🥳 Mondoo 8.12 is out! This release includes new OPC UA scanning, improved MQL helpers, and more!
Get this release: Installation Docs | Package Downloads | Docker Container
🎉 NEW FEATURES
Open Platform Communications Unified Architecture (OPC UA) support
Mondoo now allows you to scan multiple PLC IoT devices simultaneously by connecting to an OPC UA server and scanning PLC remotely. A new opcua provider in cnspec and cnquery allows you to remotely connect to these servers with querying provided with a new opcua query pack.
# gather all available namespaces
opcua.namespaces { * }
opcua.namespaces: [
0: {
id: 0
name: "http://opcfoundation.org/UA/"
}
1: {
id: 1
name: "urn:open62541.server.application"
}
]
# gather root node
cnquery> opcua.root
opcua.root: opcua.node id="i=84" name="Root"
# gather all nodes
cnquery> opcua.nodes { name namespace.name }
# gather node with a specific id
cnquery> opcua.nodes.where (id == "i=2253")
opcua.nodes.where: [
0: opcua.node id="i=2253" name="Server"
]
# gather details about the server
cnquery> opcua.server { * }
opcua.server: {
buildInfo: {
BuildDate: "2023-05-21T21:03:43.817369Z"
BuildNumber: "May 20 2023 15:51:32"
ManufacturerName: "open62541"
ProductName: "open62541 OPC UA Server"
ProductURI: "http://open62541.org"
SoftwareVersion: "1.3.5-994-g5d73f0cc5"
}
node: opcua.node id="i=2253" name="Server"
currentTime: 2023-05-22 08:28:30.625932 +0000 UTC
state: "ServerStateRunning"
startTime: 2023-05-21 21:03:43.834304 +0000 UTC
}
🧹 IMPROVEMENTS
Improved .first() and .last() MQL helpers
The .first() and .last() MQL helpers now support dict data structures such as JSON data and also include improved handling of null array/dicts.
Finding first and last values in JSON data:
cnquery> parse.json("dummy.json").params["string-array"].first
parse.json.params[string-array].first: "a"
cnquery> parse.json("dummy.json").params["string-array"].last
parse.json.params[string-array].last: "c"
cnquery> parse.json("dummy.json").params["string-array"].where("non-exist").first
parse.json.params[string-array].where.first: null
cnquery> parse.json("dummy.json").params["string-array"].where("non-exist").last
parse.json.params[string-array].where.last: null
cnquery> parse.json("dummy.json").params.first
parse.json.params.first: 1.000000
cnquery> parse.json("dummy.json").params.last
parse.json.params.last: true
cnquery> parse.json("dummy.json").params.where("non-exist").first
parse.json.params.where.first: null
cnquery> parse.json("dummy.json").params.where("non-exist").last
parse.json.params.where.last: null
Expanded date format support in parse.date() MQL helper
It is now possible to parse many different date formats automatically with the parse.date MQL helper:
# RFC 3339
parse.date("2006-01-02T15:04:05Z")
# Simple Date + Time
parse.date("2006-01-02 15:04:05")
# Date only
parse.date("2006-01-02")
# Time only, parses as a duration
parse.date("15:04:05")
# RFC 1123
parse.date("Mon, 02 Jan 2006 15:04:05 MST")
# ANSI C
parse.date("Mon Jan 2 15:04:05 2006")
# RFC 822
parse.date("02 Jan 06 15:04 MST")
# RFC 850
parse.date("Monday, 02-Jan-06 15:04:05 MST")
# Kitchen time
parse.date("3:04PM")
# Handy timestamp
parse.date("Jan 2 15:04:05")
You can also parse RFC1123 and RFC822 format dates with time zones:
# RFC 1123 with numeric time zone
parse.date('Mon, 02 Jan 2006 15:04:05 -0700')
# RFC 822 with numeric time zone
parse.date('02 Jan 06 15:04 -0700')
Expanded status information for integrations
Integrations now show a history of all integration jobs so you can see when jobs started, completed, and any errors that occurred.
🐛 BUG FIXES
- Improve the reliability of the
dnsresource with large numbers ofTXTrecords. Thanks for this fix @mariuskimmina! - Fix a panic when calling
domainNameif no name can be found. Thanks for this fix @mariuskimmina! - Fallback to
os.hostnameifos.namecannot be discovered. Thanks for this fix @mariuskimmina! - Reduce load time and cluster load when scanning Kubernetes clusters.
- Fix failures reading Kubernetes manifests from stdin when resources lack a UID.
- Add missing checks for
/etc/password,/etc/group, and/etc/shadowto CIS Google Container-Optimized OS Benchmark policy. - Fix the Privacy Policy and Terms & Conditions acceptance buttons in the Organization Settings page not loading correctly.
- Add the upcoming FreeBSD 14 release date.
- Update SELinux checks in BSI Linux policy to support Amazon Linux, SLES, and openSUSE platforms.
- Update several console pages to use the
checksterm instead of the legacycontrolsterm.
