forked from mirrors/kingfisher
updated docs
This commit is contained in:
Mick Grove
parent
93b48e86df
commit
dae93afcdd
7 changed files with 48 additions and 16 deletions
12
README.md
12
README.md
|
|
@ -7,7 +7,7 @@
|
|||
<img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg" alt="License" style="height: 24px;" />
|
||||
</a>
|
||||
<a href="https://github.com/mongodb/kingfisher">
|
||||
<img src="https://img.shields.io/badge/Detection%20Rules-950-2ea043.svg" alt="Detection Rules" style="height: 24px;" />
|
||||
<img src="https://img.shields.io/badge/Detection%20Rules-954-2ea043.svg" alt="Detection Rules" style="height: 24px;" />
|
||||
</a>
|
||||
<br>
|
||||
<a href="https://github.com/mongodb/kingfisher/pkgs/container/kingfisher">
|
||||
|
|
@ -20,7 +20,7 @@
|
|||
|
||||
Kingfisher is an open source secret scanner and **live secret validation** tool built in Rust.
|
||||
|
||||
It combines Intel's SIMD-accelerated regex engine (Hyperscan) with language-aware parsing to achieve high accuracy at massive scale, and ships with [950 built-in rules](https://mongodb.github.io/kingfisher/rules/builtin-rules/) to detect, **validate**, and triage leaked API keys, tokens, and credentials before they ever reach production.
|
||||
It combines Intel's SIMD-accelerated regex engine (Hyperscan) with language-aware parsing to achieve high accuracy at massive scale, and ships with [950+ built-in rules](https://mongodb.github.io/kingfisher/rules/builtin-rules/) to detect, **validate**, and triage leaked API keys, tokens, and credentials before they ever reach production.
|
||||
|
||||
Kingfisher also ships a **browser-based report viewer** that visualizes and triages findings from Kingfisher **and** from Gitleaks and TruffleHog JSON reports — so you can import scans from other tools and triage them in the same UI. A [hosted copy of the viewer](https://mongodb.github.io/kingfisher/viewer/) is published on the Kingfisher docs site [or run locally](#3-scan-and-view-results-in-browser)
|
||||
|
||||
|
|
@ -54,9 +54,9 @@ Kingfisher is a high-performance, open source secret detection tool for source c
|
|||
|
||||
</div>
|
||||
|
||||
### Performance, Accuracy, and 950 Rules
|
||||
### Performance, Accuracy, and 954 Rules
|
||||
- **Performance**: multithreaded, Hyperscan‑powered scanning built for huge codebases
|
||||
- **Extensible rules**: 950 built-in rules plus YAML-defined custom rules ([docs/RULES.md](/docs/RULES.md))
|
||||
- **Extensible rules**: 954 built-in rules plus YAML-defined custom rules ([docs/RULES.md](/docs/RULES.md))
|
||||
- **Validate & Revoke**: live validation of discovered secrets, plus direct revocation for supported platforms (GitHub, GitLab, Slack, AWS, GCP, and more) ([docs/USAGE.md](/docs/USAGE.md))
|
||||
- **Revocation support matrix**: current built-in revocation coverage across providers and rule IDs ([docs/REVOCATION_PROVIDERS.md](/docs/REVOCATION_PROVIDERS.md))
|
||||
- **Blast Radius Mapping**: instantly map leaked keys to their effective cloud identities and exposed resources with `--access-map` (alias `--blast-radius`). Supports 43 providers (see table below).
|
||||
|
|
@ -400,7 +400,7 @@ kingfisher scan /path/to/scan --access-map --view-report
|
|||
|
||||
# Detection Rules
|
||||
|
||||
Kingfisher ships with [950 built-in rules](crates/kingfisher-rules/data/rules/) covering cloud keys, AI tokens, CI/CD secrets, database credentials, and SaaS API keys. Below is an overview — see the full list in [crates/kingfisher-rules/data/rules/](crates/kingfisher-rules/data/rules/):
|
||||
Kingfisher ships with [954 built-in rules](crates/kingfisher-rules/data/rules/) covering cloud keys, AI tokens, CI/CD secrets, database credentials, and SaaS API keys. Below is an overview — see the full list in [crates/kingfisher-rules/data/rules/](crates/kingfisher-rules/data/rules/):
|
||||
|
||||
| Category | What we catch |
|
||||
|----------|---------------|
|
||||
|
|
@ -417,7 +417,7 @@ Kingfisher ships with [950 built-in rules](crates/kingfisher-rules/data/rules/)
|
|||
|
||||
## Write Custom Rules
|
||||
|
||||
Kingfisher ships with 950 built-in rules.
|
||||
Kingfisher ships with 954 built-in rules.
|
||||
|
||||
However, you may want to add your own custom rules, or modify a detection to better suit your needs / environment.
|
||||
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
title: Kingfisher — Open Source Secret Scanner with Live Validation
|
||||
description: >-
|
||||
Kingfisher is an open source secret scanner with live validation, blast radius
|
||||
mapping, and credential revocation. 950 detection rules (485 with live validation),
|
||||
mapping, and credential revocation. 954 detection rules (489 with live validation),
|
||||
plus a browser-based report viewer that also triages Gitleaks and TruffleHog output.
|
||||
Built in Rust by MongoDB.
|
||||
template: home.html
|
||||
|
|
|
|||
|
|
@ -1,13 +1,13 @@
|
|||
---
|
||||
title: "Built-in Rules List"
|
||||
description: "Complete list of all 950 built-in secret detection rules in Kingfisher. Searchable and filterable by provider, confidence level, and validation support."
|
||||
description: "Complete list of all 954 built-in secret detection rules in Kingfisher. Searchable and filterable by provider, confidence level, and validation support."
|
||||
---
|
||||
|
||||
# Built-in Rules
|
||||
|
||||
Kingfisher ships with **950 detection rules** across **583 providers**
|
||||
(826 detectors + 124 dependent rules).
|
||||
Of these, **485** include live validation and **50** support direct revocation.
|
||||
Kingfisher ships with **954 detection rules** across **584 providers**
|
||||
(830 detectors + 124 dependent rules).
|
||||
Of these, **489** include live validation and **50** support direct revocation.
|
||||
|
||||
!!! tip "Search"
|
||||
Use the search box below to filter rules by provider name, rule ID, or confidence level.
|
||||
|
|
@ -2020,6 +2020,30 @@ Of these, **485** include live validation and **50** support direct revocation.
|
|||
<td>Yes</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Devin</td>
|
||||
<td>Cognition Devin Personal API Key</td>
|
||||
<td><code>kingfisher.devin.1</code></td>
|
||||
<td>Medium</td>
|
||||
<td>Yes</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Devin</td>
|
||||
<td>Cognition Devin Service API Key</td>
|
||||
<td><code>kingfisher.devin.2</code></td>
|
||||
<td>Medium</td>
|
||||
<td>Yes</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Devin</td>
|
||||
<td>Cognition Devin Service User Token</td>
|
||||
<td><code>kingfisher.devin.3</code></td>
|
||||
<td>Medium</td>
|
||||
<td>Yes</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Diffbot</td>
|
||||
<td>Diffbot API Key</td>
|
||||
<td><code>kingfisher.diffbot.1</code></td>
|
||||
|
|
@ -7263,7 +7287,15 @@ Of these, **485** include live validation and **50** support direct revocation.
|
|||
<td>Voyageai</td>
|
||||
<td>Voyage AI API Key</td>
|
||||
<td><code>kingfisher.voyageai.api_key</code></td>
|
||||
<td>High</td>
|
||||
<td>Medium</td>
|
||||
<td>Yes</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Voyageai</td>
|
||||
<td>Voyage AI API Key</td>
|
||||
<td><code>kingfisher.voyageai.api_key.2</code></td>
|
||||
<td>Medium</td>
|
||||
<td>Yes</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
|
|
|
|||
|
|
@ -300,7 +300,7 @@ kingfisher scan ./my-project \
|
|||
|
||||
## Custom Rules
|
||||
|
||||
Kingfisher currently ships with 950 built-in rules, but you may want to add your own custom rules or modify existing detection to better suit your needs.
|
||||
Kingfisher currently ships with 954 built-in rules, but you may want to add your own custom rules or modify existing detection to better suit your needs.
|
||||
|
||||
First, review [RULES.md](../rules/overview.md) to learn how to create custom Kingfisher rules.
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
site_name: Kingfisher
|
||||
site_url: https://mongodb.github.io/kingfisher
|
||||
site_description: >-
|
||||
Open source secret scanner with live validation. 950 detection rules,
|
||||
Open source secret scanner with live validation. 954 detection rules,
|
||||
blast radius mapping, credential revocation, and a browser-based
|
||||
report viewer that also imports Gitleaks and TruffleHog output.
|
||||
Built in Rust by MongoDB.
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@
|
|||
<section class="kf-stats">
|
||||
<div class="kf-stats__inner md-grid">
|
||||
<div class="kf-stats__item">
|
||||
<span class="kf-stats__number">950</span>
|
||||
<span class="kf-stats__number">954</span>
|
||||
<span class="kf-stats__label">Detection Rules</span>
|
||||
</div>
|
||||
<div class="kf-stats__item">
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@
|
|||
"@context": "https://schema.org",
|
||||
"@type": "SoftwareApplication",
|
||||
"name": "Kingfisher",
|
||||
"description": "Open source secret scanner with live validation. 950 detection rules, blast radius mapping, and credential revocation.",
|
||||
"description": "Open source secret scanner with live validation. 954 detection rules, blast radius mapping, and credential revocation.",
|
||||
"applicationCategory": "DeveloperApplication",
|
||||
"operatingSystem": "Linux, macOS, Windows",
|
||||
"license": "https://opensource.org/licenses/Apache-2.0",
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue