Describe the bug
After installing an AWS Organization CSPM integration on Kibana 8.13.0, we can see the Evaluated accounts on the Dashboard, but clicking on the link provided on the Dashboard leads to a Grouped Findings page that doesn't match the data.
After installing the integration, wait for the findings to be generated
Navigate to the Cloud Security Posture dashboard
On the Accounts Evaluated counter, check the respective number for aws, click the link and confirm that the number of Groups in the Findings page doesn't match the dashboard.
Expected behavior
Numbers of AWS Accounts between the Dashboard and Findings page should match/
Desktop (please complete the following information):
Browser: Chrome
Kibana Version: 8.13 BC4
Additional context
I could see that the filter used is cloud.provider : aws and cloud.provider is missing on CSPM Findings originated from AWS Organization.
I could also see that clicking on the Accounts in the Benchmarks section of the dashboard leads to the correct matching data because it uses a combination of rule.benchmark.id: cis_aws and rule.benchmark.version: v1.5.0 filters:
Describe the bug After installing an AWS Organization CSPM integration on Kibana 8.13.0, we can see the Evaluated accounts on the Dashboard, but clicking on the link provided on the Dashboard leads to a Grouped Findings page that doesn't match the data.
https://long-run-qa-813-bc4-tww-8-13-0.kb.us-west2.gcp.elastic-cloud.com:9243/app/security/cloud_security_posture/dashboard/cspm
Preconditions Install CSPM Integration -> Select Organization -> Install with CloudFormation
To Reproduce Steps to reproduce the behavior:
Cloud Security Posture
dashboardExpected behavior Numbers of AWS Accounts between the Dashboard and Findings page should match/
**Recording
https://github.com/elastic/kibana/assets/19270322/45d28c86-8f1e-488f-8436-8c424e0557d3
Desktop (please complete the following information):
Additional context
cloud.provider : aws
andcloud.provider
is missing on CSPM Findings originated from AWS Organization.rule.benchmark.id: cis_aws
andrule.benchmark.version: v1.5.0
filters:https://github.com/elastic/kibana/assets/19270322/49d9ac56-f1d3-42a6-89e7-949df7e80773
That means a fix can be patched on Kibana side by using the filter
rule.benchmark.id: cis_aws
instead ofcloud.provider : aws