph.microsoft.com/v1.0/security/secureScoreControlProfiles
- This contains the details of (many, but not all) the controls evaluated as part of the security assessment

The mapper takes the output of the two endpoints as a single json document. Each document is included as an object under the keys profiles and secureScore.

{
   "secureScore":  <The full text of the secureScore endpoint output as JSON object>,
   "profiles":  <The full text of the secureScoreControlProfiles endpoint output as JSON object>
}

This combined file can be built with jq

jq -s '{"secureScore": .[0], "profiles": .[1]}' secureScore.json profiles.json

Sample combined secureScore/profiles document for testing:
combined_msft.json

Mapper design decisions of interest

impact: Derived from the maxScore of the Profile matching the controlName
- When no matching Profile is found, a default impact of 0.5 is used
status:
- success:
  - scoreInPercentage === 100
  - score === max value from maxScore field of any matching Profile
- error:
  - score field is undefined (per API, should never happen)
- fail:
  - any other condition
tags
- groups
  - controlCategory field from any matching Profiles
- threats
  - threat field from any matching Profiles

A matching PR for the SAF-CLI is expected early next week that will support:

CLI conversion of combined secureScore endpoints to OHDF.
- Starting with pre-downloaded REST endpoint outputs
- Starting from Graph API credentials

…a UX

libs/hdf-converters/src/msft-config-mapper.ts

ejaronne · 2024-07-18T21:03:33Z

Profiles.value.title: recommend for controls.title
Perhaps the Impact should be based on Profiles.value.userImpact instead of Profiles.value.maxScore? I can't yet find the Microsoft documentation that explains the difference between these. Impact is intended to be the relative danger should this control be in a failed state.
Remediation: seems like a perfect opportunity as descriptions:[data:””, label:”fix”]
RemediationImpact: seems like a perfect opportunity as descriptions:[data:””, label:”rationale”]

libs/hdf-converters/src/msft-config-mapper.ts

charleshu-8

Part 1 of review, will look at mapper proper later.

libs/hdf-converters/package.json

libs/hdf-converters/test/mappers/forward/msft_secure_score_mapper.spec.ts

…from MSFT)

… out code

…tags, add passthrough partial wroking

libs/hdf-converters/src/msft-secure-score-mapper.ts

This reverts commit 8a003c8.

Signed-off-by: Charles Hu <[email protected]>

libs/hdf-converters/src/msft-secure-score-mapper.ts

…port in combined_input

combined_msft.json

libs/hdf-converters/src/msft-secure-score-mapper.ts

Signed-off-by: Amndeep Singh Mann <[email protected]>

…unction don't all need to do the search Signed-off-by: Amndeep Singh Mann <[email protected]>

sonarqubecloud · 2024-08-07T01:32:56Z

Quality Gate failed

Failed conditions
1 New Code Smells (required ≤ 0)

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint

* draft of the microsoftSecureScore converter * bugfix: reading of secureScoreProfiles doc needed field for the array * minor update map/filter * add threats to tags from profile matching controlScore * add testing and update status check to use scoreInPercentage * update testing and fingerprinting * update fingerprinting for accept combined msftSecureScore document via UX * lint fix * msft-config-mapper-2.ts renamed without 2, cleanup commented out code * code cleanup. delete unused code * tslint allow commented out code in test suite * revert jest version bump * revert package.json to minimal requirements being added (only typing from MSFT) * rename mapper for consistency. msft_secure_score_mapper * update test name and remove linting inline disble block for commented out code * rename files for org per PR comments * update tags. fix array of array issue. add tiers,services,userImpact tags, add passthrough partial wroking * bugfix: replace missed exports due to rename to MsftSecureScoreMapper * bugfix/ typo * console debugging * Revert "console debugging" This reverts commit 8a003c8. * Passthrough fix; minor styling changes Signed-off-by: Charles Hu <[email protected]> * actual sample msft secureScore.json test doc updated to have value: [] * bugfix/populate code with control data and optionally profiles data * Update libs/hdf-converters/src/msft-secure-score-mapper.ts Co-authored-by: Charles Hu <[email protected]> * remove 'summary' field as no value available * Update libs/hdf-converters/src/msft-secure-score-mapper.ts Co-authored-by: Charles Hu <[email protected]> * improve names of parameters in arrow functions * Update libs/hdf-converters/src/msft-secure-score-mapper.ts Co-authored-by: Charles Hu <[email protected]> * remove unuded profile.version field as no value known from Microsoft * code cleanup. remove unused import * lint and update test expected results * update test data * Missed argument name change Signed-off-by: Charles Hu <[email protected]> * Linting Signed-off-by: Charles Hu <[email protected]> * implementationStatus -> controls.results.code_desc, remediation -> descriptions. data/label fix , leave controls.code blank * update test data for changes to mapper * Update msft-secure-score-mapper.ts * lint fix and update test data * relocate NIST to be in tags * sort exports per PR comment * add Msft_Secure_mapper to supported formats README.md * typo fixed * add run_time to mapper. required for downstream transformations that require start and end times. * update delimeter on control title from ... to \n * rename tag: group->category in dederence to msft naming * utilize lodash.uniq for tag.threats[] * add profiles[].remediationImpact as descriptions[label:rationale] * add secure score to FileReader.vue * update merge of records by id/cat * fix rawdata passthrough * update profiles.title include runID * handle output readability better * track secureScoreControlProfile.rank as control.tag.rank * remove run_time * cleanup inports * lint fix * conditional includsion of tags * secureScoreResults used to output full OHDF report per secureScore report in combined_input * bugfix/ exports from msft-secure-score-mapper fixed * update exports msftSecureMapper * export MsftSecureScoreMapper * add unmapped fields as tags or passthrough data * update MsftSecureScoreResult type hints * update MsftSecureScoreResult type hints * add withRaw parameter to msft secure score results * use utils.global constants for default NIST tags * remove duplicate tag 'rank' * convert forEach to for ... of * convert forEach to map(..) * delete extra copy of combined_msft.json * lint fix * private keyword isn't that useful Signed-off-by: Amndeep Singh Mann <[email protected]> * memoized the getProfiles function so that the repeated calls to the function don't all need to do the search Signed-off-by: Amndeep Singh Mann <[email protected]> --------- Signed-off-by: Charles Hu <[email protected]> Signed-off-by: Amndeep Singh Mann <[email protected]> Co-authored-by: Charles Hu <[email protected]> Co-authored-by: Charles Hu <[email protected]> Co-authored-by: Eugene Aronne <[email protected]> Co-authored-by: Amndeep Singh Mann <[email protected]>

meme112233 added 10 commits July 17, 2024 16:36

draft of the microsoftSecureScore converter

dfdd047

bugfix: reading of secureScoreProfiles doc needed field for the array

2621d63

minor update map/filter

6bb8070

add threats to tags from profile matching controlScore

da00d81

add testing and update status check to use scoreInPercentage

074dd7a

update testing and fingerprinting

f9dd52f

update fingerprinting for accept combined msftSecureScore document vi…

3f12007

…a UX

lint fix

1a18d6b

msft-config-mapper-2.ts renamed without 2, cleanup commented out code

86592ed

code cleanup. delete unused code

62878a3

meme112233 commented Jul 18, 2024

View reviewed changes

libs/hdf-converters/src/msft-config-mapper.ts Outdated Show resolved Hide resolved

tslint allow commented out code in test suite

cca15a3

meme112233 mentioned this pull request Jul 18, 2024

Additions of Microsoft Secure Score Artifact Support for HDF Converters mitre/saf#2564

Closed

Amndeep7 requested changes Jul 18, 2024

View reviewed changes

libs/hdf-converters/src/msft-config-mapper.ts Outdated Show resolved Hide resolved

charleshu-8 reviewed Jul 19, 2024

View reviewed changes

meme112233 added 6 commits July 19, 2024 12:47

revert jest version bump

efb1109

revert package.json to minimal requirements being added (only typing …

f96258e

…from MSFT)

rename mapper for consistency. msft_secure_score_mapper

7842362

update test name and remove linting inline disble block for commented…

7cad9c8

… out code

rename files for org per PR comments

a88392e

update tags. fix array of array issue. add tiers,services,userImpact …

387fbf3

…tags, add passthrough partial wroking

meme112233 commented Jul 19, 2024

View reviewed changes

libs/hdf-converters/src/msft-secure-score-mapper.ts Outdated Show resolved Hide resolved

meme112233 and others added 5 commits July 19, 2024 17:04

bugfix: replace missed exports due to rename to MsftSecureScoreMapper

23b1171

bugfix/ typo

353519e

console debugging

8a003c8

Revert "console debugging"

f4f5120

This reverts commit 8a003c8.

Passthrough fix; minor styling changes

59bf07b

Signed-off-by: Charles Hu <[email protected]>

charleshu-8 reviewed Jul 22, 2024

View reviewed changes

Merge branch 'master' into meme-working

6b1b3e2

meme112233 added 14 commits August 5, 2024 16:50

track secureScoreControlProfile.rank as control.tag.rank

15c96a3

remove run_time

daa958a

cleanup inports

636d739

lint fix

309b657

conditional includsion of tags

d228148

secureScoreResults used to output full OHDF report per secureScore re…

13afed3

…port in combined_input

bugfix/ exports from msft-secure-score-mapper fixed

185aa41

update exports msftSecureMapper

98242f0

export MsftSecureScoreMapper

9668cdc

Merge branch 'master' into meme-working

a8f4e55

add unmapped fields as tags or passthrough data

ab6113e

update MsftSecureScoreResult type hints

0ddff07

update MsftSecureScoreResult type hints

83ce9c1

add withRaw parameter to msft secure score results

163ff01

Amndeep7 requested changes Aug 6, 2024

View reviewed changes

meme112233 and others added 8 commits August 6, 2024 14:32

use utils.global constants for default NIST tags

529ebcf

remove duplicate tag 'rank'

f18fd5d

convert forEach to for ... of

438dee0

convert forEach to map(..)

68ead45

delete extra copy of combined_msft.json

d8e142a

lint fix

b7b8080

private keyword isn't that useful

58357f7

Signed-off-by: Amndeep Singh Mann <[email protected]>

memoized the getProfiles function so that the repeated calls to the f…

710cdf4

…unction don't all need to do the search Signed-off-by: Amndeep Singh Mann <[email protected]>

Amndeep7 approved these changes Aug 7, 2024

View reviewed changes

Amndeep7 added the ready-to-merge Used by mergify to identify if a PR is ready to merge into master. label Aug 7, 2024

Merge branch 'master' into meme-working

3537d98

Amndeep7 merged commit f5c9fe4 into master Aug 7, 2024
8 of 9 checks passed

Amndeep7 deleted the meme-working branch August 7, 2024 01:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Convert Microsoft Secure Score to OHDF #6007

Convert Microsoft Secure Score to OHDF #6007

meme112233 commented Jul 18, 2024 •

edited by Amndeep7

Loading

ejaronne commented Jul 18, 2024

charleshu-8 left a comment

sonarqubecloud bot commented Aug 7, 2024

Convert Microsoft Secure Score to OHDF #6007

Convert Microsoft Secure Score to OHDF #6007

Conversation

meme112233 commented Jul 18, 2024 • edited by Amndeep7 Loading

Mapper design decisions of interest

ejaronne commented Jul 18, 2024

charleshu-8 left a comment

Choose a reason for hiding this comment

sonarqubecloud bot commented Aug 7, 2024

Quality Gate failed

meme112233 commented Jul 18, 2024 •

edited by Amndeep7

Loading