GustavoNogueira/A-Team-Security-Infra-Agent-Engineer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Oracle CIS report engine, CIS engine auto-update, and granular report params

Browse Source 
Replace lightweight cis_runner.py with Oracle's official cis_reports.py engine
(6660 lines, 48 CIS + 11 OBP checks). Add granular execution parameters (Level,
OBP, Raw Data, Redact), per-report file storage with category browser, tenancy
filter in Downloads, and individual file download.

Add CIS Engine auto-update: check/download latest cis_reports.py from Oracle's
GitHub repo with automatic patch reapplication (admin UI card + 3 new endpoints).
Save engine version to app_settings on startup.

Update README to v1.8 with new features, API endpoints, and versioning table.
This commit is contained in:
nogueiraguh
2026-03-05 11:11:31 -03:00
parent 5038403d08
commit 973ff65989
5 changed files with 303 additions and 1435 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
README.md
View File

@@ -9,7 +9,7 @@
</p>
<p align="center">
<img src="https://img.shields.io/badge/version-1.5-C74634?style=flat-square" alt="Version">
<img src="https://img.shields.io/badge/version-1.8-C74634?style=flat-square" alt="Version">
<img src="https://img.shields.io/badge/python-3.12-3776AB?style=flat-square" alt="Python">
<img src="https://img.shields.io/badge/FastAPI-0.115-009688?style=flat-square" alt="FastAPI">
<img src="https://img.shields.io/badge/OCI-GenAI-C74634?style=flat-square" alt="OCI">
@@ -33,6 +33,8 @@ The platform combines security compliance scanning, AI-powered chat with **RAG (
- **OCI Generative AI** integration via official SDK (`oci.generative_ai_inference`)
- **RAG (Retrieval-Augmented Generation)**: automatically queries ADB vector store for relevant context before generating responses
- **MCP Tool Use (Function Calling)**: GenAI models can call tools from registered MCP servers during chat — supports both Cohere and Generic (OpenAI-style) function calling formats with automatic tool execution loop (max 5 iterations)
- **Chat Memory Compaction**: automatic summarization of older messages when conversation exceeds ~8000 tokens — keeps 6 recent messages intact and generates an LLM-based summary of older context, similar to Claude Code's context compression
- **Thinking Indicator**: button disables and shows spinner + "Pensando..." while waiting for GenAI response
- 69 chat models + 11 embedding models across 6 providers: **Cohere**, **Meta**, **Google**, **OpenAI** (GPT-5.3/5.2/5.1/5/4.1/4o, Codex, Image, Audio, o1/o3/o4-mini, GPT-oss), **xAI** (Grok 4.1/4/3), **ProtectAI**
- OCID-based model resolution: catalog maps model IDs to OCI resource IDs per region for reliable API calls
- 16 OCI regions supported with auto-generated endpoints
@@ -47,12 +49,33 @@ The platform combines security compliance scanning, AI-powered chat with **RAG (
- Select which OCI connection to explore
- Real-time API calls via OCI Python SDK
### 📊 CIS Compliance Reports
- Automated CIS OCI Foundations Benchmark 3.0 execution
- 54 security controls across 8 domains (IAM, Networking, Compute, Logging, Storage, etc.)
- HTML and JSON report output
- Optional MCP server selection per report execution
- Region filtering
### 📊 CIS Compliance Reports (Oracle Official Engine)
- Powered by Oracle's official `cis_reports.py` (6660 lines, 48 CIS + 11 OBP checks)
- **Granular execution parameters**: CIS Level (1/2), OCI Best Practices, Raw Data, OCID Redaction
- **Level 1**: Essential security controls that can be implemented with minimal impact on operations. Recommended as baseline for all organizations.
- **Level 2**: Advanced security controls that may restrict functionality or require more effort to implement. Recommended for high-security environments.
- **Multiple output formats**: HTML summary, CSV per section/finding, JSON summary, optional XLSX
- **File browser**: all generated files stored per report, browsable and downloadable individually
- **Tenancy filter**: filter reports by tenancy in the Downloads tab
- Region filtering with multi-select
- Real-time progress tracking with phase-based progress bar
- **CIS Engine auto-update**: check for new versions of `cis_reports.py` from Oracle's GitHub repository and update with one click (admin only). Custom patches are automatically reapplied after update
### 🛡️ Built-in CIS MCP Server (Granular Per-Section)
- **Auto-registered** CIS Compliance Scanner MCP server — available out of the box
- **12 granular tools** instead of monolithic full-tenancy scan:
- `cis_scan_iam` — IAM checks (CIS 1.1–1.17): users, policies, groups, MFA, API keys
- `cis_scan_networking` — Network checks (CIS 2.1–2.8): security lists, NSGs, VCNs
- `cis_scan_compute` — Compute checks (CIS 3.1–3.3): instance metadata, monitoring
- `cis_scan_logging_monitoring` — Logging/Monitoring checks (CIS 4.1–4.17): audit, alarms, events
- `cis_scan_storage` — Storage checks (CIS 5.1–5.3): buckets, block volumes, file systems
- `cis_scan_asset_management` — Asset checks (CIS 6.1–6.2): compartments, tagging
- `cis_list_configs` / `cis_list_checks` — list available OCI configs and CIS checks
- `cis_get_check` / `cis_get_remediation` — detailed findings and remediation guidance
- `cis_get_scan_status` / `cis_invalidate_cache` — session status and cache management
- **Per-section data collection**: each scan tool collects only the OCI data needed for that section, avoiding unnecessary API calls
- **Session caching**: collected data is cached per config, so subsequent scans on different sections reuse shared prerequisites (compartments, identity domains)
- Based on Oracle's official `cis_reports.py` (6660 lines, 48 CIS + 11 OBP checks)
### 🔌 MCP Server Registry + Tool Discovery
- Register multiple MCP servers (stdio, SSE, Python module)
@@ -289,8 +312,9 @@ Allow group <group-name> to read buckets in compartment <compartment-name>
```
oci-cis-agent/
├── backend/
│ ├── app.py # FastAPI application (~2200 lines)
│ ├── cis_runner.py # CIS Benchmark check executor
│ ├── app.py # FastAPI application (~2600 lines)
│ ├── cis_reports.py # Oracle CIS Benchmark checker (6660 lines, report engine)
│ ├── mcp_cis_server.py # MCP server with 12 granular CIS tools
│ ├── Dockerfile # Python 3.12 + OCI CLI
│ └── requirements.txt # Dependencies
├── frontend/
@@ -398,6 +422,16 @@ oci-cis-agent/
| GET | `/api/reports` | List reports |
| GET | `/api/reports/{id}/html` | View HTML report |
| GET | `/api/reports/{id}/download` | Download report |
| GET | `/api/reports/{rid}/files` | List report files by category |
| GET | `/api/reports/{rid}/files/{fid}/download` | Download individual report file |
### CIS Engine
| Method | Endpoint | Description |
|--------|----------|-------------|
| GET | `/api/cis-engine/version` | Current CIS engine version |
| GET | `/api/cis-engine/check-update` | Check GitHub for newer version (admin) |
| POST | `/api/cis-engine/update` | Download + apply update with patches (admin) |
### Config Logs
@@ -534,6 +568,7 @@ All models include OCID mapping for `us-ashburn-1`. For other regions, use the "
| GenAI | `oci.generative_ai_inference` |
| Container | Docker Compose, Nginx reverse proxy |
| MCP | Model Context Protocol SDK (stdio/SSE) with tool discovery + execution |
| CIS Scanner | Oracle CIS Foundations Benchmark 3.0 checker (`cis_reports.py`) |
---
@@ -541,6 +576,9 @@ All models include OCID mapping for `us-ashburn-1`. For other regions, use the "
| Version | Date | Changes |
|---------|------|---------|
| **v1.8** | 2026-03 | CIS Engine auto-update from Oracle GitHub with automatic patch reapplication, version check UI card (admin), new `/api/cis-engine/*` endpoints, report file listing and individual download endpoints |
| **v1.7** | 2026-03 | Oracle official CIS report engine (replaces lightweight checker), granular report parameters (Level, OBP, Raw Data, Redact), per-report file storage with category browser, tenancy filter in Downloads, individual file download |
| **v1.6** | 2026-03 | Granular CIS MCP server (12 per-section scan tools: IAM, Networking, Compute, Logging/Monitoring, Storage, Asset Management), chat memory compaction with LLM-based summarization, GenAI tool use loop fix (accumulated conversation), chat thinking indicator, auto-registered CIS MCP server |
| **v1.5** | 2026-03 | MCP Tool Use in Chat (GenAI function calling with auto tool discovery + execution via MCP SDK), multi-table ADB vector search, preview chunks before embedding, enriched embeddings with tenancy/regions/compartments, searchable dropdowns, editable vector tables, orphaned report cleanup on restart |
| **v1.4** | 2026-03 | In-place config editing, 69 chat + 11 embedding models with OCID resolution (OpenAI GPT-5.3/5.2/5.1/5/4.1/4o/Codex/Image/Audio, xAI, Google, Meta, ProtectAI), OpenAI Text Embedding 3, custom OCID support, wallet auto-parse with DSN extraction |
| **v1.3** | 2026-03 | Persistent config logs per tab, GenAI auto-fill from OCI credentials, inline UX feedback with loading spinners, MCP type-switch fix, encrypted key passphrase support, Docker stdin hang fix |