NAME

csaf-rolie - Build ROLIE (Resource-Oriented Lightweight Information Exchange) feed

SYNOPSIS

csaf-rolie --csaf DIRECTORY [--tlp-label STRING|--feed-id STRING|--feed-title STRING|--base-url URL|--output PATH]
csaf-rolie [--help|--man|-v]

Options:
  -c, --conf PATH     YAML config path
  -d, --csaf DIR      CSAF documents directory
      --output PATH   Feed output file path (default {csaf}/{feed-id}.json)
      --tlp-label     TLP (Traffic Light Protocol) label (default "WHITE")
      --base-url      Feed base URL (default "https://psirt.domain.tld/advisories/csaf")
      --feed-id       Feed ID (default "csaf-feed-tlp-{tlp-label}")
      --feed-title    Feed title (default "CSAF feed (TLP:{tlp-label})")
      --stdout        Write ROLIE feed in STDOUT
      --verbose       Print verbose messages
      --test          Test the configuration and exit
      --help          Brief help message
      --man           Full documentation
  -v, --version       Print version

DESCRIPTION

csaf-rolie build a ROLIE (Resource-Oriented Lightweight Information Exchange) feed using the CSAF documents.

https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html

The Resource Oriented Lightweight Information Exchange (ROLIE) is standard (RFC-8322) for exchanging security automation information between two machines, or between a machine and a human operator.

https://tools.ietf.org/html/rfc8322

EXAMPLES

Create a new ROLIE feed

$ csaf-rolie --csaf /var/www/html/advisories/csaf \
             --base-url https://security.acme.tld/advisories/csaf \
             --feed-title "ACME CSAF feed (TLP:WHITE)" \
             --verbose

CSAF directory : /var/www/html/advisories/csaf
TLP label      : WHITE
Base URL       : https://security.acme.tld/advisories/csaf
Feed ID        : csaf-feed-tlp-white
Feed title     : CSAF feed (TLP:WHITE)
Feed filename  : csaf-feed-tlp-white.json
Output file    : /var/www/html/advisories/csaf/csaf-feed-tlp-white.json

[*] Add ACMESA-2024:0001 in ROLIE feed
[*] Add ACMESA-2024:1337 in ROLIE feed

[...]

ROLIE feed saved in /var/www/html/advisories/csaf/csaf-feed-tlp-white.json

Create a new ROLIE feed using a config file

Available config items:

csaf CSAF documents directory

output Feed output file path (default {csaf}/{feed-id}.json)

tlp-label TLP (Traffic Light Protocol) label (default "WHITE")

base-url Feed base URL (default "https://psirt.domain.tld/advisories/csaf")

feed-id Feed ID (default "csaf-feed-tlp-{tlp-label}")

feed-title Feed title (default "CSAF feed (TLP:{tlp-label})")

ROLIE config file (rolie.conf):

---
csaf: /var/www/html/advisories/csaf
base_url: https://security.acme.tld/advisories/csaf
tlp_label: WHITE
feed_id: acme-csaf-feed-tlp-white
feed_title: ACME CSAF feed (TLP:WHITE)

Use rolie.conf with csaf-rolie command:

$ csaf-rolie --config /etc/csaf/rolie.conf

Schedule the refresh of ROLIE feed in crontab:

*/2 * * * * csaf-rolie --config /etc/csaf/rolie.conf 2> /dev/null

SEE ALSO

csaf-validator

AUTHOR

Giuseppe Di Terlizzi

COPYRIGHT AND LICENSE

Copyright © 2023-2024 Giuseppe Di Terlizzi

You may use and distribute this module according to the same terms that Perl is distributed under.