Skip to content

Commit 5e8bd05

Browse files
committed
readme after internal review
1 parent 40a0ddb commit 5e8bd05

1 file changed

Lines changed: 42 additions & 33 deletions

File tree

docs/content/en/connecting_your_tools/parsers/file/reversinglabs_spectraassure.md

Lines changed: 42 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -3,25 +3,35 @@ title: "ReversingLabs Spectra Assure"
33
toc_hide: true
44
---
55

6-
# ReversingLabs SpectraAssure Parser
6+
# ReversingLabs Spectra Assure Parser
7+
8+
The Spectra Assure platform is a set of [ReversingLabs](https://www.reversinglabs.com/) solutions primarily designed for software assurance and software supply chain security use-cases.
9+
Spectra Assure products analyze compiled software packages, their components and third-party dependencies to detect exposures, reduce vulnerabilities, and eliminate threats before reaching production.
10+
11+
Every Spectra Assure analysis (software scan) produces a set of reports and the overall CI status (pass or fail) for the analyzed software package.
12+
The reports are created in multiple different formats, with different level of detail and scope of information about the analysis results.
13+
The official documentation describes all [supported report formats](https://docs.secure.software/concepts/analysis-reports) in Spectra Assure.
14+
15+
**The primary purpose of this parser is extracting known vulnerabilities (CVEs) that are present in the `components` and `dependencies` sections of the `rl-json` report.**
716

817
### File Types
918

10-
The parser accepts only `report.rl.json` files.
11-
You can find instructions how to export the `rl-json` report from the cli and portal scanners.
19+
The parser accepts only `report.rl.json` files (the Spectra Assure [rl-json report](https://docs.secure.software/concepts/analysis-reports#rl-json)).
1220

13-
- [Spectra Assure Cli](https://docs.secure.software/cli/).
14-
- [Spectra Assure Portal](https://docs.secure.software/portal/).
21+
You can find instructions for exporting the `rl-json` report in the documentation of the Spectra Assure product you're using.
22+
23+
- [Spectra Assure CLI](https://docs.secure.software/cli/commands/report).
24+
- [Spectra Assure Portal](https://docs.secure.software/api-reference/#tag/Version/operation/getVersionReport).
1525
- [docker:rl-scanner](https://hub.docker.com/r/reversinglabs/rl-scanner).
1626
- [docker:rl-scanner-cloud](https://hub.docker.com/r/reversinglabs/rl-scanner-cloud).
1727

1828

1929
### Total Fields in Reversinglabs Spectra Assure rl-json
2030

21-
For the specification of the rl-json report, see the documentation at:
31+
For the specification of the `rl-json` report, consult the official Spectra Assure documentation:
2232

23-
- [rl-json-schema](https://docs.secure.software/cli/rl-json-schema)
24-
- [analysis-reports:rl-json](https://docs.secure.software/concepts/analysis-reports#rl-json).
33+
- [rl-json report schema](https://docs.secure.software/cli/rl-json-schema)
34+
- [Analysis reports: rl-json](https://docs.secure.software/concepts/analysis-reports#rl-json).
2535

2636

2737
### Field Mapping Details
@@ -30,63 +40,62 @@ For the specification of the rl-json report, see the documentation at:
3040

3141
##### Component
3242

33-
For a Components, the title shows:
43+
For a component, the title includes:
3444

35-
- the CVE.
36-
- the type: `Component`.
37-
- the `purl` of the `Component` if present, otherwise name and version.
45+
- the CVE
46+
- the type: `Component`
47+
- the `purl` of the `Component` if present; otherwise name and version
3848

3949

4050
##### Dependency
4151

42-
The title shows the:
52+
For a dependency, the title includes:
4353

44-
- the CVE.
45-
- the type: `Dependecy`.
46-
- the `purl` of the `Dependency` if present, otherwise name and version.
54+
- the CVE
55+
- the type: `Dependency`
56+
- the `purl` of the `Dependency` if present; otherwise name and version
4757

4858
#### Description
4959

5060
##### Component
5161

52-
For a component we repeat the title, but add the sha256.
62+
For a component, the description repeats the information from the [title](#title) and includes the SHA256 hash of the component.
5363

54-
The sha256 is added as sometimes a file scan my have multiple items with the same name and version
55-
but with a different hash.
56-
Typically this happens with Windows intstall packages with multiple languages.
64+
The SHA256 is included because sometimes a file scan may have multiple items with the same name and version, but with different hashes.
65+
Typically this happens with multi-language Windows installer packages.
5766

5867

5968
##### Dependency
6069

61-
For a dependency we repeat the title and then add the component_name, the component path and the component_hash.
62-
For duplicates we add one additional line to the description for each duplicate, showing its title and component.
70+
For a dependency, the description repeats the information from the [title](#title) and includes the component path, `component-name` and `component-hash`.
71+
For duplicates, the description includes an additional line showing the title and component of each duplicate.
6372

6473
#### Vulnerabilities
6574

66-
From the vulnerability data in the rl-json file, we fetch:
75+
For vulnerabilities, the following information is retrieved:
6776

68-
- the CVE unique id
69-
- cvss version
70-
- cvss.basescore
77+
- the CVE unique ID
78+
- CVSS version
79+
- CVSS base score
7180

72-
From the cvss.basescore we map the severity into:
81+
From the CVSS base score, we map the severity into:
7382

7483
- Info
7584
- Low
7685
- Medium
7786
- High
7887
- Critical
7988

89+
If no mapping is matched, the default severity is `Info`.
90+
8091
##### Notes
8192

82-
- Currently no endpoints are created
93+
- Currently, no endpoints are created.
8394
- Deduplication is done with the `unique-id-from-tool` field.
84-
- for component: `<component sha256>:<cve>`
95+
- for components: `<component sha256>:<cve>`
8596
- for dependencies: `<component sha256>:<cve>:<dependency purl>`
86-
- On detecting a duplicate `dependency` we increment the number of occurrences.<br/>
87-
`Components` have no duplicates so the nr of occurrences is always 1.
88-
- The default severity if no mapping is matched is `Info`.
89-
- We extract the scan date and the scanner version and set a static scanner-name.
97+
- On detecting a duplicate dependency, we increment the number of occurrences. Components have no duplicates, so the number of occurrences is always 1.
98+
- We extract the scan date, the Spectra Assure scanner version, and set a static scanner name.
9099

91100
### Sample Scan Data or Unit Tests
92101

0 commit comments

Comments
 (0)