Security Nodes

I nodi Security permettono di eseguire scansioni automatizzate per identificare vulnerabilità e problemi di sicurezza nell’infrastruttura.

Security

Esegue scansioni di sicurezza su target specificati.

Configurazione

Tipi di scansione

Port Scan

Identifica porte aperte e servizi in ascolto.

Workflow Esempio: Audit Porte Server

type: security
toolType: portScan
target: "192.168.1.100"
portRange: "1-65535"
label: "Full Port Scan Produzione"

Output

{
  "target": "192.168.1.100",
  "scanType": "portScan",
  "openPorts": [
    { "port": 22, "service": "ssh", "version": "OpenSSH 8.4" },
    { "port": 80, "service": "http", "version": "nginx/1.18" },
    { "port": 443, "service": "https", "version": "nginx/1.18" },
    { "port": 3306, "service": "mysql", "version": "MySQL 8.0" }
  ],
  "totalOpen": 4,
  "scanDuration": 45000
}

Condition per porte inattese

type: condition
condition: |
  {{security.output.openPorts}}.some(p => 
    ![22, 80, 443].includes(p.port)
  )

SSL Check

Verifica la validità e configurazione dei certificati SSL/TLS.

Workflow Esempio: Monitoraggio Certificati

type: security
toolType: sslCheck
target: "example.com"
checkExpiry: true
expiryDaysWarning: 30
label: "Check SSL example.com"

Output

{
  "target": "example.com",
  "scanType": "sslCheck",
  "certificate": {
    "valid": true,
    "issuer": "Let's Encrypt Authority X3",
    "subject": "example.com",
    "validFrom": "2024-01-01T00:00:00Z",
    "validTo": "2024-04-01T00:00:00Z",
    "daysUntilExpiry": 45,
    "serialNumber": "03:AB:CD:..."
  },
  "chain": {
    "valid": true,
    "certificates": 3
  },
  "protocols": {
    "TLSv1.2": true,
    "TLSv1.3": true,
    "TLSv1.1": false,
    "TLSv1.0": false
  },
  "grade": "A+"
}

Vulnerability Scan

Cerca vulnerabilità note (CVE) nei servizi esposti.

Workflow Esempio: Security Audit Completo

type: security
toolType: vulnScan
target: "api.example.com"
failOnVulnerability: true
label: "Vulnerability Scan API"

Output

{
  "target": "api.example.com",
  "scanType": "vulnScan",
  "vulnerabilities": [
    {
      "cve": "CVE-2024-1234",
      "severity": "high",
      "cvss": 8.5,
      "service": "nginx/1.18",
      "description": "Buffer overflow in HTTP/2 implementation",
      "remediation": "Upgrade to nginx 1.19+"
    }
  ],
  "summary": {
    "critical": 0,
    "high": 1,
    "medium": 2,
    "low": 3,
    "info": 5
  },
  "riskScore": 72
}

Condition per vulnerabilità critiche

type: condition
condition: |
  {{security.output.summary.critical}} > 0 || 
  {{security.output.summary.high}} > 0

Header Check

Analizza gli HTTP security headers.

Workflow Esempio: Compliance Check

type: security
toolType: headerCheck
target: "https://app.example.com"
label: "Security Headers Check"

Output

{
  "target": "https://app.example.com",
  "scanType": "headerCheck",
  "headers": {
    "Strict-Transport-Security": {
      "present": true,
      "value": "max-age=31536000; includeSubDomains",
      "score": 10
    },
    "Content-Security-Policy": {
      "present": true,
      "value": "default-src 'self'",
      "score": 10
    },
    "X-Frame-Options": {
      "present": false,
      "recommendation": "DENY o SAMEORIGIN",
      "score": 0
    },
    "X-Content-Type-Options": {
      "present": true,
      "value": "nosniff",
      "score": 10
    }
  },
  "totalScore": 75,
  "maxScore": 100,
  "grade": "B",
  "missingHeaders": ["X-Frame-Options", "Referrer-Policy"]
}

Headers consigliati

DNS Check

Verifica la configurazione DNS e record di sicurezza.

type: security
toolType: dnsCheck
target: "example.com"
label: "DNS Security Check"

Output

{
  "target": "example.com",
  "scanType": "dnsCheck",
  "records": {
    "A": ["192.168.1.100"],
    "AAAA": ["2001:db8::1"],
    "MX": ["mail.example.com"],
    "TXT": ["v=spf1 include:_spf.google.com ~all"]
  },
  "security": {
    "dnssec": true,
    "spf": { "valid": true, "record": "v=spf1..." },
    "dkim": { "valid": true, "selector": "google" },
    "dmarc": { "valid": true, "policy": "reject" }
  },
  "issues": []
}

Workflow Completo: Security Pipeline

Un workflow completo che esegue tutti i controlli di sicurezza in sequenza.

type: transform
operation: custom
expression: |
  {
    server: loop.current.hostname,
    date: new Date().toISOString(),
    portScan: {
      openPorts: portScan.output.totalOpen,
      unexpected: portScan.output.openPorts.filter(p => 
        ![22, 80, 443].includes(p.port)
      ).length
    },
    ssl: {
      valid: sslCheck.output.certificate.valid,
      daysToExpiry: sslCheck.output.certificate.daysUntilExpiry,
      grade: sslCheck.output.grade
    },
    headers: {
      score: headerCheck.output.totalScore,
      missing: headerCheck.output.missingHeaders
    },
    vulnerabilities: {
      critical: vulnScan.output.summary.critical,
      high: vulnScan.output.summary.high,
      total: Object.values(vulnScan.output.summary).reduce((a,b) => a+b, 0)
    },
    overallRisk: calculateRisk(vulnScan.output, sslCheck.output)
  }

Best Practices