|
| 1 | +[](https://opensource.org/licenses/Apache-2.0) |
| 2 | + |
1 | 3 | # Minder Rules and Profiles |
2 | 4 |
|
3 | | -A repository containing Minder rules and profiles recommended by your friends at Stacklok |
| 5 | +A repository containing Minder rules and profiles describing security policies and various tool integrations. |
| 6 | + |
| 7 | +## What are rule types, profiles, and data sources? |
| 8 | + |
| 9 | +Minder is a tool that allows you to define security policies and integrate with various tools to enforce those policies. |
| 10 | +Its engine is designed to be extensible through rule types, profiles and data sources, allowing you to integrate your own |
| 11 | +logic and processes. |
| 12 | + |
| 13 | +A profile defines your security policies that you want to apply to your software supply chain. Profiles contain rules |
| 14 | +(or rule types) that query data in a provider, and specifies whether Minder will issue alerts or perform automatic |
| 15 | +remediations when an entity is not in compliance with the policy. |
| 16 | + |
| 17 | +Profiles in Minder allow you to group and manage rules for various entity types, such as `repositories`, `pull requests`, |
| 18 | +`artifacts`, etc., across your registered GitHub repositories. |
| 19 | + |
| 20 | +Data sources are designed to enrich the information available about an entity, allowing us to make more informed policy |
| 21 | +evaluations. |
| 22 | +Unlike providers, which create entities, a data source offers additional information about an existing entity or one of |
| 23 | +its specific attributes. |
| 24 | +The entity itself, however, always originates from a provider. |
| 25 | + |
| 26 | +## How to get started with writing rules and profiles? |
4 | 27 |
|
5 | | -# Rules types |
| 28 | +To get started with writing rules and profiles, you can check the following resources: |
| 29 | +- [How to write a rule type](https://mindersec.github.io/how-to/custom-rules) |
| 30 | +- [How to write a rule type using Rego](https://mindersec.github.io/how-to/writing-rules-in-rego) |
| 31 | +- [How to use mindev to develop and debug rule types](https://mindersec.github.io/how-to/mindev) |
| 32 | +- [How to write rules and profiles - YouTube](https://www.youtube.com/watch?v=eXp0nyd72d4) |
| 33 | +- [Minder documentation](https://mindersec.github.io) |
| 34 | +- [Rego language tutorial](https://www.openpolicyagent.org/docs/latest/policy-language/) |
6 | 35 |
|
7 | | -Reference rule types are available in the `rule-types` directory. To take these rule types |
8 | | -into use, you'll need to instantiate them in a Minder instance. For example, to use the |
9 | | -reference rules recommended for GitHub, use the following command: |
10 | | - |
11 | | -```bash |
12 | | -minder ruletype create -f rule-types/github |
13 | | -``` |
| 36 | +Apart from that, you can also check the reference rules and profiles in this repository to get an idea of how to write, structure, and organize them. |
14 | 37 |
|
15 | | -# Profiles |
| 38 | +- Rule types: the reference rule types are available in the `rule-types` directory. To take these rule types |
| 39 | + into use, you'll need to instantiate them in a Minder instance. For example, to use the |
| 40 | + reference rules recommended for GitHub, use the following command - `minder ruletype create -f rule-types/github`. |
| 41 | +- Profiles: the reference profiles are available in the `profiles` directory. To take a profile |
| 42 | + into use, you'll need to instantiate it in a Minder instance. For example, to use the |
| 43 | + reference profile recommended for GitHub, use the following command - `minder profile create -f profiles/github/profile.yaml`. |
| 44 | +- Data sources: the reference data sources are available in the `data-sources` directory. To take a data source |
| 45 | + into use, you'll need to instantiate it in a Minder instance. For example, to instantiate the |
| 46 | + reference data source for using OSV as a data source, use the following command - `minder datasource create -f data-sources osv.yaml`. |
16 | 47 |
|
17 | | -Reference profiles are available in the `profiles` directory. To take a profile |
18 | | -into use, you'll need to instantiate it in a Minder instance. For example, to use the |
19 | | -reference profile recommended for GitHub, use the following command: |
| 48 | +## How to contribute? |
20 | 49 |
|
21 | | -```bash |
22 | | -minder profile create -f profiles/github/profile.yaml |
23 | | -``` |
| 50 | +We welcome contributions! |
| 51 | +If you came across a rule type, profile, or data source that you think would be useful to others, please consider contributing it back to the community. |
24 | 52 |
|
25 | | -# Data Sources |
| 53 | +If you have questions or need help getting started, feel free to reach out on the [`#minder` channel on OpenSSF Slack](https://openssf.slack.com/archives/C07SP9RSM2L) or open an issue. |
26 | 54 |
|
27 | | -Reference data sources are available in the `data-sources` directory. To take a data source |
28 | | -into use, you'll need to instantiate it in a Minder instance. For example, to instantiate the |
29 | | -reference data source for using OSV as a data source, use the following command: |
| 55 | +You can check our [CONTRIBUTING.md](CONTRIBUTING.md) guidelines for more information on how to contribute to this repository. |
30 | 56 |
|
31 | | -```bash |
32 | | -minder datasource create -f data-sources osv.yaml |
33 | | -``` |
| 57 | +## License |
34 | 58 |
|
| 59 | +This repository is licensed under the [Apache 2.0 License](./LICENSE). |
0 commit comments