Write Your Own Checks
Customizable check definitions
Check definitions are readable YAML files. When a new vulnerability is announced, your security team defines the check and distributes it to every scan server through the signed chain.
The check definition belongs to you
The institution carries the responsibility for its own network, so in Cyprob it also holds the timing. A check definition is a readable text file that your security team writes, reviews and puts into production when it decides to.
Nobody knows your network the way the team running it does, which is why the description of what to look for comes from you. A vulnerability announced in the morning can be covered by a check the same day, because writing it does not depend on anyone outside your team.
What a check looks like
Checks are written in YAML. The example below looks for an administration interface that answers without authentication.
id: corp-admin-panel
name: Admin panel exposed
type: exposed-panel
info:
severity: high
tags: [panel, discovery]
format: http-template
target_scope: SERVICE
execution_phase: vuln_scan
http_requests:
- method: GET
endpoints: [/admin/login]
matcher_logic: all
matchers:
- type: status
status: [200]
- type: word
part: body
words: ["Admin Panel"]Writing the file does not require programming knowledge, only a clear idea of what you are looking for.
How your rule reaches the scanners
Defined in one place
The rule is added to the management node. Scan servers pull it when they take a job, so you do not install anything on each server.
Delivered signed
Checks shipped with the product carry a cryptographic signature. A check whose signature does not verify, or one that has been revoked, is not executed.
Results carry evidence
Every finding is recorded with the request that was sent and the response that came back. The person reviewing the finding can verify it independently.
When this is useful
If you run software written for your own institution, a vulnerability in it will not appear in any catalog. The same holds for a configuration error specific to your sector. A team that can write the rule is not limited to where the catalog ends.
The same path is open when a vulnerability is disclosed publicly. You write the check, try it on a small group of assets, and open it to the whole network once you have seen it work correctly.
Common questions
Do we need programmers to write checks?
No. A check definition is a readable YAML file; the person writing it needs to know what to look for, not how to code.
How does a new rule reach the whole network?
In stages. You try it on a narrow set of assets first, watch how it behaves, then distribute it to every scan server through the signed chain.
Do we wait for the vendor when a new CVE lands?
No. The check definitions belong to your team. You write and distribute the rule yourself; the vendor's release calendar does not set your pace.