lacework-inline-scanner-to-csv.sh

#!/bin/bash

IMAGE_NAME="postgres"
IMAGE_TAG="15"

# Read the JSON input from the standard input
input_json=$(lw-scanner evaluate $IMAGE_NAME $IMAGE_TAG --save --build-id ${BUILD_ID} --fixable --json)

filename="$(echo "$IMAGE_NAME:$IMAGE_TAG")_vuln_report_$(date +"%Y%m%d_%H%M%S").csv"

echo "Vulnerability,Severity,CVSSv3 Score,Package Name,Package Namespace,Current Version,Fix Version,Layer Hash,Layer Created By,File Path,Description,CVE Disclosure Page,Status" > $filename
# Convert the JSON input to CSV using jq
csv_output=$(echo "$input_json" | jq -r '
  .cve.image.image_layers[] as $layer |
  $layer.packages[] as $package |
  $package.vulnerabilities[] as $vulns |
  [$vulns.name, $vulns.severity, $vulns.metadata.NVD.CVSSv3.Score, $package.name, $package.namespace, $package.version, $vulns.fix_version, $layer.hash, $layer.created_by, $package.src, $vulns.description, $vulns.link, $vulns.status] | @csv'
)

# Output the CSV
echo "$csv_output" >> $filename