Add Cyberwatch Galeax Parser #12105

AmineHazi · 2025-03-25T14:25:34Z

As discussed with @valentijnscholten , the default CSV and JSON reports from Cyberwatch do not include all the necessary data. Therefore, to use this parser, please utilize this tool : https://github.com/Galeax/Cyberwatch-API-DefectDojo to generate the required JSON input.

Cyberwatch parser : Fixed CVEs and Security issues handling, added components and mitigated findings Changed Setting for Dedup algorithm removed shashum Fixed parser bug with filters Added Epss score as %, added CAPEC and ATTACKS Fix linter and code format Co-authored-by: Amine <amine@galeax.com>

dryrunsecurity · 2025-03-25T14:26:28Z

DryRun Security Summary

A comprehensive patch for Cyberwatch Parser in DefectDojo introduces potential security risks through information exposure, logging vulnerabilities, and inadequate input validation across parser implementation, configuration, and test files.

Expand for full summary

Summary: A comprehensive patch adding Cyberwatch Parser documentation and integration to DefectDojo, including parser implementation, configuration updates, and unit test files for security finding parsing.

Security Findings:

External Reference Exposure
- GitHub repository URL directly exposed in parser code
- Potential information leakage about tooling
Logging Considerations
- Extensive logging that could potentially leak sensitive information
- Sensitive data like server names and vulnerability details logged
Datetime Parsing Vulnerabilities
- Fallback mechanisms in datetime parsing could mask data integrity issues
- Potential for timezone-related problems
Input Validation Concerns
- Extensive use of .get() method with default values
- Potential for handling unexpected input structures
Information Disclosure Risks
- Detailed system information exposure
  - Computer names
  - Product versions
  - Server status
  - Detected and fixed timestamps
Hostname and System Information Exposure
- Revealed in test JSON files
  - Specific computer names
  - Operating system details
  - Computer IDs
  - IP addresses
Potential Reconnaissance Information
- Web application framework fingerprinting details
- Detailed CVE and security issue metadata that could aid attackers

View PR in the DryRun Dashboard.

valentijnscholten · 2025-03-25T20:46:01Z

Thank you @AmineHazi . To make it clear that this parser is parsing an "extended" Cyberwatch report, could you look at changing the name of the parser to something like "Cyberwatch Galeax Scan" or "Cyberwatch Scan (Galeax)" or some suggestion from your side?

valentijnscholten · 2025-03-25T20:49:52Z

unittests/tools/test_cyberwatch_parser.py

+            self.assertEqual("Security Issue - Fingerprint Web Application Framework", finding.title)
+            self.assertEqual("Info", finding.severity)
+            # Expect both endpoints to have the same host as per new JSON
+            endpoint_hosts = [e.host for e in finding.unsaved_endpoints]


Could you add a .clean() for all endpoints? This validates if they are in valid format.

valentijnscholten · 2025-03-25T20:50:07Z

unittests/tools/test_cyberwatch_parser.py

+
+            finding = findings[0]
+            self.assertEqual("Security Issue - Fingerprint Web Application Framework", finding.title)
+            self.assertEqual("Info", finding.severity)


Could you ad an assert on cwe?

valentijnscholten · 2025-03-25T20:51:03Z

unittests/tools/test_cyberwatch_parser.py

+            self.assertIn("CVSS Base vector:", finding.description)
+            self.assertIn("CVE Published At: 2023-11-27T23:15:07.420+01:00", finding.description)
+            self.assertIn("Exploit Code Maturity: proof_of_concept", finding.description)
+            self.assertIn("EPSS: 0.00044", finding.description)


Could you assert the actual value of the epss field?

AmineHazi · 2025-04-02T10:05:47Z

Thank you @AmineHazi . To make it clear that this parser is parsing an "extended" Cyberwatch report, could you look at changing the name of the parser to something like "Cyberwatch Galeax Scan" or "Cyberwatch Scan (Galeax)" or some suggestion from your side?

Thank you for your reply, @valentijnscholten. I have just changed the parser name to "Cyberwatch Scan (Galeax)". Would you like me to update the folder and file names as well, or is the new name sufficient? (For example, change the folder 'dojo\tools\cyberwatch' to 'dojo\tools\cyberwatch_galeax'.)

valentijnscholten · 2025-04-02T10:55:06Z

Good idea, so yes 😀

AmineHazi · 2025-04-04T13:19:27Z

Good idea, so yes 😀

Hi @valentijnscholten, I changed the file and folder names too. I also added assertions on the CWE and EPSS fields and cleaned up the endpoints. Let me know if there's anything else to change!

valentijnscholten · 2025-04-04T16:52:27Z

docs/content/en/connecting_your_tools/parsers/file/cyberwatch_galeax.md

@@ -0,0 +1,14 @@
+---
+title: "Cyberwatch"


Suggested change

title: "Cyberwatch"

title: "Cyberwatch (Galeax)"

valentijnscholten · 2025-04-04T16:53:03Z

docs/content/en/connecting_your_tools/parsers/file/cyberwatch_galeax.md

+title: "Cyberwatch"
+toc_hide: true
+---
+The Cyberwatch Parser is used to import Cyberwatch scan results into DefectDojo. It accepts a JSON input that can be generated by the [Cyberwatch-API-DefectDojo](https://github.com/Galeax/Cyberwatch-API-DefectDojo) tool.


Suggested change

The Cyberwatch Parser is used to import Cyberwatch scan results into DefectDojo. It accepts a JSON input that can be generated by the [Cyberwatch-API-DefectDojo](https://github.com/Galeax/Cyberwatch-API-DefectDojo) tool.

The Cyberwatch (Galeax) Parser is used to import Cyberwatch scan results into DefectDojo. It accepts a JSON input that can be generated by the [Cyberwatch-API-DefectDojo](https://github.com/Galeax/Cyberwatch-API-DefectDojo) tool created by Galeax.

valentijnscholten · 2025-04-04T16:53:17Z

docs/content/en/connecting_your_tools/parsers/file/cyberwatch_galeax.md

+For each CVE and security issue found in the JSON input, the parser creates a corresponding finding in DefectDojo.
+
+### Sample Scan Data
+Sample Cybwerwatch Scan scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/cyberwatch).


Suggested change

Sample Cybwerwatch Scan scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/cyberwatch).

Sample Cybwerwatch Galeax Scan scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/cyberwatch).

valentijnscholten

found some more references to change

github-actions bot added settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR docs unittests parser labels Mar 25, 2025

valentijnscholten requested changes Mar 25, 2025

View reviewed changes

valentijnscholten changed the title ~~Add Cyberwatch Parser~~ Add Cyberwatch Galeax Parser Mar 25, 2025

AmineHazi requested a review from Maffooch as a code owner April 2, 2025 09:42

Fix parser name, Add assert on epss score and cwe

31eab9b

AmineHazi force-pushed the dev branch from c15a2f6 to 31eab9b Compare April 4, 2025 13:13

valentijnscholten reviewed Apr 4, 2025

View reviewed changes

valentijnscholten requested changes Apr 4, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Cyberwatch Galeax Parser #12105

Add Cyberwatch Galeax Parser #12105

AmineHazi commented Mar 25, 2025

dryrunsecurity bot commented Mar 25, 2025 •

edited

Loading

valentijnscholten commented Mar 25, 2025

valentijnscholten Mar 25, 2025

valentijnscholten Mar 25, 2025

valentijnscholten Mar 25, 2025

AmineHazi commented Apr 2, 2025

valentijnscholten commented Apr 2, 2025

AmineHazi commented Apr 4, 2025

valentijnscholten Apr 4, 2025

valentijnscholten Apr 4, 2025

valentijnscholten Apr 4, 2025

valentijnscholten left a comment

	The Cyberwatch Parser is used to import Cyberwatch scan results into DefectDojo. It accepts a JSON input that can be generated by the [Cyberwatch-API-DefectDojo](https://github.com/Galeax/Cyberwatch-API-DefectDojo) tool.
	The Cyberwatch (Galeax) Parser is used to import Cyberwatch scan results into DefectDojo. It accepts a JSON input that can be generated by the [Cyberwatch-API-DefectDojo](https://github.com/Galeax/Cyberwatch-API-DefectDojo) tool created by Galeax.

	Sample Cybwerwatch Scan scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/cyberwatch).
	Sample Cybwerwatch Galeax Scan scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/cyberwatch).

Add Cyberwatch Galeax Parser #12105

Are you sure you want to change the base?

Add Cyberwatch Galeax Parser #12105

Conversation

AmineHazi commented Mar 25, 2025

dryrunsecurity bot commented Mar 25, 2025 • edited Loading

DryRun Security Summary

valentijnscholten commented Mar 25, 2025

valentijnscholten Mar 25, 2025

Choose a reason for hiding this comment

valentijnscholten Mar 25, 2025

Choose a reason for hiding this comment

valentijnscholten Mar 25, 2025

Choose a reason for hiding this comment

AmineHazi commented Apr 2, 2025

valentijnscholten commented Apr 2, 2025

AmineHazi commented Apr 4, 2025

valentijnscholten Apr 4, 2025

Choose a reason for hiding this comment

valentijnscholten Apr 4, 2025

Choose a reason for hiding this comment

valentijnscholten Apr 4, 2025

Choose a reason for hiding this comment

valentijnscholten left a comment

Choose a reason for hiding this comment

dryrunsecurity bot commented Mar 25, 2025 •

edited

Loading