Skip to content

Commit e8fef33

Browse files
hans4devhans4dev
authored
feat: initial version
1 parent ecca15a commit e8fef33

9 files changed

+695
-0
lines changed

‎.gitignore

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
2+
# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
3+
4+
# Exclude dot-env file
5+
.env
6+
7+
# Exclude IntelliJ project settings
8+
.idea/
9+
10+
# User-specific stuff
11+
.idea/**/workspace.xml
12+
.idea/**/tasks.xml
13+
.idea/**/usage.statistics.xml
14+
.idea/**/dictionaries
15+
.idea/**/shelf
16+
17+
# AWS User-specific
18+
.idea/**/aws.xml
19+
20+
# Generated files
21+
.idea/**/contentModel.xml
22+
23+
# Sensitive or high-churn files
24+
.idea/**/dataSources/
25+
.idea/**/dataSources.ids
26+
.idea/**/dataSources.local.xml
27+
.idea/**/sqlDataSources.xml
28+
.idea/**/dynamic.xml
29+
.idea/**/uiDesigner.xml
30+
.idea/**/dbnavigator.xml
31+
32+
# Gradle
33+
.idea/**/gradle.xml
34+
.idea/**/libraries
35+
36+
# Gradle and Maven with auto-import
37+
# When using Gradle or Maven with auto-import, you should exclude module files,
38+
# since they will be recreated, and may cause churn. Uncomment if using
39+
# auto-import.
40+
# .idea/artifacts
41+
# .idea/compiler.xml
42+
# .idea/jarRepositories.xml
43+
# .idea/modules.xml
44+
# .idea/*.iml
45+
# .idea/modules
46+
# *.iml
47+
# *.ipr
48+
49+
# CMake
50+
cmake-build-*/
51+
52+
# Mongo Explorer plugin
53+
.idea/**/mongoSettings.xml
54+
55+
# File-based project format
56+
*.iws
57+
58+
# IntelliJ
59+
out/
60+
61+
# mpeltonen/sbt-idea plugin
62+
.idea_modules/
63+
64+
# JIRA plugin
65+
atlassian-ide-plugin.xml
66+
67+
# Cursive Clojure plugin
68+
.idea/replstate.xml
69+
70+
# SonarLint plugin
71+
.idea/sonarlint/
72+
73+
# Crashlytics plugin (for Android Studio and IntelliJ)
74+
com_crashlytics_export_strings.xml
75+
crashlytics.properties
76+
crashlytics-build.properties
77+
fabric.properties
78+
79+
# Editor-based Rest Client
80+
.idea/httpRequests
81+
82+
# Android studio 3.1+ serialized cache file
83+
.idea/caches/build_file_checksums.ser

‎Dockerfile

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
FROM python:3
2+
3+
LABEL org.opencontainers.image.title="OWASP DSOMM metricCA collector for confluence"
4+
LABEL org.opencontainers.image.source="https://github.com/devsecopsmaturitymodel/collector-confluence/"
5+
6+
COPY requirements.txt /app/requirements.txt
7+
RUN cd /app && pip install --target=./ --no-cache-dir -r requirements.txt
8+
COPY *.py /app
9+
COPY schemata /app
10+
11+
ENV CONFLUENCE_URL ""
12+
ENV CONFLUENCE_LOGIN ""
13+
ENV CONFLUENCE_PASSWORD ""
14+
15+
CMD "/app/confluence_collector.py"
16+

‎README.md

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# Collector for Confluence
2+
Collects meta-information about conducted threat modeling activities from Confluence wiki pages.
3+
4+
## Meta-information about a Threat Modeling Activity
5+
6+
In the OWASP Foundation community article (Nov 2023) [Threat Modeling Process](https://owasp.org/www-community/Threat_Modeling_Process#threat-model-information),
7+
lists following meta-information for a threat model:
8+
9+
> Information identifying the threat model typically includes the following:
10+
>
11+
> 1. Application Name: The name of the application examined.
12+
> 2. Application Version: The version of the application examined.
13+
> 3. Description: A high level description of the application.
14+
> 4. Document Owner: The owner of the threat modeling document.
15+
> 5. Participants: The participants involved in the threat modeling process for this application.
16+
> 6. Reviewer: The reviewer(s) of the threat model.
17+
18+
However, for the purpose of metric collection for DSOMM we adjusted our information demand to:
19+
20+
1. **Application Name**: The name of the application examined.
21+
2. **Team Name**: The name of the team that owns/maintains the application.
22+
3. **Title**: The title summarizing the scope or question of the threat modeling.
23+
4. **Date**: The date when the threat modeling activity was conducted.
24+
5. **Links**: The list of links to the _threat modeling document_ (main source)
25+
and to supplementary reference material like:
26+
- recorded drawings or pictures from physical/virtual whiteboards (e.g. Miro boards)
27+
- resulting tickets (e.g. JIRA issues)
28+
29+
See also:
30+
31+
* Blog "Let's Talk About MedSec" (24 Apr 2022): [Threat Modeling Knowledge Bases and Templates](https://tmart234.github.io/threat-model-template/)
32+
* GitHub Repository from [Izar Tarandach](https://owasp.org/www-board-candidates/2023/izar_tarandach): [izar/pytm](https://github.com/izar/pytm) :
33+
A Pythonic framework for threat modeling
34+
35+
## Quickstart
36+
Prerequisite: Python 3 must be installed.
37+
38+
### Installation
39+
Steps:
40+
41+
1. Clone the repository source-code
42+
2. Make sure all required packages are installed
43+
44+
Example:
45+
```shell
46+
git clone https://github.com/devsecopsmaturitymodel/collector-confluence.git
47+
cd collector-confluence
48+
pip install -r requirements.txt
49+
```
50+
51+
### Configuration
52+
We recommend to prepare a `.env` file and specify the confluence URL, account and credentials there.
53+
54+
Example file `.env` (with anonymized data):
55+
```
56+
CONFLUENCE_URL='https://example.atlassian.net/wiki' # change to your Confluence cloud URL
57+
CONFLUENCE_LOGIN='username@example.com' # change to your account name/email
58+
CONFLUENCE_PASSWORD='' # fill in your API token from your Atlassian profile
59+
```
60+
However, you can also set those environment-variables separately.
61+
In case both are present, the `.env` file and environment-variables, then the environment-variables are finally used.
62+
63+
### Run
64+
Run the Python executable script (e.g. on Linux and macOS):
65+
```shell
66+
./confluence_collector.py
67+
```

0 commit comments

Comments
 (0)