prowler-cloud / prowler

Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more
https://prowler.com
Apache License 2.0
9.99k stars 1.47k forks source link

refactor(ASFF): create class #4368

Closed jfagoagas closed 1 week ago

jfagoagas commented 1 week ago

Context

We are creating modular outputs for Prowler, now is the time for the AWS Security Finding Format.

Description

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

sergargar commented 1 week ago

Tested locally and it perfectly works!

codecov[bot] commented 1 week ago

Codecov Report

Attention: Patch coverage is 74.09326% with 50 lines in your changes missing coverage. Please review.

Project coverage is 87.39%. Comparing base (2345a73) to head (c7e9264).

Files Patch % Lines
prowler/lib/outputs/asff/asff.py 85.91% 20 Missing :warning:
prowler/lib/outputs/file_descriptors.py 10.00% 18 Missing :warning:
prowler/__main__.py 0.00% 8 Missing :warning:
...ler/providers/aws/lib/security_hub/security_hub.py 78.94% 4 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #4368 +/- ## ========================================== - Coverage 87.56% 87.39% -0.17% ========================================== Files 852 851 -1 Lines 26592 26618 +26 ========================================== - Hits 23284 23262 -22 - Misses 3308 3356 +48 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

pedrooot commented 1 week ago

Now, batch_send_to_security_hub use _send_findings_to_security_hub passing the findings as a dict and the finding format in AWSSecurityFindingFormat. The real problem it's that resolve_security_hub_previous_findings pass the findings in dict function. I've made a "parse" in _send_findings_to_security_hub and depending the data structure it makes a different behaviour. This is not correct so I'll work on standardize all

pedrooot commented 1 week ago

The final approach it's that all the findings passed to _send_findings_to_security_hub are dict