Plugins

Plugins run after a scan and receive the JSON report on standard input. Use them to notify, open tickets or push to a SIEM.

Install and enable

tmaegis plugin install github.com/tmaegis/plugin-slack-notify   # file, URL or GitHub release
tmaegis plugin install ./my-plugin.wasm --sha256 <digest>       # pin the digest
tmaegis plugin list
tmaegis scan --auto-detect --plugin slack,jira

Plugins are looked up in the plugin directory (./plugins by default, --plugin-dir to change). Enable them permanently in config.yaml under plugins.enabled.

Write your own

An executable plugin is a file named tmaegis-plugin-<name> (any language). It reads the JSON scan report from stdin and reads its settings from environment variables.

#!/usr/bin/env sh
# TMAegis notifier plugin: posts a scan summary somewhere.
set -eu
PAYLOAD=$(cat)
FAILED=$(printf '%s' "$PAYLOAD" | grep -o '"failed_count":[0-9]*' | head -n1 | cut -d: -f2)
echo "failed controls: ${FAILED:-0}"

WebAssembly plugins run in a sandbox (wazero) with no access to the host unless granted.

Available plugins

• jiraOfficialKind: executable

  TMAegis ITSM plugin: opens one Jira issue per failed critical/high control.

  plugins/tmaegis-plugin-jira.py

• notify-webhookOfficialKind: executable

  Sample TMAegis Executable Plugin

  plugins/tmaegis-plugin-notify-webhook.sh

• slackOfficialKind: executable

  TMAegis notifier plugin: posts a scan summary to a Slack incoming webhook.

  plugins/tmaegis-plugin-slack.sh

• telegramOfficialKind: executable

  TMAegis notifier plugin: sends a scan summary to a Telegram chat.

  plugins/tmaegis-plugin-telegram.sh

• pci-dss-v4CommunityKind: wasm

  Maps findings to PCI DSS v4.0 requirements. Community plugin: contributions welcome.

  github.com/tmaegis/plugin-pci-dss