tests fixes and some product advisories tunes ups

This commit is contained in:
master
2026-01-30 07:57:43 +02:00
parent 644887997c
commit 55744f6a39
345 changed files with 26290 additions and 2267 deletions

View File

@@ -0,0 +1,17 @@
{
"templateId": "tmpl-attest-expiry-warning-email",
"tenantId": "bootstrap",
"channelType": "Email",
"key": "tmpl-attest-expiry-warning",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "Html",
"format": "Html",
"description": "Email notification for attestation expiry warning",
"metadata": {
"eventKind": "attestor.expiry.warning",
"category": "attestation",
"subject": "[WARNING] Attestation Expiring Soon: {{ event.attestationId }}"
},
"body": "<!DOCTYPE html>\n<html>\n<head><style>body{font-family:sans-serif;line-height:1.5;}.section{margin:1em 0;padding:1em;background:#f8f9fa;border-radius:4px;}.label{font-weight:bold;color:#666;}.mono{font-family:monospace;background:#e9ecef;padding:2px 6px;border-radius:3px;}.warning{color:#ffc107;}</style></head>\n<body>\n<h2 class=\"warning\">Attestation Expiry Warning</h2>\n<div class=\"section\">\n<p><span class=\"label\">Attestation ID:</span> <span class=\"mono\">{{ event.attestationId }}</span></p>\n<p><span class=\"label\">Artifact Digest:</span> <span class=\"mono\">{{ event.artifactDigest }}</span></p>\n<p><span class=\"label\">Expires At (UTC):</span> {{ event.expiresAtUtc }}</p>\n<p><span class=\"label\">Days Until Expiry:</span> {{ event.daysUntilExpiry }}</p>\n</div>\n{{ #if event.signerIdentity }}<div class=\"section\">\n<p><span class=\"label\">Signer:</span> <span class=\"mono\">{{ event.signerIdentity }}</span></p>\n</div>{{ /if }}\n<hr>\n<p style=\"font-size:0.85em;color:#666;\">Event ID: {{ event.eventId }} | Occurred: {{ event.occurredAtUtc }}</p>\n</body>\n</html>"
}

View File

@@ -0,0 +1,16 @@
{
"templateId": "tmpl-attest-expiry-warning-slack",
"tenantId": "bootstrap",
"channelType": "Slack",
"key": "tmpl-attest-expiry-warning",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "Markdown",
"format": "Json",
"description": "Slack notification for attestation expiry warning",
"metadata": {
"eventKind": "attestor.expiry.warning",
"category": "attestation"
},
"body": ":warning: *Attestation Expiry Warning*\n\n*Attestation ID:* `{{ event.attestationId }}`\n*Artifact:* `{{ event.artifactDigest }}`\n*Expires At:* {{ event.expiresAtUtc }}\n*Days Until Expiry:* {{ event.daysUntilExpiry }}\n\n{{ #if event.signerIdentity }}*Signer:* `{{ event.signerIdentity }}`\n{{ /if }}\n---\n_Event ID: {{ event.eventId }} | {{ event.occurredAtUtc }}_"
}

View File

@@ -0,0 +1,17 @@
{
"templateId": "identity-matched-email",
"tenantId": "bootstrap",
"channelType": "email",
"key": "identity-matched",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "Markdown",
"format": "Html",
"description": "Identity watchlist match alert for Email",
"metadata": {
"category": "attestation",
"eventKind": "attestor.identity.matched",
"subject": "[{{ event.severity }}] Identity Watchlist Alert: {{ event.watchlistEntryName }}"
},
"body": "# Identity Watchlist Alert\n\n**Watchlist Entry:** {{ event.watchlistEntryName }}\n\n**Severity:** {{ event.severity }}\n\n**Occurred:** {{ event.occurredAtUtc }}\n\n---\n\n## Matched Identity\n\n| Field | Value |\n|-------|-------|\n{% if event.matchedIdentity.issuer %}| Issuer | {{ event.matchedIdentity.issuer }} |{% endif %}\n{% if event.matchedIdentity.subjectAlternativeName %}| Subject Alternative Name | {{ event.matchedIdentity.subjectAlternativeName }} |{% endif %}\n{% if event.matchedIdentity.keyId %}| Key ID | {{ event.matchedIdentity.keyId }} |{% endif %}\n\n## Rekor Entry Details\n\n| Field | Value |\n|-------|-------|\n| UUID | {{ event.rekorEntry.uuid }} |\n| Log Index | {{ event.rekorEntry.logIndex }} |\n| Artifact SHA256 | {{ event.rekorEntry.artifactSha256 }} |\n| Integrated Time (UTC) | {{ event.rekorEntry.integratedTimeUtc }} |\n\n{% if event.suppressedCount > 0 %}\n---\n\n*Note: {{ event.suppressedCount }} similar alerts were suppressed within the deduplication window.*\n{% endif %}\n\n---\n\n*This alert was generated by Stella Ops identity watchlist monitoring.*"
}

View File

@@ -0,0 +1,16 @@
{
"templateId": "identity-matched-slack",
"tenantId": "bootstrap",
"channelType": "slack",
"key": "identity-matched",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "Markdown",
"format": "Json",
"description": "Identity watchlist match alert for Slack",
"metadata": {
"category": "attestation",
"eventKind": "attestor.identity.matched"
},
"body": ":warning: *Identity Watchlist Alert*\n\n*Entry:* {{ event.watchlistEntryName }}\n*Severity:* {{ event.severity }}\n\n*Matched Identity:*\n{% if event.matchedIdentity.issuer %}• Issuer: `{{ event.matchedIdentity.issuer }}`{% endif %}\n{% if event.matchedIdentity.subjectAlternativeName %}• SAN: `{{ event.matchedIdentity.subjectAlternativeName }}`{% endif %}\n{% if event.matchedIdentity.keyId %}• Key ID: `{{ event.matchedIdentity.keyId }}`{% endif %}\n\n*Rekor Entry:*\n• UUID: `{{ event.rekorEntry.uuid }}`\n• Log Index: `{{ event.rekorEntry.logIndex }}`\n• Artifact: `{{ event.rekorEntry.artifactSha256 }}`\n• Time: {{ event.rekorEntry.integratedTimeUtc }}\n\n{% if event.suppressedCount > 0 %}_({{ event.suppressedCount }} similar alerts suppressed)_{% endif %}"
}

View File

@@ -0,0 +1,16 @@
{
"templateId": "identity-matched-teams",
"tenantId": "bootstrap",
"channelType": "teams",
"key": "identity-matched",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "Markdown",
"format": "Json",
"description": "Identity watchlist match alert for Microsoft Teams",
"metadata": {
"category": "attestation",
"eventKind": "attestor.identity.matched"
},
"body": "{ \"@type\": \"MessageCard\", \"@context\": \"http://schema.org/extensions\", \"themeColor\": \"{% if event.severity == 'Critical' %}d13438{% elsif event.severity == 'Warning' %}ffb900{% else %}0078d4{% endif %}\", \"summary\": \"Identity Watchlist Alert: {{ event.watchlistEntryName }}\", \"sections\": [{ \"activityTitle\": \"⚠️ Identity Watchlist Alert\", \"activitySubtitle\": \"Entry: {{ event.watchlistEntryName }}\", \"facts\": [{ \"name\": \"Severity\", \"value\": \"{{ event.severity }}\" }, { \"name\": \"Occurred\", \"value\": \"{{ event.occurredAtUtc }}\" }{% if event.matchedIdentity.issuer %}, { \"name\": \"Issuer\", \"value\": \"{{ event.matchedIdentity.issuer }}\" }{% endif %}{% if event.matchedIdentity.subjectAlternativeName %}, { \"name\": \"SAN\", \"value\": \"{{ event.matchedIdentity.subjectAlternativeName }}\" }{% endif %}, { \"name\": \"Rekor UUID\", \"value\": \"{{ event.rekorEntry.uuid }}\" }, { \"name\": \"Log Index\", \"value\": \"{{ event.rekorEntry.logIndex }}\" }{% if event.suppressedCount > 0 %}, { \"name\": \"Suppressed Count\", \"value\": \"{{ event.suppressedCount }}\" }{% endif %}], \"markdown\": true }] }"
}

View File

@@ -0,0 +1,16 @@
{
"templateId": "identity-matched-webhook",
"tenantId": "bootstrap",
"channelType": "webhook",
"key": "identity-matched",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "None",
"format": "Json",
"description": "Identity watchlist match alert for Webhook (SIEM/SOC integration)",
"metadata": {
"category": "attestation",
"eventKind": "attestor.identity.matched"
},
"body": "{ \"eventType\": \"attestor.identity.matched\", \"eventId\": \"{{ event.eventId }}\", \"tenantId\": \"{{ event.tenantId }}\", \"severity\": \"{{ event.severity }}\", \"occurredAtUtc\": \"{{ event.occurredAtUtc }}\", \"watchlist\": { \"entryId\": \"{{ event.watchlistEntryId }}\", \"entryName\": \"{{ event.watchlistEntryName }}\" }, \"matchedIdentity\": { \"issuer\": \"{{ event.matchedIdentity.issuer }}\", \"subjectAlternativeName\": \"{{ event.matchedIdentity.subjectAlternativeName }}\", \"keyId\": \"{{ event.matchedIdentity.keyId }}\" }, \"rekorEntry\": { \"uuid\": \"{{ event.rekorEntry.uuid }}\", \"logIndex\": {{ event.rekorEntry.logIndex }}, \"artifactSha256\": \"{{ event.rekorEntry.artifactSha256 }}\", \"integratedTimeUtc\": \"{{ event.rekorEntry.integratedTimeUtc }}\" }, \"suppressedCount\": {{ event.suppressedCount }} }"
}

View File

@@ -0,0 +1,17 @@
{
"templateId": "tmpl-attest-key-rotation-email",
"tenantId": "bootstrap",
"channelType": "Email",
"key": "tmpl-attest-key-rotation",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "Html",
"format": "Html",
"description": "Email notification for attestation signing key rotation",
"metadata": {
"eventKind": "attestor.key.rotation",
"category": "attestation",
"subject": "[INFO] Signing Key Rotated: {{ event.keyAlias }}"
},
"body": "<!DOCTYPE html>\n<html>\n<head><style>body{font-family:sans-serif;line-height:1.5;}.section{margin:1em 0;padding:1em;background:#f8f9fa;border-radius:4px;}.label{font-weight:bold;color:#666;}.mono{font-family:monospace;background:#e9ecef;padding:2px 6px;border-radius:3px;}</style></head>\n<body>\n<h2>Signing Key Rotated</h2>\n<div class=\"section\">\n<p><span class=\"label\">Key Alias:</span> <span class=\"mono\">{{ event.keyAlias }}</span></p>\n<p><span class=\"label\">Previous Key ID:</span> <span class=\"mono\">{{ event.previousKeyId }}</span></p>\n<p><span class=\"label\">New Key ID:</span> <span class=\"mono\">{{ event.newKeyId }}</span></p>\n<p><span class=\"label\">Rotated At (UTC):</span> {{ event.rotatedAtUtc }}</p>\n</div>\n{{ #if event.rotatedBy }}<div class=\"section\">\n<p><span class=\"label\">Rotated By:</span> <span class=\"mono\">{{ event.rotatedBy }}</span></p>\n</div>{{ /if }}\n<hr>\n<p style=\"font-size:0.85em;color:#666;\">Event ID: {{ event.eventId }} | Occurred: {{ event.occurredAtUtc }}</p>\n</body>\n</html>"
}

View File

@@ -0,0 +1,17 @@
{
"templateId": "tmpl-attest-key-rotation-webhook",
"tenantId": "bootstrap",
"channelType": "Webhook",
"key": "tmpl-attest-key-rotation",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "None",
"format": "Json",
"description": "Webhook payload for attestation signing key rotation",
"metadata": {
"eventKind": "attestor.key.rotation",
"category": "attestation",
"contentType": "application/json"
},
"body": "{\"alertType\":\"attestation-key-rotation\",\"keyAlias\":\"{{ event.keyAlias }}\",\"previousKeyId\":\"{{ event.previousKeyId }}\",\"newKeyId\":\"{{ event.newKeyId }}\",\"rotatedAtUtc\":\"{{ event.rotatedAtUtc }}\",\"rotatedBy\":{{ #if event.rotatedBy }}\"{{ event.rotatedBy }}\"{{ else }}null{{ /if }},\"eventId\":\"{{ event.eventId }}\",\"occurredAtUtc\":\"{{ event.occurredAtUtc }}\"}"
}

View File

@@ -0,0 +1,16 @@
{
"templateId": "tmpl-attest-transparency-anomaly-slack",
"tenantId": "bootstrap",
"channelType": "Slack",
"key": "tmpl-attest-transparency-anomaly",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "Markdown",
"format": "Json",
"description": "Slack notification for transparency log anomaly detection",
"metadata": {
"eventKind": "attestor.transparency.anomaly",
"category": "attestation"
},
"body": ":rotating_light: *Transparency Log Anomaly Detected*\n\n*Anomaly Type:* {{ event.anomalyType }}\n*Log Source:* `{{ event.logSource }}`\n*Description:* {{ event.description }}\n\n{{ #if event.affectedEntryUuid }}*Affected Entry:* `{{ event.affectedEntryUuid }}`\n{{ /if }}{{ #if event.expectedValue }}*Expected:* `{{ event.expectedValue }}`\n*Actual:* `{{ event.actualValue }}`\n{{ /if }}\n---\n_Event ID: {{ event.eventId }} | {{ event.occurredAtUtc }}_"
}

View File

@@ -0,0 +1,17 @@
{
"templateId": "tmpl-attest-transparency-anomaly-webhook",
"tenantId": "bootstrap",
"channelType": "Webhook",
"key": "tmpl-attest-transparency-anomaly",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "None",
"format": "Json",
"description": "Webhook payload for transparency log anomaly detection",
"metadata": {
"eventKind": "attestor.transparency.anomaly",
"category": "attestation",
"contentType": "application/json"
},
"body": "{\"alertType\":\"transparency-anomaly\",\"anomalyType\":\"{{ event.anomalyType }}\",\"logSource\":\"{{ event.logSource }}\",\"description\":\"{{ event.description }}\",\"affectedEntryUuid\":{{ #if event.affectedEntryUuid }}\"{{ event.affectedEntryUuid }}\"{{ else }}null{{ /if }},\"expectedValue\":{{ #if event.expectedValue }}\"{{ event.expectedValue }}\"{{ else }}null{{ /if }},\"actualValue\":{{ #if event.actualValue }}\"{{ event.actualValue }}\"{{ else }}null{{ /if }},\"eventId\":\"{{ event.eventId }}\",\"occurredAtUtc\":\"{{ event.occurredAtUtc }}\"}"
}

View File

@@ -0,0 +1,17 @@
{
"templateId": "tmpl-attest-verify-fail-email",
"tenantId": "bootstrap",
"channelType": "Email",
"key": "tmpl-attest-verify-fail",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "Html",
"format": "Html",
"description": "Email notification for attestation verification failure",
"metadata": {
"eventKind": "attestor.verify.fail",
"category": "attestation",
"subject": "[ALERT] Attestation Verification Failed: {{ event.artifactDigest }}"
},
"body": "<!DOCTYPE html>\n<html>\n<head><style>body{font-family:sans-serif;line-height:1.5;}.section{margin:1em 0;padding:1em;background:#f8f9fa;border-radius:4px;}.label{font-weight:bold;color:#666;}.mono{font-family:monospace;background:#e9ecef;padding:2px 6px;border-radius:3px;}.alert{color:#dc3545;}</style></head>\n<body>\n<h2 class=\"alert\">Attestation Verification Failed</h2>\n<div class=\"section\">\n<p><span class=\"label\">Artifact Digest:</span> <span class=\"mono\">{{ event.artifactDigest }}</span></p>\n<p><span class=\"label\">Policy:</span> {{ event.policyName }}</p>\n<p><span class=\"label\">Failure Reason:</span> {{ event.failureReason }}</p>\n</div>\n<div class=\"section\">\n{{ #if event.attestationId }}<p><span class=\"label\">Attestation ID:</span> <span class=\"mono\">{{ event.attestationId }}</span></p>{{ /if }}\n{{ #if event.signerIdentity }}<p><span class=\"label\">Signer:</span> <span class=\"mono\">{{ event.signerIdentity }}</span></p>{{ /if }}\n</div>\n<hr>\n<p style=\"font-size:0.85em;color:#666;\">Event ID: {{ event.eventId }} | Occurred: {{ event.occurredAtUtc }}</p>\n</body>\n</html>"
}

View File

@@ -0,0 +1,16 @@
{
"templateId": "tmpl-attest-verify-fail-slack",
"tenantId": "bootstrap",
"channelType": "Slack",
"key": "tmpl-attest-verify-fail",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "Markdown",
"format": "Json",
"description": "Slack notification for attestation verification failure",
"metadata": {
"eventKind": "attestor.verify.fail",
"category": "attestation"
},
"body": ":x: *Attestation Verification Failed*\n\n*Artifact:* `{{ event.artifactDigest }}`\n*Policy:* {{ event.policyName }}\n*Failure Reason:* {{ event.failureReason }}\n\n{{ #if event.attestationId }}*Attestation ID:* `{{ event.attestationId }}`\n{{ /if }}{{ #if event.signerIdentity }}*Signer:* `{{ event.signerIdentity }}`\n{{ /if }}\n---\n_Event ID: {{ event.eventId }} | {{ event.occurredAtUtc }}_"
}

View File

@@ -0,0 +1,17 @@
{
"templateId": "tmpl-attest-verify-fail-webhook",
"tenantId": "bootstrap",
"channelType": "Webhook",
"key": "tmpl-attest-verify-fail",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "None",
"format": "Json",
"description": "Webhook payload for attestation verification failure",
"metadata": {
"eventKind": "attestor.verify.fail",
"category": "attestation",
"contentType": "application/json"
},
"body": "{\"alertType\":\"attestation-verify-fail\",\"artifactDigest\":\"{{ event.artifactDigest }}\",\"policyName\":\"{{ event.policyName }}\",\"failureReason\":\"{{ event.failureReason }}\",\"attestationId\":{{ #if event.attestationId }}\"{{ event.attestationId }}\"{{ else }}null{{ /if }},\"signerIdentity\":{{ #if event.signerIdentity }}\"{{ event.signerIdentity }}\"{{ else }}null{{ /if }},\"eventId\":\"{{ event.eventId }}\",\"occurredAtUtc\":\"{{ event.occurredAtUtc }}\"}"
}

View File

@@ -0,0 +1,19 @@
{
"templateId": "tmpl-api-deprecation-email",
"tenantId": "bootstrap",
"channelType": "Email",
"key": "tmpl-api-deprecation",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "Html",
"format": "Html",
"description": "Email notification for API deprecation notice",
"metadata": {
"eventKind": "platform.api.deprecation",
"category": "deprecation",
"version": "1.0.0",
"author": "stella-ops",
"subject": "[DEPRECATION] API Endpoint Deprecated: {{ event.endpoint }}"
},
"body": "<!DOCTYPE html>\n<html>\n<head><style>body{font-family:sans-serif;line-height:1.5;}.section{margin:1em 0;padding:1em;background:#f8f9fa;border-radius:4px;}.label{font-weight:bold;color:#666;}.mono{font-family:monospace;background:#e9ecef;padding:2px 6px;border-radius:3px;}.warning{color:#e67e22;}</style></head>\n<body>\n<h2 class=\"warning\">API Deprecation Notice</h2>\n<div class=\"section\">\n<p><span class=\"label\">Endpoint:</span> <span class=\"mono\">{{ event.endpoint }}</span></p>\n<p><span class=\"label\">API Version:</span> <span class=\"mono\">{{ event.apiVersion }}</span></p>\n<p><span class=\"label\">Deprecation Date:</span> {{ event.deprecationDate }}</p>\n<p><span class=\"label\">Sunset Date:</span> {{ event.sunsetDate }}</p>\n</div>\n<div class=\"section\">\n<p><span class=\"label\">Migration Guide:</span> <a href=\"{{ event.migrationGuideUrl }}\">{{ event.migrationGuideUrl }}</a></p>\n{{ #if event.replacementEndpoint }}<p><span class=\"label\">Replacement Endpoint:</span> <span class=\"mono\">{{ event.replacementEndpoint }}</span></p>{{ /if }}\n</div>\n<hr>\n<p style=\"font-size:0.85em;color:#666;\">Event ID: {{ event.eventId }} | Occurred: {{ event.occurredAtUtc }}</p>\n</body>\n</html>"
}

View File

@@ -0,0 +1,18 @@
{
"templateId": "tmpl-api-deprecation-slack",
"tenantId": "bootstrap",
"channelType": "Slack",
"key": "tmpl-api-deprecation",
"locale": "en-US",
"schemaVersion": "1.0.0",
"renderMode": "Markdown",
"format": "Json",
"description": "Slack notification for API deprecation notice",
"metadata": {
"eventKind": "platform.api.deprecation",
"category": "deprecation",
"version": "1.0.0",
"author": "stella-ops"
},
"body": ":warning: *API Deprecation Notice*\n\n*Endpoint:* `{{ event.endpoint }}`\n*API Version:* `{{ event.apiVersion }}`\n*Deprecation Date:* {{ event.deprecationDate }}\n*Sunset Date:* {{ event.sunsetDate }}\n\n*Migration Guide:* {{ event.migrationGuideUrl }}\n\n{{ #if event.replacementEndpoint }}*Replacement:* `{{ event.replacementEndpoint }}`\n{{ /if }}\n---\n_Event ID: {{ event.eventId }} | {{ event.occurredAtUtc }}_"
}