{match[5]});
} else if (match[6]) {
parts.push({match[7]});
} else if (match[8]) {
parts.push({match[9]});
}
lastIndex = match.index + match[0].length;
}
if (lastIndex < text.length) parts.push(text.slice(lastIndex));
if (parts.length === 0) return text;
const keyRef = {
current: keyIndex
};
return expandHtmlTags(parts, keyRef);
};
const processBadges = text => {
if (!text || typeof text !== 'string') return text;
if (YES_RE.test(text)) return ✓;
if (NO_RE.test(text)) return ✗;
if (LIMITED_RE.test(text)) return ◐;
return processText(text);
};
const expandSimpleTags = (str, keyRef) => {
const result = [];
let last = 0;
SIMPLE_TAG_RE.lastIndex = 0;
let m;
while ((m = SIMPLE_TAG_RE.exec(str)) !== null) {
if (m.index > last) result.push(str.slice(last, m.index));
if (m[1]) {
result.push(); } else if (m[2]) { result.push(
,
); } else if (m[3]) { result.push(Note: ); } else if (m[4]) { result.push(Warning: ); } last = m.index + m[0].length; } if (last < str.length) result.push(str.slice(last)); return result; }; const expandHtmlTags = (chunks, keyRef) => { const out = []; for (const chunk of chunks) { if (typeof chunk === 'string') { out.push(...expandSimpleTags(chunk, keyRef)); } else { out.push(chunk); } } return out; }; const extractText = node => { if (node === null || node === undefined) return ''; if (typeof node === 'string') return node; if (typeof node === 'number') return String(node); if (typeof node === 'boolean') return ''; if (Array.isArray(node)) return node.map(extractText).join(''); if (node && typeof node === 'object' && node.type) { const props = node.props || ({}); if (typeof props.children === 'string') return props.children; if (props.children) return extractText(props.children); return ''; } return String(node || ''); }; const [mounted, setMounted] = useState(false); useEffect(() => { setMounted(true); }, []); const data = useMemo(() => { if (propData) return propData; if (content && typeof content === 'string') return parseYamlTableContent(content); if (!children) return []; if (typeof children === 'string') return parseYamlTableContent(children); const childrenArray = Array.isArray(children) ? children : [children]; return parseYamlTableContent(childrenArray.map(extractText).join('').trim()); }, [children, propData, content]); const columns = useMemo(() => { if (!data || data.length === 0) return []; const firstRow = data[0]; if (!firstRow || typeof firstRow !== 'object') return []; return Object.keys(firstRow); }, [data]); if (!mounted) return null; if (!data || data.length === 0) return null; const rowKey = row => columns.map(c => row[c] || '').join('|'); return
| {col.replaceAll('_', ' ')} | )}
|---|
| {processBadges(row[col])} | )}
4. Enter the unique **Rule Identifier** and **Rule Name**.
5. Enter the **Description** of the secret rule.
6. Enter the regex for the secret rule in **Detection Rule**.
7. Enter keywords for pre-regex check filtering as comma separated values in **Keywords**.
8. Optionally, enter the minimum Shannon entropy a regex group must have to be considered in **Entropy**.
9. Optionally, add validation details to validate the secret:
* **Validation URL**: Enter the URL for validation.
* **Validation Method**: Choose between GET and POST methods.
* **Success Response Codes**: Enter valid response codes (For example, `200` for HTTP Status OK)
* **Failure Response Codes**: Enter invalid response codes (For example, `401` for HTTP Status Unauthorized)
* **Authorization Details**: You can choose between Authorization Header, Bearer Token, and Basic Authentication.
10. Select **Propagate this rule to all child namespaces** to apply the secret rule to all child namespaces.
11. Click **Add Rule**.
### Create secret rules from the command line
For example, consider a token "demo\_value123" can be described using a regular expression. Here is an example of the rule specification:
```bash theme={null}
"meta": {
"name": "Demo Token"
},
"spec": {
"disabled": false,
"keywords": [
"demo_"
],
"regex": "demo_[0-9a-zA-Z]{20}",
"rule_id": "demo-rule"
}
```
Use the following command from the CLI to create this custom rule.
```bash expandable theme={null}
$ endorctl api create -r SecretRule -n demo \
> --data '{
> "meta": {
> "name": "Demo Token"
> },
> "spec": {
> "disabled": false,
> "keywords": [
> "demo_"
> ],
> "regex": "demo_[0-9a-zA-Z]{20}",
> "rule_id": "demo-rule"
> }
> }'
INFO: Initiating host-check ...
INFO: Host-check complete
{
"meta": {
"create_time": "2023-09-27T17:08:18.436936Z",
"kind": "SecretRule",
"name": "Demo Token",
"update_time": "2023-09-27T17:08:18.436936Z",
"upsert_time": "2023-09-27T17:08:18.436936Z",
"version": "v1"
},
"spec": {
"disabled": false,
"keywords": [
"demo_"
],
"regex": "demo_[0-9a-zA-Z]{20}",
"rule_id": "demo-rule"
},
"tenant_meta": {
"namespace": "demo"
},
"uuid": "65146182aaeeffbaf5b6b553"
}
```
After the rule is created, the system uses this rule to detect this category of secrets.
If you can validate the secret using an HTTP request, then you can also add [validation](#validator) to this rule. See the following example for creating a validation rule for a demo\_test123 token.
```bash theme={null}
curl -H "Authorization: Bearer "demo_test123" https://api.testserver.com/user
```
Then the validation specification can be:
```bash expandable theme={null}
"validation": {
"name": "Demo secrets validator",
"http_request": {
"header": [
{
"key": "Bearer",
"value": "{{.AuthzValue}}",
"authz": true
}
],
"method": "GET",
"uri": "https://api.testserver.com/user"
},
"http_response": {
"failed_auth_codes": [
401
],
"successful_auth_codes": [
200
]
}
}
```
#### Validator
You can use a validator to check if a discovered secret is valid or not. The Endor Labs system rules for secrets include the necessary validator. When you validate a secret, the finding for that secret is categorized as critical, ensuring it receives higher priority compared to others.
When defining a custom rule, you can add your own validator from the command line or from the user interface. The system uses this information to send an HTTP request such as a GET or POST to the address specified by the public service for the detected secret.
For example, when a GitHub Personal Access Token named "ghp\_endor123" is detected, the system sends the following HTTP request to GitHub's address:
```bash theme={null}
curl -H "Authorization: Token "ghp_endor123" https://api.github.com/user
```
The authentication codes defined by the service are used to mark the secrets as valid or invalid.
The validation portion of the secret rule contains the following fields:
3. Select the rule for which you want to view the details.
The rule details appear in the right sidebar.
### Clone a secret rule
Click the three vertical dots on the right side of the rule and select **Clone Rule**.
The cloned rule appears in the list of secret rules and you can edit it.
### Edit a secret rule
Click the three vertical dots on the right side of the rule and select **Edit Rule**.
You can only edit the custom rules that you created or the system rules that you cloned.
### Fetch secret rules with endorctl
To fetch the Endor Labs secret scanning rules from the command line type the following commands:
```bash theme={null}
endorctl api list -r SecretRule -n