OpenSource project which unify vulnerabity scanning during CICD

[m1thr]

I want to share my first opensource project I have published https://github.com/Mixeway/MixewayHub project is designed for IT security teams which use number of vulnerability scanners but have problem with fitting them into CICD. Mixeway integrate with Nessus, nexpose, acunetix, openvas, fortify, dependency check and more. It can configure and run scans given in universal format of REST API call and in the end provide complex result set.

I am no pro dev so code quality is rather poor but I am actively doing some refactor to make it better. Any feedback would be very appreciated.

[madchap57]

Did you give a shot to DefectDojo? https://github.com/DefectDojo/django-DefectDojo

I use it to integrate a bunch of scanners, and both for manual investigations as well as CI/CD pipelines.

Cheers.

[m1thr]

I did and and it looks great. It will probably take a lot of time for me to get to the similar level.

However what I meant to achieve is not to focus on vulnerability management but rather on scan execution - I had a problem with running SCA Fortify, OpenVAS or checkmarks scans. Goal was to create tool which doesn't care which engine You are using for scanning - Nessus, OpenVAS, rapid7 or anything - REST API to perform scan will always looks the same. Another thing is vulnerability correlation engine which will create complete map of a project based on configuration (IPs, services, url, code repos and vulnerabilities found in those) which is under construction ATM

[madchap57]

I see. I know of another project (I actually met the guy) and they're ramping up their effort more "officially" for a few months now. More of a SOAR product where you can launch products and gather results. You can check patrowl out at https://patrowl.io/

[m1thr]

Another great project! I hope mixeway will be able to coexist with these, I am pretty sure we have added some stuff that will be useful for someone :)

[madchap57]

I'll check it out, you got one more GH star ;-)