Skip to content

Commit 46c297e

Browse files
committed
Added mapping and changed cwe to category
1 parent 00fb0f2 commit 46c297e

File tree

1 file changed

+35
-7
lines changed

1 file changed

+35
-7
lines changed

docs/promote-scorecards/examples.md

Lines changed: 35 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -169,8 +169,8 @@ The scorecard resides on the `Repository` blueprint and evaluates data sourced f
169169
<h2> Set up data model </h2>
170170
<h3>Snyk Vulnerability</h3>
171171

172-
To accurately benchmark against the OWASP Top 10 for code, most static analysis tools support generating `Common Weakness Enumeration` (CWE) IDs.
173-
If `CWE`s are not yet included in your `Snyk Vulnerability` blueprint, follow these steps:
172+
To accurately benchmark against the OWASP Top 10 for code, most static analysis tools support generating `Common Weakness Enumeration` (CWE) IDs. We will store the `CWE` value in a property called `category`.
173+
If the property is not yet included in your `Snyk Vulnerability` blueprint, follow these steps:
174174

175175
**Update the `Snyk Vulnerability` blueprint:**
176176
1. Navigate to the [Data model](https://app.getport.io/settings/data-model) page of your portal.
@@ -186,9 +186,9 @@ If `CWE`s are not yet included in your `Snyk Vulnerability` blueprint, follow th
186186
```json
187187
{
188188
"properties": {
189-
"cwe": {
190-
"type": "number",
191-
"title": "Common Weakness Enumeration"
189+
"category": {
190+
"type": "string",
191+
"title": "Category"
192192
}
193193
}
194194
```
@@ -741,8 +741,9 @@ To update the `Snyk Target` blueprint:
741741
The `Snyk Target` blueprint should have a defined relation with the `GitHub Repository` blueprint.
742742
If your current model does not include a relation from the `Repository` blueprint to the `Snyk Target` blueprint, add it.
743743

744-
The next step is to add the OWASP identifiers as mirrored properties to the `GitHub Repository` blueprint.
745-
**To update the `GitHub Repository` blueprint:**
744+
The next step is to add the OWASP identifiers as mirrored properties to the `GitHub Repository` blueprint, and update the mapping configuration so that each `GitHub Repository` is automatically linked to its corresponding `Snyk Target`. This link is what allows the mirrored OWASP properties to pull their values from the related Snyk data.
745+
746+
**Update the `GitHub Repository` blueprint:**
746747

747748
1. Navigate to the [Data model](https://app.getport.io/settings/data-model) page of your portal.
748749

@@ -803,6 +804,33 @@ The next step is to add the OWASP identifiers as mirrored properties to the `Git
803804
```
804805
</details>
805806

807+
**Update the mapping configuration:**
808+
809+
1. Head over to your [Data sources](https://app.port.io/settings/data-sources) page.
810+
811+
2. Under `Exporters`, click on your desired GitHub organization.
812+
813+
3. In the **Mapping** tab, edit the YAML in the bottom-left panel and add the following entry under the `repository` kind:
814+
815+
<details>
816+
<summary><b>Mapping configuration (click to expand)</b></summary>
817+
```yaml
818+
- kind: repository
819+
port:
820+
entity:
821+
mappings:
822+
relations:
823+
snyk_target:
824+
combinator: '"and"'
825+
rules:
826+
- property: '"$title"'
827+
operator: '"="'
828+
value: .full_name
829+
```
830+
</details>
831+
832+
4. Click on the `Save & Resync` button to save the changes and resync the integration.
833+
806834
<h2>Set up the scorecard</h2>
807835

808836
The final step is to create a scorecard that reflects the security maturity of a `Respository` against the OWASP Top 10 categories.

0 commit comments

Comments
 (0)