CloudGuard CNAPP

https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/
Admin
CloudGuard Cloud Native Application Protection Platform (CNAPP) is a SaaS security platform...
Tokens:241,036
Snippets:4,297
Trust Score:10
Update:5 months ago
Show doc for...
Tokens:
Raw
### Install Spectral with DSN

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Get-Started-ShiftLeft.htm?TocPath=Code+Security%7CGetting+Started+with+Code+Security%7C_____0

Example of installing Spectral using a Data Source Name (DSN) for enterprise offerings.

```bash
curl -L https://spectral-us.dome9.com/latest/sh?dsn=<YOUR_DSN> | sh
```

--------------------------------

### Example Asset URI Template

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/SCMs-Custom-Templates.htm?TocPath=Code+Security%7CSettings%7C_____2

Use this template to construct a URL that links directly to the issue within the repository. It utilizes placeholders for the asset URI, branch, file path, and starting line number.

```text
{{{assetUri}}}/blob/{{{branch}}}{{{path}}}#L{{{start}}}
```

--------------------------------

### Install Spectral via Scoop (Windows - EU Dome9 Portal)

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Get-Started-ShiftLeft.htm

Install the spectral CLI tool on Windows using Scoop for the EU Dome9 Portal. This command fetches the installer from the specified URL.

```powershell
scoop install https://spectral.eu1.dome9.com/latest/scoop/spectral.json
```

--------------------------------

### Install Spectral via Scoop on Windows (Infinity Portal)

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Get-Started-ShiftLeft.htm?TocPath=Code+Security%7CGetting+Started+with+Code+Security%7C_____0

Install the Spectral CLI using Scoop for the Infinity Portal on Windows.

```bash
scoop install https://spectral-us.checkpoint.com/latest/scoop/spectral.json
```

--------------------------------

### Install Spectral via Scoop on Windows (Dome9 Portal)

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Get-Started-ShiftLeft.htm?TocPath=Code+Security%7CGetting+Started+with+Code+Security%7C_____0

Install the Spectral CLI using Scoop for the Dome9 Portal on Windows.

```bash
scoop install https://spectral-us.dome9.com/latest/scoop/spectral.json
```

--------------------------------

### Install Spectral via PowerShell on Windows (Infinity Portal)

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Get-Started-ShiftLeft.htm?TocPath=Code+Security%7CGetting+Started+with+Code+Security%7C_____0

Install the Spectral CLI using PowerShell for the Infinity Portal on Windows.

```powershell
iwr https://spectral-us.checkpoint.com/latest/ps1 -useb | iex
```

--------------------------------

### Install Spectral via Scoop on Windows (Infinity Portal - EU)

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Get-Started-ShiftLeft.htm?TocPath=Code+Security%7CGetting+Started+with+Code+Security%7C_____0

Install the Spectral CLI using Scoop for the Infinity Portal in the EU region.

```bash
scoop install https://spectral-eu.checkpoint.com/latest/scoop/spectral.json
```

--------------------------------

### ServiceNow Endpoint URL with Example Values

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Integrations/ServiceNow-Integration.htm

An example of a fully formed ServiceNow endpoint URL using sample values for instance, namespace, and API.

```text
https://instance123.service-now.com/api/x_chpst_dome9/alerts
```

--------------------------------

### Signature Verification Example

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Code-Security-Integrations.htm

An example demonstrating how to use the `verifySignature` function with sample values to check if a signature is valid. This helps in testing the integration.

```javascript
verifySignature('108a388872e723c0b4be83a0b37abb5a55f9a89c17209c47bb11e8064ccd811d', 'myverysecrettoken', '0', 'bar')
```

--------------------------------

### Install Spectral via PowerShell on Windows (Dome9 Portal)

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Get-Started-ShiftLeft.htm?TocPath=Code+Security%7CGetting+Started+with+Code+Security%7C_____0

Install the Spectral CLI using PowerShell for the Dome9 Portal on Windows.

```powershell
iwr https://spectral-us.dome9.com/latest/ps1 -useb | iex
```

--------------------------------

### Install Spectral via Scoop on Windows (Dome9 Portal - EU)

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Get-Started-ShiftLeft.htm?TocPath=Code+Security%7CGetting+Started+with+Code+Security%7C_____0

Install the Spectral CLI using Scoop for the Dome9 Portal in the EU region.

```bash
scoop install https://spectral-eu1.dome9.com/latest/scoop/spectral.json
```

--------------------------------

### Install Spectral via PowerShell on Windows (Infinity Portal - EU)

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Get-Started-ShiftLeft.htm?TocPath=Code+Security%7CGetting+Started+with+Code+Security%7C_____0

Install the Spectral CLI using PowerShell for the Infinity Portal in the EU region.

```powershell
iwr https://spectral-eu.checkpoint.com/latest/ps1 -useb | iex
```

--------------------------------

### Create and Scan for Dummy Secret

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Get-Started-ShiftLeft.htm

This example demonstrates creating a dummy secret file and then running a spectral scan to detect it. The output shows the file, location, severity, and detector code.

```bash
$ echo AKIAIOSFODNN7EXAMPLX > foo.txt  
$ $HOME/.spectral/spectral run  
/Users/superhero/spectral-test/foo.txt  
       0:20 Error         Visible AWS Key CLD001
```

--------------------------------

### Get Helm Release Values

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Workload-Protection/Image_Assurance/Image-Assurance-Agent-Status.htm

If using Helm for installation, run this command to view the installation arguments for your CloudGuard resources. Verify that `credentials.user` and `credentials.secret` are correct.

```bash
helm –n <namespace> get values <release-name>
```

--------------------------------

### GSL Rule Syntax Example

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/PostureManagement/GSL.htm

Defines the basic structure of a GSL rule, specifying a target entity and a condition to be checked. Use this to start building your compliance rules.

```gsl
SecurityGroup where name='default' should...
```

```gsl
Instance where (tags contain [key='env' and value='prod'] and not name='test') should ...
```

--------------------------------

### Create and scan a dummy secret with Spectral

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Get-Started-ShiftLeft.htm?TocPath=Code+Security%7CGetting+Started+with+Code+Security%7C_____0

Shows how to create a file with a dummy AWS key and then run Spectral to detect it. It also explains how to view the actual secret using an environment flag.

```bash
$ echo AKIAIOSFODNN7EXAMPLX > foo.txt
$ $HOME/.spectral/spectral run
/Users/superhero/spectral-test/foo.txt
        0:20 Error         Visible AWS Key CLD001
```

```bash
$ $HOME/.spectral/spectral run
...  
[your-project] SVC006 - Exposed PubNub Secret on Client Side App  
- res/values/strings.xml
```

--------------------------------

### Azure Organization Onboarding - Initial Setup

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Assets/Azure/Onboarding-Azure-Organizations.htm

This endpoint initiates the Azure onboarding process by generating an execution command for Azure Cloud Shell.

```APIDOC
## POST /v2/AzureCloudAccount/OnboardingExecutionCommand

### Description
Initiates the Azure onboarding process and returns a command string to be executed in Azure Cloud Shell.

### Method
POST

### Endpoint
https://api.dome9.com/v2/AzureCloudAccount/OnboardingExecutionCommand

### Request Body
This endpoint does not require a request body.

### Response
#### Success Response (200)
- **command** (string) - The command string to be executed in Azure Cloud Shell.
```

--------------------------------

### Display Help Information

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Using-CLI.htm?TocPath=Code+Security%7CUsing+Code+Security+CLI%7C_____0

Print general help information for the main binary or specific subcommand help.

```bash
spectral --help
```

--------------------------------

### Invalid JWT Example

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/The-Detector-Engine.htm?TocPath=Code+Security%7CDetectors%7C_____4

A negative example of an invalid JWT string.

```text
bad_token
```

--------------------------------

### Valid JWT Example

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/The-Detector-Engine.htm?TocPath=Code+Security%7CDetectors%7C_____4

A positive example of a valid JWT string.

```text
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJsb2dnZWRJbkFzIjoiYWRtaW4iLCJpYXQiOjE0MjI3Nzk2Mzh9.gzSraSYS8EXBxLN_oWnFSRgCzcmJmMjLiuyu5CSpyHI
```

--------------------------------

### Assignment Test Negative Example

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/The-Detector-Engine.htm?TocPath=Code+Security%7CDetectors%7C_____4

A negative example of a string that does not match an assignment pattern.

```text
DB_PASS, foo, bar
```

--------------------------------

### Initialize Spectral Project

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Buidling-Detectors.htm

Run this command to initialize a new Spectral project in your current directory. This sets up the necessary configuration files.

```bash
$ cd my-project  
$ $HOME/.spectral/spectral init
```

--------------------------------

### Scan a directory with Spectral

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Get-Started-ShiftLeft.htm?TocPath=Code+Security%7CGetting+Started+with+Code+Security%7C_____0

Demonstrates how to create a test directory and scan it using the Spectral CLI. It shows the output when no matches are found.

```bash
$ mkdir spectral-test && cd spectral-test
$ $HOME/.spectral/spectral scan
✔ no matches found
  scanned 0 bytes and 0 files in 2ms
```

--------------------------------

### Assignment Test Positive Example

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/The-Detector-Engine.htm?TocPath=Code+Security%7CDetectors%7C_____4

A positive example of a string that matches an assignment pattern.

```text
DB_PASS=<random token>
```

--------------------------------

### Review Onboarding Script for Azure

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Assets/Azure/Onboarding-Azure-Organizations.htm

Review the provided onboarding script before execution. For advanced options, consult the 'Special Modes for Onboarding Script' documentation.

```bash
Onboarding script
```

--------------------------------

### Regex Test Positive Example

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/The-Detector-Engine.htm?TocPath=Code+Security%7CDetectors%7C_____4

A positive example that satisfies the multiple regex conditions defined in the tester.

```text
token=48SfRa4idxxUVyPAejafXxwjkreyj8MoJkjV
```

--------------------------------

### Valid URI Test Example (curl)

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/The-Detector-Engine.htm?TocPath=Code+Security%7CDetectors%7C_____4

A positive example demonstrating a valid URI within a curl command.

```bash
curl -L -o https://dev.acme.corp/secure/credentials.json -H"Authorization: Bearer <token>"
```

--------------------------------

### Example of Webhook Signature Verification

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Code-Security-Integrations.htm

This example demonstrates how to call the `verifySignature` function with sample data to check its output.

```javascript
verifySignature('108a388872e723c0b4be83a0b37abb5a55f9a89c17209c47bb11e8064ccd811d', 'myverysecrettoken', '0', 'bar') // returns true
```

--------------------------------

### Confluence Integration Configuration Example

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Code-Security-Confluence-Integration.htm?TocPath=Code+Security%7CCode+Security+Integrations%7C_____1

Provides example values for configuring the Confluence event endpoint URL, the token for the Lambda function's environment variable, and the complete webhook URL to be set in Confluence.

```text
Confluence event endpoint URL |  _https://random123.execute-api.us-east-1.amazonaws.com/prod/api/confluence_event_  
Token that you set in your `function env var` |  `f4lmf4kl2ldoxxxxxx`  
Webhook URL you configure in Confluence |  `https://random123.execute-api.us-east-1.amazonaws.com/prod/api/confluence_event?webhook_token=f4lmf4kl2ldoxxxxxx`
```

--------------------------------

### Example Secret for Testing Integration

Source: https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Code-Security-Spectral/Code-Security-Confluence-Integration.htm

Use a fake secret, such as this example, to test the integration by opening a Jira issue.

```text
AKIA4HK52OLF2AAN9KWV
```
Tokens:
Raw