ComplianceAsCode / ComplianceAsCode/auditree-harvest

Harvest orchestrator/aggregator

Open
#3 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
17
Forks
6
PR merge metrics
No merged PRs in 30d

Description

## Overview

Multiple harvest reports may need to be run to answer an audit, and possibly their results will need aggregating into a single file, for example an [OSCAL Assessment Result](https://pages.nist.gov/OSCAL/documentation/schema/assessment-results-layer/assessment-results/). We should facilitate this in Harvest or with tooling "around" it.

## Requirements

- multiple reports can be run from a single invocation
- their results can be combined

## Approach

- I think you're going to need to identify reports that can be combined (e.g. that are producing reports in the same format) and have some kind of plugin/awareness per "type". Maybe that's just OSCAL, though?
- It would be nice if this were done as a "report of reports" in vanilla harvest - maybe that's possible already?

## Security and Privacy

_Provide the impact on security and privacy as it relates to the completion of
this issue. This level of detail may not be available at the time of
issue creation and can be completed at a later time. N/A if not applicable._

## Test Plan

_Provide the test process that will be followed to adequately verify that the
approach above satisfies the requirements provided. This level of detail may
not be available at the time of issue creation and can be completed at a later
time._

Contributor guide

Open the contributing guide

Research direction

Start by examining how Harvest currently invokes individual reports and how each report represents its output. Determine how a single invocation could run multiple compatible reports and combine their results, using OSCAL Assessment Results as the stated example. Done means both requirements are supported and the approach has a documented test process.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devops
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.