Add metric DocumentCSAFRedRestricted

metrics/CSAF/DocumentCSAFRedRestricted/DocumentCSAFRedRestricted.yaml

@@ -0,0 +1,9 @@
+--- # Metadata
+- id: DocumentCSAFRedRestricted
+- description: This rule assesses whether a [SecurityAdvisoryDocument] that provides the property [RemoteDocumentLocation] is access protected by ensuring that the [noAuthentication] property is not utilized.
+- version: 1.0 
+- comments: A SecurityAdvisoryDocument labeled as "Amber" or "Red" must be protected by access controls. The specification can be found at https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html#715-requirement-5-tlpamber-and-tlpred. 
+--- # Configuration data
+- p1:
+  - operator: ==
+  - targetValue: true

metrics/CSAF/DocumentCSAFRedRestricted/data.json

@@ -0,0 +1,4 @@
+{
+    "operator": "==",
+    "target_value": true
+}

metrics/CSAF/DocumentCSAFRedRestricted/metric.rego

@@ -0,0 +1,25 @@
+package metrics.csaf.document_csaf_red_restricted
+
+import data.compare
+import rego.v1
+import input as document
+
+default applicable := false
+
+default compliant := false
+
+restricted := ["RED", "AMBER"]
+
+applicable if {
+	# check resource type
+	"SecurityAdvisoryDocument" in document.type
+
+	# check, if document is restricted (i.e. RED/AMBER) labeled
+	document.labels.tlp in restricted
+}
+
+compliant if {
+	# RED/AMBER must NOT be freely accessible
+	auth := document.documentLocation.remoteDocumentLocation.authenticity
+	not auth.noAuthentication
+}

resources/jsonExamples/SecurityAdvisoryDocument.json

@@ -0,0 +1,43 @@
+{
+    "creationTime": "2020-07-01T10:09:07Z",
+    "documentLocation": {
+        "remoteDocumentLocation": {
+            "authenticity": {
+                "certificateBasedAuthentication": {}
+            },
+            "path": "https://127.0.0.1:62479/.well-known/csaf/white/2020/some-id.json",
+            "transportEncryption": {
+                "cipherSuites": [
+                    {
+                        "authenticationMechanism": "",
+                        "keyExchangeAlgorithm": "",
+                        "macAlgorithm": "SHA-256",
+                        "sessionCipher": "AES-128-GCM"
+                    }
+                ],
+                "enabled": true,
+                "enforced": false,
+                "protocol": "TLS",
+                "protocolVersion": 1.3
+            }
+        }
+    },
+    "filetype": "JSON",
+    "id": "some-id",
+    "labels": {
+        "tlp": "RED"
+    },
+    "name": "Buffer overflow in Test Product",
+    "raw": "",
+    "schemaValidation": {
+        "errors": [],
+        "format": "Common Security Advisory Framework",
+        "schemaUrl": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json"
+    },
+    "securityFeatures": [],
+    "type": [
+        "SecurityAdvisoryDocument",
+        "Document",
+        "Resource"
+    ]
+}