Fleetfolio: Threat Exposure Management & Operational Acceptance Testing

# scope.env: every target below must be covered by prior written authorization
OPSFOLIO_EAA_TENANT_ID=<tenant-id>
OPSFOLIO_EAA_DOMAINS=<authorized-target.example>
OPSFOLIO_EAA_KEY_URLS=https://<authorized-target.example>
OPSFOLIO_EAA_IP_RANGES=<authorized CIDR or blank>
OPSFOLIO_EAA_EXCLUDES=<out-of-scope hosts>
OPSFOLIO_EAA_RATE_LIMIT=50
OPSFOLIO_EAA_CONCURRENCY=10
OPSFOLIO_EAA_NAABU_PORTS=top-100
OPSFOLIO_EAA_NUCLEI_TEMPLATES=cves,default

docker run --rm -it --env-file scope.env \
  -v "$(pwd)/scope.env:/opt/eaa/.env" \
  -v "$(pwd)/results:/opt/eaa/sessions/" \
  fleetfolio/fleetfolio            # default "lite" profile

# Output: results/<ISO-timestamp>/<tool>/*.{json,jsonl,xml,txt}
#         results/<ISO-timestamp>/*.sqlite.db

surveilr ingest files -r ./results/<ISO-timestamp>/
surveilr shell --output table --cmd \
  "SELECT uri, nature FROM uniform_resource ORDER BY uri LIMIT 20;"

-- Synthetic illustration: expected inventory vs. observed endpoints
CREATE TABLE expected_asset (asset_tag TEXT PRIMARY KEY, hostname TEXT NOT NULL, boundary TEXT);
CREATE TABLE observed_endpoint (hostname TEXT NOT NULL, ip_address TEXT, tool TEXT, last_seen TEXT);

SELECT e.hostname, e.boundary, 'missing' AS drift
FROM expected_asset e
WHERE NOT EXISTS (SELECT 1 FROM observed_endpoint o WHERE o.hostname = e.hostname)
UNION ALL
SELECT o.hostname, NULL, 'unexpected'
FROM observed_endpoint o
WHERE NOT EXISTS (SELECT 1 FROM expected_asset e WHERE e.hostname = o.hostname)
  AND o.last_seen >= datetime('now', '-2 days')
GROUP BY o.hostname
ORDER BY drift, hostname;

-- Synthetic illustration: finding states by severity, and retest proof
CREATE TABLE finding (
  finding_id TEXT PRIMARY KEY,
  severity TEXT CHECK (severity IN ('critical','high','medium','low')),
  state TEXT CHECK (state IN ('open','in_progress','remediated','validated','closed')),
  retest_session TEXT,      -- session that confirmed the fix, if any
  updated_at TEXT
);

SELECT severity,
       SUM(state = 'open')                               AS open,
       SUM(state = 'in_progress')                        AS in_progress,
       SUM(state = 'remediated')                         AS awaiting_retest,
       SUM(state IN ('validated','closed'))              AS retest_confirmed,
       SUM(state = 'closed' AND retest_session IS NULL)  AS closed_without_retest
FROM finding
GROUP BY severity
ORDER BY CASE severity WHEN 'critical' THEN 1 WHEN 'high' THEN 2 WHEN 'medium' THEN 3 ELSE 4 END;