MixewayHub - Mixeway is security orchestrator for vulnerability

项目说明

<a href=" src=" alt=" data-canonical-src=" style="max-width:100%;"></a>
<a href="hub.docker.comd"><img src=" alt=" data-canonical-src=" style="max-width:100%;"></a>
![]()
![Quality Gate Status]()
![Security Rating]()

!MixewayLogo

Mixeway Hub

About Mixeway:

Mixeway is an OpenSource software that is meant to simplify the process of security assurance of projects which are implemented using CICD procedures. **Mixawey is not another scanning
software - it is security orchestration tool**.

<a href=" documentation can be found here</a>

<a href=" information and contact forms can be found here</a>


Mixeway is a middleware between CICD and Scanners. From user perspective it doesn’t matter which SAST, DAST, SCA or Network Scanner You are using – all integration is done by Mixeway in the background what makes the whole proces completely unified for the user/process.

With all this a, Mixeway provides functionalities to:

Automatic service discovery (IaaS Plugin for assets and network scans for services)

Automatic Scan Configuration (Based on most recent configuration) - hands-free!

Automatic and on-demand scan execution (based on policy and executed via a REST API call)

One Database for all type of sources - SAST, DAST, OpenSource and Infrastructure in one place

Customizable Security Quality Gateway - a reliable piece of information for CICD to decide if a job should pass or not.

REST API enables integration with already used Management systems used within the organization.

Elements of a system:

<a href=" - Spring Boot REST API</a>

<a href=" - Angular 8 application </a>

<a href=" - parent project which contain docker-compose and one click instalation </a>

and Scan Management


With Mixeway You can:
* CONFIGURE AND RUN ANY SCAN - It doesn’t matter which scanners You are using. With Mixeway integration running scans from GUI/API/CICD pipeline looks exactly the same no matter of scanning software.
* MANAGEMENT - Although Management is not main focus of Mixeway, we still serve some of the functionalities where You can browse through findings, see dashboard statistics or create JIRA tickets just by clicking on an issue.
* THREAT PRIORITIZATION - With Mixeway Vuln Auditor each detected threat is analyzed by Neural network and categorized as one of two: Relevant threat or not important/false positi to that CyberSec Teams can focus only on serious threats

Running Mixeway

Requirements:
* Installed unzip
* Docker and Docker-compose

startup.sh script is preparing en and create self-signed certificates. As a result file with content is created:

<a href=" and other options are described in details in the linked documentation</a>

Mixeway will be a at .

Supported integrations

| Software | Type | | Notes |
|-------------------------|-----------------|-----------|-------------------------------------------------------------------------|
| Acunetix | DAST Scanner | 10.0 + | Full scope |
| Burp Enterprise Edition | DAST Scanner | 2021.10 + | Full scope |
| Fortify | SAST Scanner | 16,17,21 | Downnloading results, creating scan require additional software |
| Checkmarx | SAST Scanner | 9 + | Full Scope |
| Dependency Track | SCA Scanner | 3+ | Full Scope |
| Nexus IQ | SCA Scanner | 140+ | Full Scope - integration under de |
| Nessus | Network Scanner | 6 | Full Scope |
| GVM aka OpenVAS | Network Scanner | 18+ | Full Scope, require additional software |
| AWS | Cloud | na | Security groups, resources info download |
| OpenStack | Cloud | na | Security groups, resources info download |
| GCP | Cloud | na | Security groups, resources info download, integration under de |
| OWASP ZAP | DAST Scanner | na | Load results from performed scan |
| KICS | SAST Scanner | na | Load results from performed scan |

项目信息

开发语言：Shell

Star 数：114

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Mixeway is security orchestrator for vulnerability scanners which enable easy plug in integration with CICD pipelines. MixewayHub project contain one click docker-compose file which configure and run images from docker hub.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。