Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make data query output silent by default #872

Open
scottford-io opened this issue Oct 20, 2023 · 5 comments
Open

Make data query output silent by default #872

scottford-io opened this issue Oct 20, 2023 · 5 comments
Assignees

Comments

@scottford-io
Copy link
Contributor

Is your feature request related to a problem? Please describe.
cnspec scan output now includes data query information by default without the ability to suppress that output. This potentially produces a lot of output not related to a security scan. we should suppress this output by default or provide a command line switch to turn off data query output.

Data queries:
gcp.compute.instances.where: []
gcp.project.createTime: 2023-02-02 10:17:19.803 -0800 PST
gcp.project.iamPolicy.where: [
  0: gcp.resourcemanager.binding id = luna-common-10
]
gcp.project.services.where: [
  0: gcp.service name="admin.googleapis.com"
  1: gcp.service name="artifactregistry.googleapis.com"
  2: gcp.service name="autoscaling.googleapis.com"
  3: gcp.service name="bigquery.googleapis.com"
  4: gcp.service name="bigquerymigration.googleapis.com"
  5: gcp.service name="bigquerystorage.googleapis.com"
  6: gcp.service name="calendar-json.googleapis.com"
  7: gcp.service name="cloudapis.googleapis.com"
  8: gcp.service name="cloudasset.googleapis.com"
... 34 more lines ...
gcp.project.gke.clusters: [
  0: gcp.project.gkeService.cluster name="online-store-cluster"
]
gcp.organization.id.trim: "459343096258"
gcp.project.number: "2396262307"
gcp.project.gke.clusters.length: 1
gcp.compute.instances.where.length: 9
gcp.project.id: "luna-common"
gcp.compute.instances.where: [
  0: gcp.project.computeService.instance name="gke-online-store-cluster-default-pool-65ef2035-5sn2"
  1: gcp.project.computeService.instance name="gke-online-store-cluster-default-pool-65ef2035-vhz2"
  2: gcp.project.computeService.instance name="gke-online-store-cluster-default-pool-65ef2035-vlvf"
  3: gcp.project.computeService.instance name="gke-online-store-cluster-default-pool-2a10fe80-9jp0"
  4: gcp.project.computeService.instance name="gke-online-store-cluster-default-pool-2a10fe80-fmw4"
  5: gcp.project.computeService.instance name="gke-online-store-cluster-default-pool-2a10fe80-pcpc"
  6: gcp.project.computeService.instance name="gke-online-store-cluster-default-pool-387794bc-bq06"
  7: gcp.project.computeService.instance name="gke-online-store-cluster-default-pool-387794bc-hl9k"
  8: gcp.project.computeService.instance name="gke-online-store-cluster-default-pool-387794bc-mj75"
... 1 more lines ...
gcp.project.name: "luna-common"
gcp.project.parentId.trim: "ganizations/459343096258"
gcp.project.iamPolicy.where: []
gcp.project.state: "ACTIVE"
gcp.compute.networks: [
  0: gcp.project.computeService.network name="default"
]
gcp.project.iamPolicy: [
  0: {
    role: "roles/artifactregistry.serviceAgent"
  }
  1: {
    role: "roles/cloudfunctions.serviceAgent"
  }
  2: {
    role: "roles/compute.admin"
  }
... 40 more lines ...
gcp.project.labels: {}
mondoo.version: "9.2.2"
gcp.compute.networks.length: 1
asset.title: "GCP Project"
labels: {}
gcp.project: {
  labels: {}
  id: "luna-common"
  state: "ACTIVE"
  name: "luna-common"
  number: "2396262307"
}
name: "luna-common"
id: "luna-common"
... 2 more lines ...
gcp.organization.name: "lunalectric.com"

Describe the solution you'd like
A clear and concise description of what you want to happen.

@tas50
Copy link
Member

tas50 commented Oct 20, 2023

Dom and I were discussing this the other day. I think we should provide some sort of count summary that shows the flag to show full output. The data is definitely too much at this point

@arlimus
Copy link
Member

arlimus commented Oct 20, 2023

@scottford-io Is this output happening because of data queries in the security policies, or is there another reason?

edit - I suspect they are coming from querypacks. If so, we can stop printing querypacks in cnspec's report.

@vjeffrey
Copy link
Contributor

ya it's from querypacks

@arlimus
Copy link
Member

arlimus commented Oct 20, 2023

Awesome, yeah we can filter those!

@scottford-io
Copy link
Contributor Author

Thanks all! The data is great and valuable. Glad others think this could be optional

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants