Once you’ve written your Analyzers you’ll want to deploy them to Grapl.
Analyzers live in the <DEPLOYMENT_NAME>-grapl-analyzers
, so all we need to do
is upload the files to that bucket. If you’re using a local version of Grapl the
DEPLOYMENT_NAME is always local-grapl
.
Analyzers should be deployed with a key of the form:
analyzer_name/main.py
.
If you’re uploading to a local Grapl,
AWS_ACCESS_KEY_ID="test" \
AWS_SECRET_ACCESS_KEY="test"
aws s3 cp \
<path to analyzer> \
s3://local-grapl-analyzers-bucket/analyzers/<analyzer_name>/main.py \
--endpoint-url=http://localhost:4566
Otherwise, for an AWS deployed Grapl,
aws s3 cp \
<path to analyzer> \
s3://<DEPLOYMENT_NAME>-analyzers-bucket/analyzers/<analyzer_name>/main.py \
Deploying from Github¶
We can keep our detection logic in Github, which will allow us to perform code reviews, linting, and automate the deployment of our analyzers.
As an example, insanitybit/grapl-analyzers is set up to use this webhook.
Deploy¶
To get started you’ll need to install npm, typescript, and the aws-cdk.
Clone the repo:
git clone git@github.com:insanitybit/grapl-analyzer-deployer.git
Change directories into the /grapl-analyzer-deployer/analyzer-deployer-cdk/
folder.
You’ll need to fill out a .env file with the following and place is it in the analyzer-deployer-cdk folder.
Variables:
GITHUB_SHARED_SECRET
The secret used by the server to authenticate the client.
Consider using the output of: ruby -rsecurerandom -e 'puts SecureRandom.hex(20)'
GITHUB_ACCESS_TOKEN
This is a “Personal Access Token” generated by github.
DEPLOYMENT_NAME
This is the unique deployment name for your Grapl deployment.
Example:
GITHUB_SHARED_SECRET="dba0bf0df5e2887e737990a35f356ff7e23a56c5"
GITHUB_ACCESS_TOKEN="58b37668a1d3f9f1fa82f1e99604d58ecbf1333b"
DEPLOYMENT_NAME="exampleco"
(You may need to build dependencies with npm i)
Run ./deploy.sh
Setting up the Webhook¶
https://developer.github.com/webhooks/creating/
Set the webhook url to the API Gateway created by your CDK deployment of Grapl.
Set the secret to the value of GITHUB_SHARED_SECRET
.