Using the Compliance center CLI

Edit online

IBM® Sovereign Core provides you with an in-built Compliance center. You can access the IBM Compliance center through the command-line tool (CLI). The Compliance center CLI is installed during the installation of the IBM Sovereign Core Preview.

The Compliance API is a common method of data ingestion, allowing you to upload SBOMs, vulnerability and compliance scans, certificate details, and other forms of data to inform your application topology or dimensional insights. You can invoke the Compliance API by using CLI

Note: The binaries are automatically downloaded on landing server during deployment process.

Make sure you have run the install.sh script for the product and it has completed successfully. For steps and more information see, Installing IBM Sovereign Hybrid Cloud. When the installation of the product completes successfully, the Vault CLI is available to you. Use the CLI to run commands on your Compliance center.

Before you run any command in the Compliance center CLI, you must log in to the cluster.

Use the following command to authenticate to the cluster: sov-core login <...>.

Use the following information for guidance on the different commands you can run.
Authentication commands
Login to Compliance center:
Authenticate with Compliance center and obtain a session token. 
sov-core concert login --username <username> --password <password> --instance-id <instance-id> --hostname <hostname> --insecure
Example: 
sov-core concert login --username gori_admin@ibm.com --password 3f2ab6afb9d5b7740e136240 --instance-id 0000-0000-0000-0000 --hostname concert-concert.apps.gori-int-20.cp.fyre.ibm.com –insecure
To get API key:

Concert API key is stored in Vault at path mcsp/concert/admin-apikey. To get the API key, you must first login to a cluster by using the following command:

sov-core login <cluster-url> --token=<your-token>

To get the API key, you can use the following command:

sov-core vault kv get <SECRET_PATH> -n <VAULT_NAMESPACE> -p <VAULT_POD>
.
Example: 
sov-core vault kv get secret/mcsp/concert/admin-apikey -n vault -p vault-0
Vunerability management commands
List vunerability exposures
View all vulnerability exposures detected in your environment. 
sov-core concert vulnerability exposures --hostname <hostname> --instance-id <instance-id> --token $CONCERT_TOKEN --insecure
Example: 
sov-core concert vulnerability exposures --hostname concert-concert.apps.gori-int-20.cp.fyre.ibm.com --instance-id 0000-0000-0000-0000 --token $CONCERT_TOKEN –insecure
List CVEs (Common Vulnerabilities and Exposures)
View all CVEs detected across your applications and infrastructure. 
sov-core concert vulnerability cves --hostname <hostname> --instance-id <instance-id> --token $CONCERT_TOKEN --insecure
Example: 
sov-core concert vulnerability cves --hostname concert-concert.apps.gori-int-20.cp.fyre.ibm.com --instance-id 0000-0000-0000-0000 --token $CONCERT_TOKEN –insecure
Simplified Commands using environment variables
To simplify command execution, you can set environment variables. 
export CONCERT_HOSTNAME=concert-concert.apps.gori-int-20.cp.fyre.ibm.com
export CONCERT_INSTANCE_ID=0000-0000-0000-0000
export CONCERT_TOKEN=<your-token>

After setting environment variables, you can use the following shorter commands:

List compliance postures: 
sov-core concert compliance postures --insecure
List vulnerability exposures: 
sov-core concert vulnerability exposures --insecure
List CVEs: 
sov-core concert vulnerability cves --insecure