Taskfile.yml

version: '3'

# Tool versions: Go is pinned in .tool-versions at the repo root (golang 1.21.13), and event-generator is managed via the install-tools task.
# Use `mise install` or `asdf install` to activate Go.

tasks:
  install-tools:
    desc: Install the falcosecurity event-generator binary
    cmds:
      - |
        if [ ! -f ./event-generator ]; then
          wget -qO- https://github.com/falcosecurity/event-generator/releases/download/v0.12.0/event-generator_0.12.0_linux_amd64.tar.gz | tar xvz event-generator
          chmod +x event-generator
        fi
    status:
      - test -f ./event-generator

  install-rsigma:
    desc: Install the timescale rsigma binary
    cmds:
      - |
        if [ ! -f ./rsigma ]; then
          wget -qO- https://github.com/timescale/rsigma/releases/download/v0.19.0/rsigma-x86_64-unknown-linux-gnu.tar.gz | tar xvz ./rsigma
          chmod +x rsigma
        fi
    status:
      - test -f ./rsigma

  validate-falco-rules:
    desc: Validate custom Falco rules with the Falco binary via Docker
    vars:
      FALCO_IMAGE: '{{.FALCO_IMAGE | default "falcosecurity/falco:0.45.0"}}'
    cmds:
      - |
        docker run --rm \
          -v "$(pwd)/rules:/rules:ro" \
          --entrypoint /usr/bin/falco \
          {{.FALCO_IMAGE}} \
          -r /rules/persistence_techniques.yaml \
          --list rules

  test-osquery:
    desc: Verify osquery configuration using osqtool
    cmds:
      - "mise exec go@1.21.13 -- go test -v ./tests/harness_test.go -run TestSecurityHarnesses/test-osquery"

  test-falco:
    desc: Run event-generator to test Falco rules
    deps:
      - install-tools
    cmds:
      # We ignore exit status here so it doesn't halt pipeline if it's run locally without root
      - "mise exec go@1.21.13 -- go test -v ./tests/harness_test.go -run TestSecurityHarnesses/test-falco"

  test:
    desc: Run minimal tests for osqtool and event-generator
    cmds:
      - task: test-osquery
      - task: test-falco
      - task: test-detection-coverage

  bootstrap-caldera:
    desc: Clone CALDERA and initialize stockpile ability data under .data/
    cmds:
      - uv run python tools/caldera_otel_harness.py bootstrap

  list-safe-caldera-abilities:
    desc: List curated Linux-safe CALDERA stockpile abilities for host execution
    cmds:
      - uv run python tools/caldera_otel_harness.py list-safe-abilities

  test-host-emulation:
    desc: Execute a safe CALDERA ability on the host and verify OTEL trace ingestion
    cmds:
      - uv run python -m pytest tests/test_caldera_otel_integration.py --run-stack --run-host-emulation -v

  test-caldera-detection-coverage:
    desc: Run CALDERA live coverage tests and write a JSON coverage artifact
    cmds:
      - uv run python -m pytest tests/test_caldera_detection_coverage.py tests/test_caldera_otel_integration.py --run-stack --run-host-emulation -v

  test-detection-coverage:
    desc: Validate MITRE tagging and structural coverage of Falco + OSquery configs (static, no live stack)
    cmds:
      - uv run python -m pytest tests/test_detection_coverage.py tests/test_falco_rules.py tests/test_osquery_config.py -v

  trigger-detections:
    desc: Safely trigger each custom detection rule and validate alert pipeline
    vars:
      FILTER: '{{.FILTER | default "all"}}'
    cmds:
      - bash ./tools/trigger-detections.sh {{.FILTER}}

  trigger-alerts:
    desc: Safely trigger innocent alerts across all pipelines (Falco, OSquery, ClamAV, Agent, RSigma) and notify desktop
    vars:
      STREAM: '{{.STREAM | default ""}}'
    cmds:
      - 'python3 tools/trigger_alerts.py {{if .STREAM}}--stream {{.STREAM}}{{else}}--all{{end}}'

  ensure-threat-intel:
    desc: Ensure .data/threat-intel exists with a valid default fragment so falco can boot
    cmds:
      - cmd: mkdir -p .data/threat-intel
      - cmd: test -f .data/threat-intel/falco_rules.threat_intel.local.yaml || cp rules/threat_intel/falco_rules.threat_intel.local.yaml .data/threat-intel/falco_rules.threat_intel.local.yaml

  sync-threat-intel:
    desc: Fetch Tor/VPN IPs, bad UAs, named pipes, and ransomware extensions into shared volumes
    deps:
      - ensure-threat-intel
    cmds:
      - uv run python tools/sync_threat_intel.py --output-dir .data/threat-intel --mount-dir /var/lib/threat-intel

  scan-image:
    desc: Scan a container image for CVEs with Grype (Issue #57)
    vars:
      IMAGE: '{{.IMAGE | default "alpine:3.10"}}'
      RUNTIME: '{{.RUNTIME | default "docker"}}'
    cmds:
      - mkdir -p .data/scanner && chmod 777 .data/scanner
      - "{{.RUNTIME}} compose --profile scan up -d scanner"
      - "{{.RUNTIME}} compose --profile scan exec -e SCAN_TARGET={{.IMAGE}} scanner sh -c 'grype \"{{.IMAGE}}\" -o json > /var/lib/scanner/scan.json'"
      - uv run python tools/parse_scanner_results.py .data/scanner/scan.json || true

  scan-registry:
    desc: Scan a container registry for vulnerabilities with Grype (Issue #57)
    vars:
      REGISTRY: '{{.REGISTRY | default "registry://ghcr.io"}}'
      RUNTIME: '{{.RUNTIME | default "docker"}}'
    cmds:
      - mkdir -p .data/scanner && chmod 777 .data/scanner
      - "{{.RUNTIME}} compose --profile scan up -d scanner"
      - "{{.RUNTIME}} compose --profile scan exec -e SCAN_TARGET={{.REGISTRY}} scanner sh -c 'grype \"{{.REGISTRY}}\" -o json > /var/lib/scanner/scan.json'"
      - uv run python tools/parse_scanner_results.py .data/scanner/scan.json || true

  download-osv-db:
    desc: Download the OSV vulnerability database for offline scans
    cmds:
      - mkdir -p .data/scanner && chmod 777 .data/scanner
      - mise exec osv-scanner -- osv-scanner scan source --recursive --offline --download-offline-databases --format json --output-file .data/scanner/osv-scan.json .

  scan-osv:
    desc: Scan repository dependencies with OSV-Scanner via mise (Issue #57)
    vars:
      TARGET: '{{.TARGET | default "."}}'
      OFFLINE: '{{.OFFLINE | default "false"}}'
    cmds:
      - mkdir -p .data/scanner && chmod 777 .data/scanner
      - rm -f .data/scanner/osv-scan.json
      - |
        if [ "{{.OFFLINE}}" = "true" ]; then
          mise exec osv-scanner -- osv-scanner scan source --recursive --offline --format json --output-file .data/scanner/osv-scan.json "{{.TARGET}}"
        else
          mise exec osv-scanner -- osv-scanner scan source --recursive --format json --output-file .data/scanner/osv-scan.json "{{.TARGET}}"
        fi

  secret-scan:
    desc: Scan the repo for leaked secrets with betterleaks (Issue #58, via mise)
    cmds:
      - mise exec betterleaks -- betterleaks dir --config .betterleaks.toml --redact --no-banner .

  jit-audit:
    desc: Revoke expired JIT access tickets (delete OpenObserve users, mark ledger revoked)
    cmds:
      - python3 tools/compliance_rbac_jit.py audit

  install-jit-timer:
    desc: Install the hourly systemd user timer that runs the JIT audit revocation cycle (Req-3)
    cmds:
      - bash ./scripts/install-jit-timer.sh --install

  jit-timer-status:
    desc: Show the JIT audit timer state (user scope)
    cmds:
      - bash ./scripts/install-jit-timer.sh --status

  remove-jit-timer:
    desc: Disable and remove the JIT audit timer
    cmds:
      - bash ./scripts/install-jit-timer.sh --remove

  compliance-ledger-audit:
    desc: Append current telemetry-config hashes to the tamper-evident audit ledger
    cmds:
      - python3 tools/compliance_audit_ledger.py audit

  verify-runtimes:
    desc: Boot the stack on Docker, Podman, and Nerdctl and run detection checks
    cmds:
      - bash ./scripts/verify-runtimes.sh

  update-yara:
    desc: Download and update YARA rules from Abuse.ch
    cmds:
      - bash ./tools/update_yara_rules.sh

  sync-oo-export:
    desc: Export dashboards and alerts from OpenObserve to local directory
    cmds:
      - bash ./tools/oo-dashboards.sh export
      - bash ./tools/oo-alerts.sh export

  sync-oo-import:
    desc: Import dashboards and alerts from local directory to OpenObserve
    cmds:
      - bash ./tools/oo-alerts.sh setup-destination
      - bash ./tools/oo-dashboards.sh import
      - bash ./tools/oo-alerts.sh import

  test-alerts:
    desc: Send a test notification through the webhook receiver
    cmds:
      - bash ./tools/oo-alerts.sh test

  oo-alerts-export:
    desc: Export OpenObserve alert definitions to local directory for GitOps
    cmds:
      - bash tools/oo-alerts.sh export

  oo-alerts-import:
    desc: Import OpenObserve alert definitions from local directory
    cmds:
      - bash tools/oo-alerts.sh import

  install-falco-system:
    desc: Install Falco 0.45.0 system-wide to /usr/bin/falco and /etc/falco (requires sudo)
    cmds:
      - bash scripts/install-falco-system.sh

  kill-switch:
    desc: Execute local kill switch action for a premapped ID (e.g. task kill-switch ID=718c5dbc-b1a3-419b-a329-e7721d294257)
    cmds:
      - python3 tools/kill_switch.py --id {{.ID}}

  kill-switch-list:
    desc: List all registered premapped IDs and automated mitigation actions
    cmds:
      - python3 tools/kill_switch.py --list

  notify-desktop:
    desc: Start host-side desktop alert notifier watching .data/alerts/
    cmds:
      - python3 tools/desktop_notifier.py

  notify-desktop-replay:
    desc: Visually trigger native desktop notifications for all queued alert JSONs
    cmds:
      - python3 tools/desktop_notifier.py --replay --once

  notify-desktop-dismiss:
    desc: Dismiss and clear all active/stuck on-screen desktop notification popups
    cmds:
      - python3 tools/desktop_notifier.py --dismiss

  install-minimal-libre-binaries:
    desc: Prepackage and install all minimal standalone Libre software binaries (rsigma, Falco, event-generator)
    deps:
      - install-rsigma
      - install-tools
    cmds:
      - 'echo "[*] Minimal standalone binaries installed: ./rsigma, ./event-generator"'
      - 'echo "[*] To install Falco system-wide, run: task install-falco-system"'

  bench:
    desc: Benchmark stack resource usage (RAM/SSD/CPU) against budgets
    vars:
      SCENARIO: '{{.SCENARIO | default "idle"}}'
      DURATION: '{{.DURATION | default "300"}}'
    cmds:
      - uv run python tools/bench_stack.py --scenario {{.SCENARIO}} --duration {{.DURATION}}

  bench-compare:
    desc: Compare the two most recent benchmark runs (or pass two run ids)
    cmds:
      - uv run python tools/bench_compare.py {{.CLI_ARGS}}

  rotate-logs:
    desc: Rotate the OTel-tailed log files once now (uses scripts/logrotate-localobserve.conf)
    cmds:
      - 'bash scripts/install-logrotate.sh --force || echo "logrotate failed; if permission denied run: sudo bash scripts/install-logrotate.sh --force"'

  check-ports:
    desc: Check if required published ports are in use by another process or daemon
    cmds:
      - bash scripts/check-ports.sh

  validate-otel-config:
    desc: Validate otel-collector-config.yaml with the pinned collector image
    cmds:
      - bash scripts/validate-otel-config.sh

  test-benchmarks:
    desc: Static validation of the benchmark harness and resource budgets
    cmds:
      - uv run python -m pytest tests/test_benchmarks.py -v

  agent-demo:
    desc: Run a synthetic AI agent session through the capture pipeline (issue #91)
    cmds:
      - uv run python tools/agent_session_demo.py

  test-agent-observability:
    desc: Static validation of the AI agent capture configuration
    cmds:
      - uv run python -m pytest tests/test_agent_observability.py tests/test_benchmarks.py -v