awslabs/automated-security-helper
Automated Security Helper
El asistente de seguridad automatizado es una utilidad de línea de comandos diseñada para orquestar múltiples herramientas de análisis de seguridad en un flujo de trabajo unificado y basado en configuración. Funciona como un motor central que ejecuta pruebas de seguridad de aplicaciones estáticas y escaneos de infraestructura, agregando diversas salidas de herramientas en un formato estandarizado legible por máquina para garantizar una detección de vulnerabilidades consistente a lo largo de los ciclos de vida de desarrollo.
La herramienta se distingue por una arquitectura de plugins modular que permite la integración de escáneres personalizados o propietarios, junto con una capa de inteligencia externa que transmite los hallazgos a servicios de inteligencia artificial para el análisis de remediación automatizado. Al admitir formatos de informes estandarizados como SARIF, permite una revisión y seguimiento consistentes de los hallazgos de seguridad en varias plataformas de informes y sistemas de monitoreo.
Más allá de sus capacidades de orquestación central, el framework facilita la verificación de cumplimiento automatizada y la aplicación de políticas de seguridad. Se integra directamente en entornos de desarrollo locales y tuberías de integración continua, permitiendo a los equipos definir parámetros de escaneo específicos, umbrales de severidad y exclusiones de archivos para adaptar el análisis de seguridad a los requisitos del proyecto.
Features
- Scanner Orchestrators - Orchestrates multiple security analysis tools into a unified, configuration-driven workflow for automated vulnerability detection.
- Security Vulnerability Scanning - Runs automated security checks across projects to identify vulnerabilities and misconfigurations within codebases and infrastructure.
- Vulnerability Scanning Orchestration - Coordinates multiple static analysis and infrastructure scanners into a unified security scanning pipeline.
- Configuration-Driven Scanning Engines - Uses declarative configuration files to define and execute multi-step automated security workflows.
- CLI Execution - Operates as a standalone command-line utility for seamless integration into local environments and CI pipelines.
- Security Report Exports - Converts security scan results into standardized machine-readable and human-readable formats like SARIF, JSON, and HTML.
- Security Scanning Integrations - Embeds vulnerability scanning directly into automated deployment pipelines to catch misconfigurations before production.
- Static Analysis Security Testing - Identifies potential vulnerabilities within source code and infrastructure configurations using automated static analysis.
- Plugin-Based - Coordinates multiple independent security analysis tools into a unified workflow and aggregates their output.
- AI Service Integrations - Connects local security scan results to external artificial intelligence services for automated remediation analysis.
- Security Analysis Assistants - Shares scan results with AI assistants to receive automated vulnerability analysis and remediation suggestions.
- DevSecOps Integration - Provides a utility for embedding automated security checks into local development environments and continuous integration workflows.
- Schema-Driven Data Normalizers - Standardizes heterogeneous security tool outputs into a consistent schema for unified data processing.
- Security and Compliance - Facilitates automated compliance verification and security policy enforcement throughout the development lifecycle.
- Security Finding Management - Coordinates multiple security analysis tools and standardizes their output for easier review and remediation tracking.
- Automated Security Remediation - Analyzes security scan results with artificial intelligence to provide actionable suggestions for fixing code weaknesses.
- Security Report Generation - Generates detailed summaries of security findings to support human review and integration with external tracking systems.
- Security Reporting Tools - Standardizes security findings into consistent formats to facilitate interoperability with development environments and monitoring dashboards.
- Development Integration Workflows - Embeds security checks into local environments and CI/CD pipelines to maintain consistent vulnerability detection.
- Security Compliance Automations - Automates compliance checks during development to ensure code meets safety policies and organizational standards.
- Modular Plugin Architectures - Provides a modular architectural framework that allows developers to inject custom scripts or proprietary tools into the scanning pipeline.
