Examples

Complete scripts you can save and run, each next to the CLI command that does the same job and the output it printed when these pages were written. They are the files in site/examples/, included into the pages as they are.

Most of them need no cloud account. Those marked offline build a small estate by hand or read sample scanner reports, so they run on any machine with pip install cloudg. The others say which credentials they need.

Sample reports to work with

The ingest examples read native scanner output. If you have none at hand, this script writes one small report per scanner (Prowler ASFF, ScoutSuite, Checkov and two Trivy reports), shaped like the real tools' output:

make_sample_reports.py

make_sample_reports.py

"""Write one small native report per scanner, shaped like the real tools' output."""
import json
from pathlib import Path

Path("prowler-output").mkdir(exist_ok=True)
Path("prowler-output/prowler-output-123456789012.asff.json").write_text(json.dumps([
    {
        "Id": "prowler-aws-s3_bucket_default_encryption-123456789012-eu-west-1-abc",
        "Title": "S3 bucket default encryption",
        "Description": "Bucket has no default encryption",
        "Severity": {"Label": "HIGH"},
        "Resources": [{"Id": "arn:aws:s3:::my-bucket"}],
        "Compliance": {"Status": "FAILED", "RelatedRequirements": ["CIS 2.1.1"]},
        "Remediation": {"Recommendation": {"Text": "Enable default encryption"}},
    }
]))

results = Path("scoutsuite-report/scoutsuite-results")
results.mkdir(parents=True, exist_ok=True)
(results / "scoutsuite_results_aws-123456789012.js").write_text(
    "scoutsuite_results =\n" + json.dumps({
        "services": {"s3": {"findings": {"s3-bucket-no-encryption": {
            "description": "Bucket without encryption",
            "rationale": "Data at rest should be encrypted",
            "remediation": "Enable encryption",
            "level": "danger",
            "flagged_items": 1,
            "items": ["s3.buckets.my-bucket"],
            "references": [],
        }}}}
    })
)

Path("results_json.json").write_text(json.dumps({
    "check_type": "terraform",
    "results": {"failed_checks": [{
        "check_id": "CKV_AWS_19",
        "check_name": "Ensure S3 bucket has server-side encryption enabled",
        "severity": "HIGH",
        "resource": "aws_s3_bucket.data",
        "file_path": "/main.tf",
        "file_line_range": [1, 10],
        "guideline": "https://docs.example/ckv-aws-19",
    }]},
}))

Path("trivy-image.json").write_text(json.dumps({
    "ArtifactName": "myrepo/app:latest",
    "ArtifactType": "container_image",
    "Results": [{
        "Target": "myrepo/app:latest (alpine 3.19)",
        "Type": "alpine",
        "Vulnerabilities": [{
            "VulnerabilityID": "CVE-2024-0001",
            "PkgName": "openssl",
            "InstalledVersion": "3.1.0",
            "FixedVersion": "3.1.1",
            "Severity": "CRITICAL",
            "Description": "Example vulnerability",
            "CVSS": {"nvd": {"V3Score": 9.8}},
        }],
    }],
}))

Path("trivy-fs.json").write_text(json.dumps({
    "ArtifactName": "./iac",
    "ArtifactType": "filesystem",
    "Results": [{
        "Target": "main.tf",
        "Type": "terraform",
        "Misconfigurations": [{
            "ID": "AVD-AWS-0088",
            "Title": "S3 bucket encryption not enabled",
            "Description": "Bucket does not have encryption enabled",
            "Severity": "HIGH",
            "Resolution": "Enable encryption",
        }],
    }],
}))
print("sample reports written")

Run it in an empty directory, then run the examples from the same directory.

By task

• Map and query

  ---

  Map an account, save the map, load it again and ask what depends on what.

• Ingest and report

  ---

  Merge Prowler, Checkov and Trivy output, gate a CI job on severity and export the findings.

• Graph, ontology and RAG

  ---

  Build the graph from your own assets, find what the internet reaches, query it with SPARQL, cut RAG chunks.

• Errors and strict mode

  ---

  Strict scanner wrappers, raise_for_errors(), credential checks and strict report parsing.

More examples

Every page of the Python API reference has its own examples above the generated reference, and Python recipes collects the longer integrations: streaming findings to a SIEM, combining a live inventory with ingested findings, and linking assets from a CMDB.