Extend advisory-processor for KEV

Why are we doing this work

The advisory-processor is currently used to receive advisories from GLAD and trivy-db. We should extend the advisory-processor so that it can ingest KEV data.

• Note: The feeder will compress the KEV's data before publishing.

Implementation Plan

First MR - advisory-processor

• Add a new processor type
• Add the new processor
• Extend the database.go with the functions required to:
  • Store and update KEV data (ON CONFLICT (cve_id) DO UPDATE)
  • Set is_removed to false for rows that didn't appear in the published catalog.
• Add unit tests
• Update README.md
• Create a new release

Second MR - deployment

• Extend Terraform code with a Cloud Run configuration. Add push_config to related pubsub topics.
• Deploy on dev
• Deploy on prod

---

Similiar Issues

Extend advisory-processor for EPSS (#468133 - closed) • Orin Naaman • 17.3 • On track

added to epic &11912

@onaaman, Please add a group or category label to identify issue ownership.

You can refer to the Features by Group handbook page for guidance.

If you are unsure about the correct group, please do not leave the issue without a group label, and refer to GitLab's shared responsibility functionality guidelines for more information on how to triage this kind of issue.

This message was generated automatically. You're welcome to improve it.

changed milestone to %Backlog

added License-DBdevelopment backend devopssecure featureaddition groupcomposition analysis sectionsec typefeature workflowrefinement labels

changed the description

set weight to 5

changed the description

changed the description

changed the description

marked this issue as blocking #479843 (closed)

changed title from Extend advisory processor for KEV to Extend advisory-processor for KEV

changed the description

changed the description

added workflowready for development label and removed workflowrefinement label

The analytics instrumentation label is automatically applied when featureaddition and workflowready for development labels are applied. We encourage teams to plan for instrumentation at the time of feature development for new features. This label helps groupanalytics instrumentation to proactively reach out to teams that require instrumentation support. In case instrumentation does not apply to this feature, please feel free to remove the label.

added analytics instrumentation label

changed the description

changed the description

assigned to @onaaman

changed milestone to %17.6

mentioned in issue #482903 (closed)

added workflowin dev label and removed workflowready for development label

marked the checklist item Add a new processor type as completed

marked the checklist item Extend the database.go with the functions required to: as completed

mentioned in issue gitlab-org/quality/triage-reports#20447 (closed)

marked the checklist item Add the new processor as completed

marked the checklist item Add unit tests as completed

marked the checklist item Update README.md as completed

mentioned in epic gitlab-org#11912

marked the checklist item Extend Terraform code with a Cloud Run configuration. Add push_config to related pubsub topics. as completed

mentioned in issue gitlab-org/quality/triage-reports#20584 (closed)

added workflowready for review label and removed workflowin dev label

marked the checklist item Create a new release as completed

changed milestone to %17.7

added workflowin review label and removed workflowready for review label

marked the checklist item Deploy on dev as completed

marked the checklist item Deploy on prod as completed

added workflowcomplete label and removed workflowin review label

closed