Commit a438379
feat(cron): Add monthly Log4Shell validation cron job
Completed the 2-cron-job automation system for Dependency-Check:
Cron Job #1: Daily CVE Database Update ⚙️
- Script: daily-cve-update.sh (already created)
- Schedule: Daily at 2 AM UTC
- Purpose: Keep CVE database current with NVD
- Duration: 5-10 minutes (delta-only updates)
Cron Job #2: Monthly Log4Shell Validation ✅ (NEW)
- Script: monthly-log4shell-validation.sh
- Schedule: Monthly on 1st at 3 AM UTC
- Purpose: Validate critical CVE detection capability
- Duration: 2-5 seconds (fast integrity check)
Why Both Are Needed:
1. Daily updates keep database current with latest CVEs
2. Monthly validation ensures database integrity after ~30 updates
3. Validates CVSS v4 parsing still working
4. Early warning if database corruption occurs
5. Tests critical vulnerability detection (Log4Shell = CVSS 10.0)
Monthly Validation Features:
- Checks CVE-2021-44228 exists in PostgreSQL
- Creates test project with vulnerable log4j-core 2.14.1
- Runs Dependency-Check scan
- Verifies Log4Shell is detected with CRITICAL severity
- Alerts if detection fails
Complete Documentation:
- CRON_JOBS_COMPLETE_GUIDE.md (comprehensive guide)
- Both jobs documented with installation steps
- Troubleshooting for common issues
- Monitoring and alerting setup
- Security considerations
- Quick reference commands
Installation:
```bash
# Make executable
chmod +x monthly-log4shell-validation.sh
# Test manually
./monthly-log4shell-validation.sh
# Add to crontab
crontab -e
0 2 * * * /path/to/daily-cve-update.sh >> /var/log/cve-updates.log 2>&1
0 3 1 * * /path/to/monthly-log4shell-validation.sh >> /var/log/log4shell-validation.log 2>&1
```
Testing Status:
- Syntax check: ✅ PASSED
- Local testing: 1 parent 055de1a commit a438379
2 files changed
Lines changed: 949 additions & 0 deletions
File tree
- packages/agents/src/two-branch
- docs/dependency_check
- scripts
0 commit comments