philipp.baumann/dse-security-reports
Watch
0
0
Fork
You've already forked dse-security-reports
 0
Code Issues 1 Pull requests Releases Activity

feat: add deterministic Defender report skeleton (synthetic fixture pipeline) #1

Merged
Philipp Baumann merged 2 commits from fm/dse-security-reports-skeleton into main 2026-10-26 15:19:23 +00:00
Conversation 0 Commits 2 Files changed 7 +743 -3
Philipp Baumann commented 2026-10-26 15:09:46 +00:00
Owner
Copy link

Summary

Create a basic skeleton for deterministic security reports over the two Microsoft Defender vulnerability exports, modeled on the deterministic Typst approach of cli-cloud-bi.
A Justfile drives a synthetic-fixture -> derive -> render pipeline, a stdlib-only Python derivation turns the export CSVs into canonical sorted JSON, and a German, data-driven Typst template renders byte-identical PDFs with typst compile --root . --creation-timestamp 0.
The skeleton runs entirely on a clearly-marked synthetic fixture; real Defender data never leaves gitignored .local/.

What changed

  • Justfile: recipes fixture, derive, report, all, repro (byte-identical PDF check), and local.
  • scripts/make_fixture.sh: generates small synthetic CSVs of both export shapes under .local/samples/ with fake SYNTH-* devices and impossible CVE-0000-* ids.
  • scripts/derive_findings.py: deterministic CSV -> JSON derivation (stdlib only): canonical, sorted findings plus aggregates (per system, exploit availability, CVSS, severity, per software), no timestamps, no locale-dependent formatting, stable key order, atomic writes.
  • reports/defender-findings.typ: German report in the cli-cloud-bi header-block style, standard library only (no @preview imports); per export it shows totals, findings per system, exploit availability, CVSS/severity distribution with bar visualization, and per-software aggregation; it always states that the two exports use different filters (no temporal comparison) and that findings may be false positives pending triage.
  • README.md: documents the pipeline, sensitive-data handling, and planned follow-ups (real-data analysis/triage, dse-ansible/dse-opentofu challenge, Azure API integration).
  • AGENTS.md + CLAUDE.md: project agent notes (pipeline, determinism, sensitive-data, DSE forge/fj rules).

Behaviour change

The repository now contains a working, reproducible report pipeline that renders a 4-page German analysis/triage template from the synthetic fixture without any real data; identical inputs produce identical PDF bytes, verified by just repro.

Instructions-PR: none

## Summary Create a basic skeleton for deterministic security reports over the two Microsoft Defender vulnerability exports, modeled on the deterministic Typst approach of cli-cloud-bi. A Justfile drives a synthetic-fixture -> derive -> render pipeline, a stdlib-only Python derivation turns the export CSVs into canonical sorted JSON, and a German, data-driven Typst template renders byte-identical PDFs with `typst compile --root . --creation-timestamp 0`. The skeleton runs entirely on a clearly-marked synthetic fixture; real Defender data never leaves gitignored `.local/`. ## What changed - `Justfile`: recipes `fixture`, `derive`, `report`, `all`, `repro` (byte-identical PDF check), and `local`. - `scripts/make_fixture.sh`: generates small synthetic CSVs of both export shapes under `.local/samples/` with fake `SYNTH-*` devices and impossible `CVE-0000-*` ids. - `scripts/derive_findings.py`: deterministic CSV -> JSON derivation (stdlib only): canonical, sorted findings plus aggregates (per system, exploit availability, CVSS, severity, per software), no timestamps, no locale-dependent formatting, stable key order, atomic writes. - `reports/defender-findings.typ`: German report in the cli-cloud-bi header-block style, standard library only (no `@preview` imports); per export it shows totals, findings per system, exploit availability, CVSS/severity distribution with bar visualization, and per-software aggregation; it always states that the two exports use different filters (no temporal comparison) and that findings may be false positives pending triage. - `README.md`: documents the pipeline, sensitive-data handling, and planned follow-ups (real-data analysis/triage, dse-ansible/dse-opentofu challenge, Azure API integration). - `AGENTS.md` + `CLAUDE.md`: project agent notes (pipeline, determinism, sensitive-data, DSE forge/fj rules). ## Behaviour change The repository now contains a working, reproducible report pipeline that renders a 4-page German analysis/triage template from the synthetic fixture without any real data; identical inputs produce identical PDF bytes, verified by `just repro`. Instructions-PR: none 
- Add a Justfile with fixture, derive, report, all, and repro recipes
  modeled on cli-cloud-bi.
- Add scripts/make_fixture.sh that generates small synthetic CSVs of both
  Defender export shapes under gitignored .local/samples/ (SYNTH-* devices,
  CVE-0000-* ids).
- Add scripts/derive_findings.py, a stdlib-only deterministic derivation
  from CSV to canonical, sorted JSON in .local/derived/ (no timestamps,
  no locale-dependent formatting, stable key order, atomic writes).
- Add reports/defender-findings.typ, a German, data-driven report in the
  cli-cloud-bi header-block style: per export it shows totals, findings
  per system, exploit availability, CVSS and severity distribution with
  bar visualization, and per-software aggregation; it always states that
  the two exports use different filters (no temporal comparison) and that
  findings may be false positives pending triage.
- Render with typst compile --root . --creation-timestamp 0 so identical
  input bytes produce byte-identical PDFs; just repro verifies this.
- Document setup, sensitive-data handling, and planned follow-ups in the
  README; add project notes to AGENTS.md.
- Add a synthetic triage sidecar (triage.csv) to the fixture: per-CVE
  description, verification stage (sh/just/az/ansible/opentofu),
  false-positive and follow-up flags; Defender export CSVs keep their
  original column shapes.
- Extend scripts/derive_findings.py: optional triage merge, per-finding
  stable CveId@Device key, importance rank (exploit-available first,
  then CVSS descending), per-system and per-CVE groupings with affected
  devices and software so one problem can be dispatched as one unit.
- Extend reports/defender-findings.typ with a per-CVE triage table
  (CVE, description, verification stage, false positive, follow-up,
  affected systems), importance-sorted and rendered as plain Typst
  tables from the standard library.
- Document the dispatch structure, triage sidecar, and follow-ups in
  the README; record the sidecar and dispatch notes in AGENTS.md.
Philipp Baumann deleted branch fm/dse-security-reports-skeleton 2026-10-26 15:19:24 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
philipp.baumann/dse-security-reports!1
No description provided.