Remediate issues one by one to achieve zero misconfigurations.
The audit pane lists all misconfigurations. This can be seen a TO-DO list of identified issues, helping you tackle each problem one at a time. Monokle Cloud helps ease the process of remediating misconfigurations through problem descriptions, auto-fixes, suppressions, and more.
You can use hotkeys within the audit pane to remediate faster?
jto select the next problem.
kto select the previous problem.
eto edit by focusing on the problem in the editor.
escto return to the misconfiguration list after editing.
ato apply an auto-fix.
sto request a suppression.
Edit your source code within our editor to see whether your fixes remediate the misconfiguration in real-time.
To edit a problem you can click on the editor or press
When you edit several problems you will notice that many issues can be fixed by adding or removing a property. Monokle automates this process by suggesting fixes for each error and applying the accepted update to the source code for you.
To auto-fix a problem, click the magic wand or press
When addressing a misconfiguration, you might decide that a specific misconfiguration doesn't need to be fixed or you might notice that your service actually needs a specific permission, meaning you are dealing with a case specific false positive. In these cases, suppressions allow you to hide the problem until further notice.
Fingerprint-based suppressions are external suppressions that work without any modifications to the source code. Each misconfiguration has a unique fingerprint. Requesting a suppression will store this in a database. Behind the scenes, all of Monokle's Policy Enforcement Points will stay up to date by fetching updates from said database. In Monokle, you can only use fingerprint-based suppressions within projects.
You can click the eye icon or press
s for fingerprint-based suppressions.
This inline suppression works by adding the
monokle.io/suppress annotation. There are two possible formats: either you add the rule identifier or the plugin identifier together with the human-friendly name of the rule as seen below. You will have to commit these changes to the repository to persist them.
monokle.io/suppress.PSS205: false positive
monokle.io/suppress.kbp.no-latest-image: wont fix
You can edit the source code for annotation-based suppressions.
Asking for help
Suppressions aren't always a good idea. When it's unclear if or how a misconfiguration should be handled, Monokle allows you to collaborate with your colleagues to decide what action to take by sharing these instances in real-time. Simply copy the URL and share it with a colleague to work together on remediating it.
Suppression Approval Flows
To ensure quality, project developers themselves cannot suppress misconfigurations. Instead they will request for a suppression which can be approved by a project operator. As an operator you can navigate to the project's dashboard and see all the suppressions of your project. Once approved, suppressions will be synchronised across all policy enforcement points.