Shiftleft CICD Integration

ivanmar — Thu, 25 Feb 2021 17:20:08 GMT

In this post, we are going to show how to integrate Shiflett into a modern CI/CD orchestrator like Gitlab. We will take the perspective of an application developer that integrates Shiftleft blades into the CI/CD pipeline and how leverages Shiftleft information to start solving vulnerabilities detected in the code, container image that the pipeline build as well as an infrastructure project that uses Terraform.

The following is a short description of Shiftleft modules also known as blades:

code-scan: Using as input a directory that contains a Git repository, Shiftleft will scan it for vulnerabilities, weak coding practices, sensitive content, and malicious files among other categories
image-scan: Using as input a container image, compressed into a file, this blade will apply all the capabilities already provided by code-scan and will add on top of that the scanning of OS-level packages included in the container image.
iac-assessment: In combination with CloudGuard, Infrastructure as code assessment allows users to apply policies to their Terraform projects. The mechanism to define those rules is by making use of CloudGuard Governance Specification Language (GSL). A high-level, human-friendly language.

Re: Shiftleft CICD Integration

Daniel_Kavan — Thu, 30 May 2024 16:31:39 GMT

Can shiftleft be used for on premise security or just cloud? We are using Kubernetes & podman on premise.

Re: Shiftleft CICD Integration

StuartGreen — Wed, 05 Jun 2024 11:55:40 GMT

Yes if you're running a locally hosted solution like Gitlab or Jenkins it can work there too - you just need to authenticate it against your CloudGuard solution.

topic Re: Shiftleft CICD Integration in DevSecOps

Shiftleft CICD Integration

Re: Shiftleft CICD Integration

Re: Shiftleft CICD Integration