A.S.E - CVE monitoring for Magento / Adobe Commerce / Mage

项目说明

A.S.E -- Automated Security E

![Packagist ]()

management built around OWASP Dependency-Track.
Dependency-Track is the engine and UI; A.S.E is the thin automation that feeds it and
alerts from it. You hear about a CVE only when it affects something you actually run, in
the Slack channel of the team that owns it, ranked by real-world exploitability.

> The original 1.0.0 A.S.E was a standalone feed-polling CLI; it lives on at tag
> m. The 2.x rebuild moved feed
> ingestion and matching into Dependency-Track and kept the parts that earned
> their place: KEV/EPSS/C and the Slack alert format. Rationale and parity
> e: docs/planning/, docs/parity-report.md.

How it fits together

bin/ase-sync (cron): converts each configured lockfile (ASE_PROJECTS) and the

declared-tech in (in/declared-tech.yaml,
one Dependency-Track project per owning team) into CycloneDX 1.5 SBOMs and uploads
them. Lockfiles are matched by package URL (OS entries by CPE (NVD).

bin/ase-alert (cron): reads findings newer than its cursor, scores each one,

and posts the P0/P1 ones to the owning team's webhook (ASE_ALERT_ROUTES, keyed by
Dependency-Track project tag). Anything below P1 stays in the UI, off Slack.

Dependency-Track does e else: feed mirroring, matching,

dashboards, audit trail, policy. One-time install:
docs/dependency-track-install.md, including the
required bin/dtrack-enable-osv.sh step (a fresh 5.0 instance mirrors only
NVD+EPSS and silently matches nothing for composer/npm until OSV is enabled).

Priority model

ase-alert alerts on two tiers and drops e else. Thresholds are configurable
(see below); defaults shown.

| Tier | Condition (any one) |
|------|---------------------|
| P0 | in CISA KE exploited)  ·  CVSS >= 9.0 and EPSS >= 10% |
| P1 | ransomware-associated  ·  CVSS >= 7.0 on an installed component |
| (none) | e below P1 -- in the Dependency-Track UI, never sent to Slack |

KE and ransomware association are checked by A.S.E against the live CISA
catalog; CVSS and EPSS come from Dependency-Track's enrichment.

Setup

Prerequisites: PHP 8.4+, Composer, and a running Dependency-Track instance (install
doc above).

Minimum configuration (.env on the cron host):

| | Required | Purpose |
|----------|----------|---------|
| DTRACK_URL | yes | Base URL of the Dependency-Track API server |
| DTRACK_API_KEY | yes | API key for the automation team (BOM upload + read) |
| ASE_PROJECTS | yes | Comma-separated name:/abs/path/to/composer.lock entries |
| ASE_ALERT_ROUTES | for alerts | Comma-separated project-tag=slack-webhook-url entries |
| ASE_ALERT_DEFAULT_WEBHOOK | no | Fallback webhook for findings whose tag has no route |
| ASE_IN | no | Declared-tech YAML (defaults to in/declared-tech.yaml) |
| ASE_ALERT_CURSOR_PATH | no | Alert cursor file (defaults to /alert-cursor.json) |
| EPSS_HIGH_THRESHOLD | no | EPSS cutoff, default 0.10 |
| C | no | P0 C, default 9.0 |
| C | no | P1 C, default 7.0 |

Cron, on a host that can reach Dependency-Track and the lockfiles:

The sleep 600 lets a sync settle before the alert pass reads findings from it.

First-run note: the alert cursor starts at zero, so the first run alerts on every
existing P0/P1 finding. For a quiet adoption, run bin/ase-alert once *before*
configuring ASE_ALERT_ROUTES (unrouted findings are logged and skipped, the cursor
ad), then add routes. The runbook covers this, the per-tier
SLAs, and what to do when an alert lands.

De

CI (.github/workflows/ci.yml) gates every merge on all
three: composer audit --no-dev, PHPStan, and the unit suite.

Project layout

Documentation

docs/dependency-track-install.md -- one-time

Dependency-Track 5.0 install, OS, bootstrap, backup.

docs/runbook.md -- responding to alerts, SLAs, operating the platform.

docs/parity-report.md -- 1.0 CLI vs 2.0 pipeline cuto.

docs/planning/ -- architecture and design rationale.

License

MIT. See LICENSE.

项目信息

开发语言：PHP

Star 数：15

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕CVE monitoring for Magento / Adobe Commerce / Mage-OS. Polls KEV, NVD, GHSA, OSV, Packagist; filters against your composer.lock; alerts only P0/P1 to Slack.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。