Finding
Last updated
A finding is a single instance of a matched audit query. These are what are loaded into collections or made available to remediation steps. They are available in the template as objects of flattened key/value pairs where the name is the named match from the audit and the value is the string from the file in that location.
Let's say we have the following YAML file:
key: value
foo: bar
bar: bazAnd we have the following audit:
(block_node
(block_mapping
(block_mapping_pair
(flow_node) @key
(flow_node) @value
)
)
)If used as a collection named objects, the object would look like this:
collections:
objects:
- key: key
value: value
- key: foo
value: bar
- key: bar
value: bazobjects becomes an array of findings. Each finding has the capture group names as keys (i.e., @key -> key) and the value from the file(s) as strings.
For remediation findings (i.e., spec.audit) it automatically iterates the findings and sets findings and $ to that object.
Last updated
# Loop 1
finding: {key: key, value: value}
# Loop 2
finding: {key: foo, value: bar}
# Loop 3
finding: {key: bar, value: baz}