SAF Convert
Convert
Translating your data to and from Heimdall Data Format (HDF) is done using the saf convert command.
Want to Recommend or Help Develop a Converter? See the wiki 📰 on how to get started.
Convert From HDF
HDF to ASFF
Note: Uploading findings into AWS Security hub requires configuration of the AWS CLI, see 👉 the AWS documentation or configuration of environment variables via Docker.
convert hdf2asff Translate a Heimdall Data Format JSON file into
AWS Security Findings Format JSON file(s) and/or
upload to AWS Security Hub
USAGE
$ saf convert hdf2asff -a <account-id> -r <region> -i <hdf-scan-results-json> -t <target> [-h] [-R] (-u [-I -C <certificate>] | [-o <asff-output-folder>])
FLAGS
-C, --certificate=<certificate> Trusted signing certificate file
-I, --insecure Disable SSL verification, this is insecure.
-R, --specifyRegionAttribute Manually specify the top-level `Region` attribute - SecurityHub
populates this attribute automatically and prohibits one from
updating it using `BatchImportFindings` or `BatchUpdateFindings`
-a, --accountId=<account-id> (required) AWS Account ID
-h, --help Show CLI help.
-i, --input=<hdf-scan-results-json> (required) Input HDF JSON File
-o, --output=<asff-output-folder> Output ASFF JSON Folder
-r, --region=<region> (required) SecurityHub Region
-t, --target=<target> (required) Unique name for target to track findings across time
-u, --upload Upload findings to AWS Security Hub
EXAMPLES
$ saf convert hdf2asff -i rhel7-scan_02032022A.json -a 123456789 -r us-east-1 -t rhel7_example_host -o rhel7.asff
$ saf convert hdf2asff -i rds_mysql_i123456789scan_03042022A.json -a 987654321 -r us-west-1 -t Instance_i123456789 -u
$ saf convert hdf2asff -i snyk_acme_project5_hdf_04052022A.json -a 2143658798 -r us-east-1 -t acme_project5 -o snyk_acme_project5 -uHDF to Splunk
Notice: HDF to Splunk requires configuration on the Splunk server. See 👉 Splunk Configuration.
convert hdf2splunk Translate and upload a Heimdall Data Format JSON file into a Splunk server
USAGE
$ saf convert hdf2splunk -i <hdf-scan-results-json> -H <host> -I <index> [-h] [-P <port>] [-s http|https] [-u <username> | -t <token>] [-p <password>] [-L info|warn|debug|verbose]
FLAGS
-H, --host=<host> (required) Splunk Hostname or IP
-I, --index=<index> (required) Splunk index to import HDF data into
-L, --logLevel=<option> [default: info]
<options: info|warn|debug|verbose>
-P, --port=<port> [default: 8089] Splunk management port (also known as the Universal Forwarder port)
-h, --help Show CLI help.
-i, --input=<hdf-scan-results-json> (required) Input HDF file
-p, --password=<password> Your Splunk password
-s, --scheme=<option> [default: https] HTTP Scheme used for communication with splunk
<options: http|https>
-t, --token=<token> Your Splunk API Token
-u, --username=<username> Your Splunk username
EXAMPLES
$ saf convert hdf2splunk -i rhel7-results.json -H 127.0.0.1 -u admin -p Valid_password! -I hdf
$ saf convert hdf2splunk -i rhel7-results.json -H 127.0.0.1 -t your.splunk.token -I hdf
For HDF Splunk Schema documentation visit 👉 Heimdall converter schemas
Previewing HDF Data Within Splunk:
An example of a full raw search query:
index="<<YOUR INDEX>>" meta.subtype=control | stats values(meta.filename) values(meta.filetype) list(meta.profile_sha256) values(meta.hdf_splunk_schema) first(meta.status) list(meta.status) list(meta.is_baseline) values(title) last(code) list(code) values(desc) values(descriptions.*) values(id) values(impact) list(refs{}.*) list(results{}.*) list(source_location{}.*) values(tags.*) by meta.guid id
| join meta.guid
[search index="<<YOUR INDEX>>" meta.subtype=header | stats values(meta.filename) values(meta.filetype) values(meta.hdf_splunk_schema) list(statistics.duration) list(platform.*) list(version) by meta.guid]
| join meta.guid
[search index="<<YOUR INDEX>>" meta.subtype=profile | stats values(meta.filename) values(meta.filetype) values(meta.hdf_splunk_schema) list(meta.profile_sha256) list(meta.is_baseline) last(summary) list(summary) list(sha256) list(supports{}.*) last(name) list(name) list(copyright) list(maintainer) list(copyright_email) last(version) list(version) list(license) list(title) list(parent_profile) list(depends{}.*) list(controls{}.*) list(attributes{}.*) list(status) by meta.guid]
An example of a formatted table search query:
index="<<YOUR INDEX>>" meta.subtype=control | stats values(meta.filename) values(meta.filetype) list(meta.profile_sha256) values(meta.hdf_splunk_schema) first(meta.status) list(meta.status) list(meta.is_baseline) values(title) last(code) list(code) values(desc) values(descriptions.*) values(id) values(impact) list(refs{}.*) list(results{}.*) list(source_location{}.*) values(tags.*) by meta.guid id
| join meta.guid
[search index="<<YOUR INDEX>>" meta.subtype=header | stats values(meta.filename) values(meta.filetype) values(meta.hdf_splunk_schema) list(statistics.duration) list(platform.*) list(version) by meta.guid]
| join meta.guid
[search index="<<YOUR INDEX>>" meta.subtype=profile | stats values(meta.filename) values(meta.filetype) values(meta.hdf_splunk_schema) list(meta.profile_sha256) list(meta.is_baseline) last(summary) list(summary) list(sha256) list(supports{}.*) last(name) list(name) list(copyright) list(maintainer) list(copyright_email) last(version) list(version) list(license) list(title) list(parent_profile) list(depends{}.*) list(controls{}.*) list(attributes{}.*) list(status) by meta.guid]
| rename values(meta.filename) AS "Results Set", values(meta.filetype) AS "Scan Type", list(statistics.duration) AS "Scan Duration", first(meta.status) AS "Control Status", list(results{}.status) AS "Test(s) Status", id AS "ID", values(title) AS "Title", values(desc) AS "Description", values(impact) AS "Impact", last(code) AS Code, values(descriptions.check) AS "Check", values(descriptions.fix) AS "Fix", values(tags.cci{}) AS "CCI IDs", list(results{}.code_desc) AS "Results Description", list(results{}.skip_message) AS "Results Skip Message (if applicable)", values(tags.nist{}) AS "NIST SP 800-53 Controls", last(name) AS "Scan (Profile) Name", last(summary) AS "Scan (Profile) Summary", last(version) AS "Scan (Profile) Version"
| table meta.guid "Results Set" "Scan Type" "Scan (Profile) Name" ID "NIST SP 800-53 Controls" Title "Control Status" "Test(s) Status" "Results Description" "Results Skip Message (if applicable)" Description Impact Severity Check Fix "CCI IDs" Code "Scan Duration" "Scan (Profile) Summary" "Scan (Profile) Version"HDF to XCCDF Results
convert hdf2xccdf Translate an HDF file into an XCCDF XML
USAGE
$ saf convert hdf2xccdf -i <hdf-scan-results-json> -o <output-xccdf-xml> [-h]
FLAGS
-h, --help Show CLI help.
-i, --input=<hdf-scan-results-json> (required) Input HDF file
-o, --output=<output-xccdf-xml> (required) Output XCCDF XML File
EXAMPLES
$ saf convert hdf2xccdf -i hdf_input.json -o xccdf-results.xmlHDF to Checklist
convert hdf2ckl Translate a Heimdall Data Format JSON file into a
DISA checklist file
USAGE
$ saf convert hdf2ckl -i <hdf-scan-results-json> -o <output-ckl> [-h] [-m <metadata>] [-H <hostname>] [-F <fqdn>] [-M <mac-address>] [-I <ip-address>]
FLAGS
-F, --fqdn=<fqdn> FQDN for CKL metadata
-H, --hostname=<hostname> Hostname for CKL metadata
-I, --ip=<ip-address> IP address for CKL metadata
-M, --mac=<mac-address> MAC address for CKL metadata
-h, --help Show CLI help.
-i, --input=<hdf-scan-results-json> (required) Input HDF file
-m, --metadata=<metadata> Metadata JSON file, generate one with "saf generate ckl_metadata"
-o, --output=<output-ckl> (required) Output CKL file
EXAMPLES
$ saf convert hdf2ckl -i rhel7-results.json -o rhel7.ckl --fqdn reverseproxy.example.org --hostname reverseproxy --ip 10.0.0.3 --mac 12:34:56:78:90HDF to CSV
convert hdf2csv Translate a Heimdall Data Format JSON file into a
Comma Separated Values (CSV) file
USAGE
$ saf convert hdf2csv -i <hdf-scan-results-json> -o <output-csv> [-h] [-f <csv-fields>] [-t]
FLAGS
-f, --fields=<csv-fields> [default: All Fields] Fields to include in output CSV, separated by commas
-h, --help Show CLI help.
-i, --input=<hdf-scan-results-json> (required) Input HDF file
-o, --output=<output-csv> (required) Output CSV file
-t, --noTruncate Don't truncate fields longer than 32,767 characters (the cell limit in Excel)
EXAMPLES
$ saf convert hdf2csv -i rhel7-results.json -o rhel7.csv --fields "Results Set,Status,ID,Title,Severity"HDF to Condensed JSON
convert hdf2condensed Condensed format used by some community members
to pre-process data for elasticsearch and custom dashboards
USAGE
$ saf convert hdf2condensed -i <hdf-scan-results-json> -o <condensed-json> [-h]
FLAGS
-h, --help Show CLI help.
-i, --input=<hdf-scan-results-json> (required) Input HDF file
-o, --output=<condensed-json> (required) Output condensed JSON file
EXAMPLES
$ saf convert hdf2condensed -i rhel7-results.json -o rhel7-condensed.jsonConvert To HDF
ASFF to HDF
| Output | Use | Command |
|---|---|---|
| ASFF json | All the findings that will be fed into the mapper | aws securityhub get-findings > asff.json |
| AWS SecurityHub enabled standards json | Get all the enabled standards so you can get their identifiers | aws securityhub get-enabled-standards > asff_standards.json |
| AWS SecurityHub standard controls json | Get all the controls for a standard that will be fed into the mapper | aws securityhub describe-standards-controls –standards-subscription-arn “arn:aws:securityhub:us-east-1:123456789123:subscription/cis-aws-foundations-benchmark/v/1.2.0” > asff_cis_standard.json |
convert asff2hdf Translate a AWS Security Finding Format JSON into a
Heimdall Data Format JSON file(s)
USAGE
$ saf convert asff2hdf -o <hdf-output-folder> [-h] (-i <asff-json> [--securityhub <standard-json>]... | -a -r <region> [-I | -C <certificate>] [-t <target>]) [-L info|warn|debug|verbose]
FLAGS
-C, --certificate=<certificate> Trusted signing certificate file
-I, --insecure Disable SSL verification, this is insecure.
-L, --logLevel=<option> [default: info]
<options: info|warn|debug|verbose>
-a, --aws Pull findings from AWS Security Hub
-h, --help Show CLI help.
-i, --input=<asff-json> Input ASFF JSON file
-o, --output=<hdf-output-folder> (required) Output HDF JSON folder
-r, --region=<region> Security Hub region to pull findings from
-t, --target=<target>... Target ID(s) to pull from Security Hub (maximum 10), leave blank for non-HDF findings
--securityhub=<standard-json>... Additional input files to provide context that an ASFF file needs
such as the CIS AWS Foundations or AWS Foundational Security Best
Practices documents (in ASFF compliant JSON form)
EXAMPLES
$ saf convert asff2hdf -i asff-findings.json -o output-folder-name
$ saf convert asff2hdf -i asff-findings.json --securityhub <standard-1-json> ... --securityhub <standard-n-json> -o output-folder-name
$ saf convert asff2hdf --aws -o out -r us-west-2 --target rhel7AWS Config to HDF
Note: Pulling AWS Config results data requires configuration of the AWS CLI, see 👉 the AWS documentation or configuration of environment variables via Docker.
convert aws_config2hdf Pull Configuration findings from AWS Config and convert
into a Heimdall Data Format JSON file
USAGE
$ saf convert aws_config2hdf -r <region> -o <hdf-scan-results-json> [-h] [-a <access-key-id>] [-s <secret-access-key>] [-t <session-token>] [-i]
FLAGS
-a, --accessKeyId=<access-key-id> Access key ID
-h, --help Show CLI help.
-i, --insecure Disable SSL verification, this is insecure.
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
-r, --region=<region> (required) Region to pull findings from
-s, --secretAccessKey=<secret-access-key> Secret access key
-t, --sessionToken=<session-token> Session token
EXAMPLES
$ saf convert aws_config2hdf -a ABCDEFGHIJKLMNOPQRSTUV -s +4NOT39A48REAL93SECRET934 -r us-east-1 -o output-hdf-name.jsonBurp Suite to HDF
convert burpsuite2hdf Translate a BurpSuite Pro XML file into a Heimdall
Data Format JSON file
USAGE
$ saf convert burpsuite2hdf -i <burpsuite-xml> -o <hdf-scan-results-json> [-h] [-w]
FLAGS
-h, --help Show CLI help.
-i, --input=<burpsuite-xml> (required) Input Burpsuite Pro XML File
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
-w, --with-raw Include raw input file in HDF JSON file
EXAMPLES
$ saf convert burpsuite2hdf -i burpsuite_results.xml -o output-hdf-name.jsonChecklist to HDF
convert ckl2hdf Translate a DISA Checklist XML file into a Heimdall Data
Format JSON file
USAGE
$ saf convert ckl2hdf -i <ckl-xml> -o <hdf-scan-results-json> [-h] [-s] [-w]
FLAGS
-h, --help Show CLI help.
-i, --input=<value> (required) Input Checklist XML File
-o, --output=<value> (required) Output HDF JSON File
-w, --with-raw Include raw input file in HDF JSON file
EXAMPLES
$ saf convert ckl2hdf -i ckl_results.xml -o output-hdf-name.jsonDBProtect to HDF
convert dbprotect2hdf Translate a DBProtect report in "Check Results
Details" XML format into a Heimdall Data Format JSON file
USAGE
$ saf convert dbprotect2hdf -i <dbprotect-xml> -o <hdf-scan-results-json> [-h] [-w]
FLAGS
-h, --help Show CLI help.
-i, --input=<dbprotect-xml> (required) 'Check Results Details' XML File
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
-w, --with-raw Include raw input file in HDF JSON file
EXAMPLES
$ saf convert dbprotect2hdf -i check_results_details_report.xml -o output-hdf-name.jsonFortify to HDF
convert fortify2hdf Translate a Fortify results FVDL file into a Heimdall
Data Format JSON file; the FVDL file is an XML that can be
extracted from the Fortify FPR project file using standard
file compression tools
USAGE
$ saf convert fortify2hdf -i <fortify-fvdl> -o <hdf-scan-results-json> [-h] [-w]
FLAGS
-h, --help Show CLI help.
-i, --input=<fortify-fvdl> (required) Input FVDL File
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
-w, --with-raw Include raw input file in HDF JSON file
EXAMPLES
$ saf convert fortify2hdf -i audit.fvdl -o output-hdf-name.jsonGoSec to HDF
convert gosec2hdf Translate a GoSec (Golang Security Checker) results file
into a Heimdall Data Format JSON file
USAGE
$ saf convert gosec2hdf -i <gosec-json> -o <hdf-scan-results-json> [-h]
FLAGS
-h, --help Show CLI help.
-i, --input=<value> (required) Input GoSec Results JSON File
-o, --output=<value> (required) Output HDF JSON File
EXAMPLES
$ saf convert gosec2hdf -i gosec_results.json -o output-hdf-name.jsonIon Channel to HDF
convert ionchannel2hdf Pull and translate SBOM data from Ion Channel
into Heimdall Data Format
USAGE
$ saf convert ionchannel2hdf -o <hdf-output-folder> [-h] (-i <ionchannel-json> | -a <api-key> -t <team-name> [--raw ] [-p <project>] [-A ]) [-L info|warn|debug|verbose]
FLAGS
-A, --allProjects Pull all projects available within your team
-L, --logLevel=<option> [default: info]
<options: info|warn|debug|verbose>
-a, --apiKey=<api-key> API Key from Ion Channel user settings
-h, --help Show CLI help.
-i, --input=<ionchannel-json>... Input IonChannel JSON file
-o, --output=<hdf-output-folder> (required) Output JSON folder
-p, --project=<project>... The name of the project(s) you would like to pull
-t, --teamName=<team-name> Your team name that contains the project(s) you would like to pull data from
--raw Output Ion Channel raw dataJFrog Xray to HDF
convert jfrog_xray2hdf Translate a JFrog Xray results JSON file into a
Heimdall Data Format JSON file
USAGE
$ saf convert jfrog_xray2hdf -i <jfrog-xray-json> -o <hdf-scan-results-json> [-h] [-w]
FLAGS
-h, --help Show CLI help.
-i, --input=<jfrog-xray-json> (required) Input JFrog JSON File
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
-w, --with-raw Include raw input file in HDF JSON file
EXAMPLES
$ saf convert jfrog_xray2hdf -i xray_results.json -o output-hdf-name.jsonTenable Nessus to HDF
convert nessus2hdf Translate a Nessus XML results file into a Heimdall
Data Format JSON file. The current iteration maps all
plugin families except for 'Policy Compliance'
A separate HDF JSON is generated for each host reported in the Nessus Report.
USAGE
$ saf convert nessus2hdf -i <nessus-xml> -o <hdf-scan-results-json> [-h] [-w]
FLAGS
-h, --help Show CLI help.
-i, --input=<nessus-xml> (required) Input Nessus XML File
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
-w, --with-raw Include raw input file in HDF JSON file
EXAMPLES
$ saf convert nessus2hdf -i nessus_results.xml -o output-hdf-name.jsonNetsparker to HDF
convert netsparker2hdf Translate a Netsparker XML results file into a
Heimdall Data Format JSON file. The current
iteration only works with Netsparker Enterprise
Vulnerabilities Scan.
USAGE
$ saf convert netsparker2hdf -i <netsparker-xml> -o <hdf-scan-results-json> [-h] [-w]
FLAGS
-h, --help Show CLI help.
-i, --input=<netsparker-xml> (required) Input Netsparker XML File
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
-w, --with-raw Include raw input file in HDF JSON file
EXAMPLES
$ saf convert netsparker2hdf -i netsparker_results.xml -o output-hdf-name.jsonNikto to HDF
convert nikto2hdf Translate a Nikto results JSON file into a Heimdall
Data Format JSON file.
Note: Currently this mapper only supports single
target Nikto Scans
USAGE
$ saf convert nikto2hdf -i <nikto-json> -o <hdf-scan-results-json> [-h] [-w]
FLAGS
-h, --help Show CLI help.
-i, --input=<nikto-json> (required) Input Niktop Results JSON File
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
-w, --with-raw Include raw input file in HDF JSON file
EXAMPLES
$ saf convert nikto2hdf -i nikto-results.json -o output-hdf-name.jsonPrisma to HDF
convert prisma2hdf Translate a Prisma Cloud Scan Report CSV file into
Heimdall Data Format JSON files
USAGE
$ saf convert prisma2hdf -i <prisma-cloud-csv> -o <hdf-output-folder> [-h]
FLAGS
-h, --help Show CLI help.
-i, --input=<prisma-cloud-csv> (required) Prisma Cloud Scan Report CSV
-o, --output=<hdf-output-folder> (required) Output HDF JSON file
EXAMPLES
$ saf convert prisma2hdf -i prismacloud-report.csv -o output-hdf-name.jsonProwler to HDF
convert prowler2hdf Translate a Prowler-derived AWS Security Finding
Format results from JSONL
into a Heimdall Data Format JSON file
USAGE
$ saf convert prowler2hdf -i <prowler-finding-json> -o <hdf-output-folder> [-h]
FLAGS
-h, --help Show CLI help.
-i, --input=<prowler-finding-json> (required) Input Prowler ASFF JSON File
-o, --output=<hdf-output-folder> (required) Output HDF JSON Folder
EXAMPLES
$ saf convert prowler2hdf -i prowler-asff.json -o output-folderSarif to HDF
convert sarif2hdf Translate a SARIF JSON file into a Heimdall Data
Format JSON file
USAGE
$ saf convert sarif2hdf -i <sarif-json> -o <hdf-scan-results-json> [-h] [-w]
FLAGS
-h, --help Show CLI help.
-i, --input=<sarif-json> (required) Input SARIF JSON File
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
-w, --with-raw Include raw input file in HDF JSON file
DESCRIPTION
SARIF level to HDF impact Mapping:
SARIF level error -> HDF impact 0.7
SARIF level warning -> HDF impact 0.5
SARIF level note -> HDF impact 0.3
SARIF level none -> HDF impact 0.1
SARIF level not provided -> HDF impact 0.1 as default
EXAMPLES
$ saf convert sarif2hdf -i sarif-results.json -o output-hdf-name.jsonScoutsuite to HDF
convert scoutsuite2hdf Translate a ScoutSuite results from a Javascript
object into a Heimdall Data Format JSON file
Note: Currently this mapper only supports AWS
USAGE
$ saf convert scoutsuite2hdf -i <scoutsuite-results-js> -o <hdf-scan-results-json> [-h] [-w]
FLAGS
-h, --help Show CLI help.
-i, --input=<scoutsuite-results-js> (required) Input ScoutSuite Results JS File
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
-w, --with-raw Include raw input file in HDF JSON file
EXAMPLES
$ saf convert scoutsuite2hdf -i scoutsuite-results.js -o output-hdf-name.jsonSnyk to HDF
convert snyk2hdf Translate a Snyk results JSON file into a Heimdall
Data Format JSON file
A separate HDF JSON is generated for each project
reported in the Snyk Report
USAGE
$ saf convert snyk2hdf -i <snyk-json> -o <hdf-scan-results-json> [-h]
FLAGS
-h, --help Show CLI help.
-i, --input=<snyk-json> (required) Input Snyk Results JSON File
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
EXAMPLES
$ saf convert snyk2hdf -i snyk_results.json -o output-file-prefixSonarQube to HDF
convert sonarqube2hdf Pull SonarQube vulnerabilities for the specified
project name and optional branch or pull/merge
request ID name from an API and convert into a
Heimdall Data Format JSON file
USAGE
$ saf convert sonarqube2hdf -n <sonar-project-key> -u <http://your.sonar.instance:9000> -a <your-sonar-api-key> [ -b <target-branch> | -p <pull-request-id> ] -o <hdf-scan-results-json>
FLAGS
-a, --auth=<your-sonar-api-key> (required) SonarQube API Key
-b, --branch=<target-branch> Requires Sonarqube Developer Edition or above
-h, --help Show CLI help.
-n, --projectKey=<sonar-project-key> (required) SonarQube Project Key
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
-p, --pullRequestID=<pull-request-id> Requires Sonarqube Developer Edition or above
-u, --url=<http://your.sonar.instance:9000> (required) SonarQube Base URL (excluding '/api')
EXAMPLES
$ saf convert sonarqube2hdf -n sonar_project_key -u http://sonar:9000 --auth abcdefg -p 123 -o scan_results.jsonSplunk to HDF
convert splunk2hdf Pull HDF data from your Splunk instance back into an HDF file
USAGE
$ saf splunk2hdf -H <host> -I <index> [-h] [-P <port>] [-s http|https] (-u <username> -p <password> | -t <token>) [-L info|warn|debug|verbose] [-i <filename/GUID> -o <hdf-output-folder>]
FLAGS
-H, --host=<host> (required) Splunk Hostname or IP
-I, --index=<index> (required) Splunk index to query HDF data from
-L, --logLevel=<option> [default: info]
<options: info|warn|debug|verbose>
-P, --port=<port> [default: 8089] Splunk management port (also known as the Universal Forwarder port)
-h, --help Show CLI help.
-i, --input=<filename/GUID>... GUID(s) or Filename(s) of files from Splunk to convert
-o, --output=<hdf-output-folder> Output HDF JSON Folder
-p, --password=<password> Your Splunk password
-s, --scheme=<option> [default: https] HTTP Scheme used for communication with splunk
<options: http|https>
-t, --token=<token> Your Splunk API Token
-u, --username=<username> Your Splunk username
EXAMPLES
$ saf convert splunk2hdf -H 127.0.0.1 -u admin -p Valid_password! -I hdf -i some-file-in-your-splunk-instance.json -i yBNxQsE1mi4f3mkjtpap5YxNTttpeG -o output-folderTrivy to HDF
convert trivy2hdf Translate a Trivy-derived AWS Security Finding
Format results from JSONL
into a Heimdall Data Format JSON file
USAGE
$ saf convert trivy2hdf -i <trivy-finding-json> -o <hdf-output-folder>
FLAGS
-h, --help Show CLI help.
-i, --input=<trivy-finding-json> (required) Input Trivy ASFF JSON File
-o, --output=<hdf-output-folder> (required) Output HDF JSON Folder
DESCRIPTION
Note: Currently this mapper only supports the results of Trivy's `image`
subcommand (featuring the CVE findings) while using the ASFF template format
(which comes bundled with the repo). An example call to Trivy to get this
type of file looks as follows:
AWS_REGION=us-east-1 AWS_ACCOUNT_ID=123456789012 trivy image --no-progress --format template --template "@/absolute_path_to/git_clone_of/trivy/contrib/asff.tpl" -o trivy_asff.json golang:1.12-alpine
EXAMPLES
$ saf convert trivy2hdf -i trivy-asff.json -o output-folderTwistlock to HDF
convert twistlock2hdf Translate a Twistlock CLI output file into an HDF results set
USAGE
$ saf convert twistlock2hdf -i <twistlock-json> -o <hdf-scan-results-json> [-h] [-w]
FLAGS
-h, --help Show CLI help.
-i, --input=<twistlock-json> (required) Input Twistlock file
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
-w, --with-raw Include raw input file in HDF JSON file
EXAMPLES
$ saf convert twistlock2hdf -i twistlock.json -o output-hdf-name.jsonVeracode to HDF
convert veracode2hdf Translate a Veracode XML file into a Heimdall Data
Format JSON file
USAGE
$ saf convert veracode2hdf -i <veracode-xml> -o <hdf-scan-results-json> [-h]
FLAGS
-h, --help Show CLI help.
-i, --input=<veracode-xml> (required) Input Veracode XML File
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
EXAMPLES
$ saf convert veracode2hdf -i veracode_results.xml -o output-hdf-name.jsonXCCDF Results to HDF
Note: xccdf_results2hdf only supports native OpenSCAP and SCC output.
[top](#convert-other-formats-to-hdf)
convert xccdf_results2hdf Translate a SCAP client XCCDF-Results XML report
to a Heimdall Data Format JSON file
USAGE
$ saf convert xccdf_results2hdf -i <xccdf-results-xml> -o <hdf-scan-results-json> [-h] [-w]
FLAGS
-h, --help Show CLI help.
-i, --input=<xccdf-results-xml> (required) Input XCCDF Results XML File
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
-w, --with-raw Include raw input file in HDF JSON file
EXAMPLES
$ saf convert xccdf_results2hdf -i results-xccdf.xml -o output-hdf-name.jsonOWASP ZAP to HDF
convert zap2hdf Translate a OWASP ZAP results JSON to a Heimdall Data Format JSON file
USAGE
$ saf convert zap2hdf -i <zap-json> -n <target-site-name> -o <hdf-scan-results-json> [-h] [-w]
FLAGS
-h, --help Show CLI help.
-i, --input=<zap-json> (required) Input OWASP Zap Results JSON File
-n, --name=<target-site-name> (required) Target Site Name
-o, --output=<hdf-scan-results-json> (required) Output HDF JSON File
-w, --with-raw Include raw input file in HDF JSON file
EXAMPLES
$ saf convert zap2hdf -i zap_results.json -n mitre.org -o scan_results.jsonOther Useful Converters
Checklist to POA&M
Note: The included CCI to NIST Mappings are the extracted from NIST.gov, for mappings specific to eMASS use this file instead).
convert ckl2POAM Translate DISA Checklist CKL file(s) to POA&M files
USAGE
$ saf convert ckl2POAM -i <disa-checklist> -o <poam-output-folder> [-h] [-O <office/org>] [-d <device-name>] [-s <num-rows>]
FLAGS
-O, --officeOrg=<office/org> Default value for Office/org (prompts for each file if not set)
-d, --deviceName=<device-name> Name of target device (prompts for each file if not set)
-h, --help Show CLI help.
-i, --input=<disa-checklist>... (required) Path to the DISA Checklist File(s)
-o, --output=<poam-output-folder> (required) Path to output PO&M File(s)
-s, --rowsToSkip=<num-rows> [default: 4] Rows to leave between POA&M Items for milestones
ALIASES
$ saf convert ckl2poam
EXAMPLES
$ saf convert ckl2POAM -i checklist_file.ckl -o output-folder -d abcdefg -s 2