intuitem / ciso-assistant-community

CISO Assistant is a one-stop-shop for GRC, covering Risk, AppSec and Audit Management and supporting +37 frameworks worldwide: NIST CSF, ISO 27001, SOC2, CIS, PCI DSS, NIS2, CMMC, PSPF, GDPR, HIPAA, Essential Eight, NYDFS-500, DORA, NIST AI RMF, 800-53, 800-171, CyFun, CJIS, AirCyber and so much more

intuitem.com · SaaS Free trial · Docs · Discord · Frameworks

CISO Assistant brings a different take to GRC and Cyber Security Posture Management:

• by explicitly decoupling compliance from cybersecurity controls implementation
• has built-in standards, security controls and threats
• risk assessment and remediation plan follow-up
• allows to manage a catalog for security controls and threats
• you can bring your own framework as well using a simple syntax
• manage audit, evidences collection and report generation

Our vision is to provide a one stop shop for cyber security posture management and cover the layers of GRC (Governance, Risk and Compliance). As practitioners interacting with multiple cybersecurity and IT professionals, we have struggled with fragmentation and lack of efficient tooling. We keep improving CISO Assistant with anything that could bring clarity and productivity to cybersecurity teams and reduce the effort of research, audit management and paperwork.

CyberSecurity teams need to use GRC as a foundation to structure their program and implement the right tools and processes to mitigate the risks, and leave the rest to CISO Assistant 🐙

The vision of the tool is based on this model:

The full details are available in the data model.

The decoupling allows you to save a considerable amount of time:

• reuse previous assessments,
• assess a scope against multiple frameworks at the same time,
• leave the reporting formatting and sanity check to CISO assistant and focus on your fixes,
• balance controls implementation and compliance follow-up

CISO Assistant is developed and maintained by intuitem, a French 🇫🇷 company specialized in Cyber Security, Cloud and Data/AI.

Quick Start 🚀

Tip

The easiest way to get started is through the free trial of cloud instance available here.

Alternatively, once you have Docker and Docker-compose installed, on your workstation or server, clone the repo and run:

./docker-compose.sh

Note

The docker-compose script uses prebuilt Docker images supporting most of the standard hardware architecture. If you're using Windows, Make sure to have WSL installed and trigger the script within a WSL command line. It will feed Docker Desktop on your behalf.

Warning

If you're getting warnings or errors about image's platform not matching host platform, raise an issue with the details and we'll add it shortly after. You can also use docker-compose-build.sh instead (see below) to build for your specific architecture.

End-user Documentation

Check out the online documentation on https://intuitem.gitbook.io/ciso-assistant.

Supported frameworks 🐙

1. ISO 27001:2022 🌐
2. NIST Cyber Security Framework (CSF) v1.1 🇺🇸
3. NIST Cyber Security Framework (CSF) v2.0 🇺🇸
4. NIS2 🇪🇺
5. SOC2 🇺🇸
6. PCI DSS 4.0 💳
7. CMMC v2 🇺🇸
8. PSPF 🇦🇺
9. GDPR checklist from GDPR.EU 🇪🇺
10. Essential Eight 🇦🇺
11. NYDFS 500 with 2023-11 amendments 🇺🇸
12. DORA 🇪🇺
13. NIST AI Risk Management Framework 🇺🇸🤖
14. NIST SP 800-53 rev5 🇺🇸
15. France LPM/OIV rules 🇫🇷
16. CCB CyberFundamentals Framework 🇧🇪
17. NIST SP-800-66 (HIPAA) 🏥
18. HDS/HDH 🇫🇷
19. OWASP Application Security Verification Standard (ASVS) 🐝
20. RGS v2.0 🇫🇷
21. AirCyber ✈️🌐
22. Cyber Resilience Act (CRA) 🇪🇺
23. TIBER-EU 🇪🇺
24. NIST Privacy Framework 🇺🇸
25. TISAX (VDA ISA) 🚘
26. ANSSI hygiene guide 🇫🇷
27. Essential Cybersecurity Controls (ECC) 🇸🇦
28. CIS Controls v8*
29. CSA CCM (Cloud Controls Matrix)*
30. FADP (Federal Act on Data Protection) 🇨🇭
31. NIST SP 800-171 rev2 🇺🇸
32. ANSSI : recommandations de sécurité pour un système d'IA générative 🇫🇷🤖
33. NIST SP 800-218: Secure Software Development Framework (SSDF) 🖥️
34. GSA FedRAMP rev5 ☁️🇺🇸
35. Cadre Conformité Cyber France (3CF) v1 (2021) ✈️🇫🇷
36. ANSSI : SecNumCloud ☁️🇫🇷
37. Cadre Conformité Cyber France (3CF) v2 (2024) ✈️🇫🇷

Community contrib

1. ISO 27001:2022, version Française 🇫🇷🌐
2. PGSSI-S (Politique Générale de Sécurité des Systèmes d'Information de Santé) 🇫🇷

Note

* These frameworks require an extra manual step of getting the latest Excel sheet through their website as their license prevent direct usage.

Checkout the library and tools for the Domain Specific Language used and how you can define your own.

Coming soon

• FBI CJIS
• BSI-IT (as requested by the German community)
• CCPA
• AI Act
• Part-IS
• SOX
• MASVS
• NIST 800-82
• NCSC Cyber Assessment Framework (CAF)
• UK Cyber Essentials
• and much more: just ask on Discord. If it's an open standard, we'll do it for you, free of charge 😉

Add your own library (framework, threat catalog, reference controls catalog or matrix)

Have a look in the tools directory and its dedicated readme. The convert_library.py script will help you create your library from a simple Excel file. A typical framework can be ingested in a few hours.

You will also find some specific converters in the tools directory (e.g. for CIS or CCM Controls).

Community

Join our open Discord community to interact with the team and other GRC experts.

Testing the cloud version

The fastest and easiest way to get started is through the free trial of cloud instance available here.

Testing locally 🚀

To run CISO Assistant locally in a straightforward way, you can use Docker compose.

0. Update docker

Make sure you have a recent version of docker (>= 25.0).

1. Clone the repository

git clone [email protected]:intuitem/ciso-assistant-community.git
cd ciso-assistant-community

2. Launch docker-compose script for prebuilt images:

./docker-compose.sh

Alternatively, you can use this variant to build the docker images for your specific architecture:

./docker-compose-build.sh

When asked for, enter your email and password for your superuser.

You can then reach CISO Assistant using your web browser at https://localhost:8443/

For the following executions, use "docker compose up" directly.

Tip

If you want a fresh install, simply delete the db directory, (default: backend/db) where the database is stored.

Docker-compose on remote

For docker setup on a remote server or hypervisor, checkout the specific instructions here

Setting up CISO Assistant for development

Requirements

• Python 3.11+
• pip 20.3+
• node 18+
• npm 10.2+
• yaml-cpp (brew install yaml-cpp libyaml or apt install libyaml-cpp-dev)

Running the backend

1. Clone the repository.

git clone [email protected]:intuitem/ciso-assistant-community.git
cd ciso-assistant-community

2. Create a file in the parent folder (e.g. ../myvars) and store your environment variables within it by copying and modifying the following code and replace "<XXX>" by your private values. Take care not to commit this file in your git repo.

Mandatory variables

All variables in the backend have handy default values.

Recommended variables

export DJANGO_DEBUG=True

# Default url is set to http://localhost:5173 but you can change it, e.g. to use https with a caddy proxy
export CISO_ASSISTANT_URL=https://localhost:8443

# Setup a development mailer with Mailhog for example
export EMAIL_HOST_USER=''
export EMAIL_HOST_PASSWORD=''
export [email protected]
export EMAIL_HOST=localhost
export EMAIL_PORT=1025

Other variables

# CISO Assistant will use SQLite by default, but you can setup PostgreSQL by declaring these variables
export POSTGRES_NAME=ciso-assistant
export POSTGRES_USER=ciso-assistantuser
export POSTGRES_PASSWORD=<XXX>
export POSTGRES_PASSWORD_FILE=<XXX>  # alternative way to specify password
export DB_HOST=localhost
export DB_PORT=5432  # optional, default value is 5432

# Add a second backup mailer
export EMAIL_HOST_RESCUE=<XXX>
export EMAIL_PORT_RESCUE=587
export EMAIL_HOST_USER_RESCUE=<XXX>
export EMAIL_HOST_PASSWORD_RESCUE=<XXX>
export EMAIL_USE_TLS_RESCUE=True

# You can define the email of the first superuser, useful for automation. A mail is sent to the superuser for password initialization
export CISO_SUPERUSER_EMAIL=<XXX>

# By default, Django secret key is generated randomly at each start of CISO Assistant. This is convenient for quick test,
# but not recommended for production, as it can break the sessions (see
# this [topic](https://stackoverflow.com/questions/15170637/effects-of-changing-djangos-secret-key) for more information).
# To set a fixed secret key, use the environment variable DJANGO_SECRET_KEY.
export DJANGO_SECRET_KEY=...

# Logging configuration
export LOG_LEVEL=INFO # optional, default value is INFO. Available options: DEBUG, INFO, WARNING, ERROR, CRITICAL
export LOG_FORMAT=plain # optional, default value is plain. Available options: json, plain

3. Choose the tool of your choice, either python-venv or virtualenv. For example:

# Install python-venv
sudo apt install python-venv # or python3-venv
# Create the virtual environment venv
python -m venv venv # or python3 -m venv venv
# To enter inside the virtual environment
source venv/bin/activate
# If you want to exit the virtual environment once finished
deactivate

4. Install required dependencies.

pip install -r requirements.txt

5. Recommended: Install the pre-commit hooks.

pre-commit install

6. If you want to setup Postgres:

• Launch one of these commands to enter in Postgres:
  • psql as superadmin
  • sudo su postgres
  • psql
• Create the database "ciso-assistant"
  • create database ciso-assistant;
• Create user "ciso-assistantuser" and grant it access
  • create user ciso-assistantuser with password '<POSTGRES_PASSWORD>';
  • grant all privileges on database ciso-assistant to ciso-assistantuser;

7. Apply migrations.

python manage.py migrate

8. Create a Django superuser, that will be CISO Assistant administrator.

If you have set a mailer and CISO_SUPERUSER_EMAIL variable, there's no need to create a Django superuser with createsuperuser, as it will be created automatically on first start. You should receive an email with a link to setup your password.

python manage.py createsuperuser

9. Run development server.

python manage.py runserver

10. Configure the git hooks for generating the build name.

cd .git/hooks
ln -fs ../../git_hooks/post-commit .
ln -fs ../../git_hooks/post-merge .

Running the frontend

1. cd into the frontend directory

cd frontend

2. Install dependencies

npm install

3. Start a development server (make sure that the django app is running)

npm run dev

4. Reach the frontend on http://localhost:5173

Note

Safari will not properly work in this setup, as it requires https for secure cookies. The simplest solution is to use Chrome or Firefox. An alternative is to use a caddy proxy. This is the solution used in docker-compose, so you can use it as an example.

5. Environment variables

All variables in the frontend have handy default values.

If you move the frontend on another host, you should set the following variable: PUBLIC_BACKEND_API_URL. Its default value is http://localhost:8000/api.

When you launch "node server" instead of "npm run dev", you need to set the ORIGIN variable to the same value as CISO_ASSISTANT_URL in the backend (e.g. http://localhost:3000).

Managing migrations

The migrations are tracked by version control, https://docs.djangoproject.com/en/4.2/topics/migrations/#version-control

For the first version of the product, it is recommended to start from a clean migration.

Note: to clean existing migrations, type:

find . -path "*/migrations/*.py" -not -name "__init__.py" -delete
find . -path "*/migrations/*.pyc"  -delete

After a change (or a clean), it is necessary to re-generate migration files:

python manage.py makemigrations
python manage.py migrate

These migration files should be tracked by version control.

Test suite

To run API tests on the backend, simply type "pytest" in a shell in the backend folder.

To run functional tests on the frontend, do the following actions:

• in the frontend folder, launch the following command:

tests/e2e-tests.sh

The goal of the test harness is to prevent any regression, i.e. all the tests shall be successful, both for backend and frontend.

Setting CISO Assistant for production

The docker-compose.yml highlights a relevant configuration with a Caddy proxy in front of the frontend.

Set DJANGO_DEBUG=False for security reason.

Note

The frontend cannot infer the host automatically, so you need to either set the ORIGIN variable, or the HOST_HEADER and PROTOCOL_HEADER variables. Please see the sveltekit doc on this tricky issue.

Note

Caddy needs to receive a SNI header. Therefore, for your public URL (the one declared in CISO_ASSISTANT_URL), you need to use a FQDN, not an IP address, as the SNI is not transmitted by a browser if the host is an IP address. Another tricky issue!

Built With 💜

• Django - Python Web Development Framework
• SvelteKit - Frontend Framework
• eCharts - Charting library
• Gunicorn - Python WSGI HTTP Server for UNIX
• Caddy - The coolest reverse Proxy
• Gitbook - Documentation platform
• PostgreSQL - Open Source RDBMS
• SQLite - Open Source RDBMS
• Docker - Container Engine
• inlang - The ecosystem to globalize your software

Security

Great care has been taken to follow security best practices. Please report any issue to [email protected].

License

AGPLv3

ciso-assistant-community's Issues

Ciso assistant docker SSL error

Describe the bug
CISO assistant does not allow connections when installed via docker (see screenshots for browser error). Using curl on the server I get the following message:

root@server:~/ciso-assistant-community# curl -vvI https://localhost:8443
*   Trying 127.0.0.1:8443...
* Connected to localhost (127.0.0.1) port 8443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS alert, internal error (592):
* OpenSSL/3.0.11: error:0A000438:SSL routines::tlsv1 alert internal error
* Closing connection 0

Furthermore the following error is printed during compose up. It looks to me like the database does not start properly as indicated by database not ready; waiting in the logs:

WARN[0000] /root/ciso-assistant-community/docker-compose.yml: `version` is obsolete
[+] Building 2.3s (31/31) FINISHED                                                                                                                                                     docker:default
 => [backend internal] load build definition from Dockerfile                                                                                                                                     0.0s
 => => transferring dockerfile: 599B                                                                                                                                                             0.0s
 => [backend] resolve image config for docker-image://docker.io/docker/dockerfile:1                                                                                                              0.7s
 => CACHED [backend] docker-image://docker.io/docker/dockerfile:1@sha256:ac85f380a63b13dfcefa89046420e1781752bab202122f8f50032edf31be0021                                                        0.0s
 => [backend internal] load metadata for docker.io/library/python:3.11                                                                                                                           0.7s
 => [backend internal] load .dockerignore                                                                                                                                                        0.0s
 => => transferring context: 92B                                                                                                                                                                 0.0s
 => [backend 1/8] FROM docker.io/library/python:3.11@sha256:58ef3c375e20ca749f5bf4d1a62186a01e9d1d5756671037e391c832a5062d1e                                                                     0.0s
 => [backend internal] load build context                                                                                                                                                        0.0s
 => => transferring context: 15.10kB                                                                                                                                                             0.0s
 => CACHED [backend 2/8] WORKDIR /code                                                                                                                                                           0.0s
 => CACHED [backend 3/8] COPY . /code/                                                                                                                                                           0.0s
 => CACHED [backend 4/8] COPY startup.sh /code/                                                                                                                                                  0.0s
 => CACHED [backend 5/8] RUN pip install --upgrade pip                                                                                                                                           0.0s
 => CACHED [backend 6/8] RUN pip install -r requirements.txt                                                                                                                                     0.0s
 => CACHED [backend 7/8] RUN apt update &&   apt install -y gettext &&   apt install -y locales                                                                                                  0.0s
 => CACHED [backend 8/8] RUN sed -i -e 's/# en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen   && sed -i -e 's/# fr_FR.UTF-8 UTF-8/fr_FR.UTF-8 UTF-8/' /etc/locale.gen   && locale-gen      0.0s
 => [backend] exporting to image                                                                                                                                                                 0.0s
 => => exporting layers                                                                                                                                                                          0.0s
 => => writing image sha256:1bddca633fd21d3aaa29f3c5219b52b591d11660776889570c91671ccd000be6                                                                                                     0.0s
 => => naming to docker.io/library/ciso-assistant-community-backend                                                                                                                              0.0s
 => [frontend internal] load build definition from Dockerfile                                                                                                                                    0.0s
 => => transferring dockerfile: 477B                                                                                                                                                             0.0s
 => [frontend internal] load metadata for docker.io/library/node:21-alpine                                                                                                                       0.6s
 => [frontend internal] load .dockerignore                                                                                                                                                       0.0s
 => => transferring context: 222B                                                                                                                                                                0.0s
 => [frontend internal] load build context                                                                                                                                                       0.0s
 => => transferring context: 18.30kB                                                                                                                                                             0.0s
 => [frontend builder 1/7] FROM docker.io/library/node:21-alpine@sha256:ad255c65652e8e99ce0b9d9fc52eee3eae85f445b192f6f9e49a1305c77b2ba6                                                         0.0s
 => CACHED [frontend builder 2/7] WORKDIR /app                                                                                                                                                   0.0s
 => CACHED [frontend builder 3/7] COPY package*.json ./                                                                                                                                          0.0s
 => CACHED [frontend builder 4/7] COPY . .                                                                                                                                                       0.0s
 => CACHED [frontend builder 5/7] RUN npm ci                                                                                                                                                     0.0s
 => CACHED [frontend builder 6/7] RUN npm run build                                                                                                                                              0.0s
 => CACHED [frontend builder 7/7] RUN npm prune --production                                                                                                                                     0.0s
 => CACHED [frontend stage-1 3/6] COPY --from=builder /app/build build/                                                                                                                          0.0s
 => CACHED [frontend stage-1 4/6] COPY --from=builder /app/server server/                                                                                                                        0.0s
 => CACHED [frontend stage-1 5/6] COPY --from=builder /app/node_modules node_modules/                                                                                                            0.0s
 => CACHED [frontend stage-1 6/6] COPY package.json .                                                                                                                                            0.0s
 => [frontend] exporting to image                                                                                                                                                                0.0s
 => => exporting layers                                                                                                                                                                          0.0s
 => => writing image sha256:6da5f556483fa56973205d7c9eada58faaec313a3c647c9bb333cc2ac1e0c1ec                                                                                                     0.0s
 => => naming to docker.io/library/ciso-assistant-community-frontend                                                                                                                             0.0s
WARN[0000] /root/ciso-assistant-community/docker-compose.yml: `version` is obsolete
[+] Running 3/4
 ⠦ Network ciso-assistant-community_default  Created                                                                                                                                             0.6s
 ✔ Container caddy                           Started                                                                                                                                             0.4s
 ✔ Container backend                         Started                                                                                                                                             0.3s
 ✔ Container frontend                        Started                                                                                                                                             0.5s
WARN[0000] /root/ciso-assistant-community/docker-compose.yml: `version` is obsolete
2024-04-08T09:13:11.660331Z [info     ] BASE_DIR: /code                [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
2024-04-08T09:13:11.660840Z [info     ] CISO Assistant Version: 1.0.3  [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
2024-04-08T09:13:11.661221Z [info     ] CISO Assistant Build: main aff6055a5d85bd6b937d2ac4898f1f159377b00b 2024-04-07T18:40:06+02:00 [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
2024-04-08T09:13:11.661686Z [info     ] DEBUG mode: True               [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
2024-04-08T09:13:11.661833Z [info     ] CISO_ASSISTANT_URL: https://localhost:8443 [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
2024-04-08T09:13:11.662165Z [info     ] ALLOWED_HOSTS: ['backend']     [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
2024-04-08T09:13:11.662478Z [info     ] SQLITE_FILE: /code/db/ciso-assistant.sqlite3 [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
2024-04-08T09:13:11.662717Z [info     ] DATABASE ENGINE: django.db.backends.sqlite3 [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
Traceback (most recent call last):
  File "/code/manage.py", line 22, in <module>
    main()
  File "/code/manage.py", line 18, in main
    execute_from_command_line(sys.argv)
  File "/usr/local/lib/python3.11/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line
    utility.execute()
  File "/usr/local/lib/python3.11/site-packages/django/core/management/__init__.py", line 436, in execute
    self.fetch_command(subcommand).run_from_argv(self.argv)
  File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 413, in run_from_argv
    self.execute(*args, **cmd_options)
  File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 459, in execute
    output = self.handle(*args, **options)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 107, in wrapper
    res = handle_func(*args, **kwargs)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/django/core/management/commands/migrate.py", line 117, in handle
    executor = MigrationExecutor(connection, self.migration_progress_callback)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/executor.py", line 18, in __init__
    self.loader = MigrationLoader(self.connection)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/loader.py", line 58, in __init__
    self.build_graph()
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/loader.py", line 276, in build_graph
    self.graph.validate_consistency()
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/graph.py", line 198, in validate_consistency
    [n.raise_error() for n in self.node_map.values() if isinstance(n, DummyNode)]
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/graph.py", line 198, in <listcomp>
    [n.raise_error() for n in self.node_map.values() if isinstance(n, DummyNode)]
     ^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/graph.py", line 60, in raise_error
    raise NodeNotFoundError(self.error_message, self.key, origin=self.origin)
django.db.migrations.exceptions.NodeNotFoundError: Migration core.0005_merge_20240216_1246 dependencies reference nonexistent parent node ('core', '0004_policy')
initialize your superuser account...
WARN[0000] /root/ciso-assistant-community/docker-compose.yml: `version` is obsolete
2024-04-08T09:13:13.363128Z [info     ] BASE_DIR: /code                [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
2024-04-08T09:13:13.363482Z [info     ] CISO Assistant Version: 1.0.3  [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
2024-04-08T09:13:13.364092Z [info     ] CISO Assistant Build: main aff6055a5d85bd6b937d2ac4898f1f159377b00b 2024-04-07T18:40:06+02:00 [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
2024-04-08T09:13:13.364570Z [info     ] DEBUG mode: True               [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
2024-04-08T09:13:13.364854Z [info     ] CISO_ASSISTANT_URL: https://localhost:8443 [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
2024-04-08T09:13:13.365100Z [info     ] ALLOWED_HOSTS: ['backend']     [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
2024-04-08T09:13:13.365423Z [info     ] SQLITE_FILE: /code/db/ciso-assistant.sqlite3 [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
2024-04-08T09:13:13.365668Z [info     ] DATABASE ENGINE: django.db.backends.sqlite3 [ciso_assistant.settings] ciso_assistant_url=https://localhost:8443
Traceback (most recent call last):
  File "/code/manage.py", line 22, in <module>
    main()
  File "/code/manage.py", line 18, in main
    execute_from_command_line(sys.argv)
  File "/usr/local/lib/python3.11/site-packages/django/core/management/__init__.py", line 442, in execute_from_command_line
    utility.execute()
  File "/usr/local/lib/python3.11/site-packages/django/core/management/__init__.py", line 436, in execute
    self.fetch_command(subcommand).run_from_argv(self.argv)
  File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 413, in run_from_argv
    self.execute(*args, **cmd_options)
  File "/usr/local/lib/python3.11/site-packages/django/contrib/auth/management/commands/createsuperuser.py", line 89, in execute
    return super().execute(*args, **options)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 458, in execute
    self.check_migrations()
  File "/usr/local/lib/python3.11/site-packages/django/core/management/base.py", line 581, in check_migrations
    executor = MigrationExecutor(connections[DEFAULT_DB_ALIAS])
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/executor.py", line 18, in __init__
    self.loader = MigrationLoader(self.connection)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/loader.py", line 58, in __init__
    self.build_graph()
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/loader.py", line 276, in build_graph
    self.graph.validate_consistency()
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/graph.py", line 198, in validate_consistency
    [n.raise_error() for n in self.node_map.values() if isinstance(n, DummyNode)]
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/graph.py", line 198, in <listcomp>
    [n.raise_error() for n in self.node_map.values() if isinstance(n, DummyNode)]
     ^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/django/db/migrations/graph.py", line 60, in raise_error
    raise NodeNotFoundError(self.error_message, self.key, origin=self.origin)
django.db.migrations.exceptions.NodeNotFoundError: Migration core.0005_merge_20240216_1246 dependencies reference nonexistent parent node ('core', '0004_policy')
connect to ciso assistant on https://localhost:8443
for successive runs you can now use docker compose up

To Reproduce
Steps to reproduce the behavior:

1. Clone repository
2. run ./docker-compose.sh
3. try accessing the web page or use local curl to test

Expected behavior
Ciso Assistant is accessible

Screenshots

• Edge:

• Firefox:

Environment (please complete the following information):

• OS: Debian 12.5
• Browser Edge (123.0.2420.65) and Firefox (124.0.2)

Observation not saved in associated requirement dialog

When I enter an observation on an 'associated requirement' in 'compliance assessments,' and then click on 'Save,' the system responds 'The Requirement assessment object has been successfully saved,' but the observation is not actually saved.

Expected behavior
I expect the observation to be saved.

Environment (please complete the following information):

Client :

• OS: Linux
• Browser : Chrome 122.0.6261.128

Server :

• CISO Assistant Version: v1.0.8 Build: 07c5855
• Launched via Docker-compose from cisoassistant repo

Essential Cybersecurity Controls (ECC)

Interesting Saudi Framework requested on Discord

RGS

scoring of requirements

The use case is to be able to have an extra dimension for the maturity of the control implementation if supported, or switch to a percentage when not. Very valuable when comparing projects or divisions regarding their posture maturity.
can be based on CSF tiers for instance and will be valuable for analytics

Be able to filter items on the library per specific type

Problem statement
The library can become overwhelming when containing matrices, threats, frameworks and so on. Obviously we can have an entry that contains multiple types but would nice to be able to see only specific ones.

Expected behavior

Be able to filter per specific type

Additional context
Thanks to blafarus for the feedback

Be able to download the library template for adjustment

Problem statement
I want to extend or edit a framework for my specific need. As of now, I need to go the repo to find the matching one

Expected behavior

1. Reference the link from github,
2. or, be able to download the yaml file directly

Additional context
Thanks to Guillaume for the feedback

Improve frontend logs

CCB

NPM fail on frontend image build / 403 Referrer Policystrict-origin-when-cross-origin

Describe the bug
Issue #205 is probably same nature problem

Hello,

I tried to build image frontend image with Docker 26.0.0 and docker-compose 1.29.2 and I get this error

 > [ciso_frontend builder 6/8] RUN npm ci:
9.576 npm WARN ERESOLVE overriding peer dependency
9.580 npm WARN While resolving: @sveltejs/[email protected]
9.580 npm WARN Found: [email protected]
9.580 npm WARN node_modules/vite
9.580 npm WARN   dev vite@"^5.0.0" from the root project
9.581 npm WARN   10 more (@storybook/builder-vite, @storybook/svelte-vite, ...)
9.581 npm WARN
9.582 npm WARN Could not resolve dependency:
9.582 npm WARN peer vite@"^4.0.0" from @sveltejs/[email protected]
9.582 npm WARN node_modules/@storybook/svelte-vite/node_modules/@sveltejs/vite-plugin-svelte
9.582 npm WARN   @sveltejs/vite-plugin-svelte@"^2.4.2" from @storybook/[email protected]
9.582 npm WARN   node_modules/@storybook/svelte-vite
9.582 npm WARN   1 more (@sveltejs/vite-plugin-svelte-inspector)
9.583 npm WARN
9.583 npm WARN Conflicting peer dependency: [email protected]
9.583 npm WARN node_modules/vite
9.584 npm WARN   peer vite@"^4.0.0" from @sveltejs/[email protected]
9.584 npm WARN   node_modules/@storybook/svelte-vite/node_modules/@sveltejs/vite-plugin-svelte
9.584 npm WARN     @sveltejs/vite-plugin-svelte@"^2.4.2" from @storybook/[email protected]
9.584 npm WARN     node_modules/@storybook/svelte-vite
9.585 npm WARN     1 more (@sveltejs/vite-plugin-svelte-inspector)
9.637 npm WARN ERESOLVE overriding peer dependency
9.639 npm WARN While resolving: @sveltejs/[email protected]
9.639 npm WARN Found: [email protected]
9.639 npm WARN node_modules/vite
9.640 npm WARN   dev vite@"^5.0.0" from the root project
9.641 npm WARN   10 more (@storybook/builder-vite, @storybook/svelte-vite, ...)
9.641 npm WARN
9.641 npm WARN Could not resolve dependency:
9.642 npm WARN peer vite@"^4.0.0" from @sveltejs/[email protected]
9.643 npm WARN node_modules/@storybook/svelte-vite/node_modules/@sveltejs/vite-plugin-svelte/node_modules/@sveltejs/vite-plugin-svelte-inspector
9.643 npm WARN   @sveltejs/vite-plugin-svelte-inspector@"^1.0.4" from @sveltejs/[email protected]
9.643 npm WARN
9.644 npm WARN Conflicting peer dependency: [email protected]
9.644 npm WARN node_modules/vite
9.645 npm WARN   peer vite@"^4.0.0" from @sveltejs/[email protected]
9.645 npm WARN   node_modules/@storybook/svelte-vite/node_modules/@sveltejs/vite-plugin-svelte/node_modules/@sveltejs/vite-plugin-svelte-inspector
9.646 npm WARN     @sveltejs/vite-plugin-svelte-inspector@"^1.0.4" from @sveltejs/[email protected]
36.55 npm WARN deprecated [email protected]: Use your platform's native atob() and btoa() methods instead
38.12 npm WARN deprecated [email protected]: Use your platform's native DOMException instead
51.97
51.97 > [email protected] postinstall
51.97 > paraglide-js compile --project ./project.inlang
51.97
53.03 ℹ [paraglide] Compiling inlang project at "./project.inlang".
53.12
53.12  WARN  Could not find repository root for path /app/project.inlang
53.12
64.40
64.40  WARN  The project has errors:
64.40
64.42
64.42  ERROR  Couldn't import the plugin "https://cdn.jsdelivr.net/npm/@inlang/message-lint-rule-empty-pattern@latest/dist/index.js":
64.42
64.42 TypeError: fetch failed
64.42
64.42
64.42   TypeError: fetch failed
64.42   at resolveModules (node_modules/@inlang/paraglide-js/dist/index.js:21488:25)
64.42   at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
64.42
64.42
64.42  ERROR  Couldn't import the plugin "https://cdn.jsdelivr.net/npm/@inlang/message-lint-rule-identical-pattern@latest/dist/index.js":
64.42
64.42 TypeError: fetch failed
64.42
64.42
64.42   TypeError: fetch failed
64.42   at resolveModules (node_modules/@inlang/paraglide-js/dist/index.js:21488:25)
64.42   at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
64.42
64.42
64.42  ERROR  Couldn't import the plugin "https://cdn.jsdelivr.net/npm/@inlang/message-lint-rule-missing-translation@latest/dist/index.js":
64.42
64.42 TypeError: fetch failed
64.42
64.42
64.42   TypeError: fetch failed
64.42   at resolveModules (node_modules/@inlang/paraglide-js/dist/index.js:21488:25)
64.42   at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
64.42
64.42
64.42  ERROR  Couldn't import the plugin "https://cdn.jsdelivr.net/npm/@inlang/message-lint-rule-without-source@latest/dist/index.js":
64.42
64.42 TypeError: fetch failed
64.42
64.42
64.42   TypeError: fetch failed
64.42   at resolveModules (node_modules/@inlang/paraglide-js/dist/index.js:21488:25)
64.42   at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
64.42
64.42
64.42  ERROR  Couldn't import the plugin "https://cdn.jsdelivr.net/npm/@inlang/message-lint-rule-valid-js-identifier@latest/dist/index.js":
64.42
64.42 TypeError: fetch failed
64.42
64.42
64.42   TypeError: fetch failed
64.42   at resolveModules (node_modules/@inlang/paraglide-js/dist/index.js:21488:25)
64.42   at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
64.42
64.42
64.42  ERROR  Couldn't import the plugin "https://cdn.jsdelivr.net/npm/@inlang/plugin-message-format@latest/dist/index.js":
64.42
64.42 TypeError: fetch failed
64.42
64.42
64.42   TypeError: fetch failed
64.42   at resolveModules (node_modules/@inlang/paraglide-js/dist/index.js:21488:25)
64.42   at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
64.42
64.42
64.42  ERROR  Couldn't import the plugin "https://cdn.jsdelivr.net/npm/@inlang/plugin-m-function-matcher@latest/dist/index.js":
64.42
64.42 TypeError: fetch failed
64.42
64.42
64.42   TypeError: fetch failed
64.42   at resolveModules (node_modules/@inlang/paraglide-js/dist/index.js:21488:25)
64.42   at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
64.42
64.43
64.43  ERROR  No plugin provides a loadMessages() or saveMessages() function
64.43
64.43 In case no plugin threw an error, you likely forgot to add a plugin that handles the loading and saving of messages. Refer to the marketplace for available plugins https://inlang.com/marketplace.
64.43
64.43
64.43   In case no plugin threw an error, you likely forgot to add a plugin that handles the loading and saving of messages. Refer to the marketplace for available plugins https://inlang.com/marketplace.
64.43   at resolvePlugins (node_modules/@inlang/paraglide-js/dist/index.js:21454:24)
64.43   at resolveModules (node_modules/@inlang/paraglide-js/dist/index.js:21529:33)
64.43   at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
64.43
64.47 npm ERR! code 1
64.47 npm ERR! path /app
64.47 npm ERR! command failed
64.48 npm ERR! command sh -c paraglide-js compile --project ./project.inlang
64.48
64.48 npm ERR! A complete log of this run can be found in: /root/.npm/_logs/2024-04-08T14_58_57_711Z-debug-0.log
------
failed to solve: process "/bin/sh -c npm ci" did not complete successfully: exit code: 1

I'm behind reverse proxy I don't think the problem come from that since packages are retrieved at the start.

Here is my docker-compose.yml

services:
  ciso_backend:
    container_name: ciso_backend
    hostname: ciso_backend
    build: ./backend
    restart: always
    environment:
      - ALLOWED_HOSTS=backend
      - CISO_ASSISTANT_URL=https://ciso.domain.com
      - DJANGO_DEBUG=False
      # DB
      - POSTGRES_NAME=ciso
      - POSTGRES_USER=ciso_user
      - POSTGRES_PASSWORD=<password>
      - DB_HOST=ciso_db
      - DB_PORT=5432
      # Email
      - [email protected]
      - EMAIL_HOST=<smtp_host>
      - EMAIL_PORT=25

  ciso_frontend:
    container_name: ciso_frontend
    hostname: ciso_frontend
    build: ./frontend
    restart: always
    environment:
      - PUBLIC_BACKEND_API_URL=http://ciso_backend:8000/api
      - PROTOCOL_HEADER=x-forwarded-proto
      - HOST_HEADER=x-forwarded-host
    depends_on:
      - ciso_backend
    ports:
      - 127.0.0.1:8001:8000

  ciso_db:
    image: docker.io/postgres:latest
    container_name: ciso_db
    hostname: ciso_db
    restart: always
    environment:
      - POSTGRES_USER=ciso_user
      - POSTGRES_PASSWORD=<password>
      - POSTGRES_DB=ciso
    volumes:
      - /srv/cisoassistant/data:/var/lib/postgres/data

To Reproduce
Steps to reproduce the behavior:

1. Clone repo
2. Configure Dockerfile to use proxy
3. Adapt docker-compose.yml to my need
4. Build image before compose up

Expected behavior
A working image.

Environment (please complete the following information):

• Device: Server (VM)
• OS: Debian
• Version 12.5

Additional context
I builded it successfully on Fedora 39 clean install, but can't import image to another docker node.

When I import it and launch, it say me that the image have no command.

startup.sh: $'\r': command not found

Describe the bug
docker-compose.sh executes and creates container into Docker Desktop, containing 3 images: caddy and frontend run well but backend image fails and gives logs attached.
ciso-assistant_docker_fail.log

To Reproduce
Steps to reproduce the behavior:

1. Execute docker-compose.sh
2. See error

Expected behavior
All 3 images to run and application accessible at localhost:8443

Screenshots

Environment (please complete the following information):

• Device: Laptop
• OS: Windows 11
• Docker Desktop v4.28.0

CCPA

Expose and document API

Essentially expose a swagger for the API to explore the extend of the autodoc for the standard CRUD operations.
We will add another card for wrappers for aggregated use cases.

Mapping Frameworks

• I want to do an assessment on one framework and automatically get my posture on another one
• will be helpful to move from, let's say CSF to CMMC to assess the same project on a different scope
• will be helpful when a framework gets an upgrade to avoid redoing the assessment
• will be useful for reporting: I've just finished CSF assessment. How am I doing against ISO for instance?

Frameworks don't overlap necessarily, but if it can get half the work pre-done, it's a win

Multiple frameworks already have part of it done and we can improve that

Caddy with FQDN

Describe the bug
I'm trying to configure a FQDN to access ciso assistant app but i have a connection refused.
(telnet: Unable to connect to remote host: Connection refused)

To Reproduce
Steps to reproduce the behavior:
Change docker-compose.yml :
Change Backend VAR : CISO_ASSISTANT_URL=https://ciso.local:8443
Change Caddy url by : https://ciso.nikko.local
Add -i to caddy config

Expected behavior
Web UI should appear and telnet should work on caddy exposed port.

Environment (please complete the following information):

• Ubuntu 22.04 (jammy)
• Docker version 26

Docker config :

version: "3.9"

services:
  backend:
    container_name: backend
    image: ghcr.io/intuitem/ciso-assistant-community/backend:latest
    restart: always
    environment:
      - ALLOWED_HOSTS=backend
      - CISO_ASSISTANT_URL=https://ciso.local:8443
      - DJANGO_DEBUG=True
    volumes:
      - ./db:/code/db

  frontend:
    container_name: frontend
    environment:
      - PUBLIC_BACKEND_API_URL=http://backend:8000/api
      - PROTOCOL_HEADER=x-forwarded-proto
      - HOST_HEADER=x-forwarded-host
    image: ghcr.io/intuitem/ciso-assistant-community/frontend:latest
    depends_on:
      - backend

  caddy:
    container_name: caddy
    image: caddy:2.7.6
    restart: unless-stopped
    ports:
      - 8443:8443
    command:
      - caddy
      - reverse-proxy
      - --from
      - https://ciso.local
      - --to
      - frontend:3000
      - -i
    volumes:
      - ./db:/data

Docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
ff53791ab1e2 ghcr.io/intuitem/ciso-assistant-community/frontend:latest "docker-entrypoint.s…" 6 minutes ago Up 6 minutes 3000/tcp frontend
900b088d8a34 ghcr.io/intuitem/ciso-assistant-community/backend:latest "bash startup.sh" 16 minutes ago Up 6 minutes 8000/tcp backend
aa75029cb72a caddy:2.7.6 "caddy reverse-proxy…" 16 minutes ago Up 6 minutes 80/tcp, 443/tcp, 2019/tcp, 443/udp, 0.0.0.0:8443->8443/tcp, :::8443->8443/tcp caddy

netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:8443 0.0.0.0:* LISTEN 30581/docker-proxy
tcp6 0 0 :::8443 :::* LISTEN 30588/docker-proxy

Caddy log

{"level":"warn","ts":1713191624.283862,"logger":"admin","msg":"admin endpoint disabled"}
{"level":"info","ts":1713191624.2841592,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc000394c80"}
{"level":"info","ts":1713191624.2843564,"logger":"http.auto_https","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"proxy","https_port":443}
{"level":"info","ts":1713191624.2843742,"logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"proxy"}
{"level":"warn","ts":1713191624.30753,"logger":"pki.ca.local","msg":"installing root certificate (you might be prompted for password)","path":"storage:pki/authorities/local/root.crt"}
{"level":"info","ts":1713191624.3078496,"msg":"warning: \"certutil\" is not available, install \"certutil\" with \"apt install libnss3-tools\" or \"yum install nss-tools\" and try again"}
{"level":"info","ts":1713191624.3078616,"msg":"define JAVA_HOME environment variable to use the Java trust"}
{"level":"info","ts":1713191624.3451345,"msg":"certificate installed properly in linux trusts"}
{"level":"info","ts":1713191624.3463805,"logger":"http","msg":"enabling HTTP/3 listener","addr":":443"}
{"level":"info","ts":1713191624.3465269,"msg":"failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 2048 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details."}
{"level":"info","ts":1713191624.3468025,"logger":"http.log","msg":"server running","name":"proxy","protocols":["h1","h2","h3"]}
{"level":"info","ts":1713191624.346855,"logger":"http.log","msg":"server running","name":"remaining_auto_https_redirects","protocols":["h1","h2","h3"]}
{"level":"info","ts":1713191624.346866,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["ciso.local"]}
{"level":"warn","ts":1713191624.3494506,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [*.local localhost]: no OCSP server specified in certificate","identifiers":["*.local","localhost"]}
Caddy proxying https://ciso.local -> frontend:3000
{"level":"warn","ts":1713191624.35001,"logger":"tls","msg":"storage cleaning happened too recently; skipping for now","storage":"FileStorage:/data/caddy","instance":"c578598c-b558-467f-872b-c669785d0463","try_again":1713278024.350008,"try_again_in":86399.999999608}
{"level":"info","ts":1713191624.3500931,"logger":"tls","msg":"finished cleaning storage units"}
{"level":"info","ts":1713192207.6556282,"msg":"shutting down apps, then terminating","signal":"SIGTERM"}
{"level":"warn","ts":1713192207.6557248,"msg":"exiting; byeee!! 👋","signal":"SIGTERM"}
{"level":"info","ts":1713192207.6559622,"logger":"http","msg":"servers shutting down with eternal grace period"}
{"level":"info","ts":1713192207.6564848,"msg":"shutdown complete","signal":"SIGTERM","exit_code":0}
{"level":"warn","ts":1713192212.1010666,"logger":"admin","msg":"admin endpoint disabled"}
{"level":"info","ts":1713192212.101299,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc00048aa00"}
{"level":"info","ts":1713192212.1019592,"logger":"http.auto_https","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"proxy","https_port":443}
{"level":"info","ts":1713192212.1019783,"logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"proxy"}
{"level":"info","ts":1713192212.1285663,"logger":"pki.ca.local","msg":"root certificate is already trusted by system","path":"storage:pki/authorities/local/root.crt"}
{"level":"info","ts":1713192212.128943,"logger":"http.log","msg":"server running","name":"remaining_auto_https_redirects","protocols":["h1","h2","h3"]}
{"level":"info","ts":1713192212.1289856,"logger":"http","msg":"enabling HTTP/3 listener","addr":":443"}
{"level":"info","ts":1713192212.1291244,"msg":"failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 2048 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details."}
{"level":"info","ts":1713192212.1293335,"logger":"http.log","msg":"server running","name":"proxy","protocols":["h1","h2","h3"]}
{"level":"info","ts":1713192212.1293406,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["ciso.local"]}
{"level":"warn","ts":1713192212.1305852,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [*.local localhost]: no OCSP server specified in certificate","identifiers":["*.local","localhost"]}
Caddy proxying https://ciso.local -> frontend:3000
{"level":"warn","ts":1713192212.1331465,"logger":"tls","msg":"storage cleaning happened too recently; skipping for now","storage":"FileStorage:/data/caddy","instance":"c578598c-b558-467f-872b-c669785d0463","try_again":1713278612.1331441,"try_again_in":86399.999999586}
{"level":"info","ts":1713192212.133242,"logger":"tls","msg":"finished cleaning storage units"}

TPRM

Third Party Risk Management

German translation

TISAX

Data import wizard

Libraries improvements: custom one appearing in the imported libraries and be able to delete it

Problem statement
Given that my custom library is not part of the standard store, it doesn't appear on the imported libraries but directly in the frameworks.

Expected behavior

Have them in dedicated section on frameworks management

Additional context
Thanks to Gildas for the feedback

Update CI to push to prebuilt images and use GHCR

To benefit docker-compose and avoid some specific issues with local build

Important: support multi-arch

Improve the management of frameworks with multiple levels

Problem statement

Some frameworks (such as CyFun and FedRAMP) have multiple levels, and with the current pattern, we will have to have the most comprehensive level or multiple ones. This is not ideal and could be misleading for users or duplicate the effort for the auditor.

Expected behavior

1. Import a framework
2. When starting an assessment (audit), if the framework has multiple levels, the modal will ask for the targeted one and create the assessment accordingly
3. The tracking of progress, reporting and other features should not be affected
4. The auditor should be able to change the targeted level of an ongoing assessment, up or down and CISO Assistant should adjust to that

paraglide-js: not found

Hello,

npm CI is failing

To Reproduce
docker compose up
Expected behavior
Application should run without error

Environment (please complete the following information):

Device: Ubuntu server
OS: 12.02
Docker version 25.0.1, build 29cf629

Output :
=> ERROR [frontend builder 13/15] RUN npm ci 36.4s

[frontend builder 13/15] RUN npm ci:
4.022 npm WARN ERESOLVE overriding peer dependency
4.023 npm WARN While resolving: @sveltejs/[email protected]
4.023 npm WARN Found: [email protected]
4.023 npm WARN node_modules/vite
4.024 npm WARN dev vite@"^5.0.0" from the root project
4.024 npm WARN 10 more (@storybook/builder-vite, @storybook/svelte-vite, ...)
4.024 npm WARN
4.024 npm WARN Could not resolve dependency:
4.024 npm WARN peer vite@"^4.0.0" from @sveltejs/[email protected]
4.024 npm WARN node_modules/@storybook/svelte-vite/node_modules/@sveltejs/vite-plugin-svelte
4.024 npm WARN @sveltejs/vite-plugin-svelte@"^2.4.2" from @storybook/[email protected]
4.024 npm WARN node_modules/@storybook/svelte-vite
4.024 npm WARN 1 more (@sveltejs/vite-plugin-svelte-inspector)
4.024 npm WARN
4.024 npm WARN Conflicting peer dependency: [email protected]
4.024 npm WARN node_modules/vite
4.024 npm WARN peer vite@"^4.0.0" from @sveltejs/[email protected]
4.024 npm WARN node_modules/@storybook/svelte-vite/node_modules/@sveltejs/vite-plugin-svelte
4.024 npm WARN @sveltejs/vite-plugin-svelte@"^2.4.2" from @storybook/[email protected]
4.024 npm WARN node_modules/@storybook/svelte-vite
4.024 npm WARN 1 more (@sveltejs/vite-plugin-svelte-inspector)
4.037 npm WARN ERESOLVE overriding peer dependency
4.038 npm WARN While resolving: @sveltejs/[email protected]
4.038 npm WARN Found: [email protected]
4.038 npm WARN node_modules/vite
4.038 npm WARN dev vite@"^5.0.0" from the root project
4.038 npm WARN 10 more (@storybook/builder-vite, @storybook/svelte-vite, ...)
4.038 npm WARN
4.038 npm WARN Could not resolve dependency:
4.038 npm WARN peer vite@"^4.0.0" from @sveltejs/[email protected]
4.038 npm WARN node_modules/@storybook/svelte-vite/node_modules/@sveltejs/vite-plugin-svelte/node_modules/@sveltejs/vite-plugin-svelte-inspector
4.038 npm WARN @sveltejs/vite-plugin-svelte-inspector@"^1.0.4" from @sveltejs/[email protected]
4.038 npm WARN
4.038 npm WARN Conflicting peer dependency: [email protected]
4.038 npm WARN node_modules/vite
4.038 npm WARN peer vite@"^4.0.0" from @sveltejs/[email protected]
4.038 npm WARN node_modules/@storybook/svelte-vite/node_modules/@sveltejs/vite-plugin-svelte/node_modules/@sveltejs/vite-plugin-svelte-inspector
4.038 npm WARN @sveltejs/vite-plugin-svelte-inspector@"^1.0.4" from @sveltejs/[email protected]
17.64 npm WARN deprecated [email protected]: Use your platform's native atob() and btoa() methods instead
18.56 npm WARN deprecated [email protected]: Use your platform's native DOMException instead
36.13
36.13 > [email protected] postinstall
36.13 > paraglide-js compile --project ./project.inlang
36.13
36.15 sh: paraglide-js: not found
36.16 npm ERR! code 127
36.16 npm ERR! path /app
36.16 npm ERR! command failed
36.16 npm ERR! command sh -c paraglide-js compile --project ./project.inlang
36.16
36.16 npm ERR! A complete log of this run can be found in: /root/.npm/_logs/2024-04-05T10_58_05_289Z-debug-0.log

---

failed to solve: process "/bin/sh -c npm ci" did not complete successfully: exit code: 127

Regards.

Spanish translation

LPM

Production settings for Front Build

ciso-assistant-community/frontend/Dockerfile

Line 18 in 08031b0

ENV NODE_ENV=development

ANSSI guide hygiene

FedRAMP framework

Portuguese translation

Token based API interaction

Problem statement
I want to be able to interact with the back for automation and relying on a secure ephemeral token instead of the username/password

Expected behavior

1. call the login endpoint with user credentials to get the ephemeral token,
2. interact with the api with the Authorisation header
3. No regression on the standard user flow (through the UI)

HIPAA

Support HIPAA framework

History of old assets

Problem statement
I would like to be able to have a traceability of old assets. For some audits, it is required to see what was the previous status of the company and how it has evolved until now. When deleting an asset, it is currently totally erased. An option to be able to keep it in an history bucket could be great.

Expected behavior

1. Delete an asset
2. Pop-up appears with an option to move the asset to the history dump or not

AirCyber

HDS/HDH

Health Data Hosting / Hébergeur de Données de Santé

Be able to see/reach the evidences from the audit directly

Problem statement

• Evidences directly available for auditors
• allow auditors to directly have access to the evidence next to a control (in the compliance assessment page) instead of waiting for the export phase

Expected behavior

1. next to a control, see badges indicating attached evidences. to avoid saturating the UI, the names will be on the tooltip and we will get to the evidence when clicked on

Additional context
Thanks to Julien for the suggestion

Ebios RM (ateliers)

On dispose des objets pour gérer une analyse de risque et son plan de remediation mais il serait utile d'avoir des écrans supplémentaires pour gérer les ateliers

Failed to import ISO 27001-2022 library

Describe the bug
Similar to #14

Internal Server error 500

To Reproduce
Steps to reproduce the behavior:

1. Import ISO 27001-2022 framework

Expected behavior
Import works as expected

Screenshots

Environment (please complete the following information):

• OS: Debian 12
• Python: 3.11
• Git repo hash:

git rev-parse --verify HEAD
5c4051040f572fb3efafeee0dd0d16a40d6e6b8e

git rev-parse --branches
5c4051040f572fb3efafeee0dd0d16a40d6e6b8e

git rev-parse --remotes
5c4051040f572fb3efafeee0dd0d16a40d6e6b8e
a9a6d866e7c52623969138079bfb0fbfb05785e6
b19b1e005044ace506dae5d9d233e4e50b89bcdf
d373310ac476ba4c4d5bd52e0e26af2dfa39fee6
7f9dd77973a8bb69eec4755735b2054e1dba6dec
5c4051040f572fb3efafeee0dd0d16a40d6e6b8e

Additional context
Debug log

[30/Jan/2024 07:53:33] "POST /accounts/login/?next=/libraries/import_default_library/urn%3Aintuitem%3Arisk%3Alibrary%3Aiso27001-2022 HTTP/1.1" 302 0
Internal Server Error: /libraries/import_default_library/urn:intuitem:risk:library:iso27001-2022
Traceback (most recent call last):
  File "/root/ciso-assistant-community/venv/lib/python3.11/site-packages/django/db/models/query.py", line 916, in get_or_create
    return self.get(**kwargs), False
           ^^^^^^^^^^^^^^^^^^
  File "/root/ciso-assistant-community/venv/lib/python3.11/site-packages/django/db/models/query.py", line 637, in get
    raise self.model.DoesNotExist(
core.models.SecurityFunction.DoesNotExist: SecurityFunction matching query does not exist.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/root/ciso-assistant-community/venv/lib/python3.11/site-packages/django/core/handlers/exception.py", line 55, in inner
    response = get_response(request)
               ^^^^^^^^^^^^^^^^^^^^^
  File "/root/ciso-assistant-community/venv/lib/python3.11/site-packages/django/core/handlers/base.py", line 197, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/root/ciso-assistant-community/venv/lib/python3.11/site-packages/django/contrib/auth/decorators.py", line 23, in _wrapper_view
    return view_func(request, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/root/ciso-assistant-community/library/views.py", line 82, in import_default_library
    raise e
  File "/root/ciso-assistant-community/library/views.py", line 80, in import_default_library
    import_library_view(request, library)
  File "/root/ciso-assistant-community/library/utils.py", line 355, in import_library_view
    import_objects(objects_imported)
  File "/root/ciso-assistant-community/library/utils.py", line 303, in import_objects
    import_security_function(security_function)
  File "/root/ciso-assistant-community/library/utils.py", line 274, in import_security_function
    security_function = SecurityFunction.objects.update_or_create(
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/root/ciso-assistant-community/venv/lib/python3.11/site-packages/django/db/models/manager.py", line 87, in manager_method
    return getattr(self.get_queryset(), name)(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/root/ciso-assistant-community/venv/lib/python3.11/site-packages/django/db/models/query.py", line 949, in update_or_create
    obj, created = self.select_for_update().get_or_create(defaults, **kwargs)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/root/ciso-assistant-community/venv/lib/python3.11/site-packages/django/db/models/query.py", line 923, in get_or_create
    return self.create(**params), True
           ^^^^^^^^^^^^^^^^^^^^^
  File "/root/ciso-assistant-community/venv/lib/python3.11/site-packages/django/db/models/query.py", line 658, in create
    obj.save(force_insert=True, using=self.db)
  File "/root/ciso-assistant-community/core/base_models.py", line 95, in save
    self.clean()
  File "/root/ciso-assistant-community/core/base_models.py", line 92, in clean
    raise ValidationError(field_errors)
django.core.exceptions.ValidationError: {'name': ['Value already used in this scope.']}
[30/Jan/2024 07:53:34] "GET /libraries/import_default_library/urn:intuitem:risk:library:iso27001-2022 HTTP/1.1" 500 192245

Miss-alignment on bar charts

Analytics can have some inconsistencies: for instance on the the main dashboard, the assessment status are not accurate

Merge Risk and Compliance engine

ISO 31000 support?

npm CI is failing in docker compose

npm CI is failing

To Reproduce
docker compose up
Expected behavior
Application should run without error

Environment (please complete the following information):

• Device: MacOS
• OS: 14.2

Additional context

[+] Building 19.9s (9/15)                                                                                                                                                                                                                                docker:desktop-linux
 => [frontend internal] load build definition from Dockerfile                                                                                                                                                                                                            0.0s
 => => transferring dockerfile: 454B                                                                                                                                                                                                                                     0.0s
 => [frontend internal] load metadata for docker.io/library/node:18-alpine                                                                                                                                                                                               1.7s
 => [frontend auth] library/node:pull token for registry-1.docker.io                                                                                                                                                                                                     0.0s
 => [frontend internal] load .dockerignore                                                                                                                                                                                                                               0.0s
 => => transferring context: 222B                                                                                                                                                                                                                                        0.0s
 => [frontend internal] load build context                                                                                                                                                                                                                               0.0s
 => => transferring context: 17.14kB                                                                                                                                                                                                                                     0.0s
 => [frontend stage-1 1/5] FROM docker.io/library/node:18-alpine@sha256:0085670310d2879621f96a4216c893f92e2ded827e9e6ef8437672e1bd72f437                                                                                                                                 0.0s
 => CACHED [frontend stage-1 2/5] WORKDIR /app                                                                                                                                                                                                                           0.0s
 => CACHED [frontend builder 3/7] COPY package*.json .                                                                                                                                                                                                                   0.0s
 => ERROR [frontend builder 4/7] RUN npm ci                                                                                                                                                                                                                             18.2s
------
 > [frontend builder 4/7] RUN npm ci:
9.085 npm WARN deprecated [email protected]: Use your platform's native atob() and btoa() methods instead
9.344 npm WARN deprecated [email protected]: Use your platform's native DOMException instead
17.39
17.39 > [email protected] postinstall
17.39 > paraglide-js compile --project ./project.inlang
17.39
17.73 ℹ [paraglide] Compiling inlang project at "./project.inlang".
17.75
17.75  WARN  Could not find repository root for path /app/project.inlang
17.75
17.76
17.76  WARN  The project has errors:
17.76
17.76
17.76  ERROR  The file at "/app/project.inlang/settings.json" could not be read. Does the file exists?
17.76
17.76   at loadSettings (node_modules/@inlang/paraglide-js/dist/index.js:24697:11)
17.76
17.77 npm notice
17.77 npm notice New minor version of npm available! 10.2.3 -> 10.4.0
17.77 npm notice Changelog: <https://github.com/npm/cli/releases/tag/v10.4.0>
17.77 npm notice Run `npm install -g [email protected]` to update!
17.77 npm notice
17.77 npm ERR! code 1
17.77 npm ERR! path /app
17.77 npm ERR! command failed
17.77 npm ERR! command sh -c paraglide-js compile --project ./project.inlang
17.77
17.77 npm ERR! A complete log of this run can be found in: /root/.npm/_logs/2024-02-14T07_44_52_432Z-debug-0.log
------
failed to solve: process "/bin/sh -c npm ci" did not complete successfully: exit code: 1

No proper update of displayed 'Primary' fields in assets table

The 'Primary' label of primary assets, displayed besides the name of the asset does not get updated when moving to another page, where only Secondary assets are displayed (and thus no label at all should appear).

Steps to reproduce the behavior:

1. Create one or more Primary assets
2. Create more than 10 other secondary assets (or less depending on the number of asset to display) in order to have at least 2 pages to be displayed
3. Go from one page to another and see the label appear next to secondary assets

Normally, the 'Primary' label should disappear next to secondary assets.

Screenshots

• Device: Virtual Box VM
• OS: OpenSuse 15
• Browser: Firefox
• Version : 102.11.0esr

TIBER-EU TIBER-FR

OWASP ASVS

https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0.3-en.pdf

NIST Privacy Framework

Add Domain name in projects list

3CF

Arabic translation

Failed to import ISO 27001-2022 library

I tried to import the ISO 27k library multiple times, but it always fails no matter if the DB if SQLite or Postgres. Also tried Docker and local installs, without success...

To get some more context, I enabled DJANGO_DEBUG and imported https://github.com/Qix-/better-exceptions

Version is 0.9.1 (cloned Oct 18 2023)
$ cat ciso_assistant/VERSION 0.9.1

Stacktrace:

`Importing framework: ISO/IEC 27001:2022
Traceback (most recent call last):
File "/home/stefan/tools/ciso-assistant-community/venv/lib/python3.11/site-packages/django/db/models/query.py", line 916, in get_or_create
return self.get(**kwargs), False
│ └ {'urn': 'urn:intuitem:risk:req_groups:iso27001-2022:core:10:10.2:annex-a:5'}
└ <QuerySet [<RequirementGroup: Core>, <RequirementGroup: 4>, <RequirementGroup: 4.1>, <RequirementGroup: 4.2>, <RequirementGroup:...
File "/home/stefan/tools/ciso-assistant-community/venv/lib/python3.11/site-packages/django/db/models/query.py", line 637, in get
raise self.model.DoesNotExist(
core.models.RequirementGroup.DoesNotExist: RequirementGroup matching query does not exist.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/stefan/tools/ciso-assistant-community/venv/lib/python3.11/site-packages/django/core/handlers/base.py", line 197, in _get_response
response = wrapped_callback(request, *callback_args, **callback_kwargs)
│ │ │ │ └ {'library_urn': 'urn:intuitem:risk:library:iso27001-2022'}
│ │ │ └ ()
│ │ └ <WSGIRequest: POST '/libraries/import_default_library/urn:intuitem:risk:library:iso27001-2022'>
│ └ <function import_default_library at 0x7fb492ec6ac0>
└ None
File "/home/stefan/tools/ciso-assistant-community/venv/lib/python3.11/site-packages/django/contrib/auth/decorators.py", line 23, in _wrapper_view
return view_func(request, *args, **kwargs)
│ │ │ └ {'library_urn': 'urn:intuitem:risk:library:iso27001-2022'}
│ │ └ ()
│ └ <WSGIRequest: POST '/libraries/import_default_library/urn:intuitem:risk:library:iso27001-2022'>
└ <function import_default_library at 0x7fb49304cfe0>
File "/home/stefan/tools/ciso-assistant-community/library/views.py", line 82, in import_default_library
raise e
File "/home/stefan/tools/ciso-assistant-community/library/views.py", line 80, in import_default_library
import_library_view(request, library)
│ │ └ {'urn': 'urn:intuitem:risk:library:iso27001-2022', 'locale': 'en', 'name': 'ISO/IEC 27001:2022', 'description': 'Information sec...
│ └ <WSGIRequest: POST '/libraries/import_default_library/urn:intuitem:risk:library:iso27001-2022'>
└ <function import_library_view at 0x7fb492ec6340>
File "/home/stefan/tools/ciso-assistant-community/library/utils.py", line 355, in import_library_view
import_objects(objects_imported)
│ └ {'threats': [{'urn': 'urn:intuitem:risk:threat:T1047', 'name': 'T1047 - Windows Management Instrumentation', 'provider': 'MITRE ...
└ <function import_objects at 0x7fb492ec6200>
File "/home/stefan/tools/ciso-assistant-community/library/utils.py", line 311, in import_objects
import_requirement_group(framework_urn=framework['urn'], fields=requirement_group)
│ │ └ {'urn': 'urn:intuitem:risk:req_groups:iso27001-2022:core:10:10.2:annex-a:5', 'name': '5', 'description': 'Organisational control...
│ └ {'urn': 'urn:intuitem:risk:framework:iso27001-2022', 'provider': 'ISO/IEC', 'name': 'ISO/IEC 27001:2022', 'description': 'Inform...
└ <function import_requirement_group at 0x7fb492ec5e40>
File "/home/stefan/tools/ciso-assistant-community/library/utils.py", line 111, in import_requirement_group
requirement_group = RequirementGroup.objects.update_or_create(
File "/home/stefan/tools/ciso-assistant-community/venv/lib/python3.11/site-packages/django/db/models/manager.py", line 87, in manager_method
return getattr(self.get_queryset(), name)(*args, **kwargs)
│ │ │ └ {'defaults': {'framework': <Framework: ISO/IEC 27001:2022>, 'urn': 'urn:intuitem:risk:req_groups:iso27001-2022:core:10:10.2:anne...
│ │ └ ()
│ └ 'update_or_create'
└ <django.db.models.manager.Manager object at 0x7fb492f7acd0>
File "/home/stefan/tools/ciso-assistant-community/venv/lib/python3.11/site-packages/django/db/models/query.py", line 949, in update_or_create
obj, created = self.select_for_update().get_or_create(defaults, **kwargs)
│ │ └ {'urn': 'urn:intuitem:risk:req_groups:iso27001-2022:core:10:10.2:annex-a:5'}
│ └ {'framework': <Framework: ISO/IEC 27001:2022>, 'urn': 'urn:intuitem:risk:req_groups:iso27001-2022:core:10:10.2:annex-a:5', 'pare...
└ <QuerySet [<RequirementGroup: Core>, <RequirementGroup: 4>, <RequirementGroup: 4.1>, <RequirementGroup: 4.2>, <RequirementGroup:...
File "/home/stefan/tools/ciso-assistant-community/venv/lib/python3.11/site-packages/django/db/models/query.py", line 923, in get_or_create
return self.create(**params), True
│ └ {'urn': 'urn:intuitem:risk:req_groups:iso27001-2022:core:10:10.2:annex-a:5', 'framework': <Framework: ISO/IEC 27001:2022>, 'pare...
└ <QuerySet [<RequirementGroup: Core>, <RequirementGroup: 4>, <RequirementGroup: 4.1>, <RequirementGroup: 4.2>, <RequirementGroup:...
File "/home/stefan/tools/ciso-assistant-community/venv/lib/python3.11/site-packages/django/db/models/query.py", line 658, in create
obj.save(force_insert=True, using=self.db)
│ └ <QuerySet [<RequirementGroup: Core>, <RequirementGroup: 4>, <RequirementGroup: 4.1>, <RequirementGroup: 4.2>, <RequirementGroup:...
└ <RequirementGroup: 5>
File "/home/stefan/tools/ciso-assistant-community/core/base_models.py", line 107, in save
self.clean()
└ <RequirementGroup: 5>
File "/home/stefan/tools/ciso-assistant-community/core/base_models.py", line 102, in clean
super().clean()
File "/home/stefan/tools/ciso-assistant-community/core/base_models.py", line 29, in clean
raise ValidationError(field_errors)
│ └ {'name': 'This name is already in use.'}
└ <class 'django.core.exceptions.ValidationError'>
django.core.exceptions.ValidationError: {'name': ['This name is already in use.']}
"POST /libraries/import_default_library/urn:intuitem:risk:library:iso27001-2022 HTTP/1.1" 500 215317`

MASVS

https://mas.owasp.org/MASVS/
Mobile ASVS