⚓️ Integrate with OpenDistro as alternative to elasticsearch

[rseedorff]

⚓️ New Hook implementation request

Is your feature request related to a problem

As secureCodeBox User I would like to use the open distro solution as alternative to Elasticsearch.

Describe the solution you'd like

Please integrate https://opendistro.github.io/for-elasticsearch-docs

Describe alternatives you've considered

Additional context

Steps to implement a new hook

Hint: A general guide how to implement a new SCB Hook is documented here

• Create a new folder with the name of the hook here
• Add a README.md and give a brief overview of the scanner and its configuration options.
• Add a HelmChart and document all configuration options.
• Add (optional) a Dockerfile for the scanner if there is no existing one publicly available on dockerHub.io
• Use the Hook-SDK to implement a new hook (currently based on NodeJS)
• Add unit tests with at minimum 80% test coverage
• Add some example scan.yaml and finding.yaml files in the example folder
• Implement a new integration or E2E test for the hook here

[J12934]

Haven't tested this, but should this work with the normal elasticsearch hook? API should be largely the same, as far as I know.

[rseedorff]

I haven't tested this yet but it should work (hopefully). As our HelmChart depends on elasticsearch and also installs the sub chart for elasticsearch and Kibana we might think about switching that or add a second alternative based on opendistro.

elasticsearch:
  # elasticsearch.enabled -- Enable if you want to deploy an elasticsearch service.
  enabled: true

kibana:
  # kibana.enabled -- Enable if you want to deploy an kibana service (see: https://github.com/elastic/helm-charts/tree/master/kibana)
  enabled: true

[J12934]

I'd said it's probably best for us to only have either elasticsearch or opendistro included in the helm chart and and only provide the option to switch that one on or off.

If a users wants to really use the non default options they probably know better than us how to run it properly. They would then simply have to turn of the default one and configure the connection.