checkmarx/kics-query-builder repository overview

⁠KICS - Keep Infrastructure as Code Secure

KICS is an Open Source Infrastructure as Code security scanning tool by Checkmarx. Available at https://kics.io⁠ and https://github.com/checkmarx/kics⁠

⁠KICS Query Builder

KICS Query Builder auto-generates KICS queries (including rego code, relevant metadata and tests) from free text description with the help of GPT-4.

After a query is created, the it can initiate a KICS scan that includes the custom query in addition to the built-in queries in KICS.

Notice this tool doesn't upload / share any IaC files with GPT-4 - fully safeguarding the your privacy and intellectual property of IaC files.

This tool collects statistics regarding the generated query names and platforms. To disable this feature, use the '--nostat' flag.

© 2023 Checkmarx Ltd. All Rights Reserved.

Feedback and questions can be sent to [email protected]⁠ or as issues with the kics-query-builder label at https://github.com/Checkmarx/kics⁠

⁠Prerequisite - GPT-4 API key

The tool makes use of GPT-4 APIs and requires a valid OpenAI API Key for GPT-4. To obtain a legitimate API Key, log in to the OpenAI website and go to https://platform.openai.com/account/api-keys⁠ to create a new key. Be advised that if you lack access to GPT-4, a GPT-3 API KEY will not work, resulting in a 'GPT-4 does not exist' message. To verify if you have access to GPT-4, visit OpenAI's Playground at https://platform.openai.com/playground⁠, choose 'Chat' from the Model dropdown in the top-right corner, and check for 'gpt-4' in the options. To gain access to GPT-4, first you should join the GPT-4 waiting list at https://openai.com/waitlist/gpt-4-api⁠. If you possess a valid GPT-4 key and continue to face the issue of 'GPT-4 does not exist,' please attempt to regenerate the key. Once you have obtained a valid key, it is recommended to store it in the 'GPT_KEY' environment variable:

#for Linux: 
export GPT_KEY=YOUR_OPENAI_API_KEY
#for Windows: 
SET GPT_KEY=YOUR_OPENAI_API_KEY 

Now you can use the standard docker run command with the '-e OPENAI_API_KEY=$GPT_KEY' argument.

⁠Documentation - Quick Start

To generate a new KICS query you can use:

docker run -it -e OPENAI_API_KEY=$GPT_KEY -v LOCAL_FOLDER:/out checkmarx/kics-query-builder -n QUERY_NAME -p QUERY_PLATFORM -d QUERY_DESCRIPTION -o /out/

Parameter descriptions:

QUERY_NAME: name of the query for which you want to generate code, e.g.: Public S3 Bucket
QUERY_PLATFORM: platform for which the generate code will work, e.g.: Terraform
QUERY_DESCRIPTION: describes an issue to generate a query for, e.g.: "Public S3 Bucket has a risk of unauthorized access from the Internet"
LOCAL_FOLDER: The path (on your local machine) files should be saved in

To generate new KICS queries defined in a JSON file 'LOCAL_FOLDER_WITH_INPUT/input.json' (AKA batch mode), you can use:

docker run -it -e OPENAI_API_KEY=$GPT_KEY -v LOCAL_FOLDER_WITH_INPUT:/in  -v LOCAL_FOLDER:/out checkmarx/kics-query-builder -i /in/input.json -o /out/

Optional parameters:

'--nocache' is used to invalidate the cache and re-generate queries
'--scan' and '-s PATH' are used together to execute a KICS scan on sources from PATH when all queries are generated
'--nostat' is used to disable collecting statistics about generated query names and platforms

For example:

docker run -it -e OPENAI_API_KEY=$GPT_KEY -v LOCAL_FOLDER:/out checkmarx/kics-query-builder -n QUERY_NAME -p QUERY_PLATFORM -d QUERY_DESCRIPTION -o /out/
docker run -it -e OPENAI_API_KEY=$GPT_KEY -v LOCAL_FOLDER_WITH_INPUT:/input -v LOCAL_FOLDER:/out  checkmarx/kics-query-builder -i /input/input.json -o /out/
docker run -it -e OPENAI_API_KEY=$GPT_KEY -v LOCAL_FOLDER_WITH_INPUT_AND_SOURCES:/src -v LOCAL_FOLDER:/out  checkmarx/kics-query-builder -i /src/input.json -o /out/ --scan -s /src/
docker run -it -e OPENAI_API_KEY=$GPT_KEY -v LOCAL_FOLDER_WITH_INPUT:/input -v LOCAL_FOLDER:/out  checkmarx/kics-query-builder -i /input/input.json -o /out/ --nocache

If parameters are not provided, the tool will switch to interactive mode and prompt for the missing parameter. To run in interactive mode, use the following simple command:

docker run -it -e OPENAI_API_KEY=$GPT_KEY -v LOCAL_FOLDER:/out checkmarx/kics-query-builder

Usage:

kics-query-builder [ARGUMENTS]
ARGUMENTS:
  -n, --name			Name of a query to generate
  -d, --description		Description of a query to generate
  -p, --platform		Platform a query will target
  -i, --input-file 		Path to the input JSON file
  -o, --output-dir    		Path to the output folder where queries will be generated
  -s, --source-dir 		Path to the source folder to scan
  -h, --help			To show this help message and exit
  --scan        		To scan sources with KICS after generating queries 
  --nocache     		To invalidate cache and re-generate queries
  --nostat  			Not to collect statistics about query names and platforms

By using this tool, it's possible to generate a logic for searching for security issues in IaC in Rego format.
Then, this logic (queries) can be run locally to analyze IaC code - this approach eliminates sending IaC code to the GPT server.
Instead of sending IaC code to GPT and asking about security issues with a GPT prompt, you can generate local KICS queries with GPT, and then run them locally.

At this stage, it's recommended that a developer generates a query and all relevant files with this tool, and then reviews and validates what is generated.
This tool uses the GPT-4 model, which is currently in Beta state. Thus, sometimes it's possible that the tool will fail due to GPT-side errors; the correct error message will be presented.