fjogeleit/trivy-operator-polr-adapter

Question: mapping result from Vulnerability- & ConfigAudit-Reports

sudoleg opened this issue · 2 comments

sudoleg commented

Hey, I don't quite understand how the result (pass, skip, warn, error, or fail) is mapped from Vulnerability- & ConfigAudit-Reports.

Based on my observations, I guess that for VulnerabilityReports, if a CVE has a critical/high score, the result is fail. For low to medium scores it's warn.
And for ConfigAuditReport it's always fail if a resource doesn't pass the evaluation.

Is my understanding correct? Otherwise I would be very happy if someone could provide a brief explanation :)

fjogeleit commented

Hey,

correct, in case of VulnerabilityReport the result mapping is resolved by severity

https://github.com/fjogeleit/trivy-operator-polr-adapter/blob/main/pkg/adapters/shared/severity.go#L24

In case of ConfigAuditReports its based on the "success" flag

Success: false => fail Result
Success: true => pass Result

sudoleg commented

ok, I understand. Thank you :)