287 lines
9.1 KiB
JSON
287 lines
9.1 KiB
JSON
{
|
||
"schema_version": "kali_scan_scope_approval_v1",
|
||
"status": "draft_waiting_approval",
|
||
"date": "2026-05-13",
|
||
"source_host": {
|
||
"asset_key": "host:kali-112",
|
||
"ip": "192.168.0.112",
|
||
"role": "Kali 資安感測與掃描 API 主機"
|
||
},
|
||
"mode": "approval_only",
|
||
"scope_groups": [
|
||
{
|
||
"group_id": "kali_112_health",
|
||
"title": "Kali 112 health 與 scanner 狀態",
|
||
"default_mode": "observe",
|
||
"scan_level": "health_only",
|
||
"assets": [
|
||
{
|
||
"asset_key": "host:kali-112",
|
||
"target_type": "host",
|
||
"target": "192.168.0.112",
|
||
"environment": "infra",
|
||
"owner_team": "security-commander",
|
||
"allowed_scan_modes": [
|
||
"health_only",
|
||
"passive_inventory"
|
||
],
|
||
"approval_required": false,
|
||
"notes": "只允許 health / service / tool version 類觀測；不得啟動 active scan 或 /execute。"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"group_id": "dev_hosts_observe_only",
|
||
"title": "開發主機 111 / 168 observe-only 納管",
|
||
"default_mode": "observe",
|
||
"scan_level": "passive",
|
||
"assets": [
|
||
{
|
||
"asset_key": "host:dev-111",
|
||
"target_type": "host",
|
||
"target": "192.168.0.111",
|
||
"environment": "dev",
|
||
"owner_team": "dev-host-steward",
|
||
"allowed_scan_modes": [
|
||
"passive_inventory"
|
||
],
|
||
"approval_required": false,
|
||
"notes": "先納入資產地圖與 owner；任何 credentialed scan、active scan、service hardening 都要另走 approval。"
|
||
},
|
||
{
|
||
"asset_key": "host:dev-168",
|
||
"target_type": "host",
|
||
"target": "192.168.0.168",
|
||
"environment": "dev",
|
||
"owner_team": "dev-host-steward",
|
||
"allowed_scan_modes": [
|
||
"passive_inventory"
|
||
],
|
||
"approval_required": false,
|
||
"notes": "先納入資產地圖與 owner；不得把 dev host observation 直接變成 compliance blocker。"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"group_id": "core_runtime_hosts",
|
||
"title": "核心 runtime 主機健康與被動盤點",
|
||
"default_mode": "observe",
|
||
"scan_level": "passive",
|
||
"assets": [
|
||
{
|
||
"asset_key": "host:infra-110",
|
||
"target_type": "host",
|
||
"target": "192.168.0.110",
|
||
"environment": "infra",
|
||
"owner_team": "sre-security",
|
||
"allowed_scan_modes": [
|
||
"health_only",
|
||
"passive_inventory"
|
||
],
|
||
"approval_required": false,
|
||
"notes": "Gitea、Harbor、runner、monitoring 類控制面只做 read-only evidence；active port scan 需另批。"
|
||
},
|
||
{
|
||
"asset_key": "host:k3s-120",
|
||
"target_type": "host",
|
||
"target": "192.168.0.120",
|
||
"environment": "prod",
|
||
"owner_team": "sre-security",
|
||
"allowed_scan_modes": [
|
||
"health_only",
|
||
"passive_inventory"
|
||
],
|
||
"approval_required": false,
|
||
"notes": "K3s node 初期只接既有 health / metadata evidence，不改 RBAC 或 NetworkPolicy。"
|
||
},
|
||
{
|
||
"asset_key": "host:k3s-121",
|
||
"target_type": "host",
|
||
"target": "192.168.0.121",
|
||
"environment": "prod",
|
||
"owner_team": "sre-security",
|
||
"allowed_scan_modes": [
|
||
"health_only",
|
||
"passive_inventory"
|
||
],
|
||
"approval_required": false,
|
||
"notes": "K3s node 初期只接既有 health / metadata evidence，不改 RBAC 或 NetworkPolicy。"
|
||
},
|
||
{
|
||
"asset_key": "host:data-ai-188",
|
||
"target_type": "host",
|
||
"target": "192.168.0.188",
|
||
"environment": "prod",
|
||
"owner_team": "sre-security",
|
||
"allowed_scan_modes": [
|
||
"health_only",
|
||
"passive_inventory"
|
||
],
|
||
"approval_required": false,
|
||
"notes": "DB、Redis、AI、SignOz、MinIO 類服務初期只做被動 evidence，不做 credentialed scan。"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"group_id": "public_web_perimeter",
|
||
"title": "公開網站與 API 邊界",
|
||
"default_mode": "warn",
|
||
"scan_level": "safe_active",
|
||
"assets": [
|
||
{
|
||
"asset_key": "web:awoooi-public-domains",
|
||
"target_type": "website",
|
||
"target": "public_product_domains_from_service_endpoints",
|
||
"environment": "prod",
|
||
"owner_team": "web-perimeter",
|
||
"allowed_scan_modes": [
|
||
"tls_header_check",
|
||
"basic_crawl"
|
||
],
|
||
"approval_required": true,
|
||
"notes": "TLS/header/basic crawl 可以準備批准；active DAST、fuzz、auth flow testing 必須另批。"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"group_id": "kali_execute_and_maintenance",
|
||
"title": "Kali /execute 與維護窗口",
|
||
"default_mode": "block_candidate",
|
||
"scan_level": "execute",
|
||
"assets": [
|
||
{
|
||
"asset_key": "tool:kali-scanner-execute",
|
||
"target_type": "tool",
|
||
"target": "kali-scanner:/execute",
|
||
"environment": "infra",
|
||
"owner_team": "security-commander",
|
||
"allowed_scan_modes": [
|
||
"blocked"
|
||
],
|
||
"approval_required": true,
|
||
"notes": "AwoooP 不得直接接此 endpoint；若未來保留，必須獨立 high-risk approval、allowlist、audit、disable gate。"
|
||
},
|
||
{
|
||
"asset_key": "host:kali-112-maintenance",
|
||
"target_type": "host",
|
||
"target": "192.168.0.112",
|
||
"environment": "infra",
|
||
"owner_team": "security-commander",
|
||
"allowed_scan_modes": [
|
||
"full_upgrade_reboot"
|
||
],
|
||
"approval_required": true,
|
||
"notes": "Kali rolling full-upgrade / autoremove / reboot 必須排維護窗口、snapshot、rollback 與 post-health check。"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"approval_gates": [
|
||
{
|
||
"gate_id": "kali-safe-web-crawl-approval-20260513",
|
||
"requested_action": "run_safe_active_scan",
|
||
"risk": "MEDIUM",
|
||
"required_reviewers": [
|
||
"security-commander",
|
||
"human-owner"
|
||
],
|
||
"blocked_until_approved": true,
|
||
"evidence_refs": [
|
||
"docs/security/KALI-SCAN-SCOPE-APPROVAL-PACKAGE.md",
|
||
"docs/security/KALI-SECURITY-MESH-BLUEPRINT.md"
|
||
]
|
||
},
|
||
{
|
||
"gate_id": "kali-credentialed-scan-approval-20260513",
|
||
"requested_action": "run_credentialed_scan",
|
||
"risk": "HIGH",
|
||
"required_reviewers": [
|
||
"security-commander",
|
||
"vuln-verifier",
|
||
"human-owner"
|
||
],
|
||
"blocked_until_approved": true,
|
||
"evidence_refs": [
|
||
"docs/security/KALI-SCAN-SCOPE-APPROVAL-PACKAGE.md",
|
||
"docs/security/SECURITY-LOW-FRICTION-ROLLOUT-POLICY.md"
|
||
]
|
||
},
|
||
{
|
||
"gate_id": "kali-execute-endpoint-approval-20260513",
|
||
"requested_action": "call_execute_endpoint",
|
||
"risk": "CRITICAL",
|
||
"required_reviewers": [
|
||
"critic",
|
||
"security-commander",
|
||
"human-owner"
|
||
],
|
||
"blocked_until_approved": true,
|
||
"evidence_refs": [
|
||
"docs/security/KALI-INTEGRATION-STATUS.md",
|
||
"docs/security/SECURITY-LOW-FRICTION-ROLLOUT-POLICY.md"
|
||
]
|
||
},
|
||
{
|
||
"gate_id": "kali-finding-runtime-ingestion-approval-20260513",
|
||
"requested_action": "ingest_findings_to_awooop_runtime",
|
||
"risk": "MEDIUM",
|
||
"required_reviewers": [
|
||
"security-commander",
|
||
"human-owner"
|
||
],
|
||
"blocked_until_approved": true,
|
||
"evidence_refs": [
|
||
"docs/security/SECURITY-FINDING-CONTRACT.md",
|
||
"docs/security/security-finding-kali-sample.snapshot.json"
|
||
]
|
||
},
|
||
{
|
||
"gate_id": "kali-full-upgrade-reboot-approval-20260513",
|
||
"requested_action": "run_full_upgrade_reboot",
|
||
"risk": "HIGH",
|
||
"required_reviewers": [
|
||
"security-commander",
|
||
"human-owner"
|
||
],
|
||
"blocked_until_approved": true,
|
||
"evidence_refs": [
|
||
"docs/security/KALI-INTEGRATION-STATUS.md"
|
||
]
|
||
}
|
||
],
|
||
"finding_ingestion_policy": {
|
||
"finding_contract": "security_finding_v1",
|
||
"consumption_mode": "mirror_only",
|
||
"redaction_required": true,
|
||
"runtime_ingestion_status": "not_enabled_contract_only",
|
||
"storage_landing": [
|
||
"asset_inventory.metadata",
|
||
"asset_compliance_snapshot",
|
||
"asset_change_event",
|
||
"AwoooP Runtime State / Channel Event / Audit mirror"
|
||
],
|
||
"awooop_allowed_actions": [
|
||
"mirror_redacted_finding",
|
||
"display_scope_group",
|
||
"display_approval_gate",
|
||
"create_approval_candidate"
|
||
],
|
||
"awooop_forbidden_actions": [
|
||
"start_scan",
|
||
"call_execute_endpoint",
|
||
"store_secret_value",
|
||
"auto_patch",
|
||
"auto_block_deploy"
|
||
]
|
||
},
|
||
"still_forbidden": [
|
||
"run_active_scan_without_scope_approval",
|
||
"run_credentialed_scan_without_approval",
|
||
"call_execute_endpoint_from_awooop_runtime",
|
||
"store_api_key_password_token_cookie_or_private_key",
|
||
"change_firewall_networkpolicy_rbac_or_route",
|
||
"full_upgrade_autoremove_or_reboot_without_maintenance_window",
|
||
"turn_low_medium_observations_into_blocking_gates"
|
||
]
|
||
}
|