🪄 jq trick > group and count by severity 📊

[adriens]

Provide the jq query that takes in input a grype -o json command and returns

"Negligible",0
"Low",4
"High",10

see Group vulnerabilities by severity

🐦 Tweet
:

[adriens]

@mbarre 😺
If you can submit the PR before September 🙏

[mbarre]

grype nginx:latest -o json --file grype.json 
cat grype.json | jq  '.matches[].vulnerability.severity' | sort | uniq -c
     7 "Critical"
     23 "High"
     10 "Low"
     22 "Medium"
     82 "Negligible"
      9 "Unknown"

c pas du json, mais ca permet de decouvrir uniq

[adriens]

💡 even shorter, and without temporary file :

grype nginx:latest -o json | \
    jq  '.matches[].vulnerability.severity' \
    | sort \
    | uniq -c

👇

❯ grype nginx:latest -o json | \
    jq  '.matches[].vulnerability.severity' \
    | sort \
    | uniq -c
 ✔ Vulnerability DB        [updated]
 ✔ Loaded image            
 ✔ Parsed image            
 ✔ Cataloged packages      [143 packages]
 ✔ Scanned image           [155 vulnerabilities]
      7 "Critical"
     23 "High"
     10 "Low"
     22 "Medium"
     82 "Negligible"
      9 "Unknown"

[adriens]

cf https://twitter.com/rastadidi/status/1554570454764883968

[mbarre]

 jq '[.matches[].vulnerability | {severity : .severity} ]| group_by(.severity)[] |.[0] + { count: length } ' 

{
  "severity": "Critical",
  "count": 8
}
{
  "severity": "High",
  "count": 26
}
{
  "severity": "Low",
  "count": 10
}
{
  "severity": "Medium",
  "count": 24
}
{
  "severity": "Negligible",
  "count": 82
}
{
  "severity": "Unknown",
  "count": 4
}

[adriens]

je teste ça !

[adriens]

grype -o json nginx:latest \
    | jq '[.matches[].vulnerability | {severity : .severity} ]| group_by(.severity)[] |.[0] + { count: length } ' 

👌

Can you also please provide (pure js) :

• piping for a tabular output
• piping for a csv input

[adriens]

I think the next step will be to make a PR to feed JQ_TRICKS.md 👏 🏅 @mbarre

[mbarre]

❯ cat grype.json | jq -r '[[.matches[].vulnerability | {severity : .severity}] | group_by(.severity)[] | .[0] + {count: length}] '

[
  {
    "severity": "Critical",
    "count": 8
  },
  {
    "severity": "High",
    "count": 26
  },
  {
    "severity": "Low",
    "count": 10
  },
  {
    "severity": "Medium",
    "count": 24
  },
  {
    "severity": "Negligible",
    "count": 82
  },
  {
    "severity": "Unknown",
    "count": 4
  }
]

[adriens]

🤑 you git it ! Just drop PRs on the tricks now 🚀 🙏

[mbarre]

cat grype.json | jq -r '[.matches[].vulnerability | {severity}] | group_by(.severity) | [.[] | {severity: .[0].severity, count: . | length}]| to_entries as $row |  ( ( map(keys_unsorted ) | add | unique ) as $cols | ( [$cols] | flatten) ,  ( $row | .[] as $onerow | $onerow |( [ ( $cols |   map ($onerow.value[.] as $v | $v )  ) ]| flatten ) ) ) | @csv '

"count","severity"
8,"Critical"
26,"High"
10,"Low"
24,"Medium"
82,"Negligible"
4,"Unknown"

cat grype.json | jq -r '[.matches[].vulnerability | {severity}] | group_by(.severity) | [.[] | {severity: .[0].severity, count: . | length}]| to_entries as $row |  ( ( map(keys_unsorted ) | add | unique ) as $cols | ( [$cols] | flatten) ,  ( $row | .[] as $onerow | $onerow |( [ ( $cols |   map ($onerow.value[.] as $v | $v )  ) ]| flatten ) ) ) | @tsv '

count	severity
8	Critical
26	High
10	Low
24	Medium
82	Negligible
4	Unknown

[adriens]

Afert some integration tests, it appears that it would be much more optimal to get the output like following :

"severity", "count"
"Critical",9
"High",29
"Low",10
"Medium",28
"Negligible",86
"Unknown",2

👉 Can you please put columns in the following order :

1. severity
2. count

[mbarre]

cat grype.json | jq -r '[.matches[].vulnerability | {severity}] | group_by(.severity) | [.[] | {severity: .[0].severity, count: . | length}]|(.[0] | keys_unsorted) as $keys | ([$keys] + map([.[ $keys[] ]])) [] | @csv'

"severity","count"
"Critical",8
"High",26
"Low",10
"Medium",24
"Negligible",82
"Unknown",4

[adriens]