Package: auditree-arboretum
auditree-arboretumThe Auditree common fetchers, checks andharvestreports library.IntroductionAuditree Arboretum is a Python library of common compliance fetchers, checks & harvest
reports built upon theAuditree compliance automation framework.Repo contentFunctionality categorizationArboretum fetchers, checks, and Harvest reports are organized into functional
grouping categories.  The following categories have either been contributed to
or will be contributed to in the near future.  We anticipate that this list will
grow as arboretum matures.AnsibleAuditreeChefIBM CloudKubernetesObject StoragePager DutySplunkFetchersPlease read the framework documentation forfetcher design principlesbefore
contributing a fetcher.Fetchers must apply no logic to the data they retrieve. They must write unadulterated
(modulo sorting & de-duplication) into the/rawarea of the locker via the
framework-provided decorators or context managers.Fetchers must be atomic - retrieving and creating the data they are responsible
for. Fetcher execution order is not guaranteed and so you must not assume that
evidence already exists and is current in the locker.  Useevidence dependency chainingif a fetcher depends on evidence gathered by another
fetcher in order to gather its intended evidence.Fetchers should be as fast as the API call allows. If a call is long running it
should be separated into a dedicated evidence providing tool, which places data
where a fetcher can retrieve it easily & quickly.ChecksPlease read the framework documentation forcheck design principlesbefore
contributing a check.Checks should only use evidence from the evidence locker to perform check operations.
Also, checksshould notwrite or change evidence from the evidence locker.  That
is the job of a fetcher.Jinjais used to produce reports from checks.  As such each check class must have
at least one associated report template in order to produce a check report.  In keeping
with the "DevSecOps" theme, check reports are meant to provide details on violations
identified by checks.  These violations are in the form of failures and warnings.They aren't meant to be used to format fetched raw evidence into a readable report.Harvestreports should be used to satisfy that need.Harvest ReportsHarvest reports are hosted with the fetchers/checks that collect the evidence for
the reports process. Withinauditree-arboretumthis means the harvest report code
lives inreportsfolders throughout this repository. For more details check outharvest report developmentin theharvestREADME.Usagearboretumis available for download fromPyPI.PrerequisitesSupported for execution on OSX and LINUX.Supported for execution with Python 3.6 and above.IntegrationFollow these steps to integrate auditree-arboretum fetchers and checks into your project:Add thisauditree-arboretumpackage as a dependency in your Python project.The following steps can be taken to import individual arboretum fetchers and checks.For a fetcher, add afetch_<category>_common.pymodule, if one does not already
exist, in your project'sfetcherspath where the<category>is
the respective category folder within this repo of that fetcher.  Having a separate
common "category" module guards against name collisions across categories.For a check, add atest_<category>_common.pymodule, if one does not already exist,
in your project'scheckspath where the<category>is the respective category folder
within this repo of that check.  Having a separate common "category" module guards
against name collisions across providers and technologies.Import the desired fetcher or check class and theauditree-frameworkwill handle
the rest.For example to use the Abandoned Evidence fetcher from theauditreecategory, add
the following to yourfetch_auditree_common.py:fromarboretum.auditree.fetchers.fetch_abandoned_evidenceimportAbandonedEvidenceFetcherauditree-arboretumfetchers and checks are designed to execute as part of a downstream
Python project, so you may need to setup your project's configuration in order for the
fetchers and checks to execute as desired.  Each category folder in this repository
includes a README.md that documents each fetcher's and check's configuration.In generalauditree-arboretumfetchers and checks expect anorgfield with content
that captures each fetcher's and check's configuration settings.For example:{"org":{"auditree":{"abandoned_evidence":{"threshold":1234567,"exceptions":{"raw/path/to-evidence.json":"This is a good reason","raw/path/to-evidence-2.json":"This is also a good reason"}}}}Finally, for a check, be sure to add the appropriate entry into your project'scontrols.jsonfile.  Doing this allows you to group checks together as a control
set which is useful for organizing check notifications and targeted check execution.For example to use the Abandoned Evidence check, add something similar to the
following to your project'scontrols.json:{"arboretum.auditree.checks.test_abandoned_evidence.AbandonedEvidenceCheck":{"auditree_evidence":{"auditree_control":["arboretum.auditree"]}}}