diff --git a/code-scanning/fcs-container.yml b/code-scanning/fcs-container.yml new file mode 100644 index 0000000000..724031b943 --- /dev/null +++ b/code-scanning/fcs-container.yml @@ -0,0 +1,58 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# A sample workflow which checks out the code, builds a container +# image using Docker, and scans that image for vulnerabilities using +# CrowdStrike Falcon Cloud Security (FCS). The results are then +# uploaded to GitHub Security Code Scanning. +# +# To use this action, you will need a CrowdStrike API Client ID and Secret. +# See https://github.com/CrowdStrike/fcs-action#prerequisites for setup instructions. +# +# For more examples, see https://github.com/CrowdStrike/fcs-action + +name: CrowdStrike FCS Container Image Scanning + +on: + push: + branches: [ $default-branch, $protected-branches ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ $default-branch ] + schedule: + - cron: $cron-weekly + +permissions: + contents: read + +jobs: + fcs-container: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Build a Docker image + run: docker build -t your/image-to-test . + + - name: Run CrowdStrike FCS to check Docker image for vulnerabilities + uses: crowdstrike/fcs-action@0e9d7bba776ed4dc623f8d0c5f0888f36e090d90 + with: + falcon_client_id: ${{ vars.FALCON_CLIENT_ID }} + falcon_region: 'us-1' + scan_type: image + image: your/image-to-test + report_formats: sarif + output_path: ./fcs-container-results.sarif + env: + FALCON_CLIENT_SECRET: ${{ secrets.FALCON_CLIENT_SECRET }} + + - name: Upload result to GitHub Code Scanning + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: fcs-container-results.sarif diff --git a/code-scanning/fcs-iac.yml b/code-scanning/fcs-iac.yml new file mode 100644 index 0000000000..4f37c603df --- /dev/null +++ b/code-scanning/fcs-iac.yml @@ -0,0 +1,57 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# A sample workflow which checks out your Infrastructure as Code configuration files, +# and scans them for security issues using CrowdStrike Falcon Cloud Security (FCS). +# The results are then uploaded to GitHub Security Code Scanning. +# +# To use this action, you will need a CrowdStrike API Client ID and Secret. +# See https://github.com/CrowdStrike/fcs-action#prerequisites for setup instructions. +# +# For more examples, see https://github.com/CrowdStrike/fcs-action + +name: CrowdStrike FCS Infrastructure as Code + +on: + push: + branches: [ $default-branch, $protected-branches ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ $default-branch ] + schedule: + - cron: $cron-weekly + +permissions: + contents: read + +jobs: + fcs-iac: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Run CrowdStrike FCS to check configuration files for security issues + uses: crowdstrike/fcs-action@0e9d7bba776ed4dc623f8d0c5f0888f36e090d90 + with: + falcon_client_id: ${{ vars.FALCON_CLIENT_ID }} + falcon_region: 'us-1' + scan_type: iac + # Add the path to the directory or file that you would like to scan. + # For example `./kubernetes` for a directory of manifests + # or `main.tf` for Terraform + path: './your-iac-directory' + report_formats: sarif + output_path: ./fcs-iac-results.sarif + env: + FALCON_CLIENT_SECRET: ${{ secrets.FALCON_CLIENT_SECRET }} + + - name: Upload result to GitHub Code Scanning + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: fcs-iac-results.sarif diff --git a/code-scanning/properties/fcs-container.properties.json b/code-scanning/properties/fcs-container.properties.json new file mode 100644 index 0000000000..dc93a3fb7f --- /dev/null +++ b/code-scanning/properties/fcs-container.properties.json @@ -0,0 +1,7 @@ +{ + "name": "CrowdStrike FCS Container Image Scanning", + "creator": "CrowdStrike", + "description": "Detect vulnerabilities in your container images and surface the issues in GitHub code scanning with CrowdStrike Falcon Cloud Security.", + "iconName": "crowdstrike", + "categories": ["Code Scanning", "dockerfile"] +} diff --git a/code-scanning/properties/fcs-iac.properties.json b/code-scanning/properties/fcs-iac.properties.json new file mode 100644 index 0000000000..33c65083d7 --- /dev/null +++ b/code-scanning/properties/fcs-iac.properties.json @@ -0,0 +1,7 @@ +{ + "name": "CrowdStrike FCS Infrastructure as Code", + "creator": "CrowdStrike", + "description": "Detect misconfigurations and security vulnerabilities in your infrastructure as code files and surface the issues in GitHub code scanning.", + "iconName": "crowdstrike", + "categories": ["Code Scanning"] +} diff --git a/icons/crowdstrike.svg b/icons/crowdstrike.svg new file mode 100644 index 0000000000..b48de3f12b --- /dev/null +++ b/icons/crowdstrike.svg @@ -0,0 +1,27 @@ + + + + + + + + + + + + + + + + + + + \ No newline at end of file