From 5ecf1e2a855afd5315b1f87e1c22286dfebb9bfb Mon Sep 17 00:00:00 2001 From: nikirby Date: Wed, 1 Dec 2021 13:25:48 -0500 Subject: [PATCH 1/5] Fixed error that appeared if the number of findings was very high. --- include/securityhub_integration | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/include/securityhub_integration b/include/securityhub_integration index 74a1c35d9e..11f62f35c6 100644 --- a/include/securityhub_integration +++ b/include/securityhub_integration @@ -42,15 +42,31 @@ checkSecurityHubCompatibility(){ resolveSecurityHubPreviousFails(){ # Move previous check findings RecordState to ARCHIVED (as prowler didn't re-detect them) + SH_TEMP_FOLDER="$PROWLER_DIR/SH-$ACCOUNT_NUM" + if [[ ! -d $SH_TEMP_FOLDER ]]; then + # this folder is deleted once the security hub update is completed + mkdir "$SH_TEMP_FOLDER" + fi for regx in $REGIONS; do - + REGION_FOLDER="$SH_TEMP_FOLDER/$regx" + if [[ ! -d $REGION_FOLDER ]]; then + mkdir "$REGION_FOLDER" + fi local check="$1" NEW_TIMESTAMP=$(get_iso8601_timestamp) FILTER="{\"GeneratorId\":[{\"Value\": \"prowler-$check\",\"Comparison\":\"EQUALS\"}],\"RecordState\":[{\"Value\": \"ACTIVE\",\"Comparison\":\"EQUALS\"}],\"AwsAccountId\":[{\"Value\": \"$ACCOUNT_NUM\",\"Comparison\":\"EQUALS\"}]}" - NEW_FINDING_IDS=$(echo -n "${SECURITYHUB_NEW_FINDINGS_IDS[@]}" | jq -cRs 'split(" ")') - SECURITY_HUB_PREVIOUS_FINDINGS=$($AWSCLI securityhub --region "$regx" $PROFILE_OPT get-findings --filters "${FILTER}" | jq -c --argjson ids "$NEW_FINDING_IDS" --arg updated_at $NEW_TIMESTAMP '[ .Findings[] | select( .Id| first(select($ids[] == .)) // false | not) | .RecordState = "ARCHIVED" | .UpdatedAt = $updated_at ]') + NEW_FINDING_FILE="$REGION_FOLDER/findings.json" + NEW_FINDING_IDS=$(echo -n "${SECURITYHUB_NEW_FINDINGS_IDS[@]}" | jq -cRs 'split(" ")' > $NEW_FINDING_FILE) + EXISTING_FILE="$REGION_FOLDER/existing.json" + EXISTING_FINDINGS=$($AWSCLI securityhub --region "$regx" $PROFILE_OPT get-findings --filters "${FILTER}" > $EXISTING_FILE) + + SECURITY_HUB_PREVIOUS_FINDINGS=$(for id in $(comm -23 <(jq '[.Findings[].Id] | sort | .[]' $EXISTING_FILE) <(jq '[.[]] | sort | .[]' $NEW_FINDING_FILE)); + do + jq --arg updated_at $NEW_TIMESTAMP '.Findings[] | select(.Id == '"$id"') | .RecordState = "ARCHIVED" | .UpdatedAt = $updated_at ' < $EXISTING_FILE + done | jq -s '.') + if [[ $SECURITY_HUB_PREVIOUS_FINDINGS != "[]" ]]; then FINDINGS_COUNT=$(echo $SECURITY_HUB_PREVIOUS_FINDINGS | jq '. | length') From 43b3ad6447d77001ae63d11576b7eb2ad9d06f53 Mon Sep 17 00:00:00 2001 From: nikirby Date: Wed, 1 Dec 2021 13:29:12 -0500 Subject: [PATCH 2/5] Adjusted the batch to only do 50 at a time. 100 caused capacity issues. Also added a check for an edge case where if the updated findings was a multiple of the batch size, it would throw an error for attempting to import 0 findings. --- include/securityhub_integration | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/include/securityhub_integration b/include/securityhub_integration index 11f62f35c6..9c3d8f48a5 100644 --- a/include/securityhub_integration +++ b/include/securityhub_integration @@ -70,12 +70,15 @@ resolveSecurityHubPreviousFails(){ if [[ $SECURITY_HUB_PREVIOUS_FINDINGS != "[]" ]]; then FINDINGS_COUNT=$(echo $SECURITY_HUB_PREVIOUS_FINDINGS | jq '. | length') - for i in `seq 0 100 $FINDINGS_COUNT`; + for i in $(seq 0 50 $FINDINGS_COUNT); do - BATCH_FINDINGS=$(echo $SECURITY_HUB_PREVIOUS_FINDINGS | jq -c '.['"$i:$i+100"']') - BATCH_IMPORT_RESULT=$($AWSCLI securityhub --region "$regx" $PROFILE_OPT batch-import-findings --findings "${BATCH_FINDINGS}") - if [[ -z "${BATCH_IMPORT_RESULT}" ]] || jq -e '.FailedCount >= 1' <<< "${BATCH_IMPORT_RESULT}" > /dev/null 2>&1; then - echo -e "\n$RED ERROR!$NORMAL Failed to send check output to AWS Security Hub\n" + BATCH_FINDINGS=$(echo $SECURITY_HUB_PREVIOUS_FINDINGS | jq -c '.['"$i:$i+50"']') + BATCH_FINDINGS_COUNT=$(echo $BATCH_FINDINGS | jq '. | length') + if [ "$BATCH_FINDINGS_COUNT" -gt 0 ]; then + BATCH_IMPORT_RESULT=$($AWSCLI securityhub --region "$regx" $PROFILE_OPT batch-import-findings --findings "${BATCH_FINDINGS}") + if [[ -z "${BATCH_IMPORT_RESULT}" ]] || jq -e '.FailedCount >= 1' <<< "${BATCH_IMPORT_RESULT}" > /dev/null 2>&1; then + echo -e "\n$RED ERROR!$NORMAL Failed to send check output to AWS Security Hub\n" + fi fi done fi From 4ea4debeddac054fc999ca04d610fd63984831ed Mon Sep 17 00:00:00 2001 From: nikirby Date: Wed, 1 Dec 2021 15:06:09 -0500 Subject: [PATCH 3/5] Added line to delete the temp folder after everything is done. --- include/securityhub_integration | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/securityhub_integration b/include/securityhub_integration index 9c3d8f48a5..92151d45e7 100644 --- a/include/securityhub_integration +++ b/include/securityhub_integration @@ -83,7 +83,7 @@ resolveSecurityHubPreviousFails(){ done fi done - + rm -rf "$SH_TEMP_FOLDER" } sendToSecurityHub(){ From e1e57db93e0980cb5d8d45f74486d6ed10b0b2af Mon Sep 17 00:00:00 2001 From: Joel Maisenhelder Date: Wed, 1 Dec 2021 19:44:34 -0600 Subject: [PATCH 4/5] New check 7164 Check if Cloudwatch log groups are protected by AWS KMS@maisenhe --- checks/check_extra7164 | 57 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 checks/check_extra7164 diff --git a/checks/check_extra7164 b/checks/check_extra7164 new file mode 100644 index 0000000000..0fe7ed33f2 --- /dev/null +++ b/checks/check_extra7164 @@ -0,0 +1,57 @@ +#!/usr/bin/env bash + +# Prowler - the handy cloud security tool (copyright 2019) by Toni de la Fuente +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may not +# use this file except in compliance with the License. You may obtain a copy +# of the License at http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software distributed +# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR +# CONDITIONS OF ANY KIND, either express or implied. See the License for the +# specific language governing permissions and limitations under the License. + +# Remediation: +# +# https://docs.aws.amazon.com/cli/latest/reference/logs/associate-kms-key.html +# associate-kms-key +# --log-group-name +# --kms-key-id +# [--cli-input-json ] +# [--generate-cli-skeleton ] + +CHECK_ID_extra7164="7.164" +CHECK_TITLE_extra7164="[extra7164] Check if CloudWatch log groups are protected by AWS KMS " +CHECK_SCORED_extra7164="NOT_SCORED" +CHECK_TYPE_extra7164="EXTRA" +CHECK_SEVERITY_extra7164="Medium" +CHECK_ASFF_RESOURCE_TYPE_extra7164="Logs" +CHECK_ALTERNATE_extra7164="extra7164" +CHECK_SERVICENAME_extra7164="logs" +CHECK_RISK_extra7164="" +CHECK_REMEDITATION_extra7164="Associate KMS Key with Cloudwatch log group." +CHECK_DOC_extra7164="https://docs.aws.amazon.com/cli/latest/reference/logs/associate-kms-key.html" +CHECK_CAF_EPIC_extra7164="Data Protection" + +extra7164(){ + # "Check if Cloudwatch log groups are associated with AWS KMS" + for regx in $REGIONS; do + LIST_OF_LOGGROUPS=$($AWSCLI logs describe-log-groups $PROFILE_OPT --region $regx --output json | jq '.logGroups[]') + if [[ $LIST_OF_LOGGROUPS ]]; then + LIST_OF_LOGGROUPS_WITHOUT_KMS=$(echo "${LIST_OF_LOGGROUPS}" | jq '. | select( has("kmsKeyId") == false )' | jq -r '.logGroupName') + LIST_OF_LOGGROUPS_WITH_KMS=$(echo "${LIST_OF_LOGGROUPS}" | jq '. | select( has("kmsKeyId") == true )' | jq -r '.logGroupName') + if [[ $LIST_OF_LOGGROUPS_WITHOUT_KMS ]]; then + for loggroup in $LIST_OF_LOGGROUPS_WITHOUT_KMS; do + textFail "$regx: ${loggroup} does not have AWS KMS keys associated." "$regx" "${loggroup}" + done + fi + if [[ $LIST_OF_LOGGROUPS_WITH_KMS ]]; then + for loggroup in $LIST_OF_LOGGROUPS_WITH_KMS; do + textPass "$regx: ${loggroup} does have AWS KMS keys associated." "$regx" "${loggroup}" + done + fi + else + textPass "$regx: No Cloudwatch log groups found." "$regx" + fi + done +} From 6ff94b2b60701bfce0d3b25d0f2a8929abff25a2 Mon Sep 17 00:00:00 2001 From: Joel Maisenhelder Date: Thu, 2 Dec 2021 09:01:54 -0600 Subject: [PATCH 5/5] updated CHECK_RISK --- checks/check_extra7164 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checks/check_extra7164 b/checks/check_extra7164 index 0fe7ed33f2..3e64c0f978 100644 --- a/checks/check_extra7164 +++ b/checks/check_extra7164 @@ -28,7 +28,7 @@ CHECK_SEVERITY_extra7164="Medium" CHECK_ASFF_RESOURCE_TYPE_extra7164="Logs" CHECK_ALTERNATE_extra7164="extra7164" CHECK_SERVICENAME_extra7164="logs" -CHECK_RISK_extra7164="" +CHECK_RISK_extra7164="Using customer managed KMS to encrypt CloudWatch log group provide additional confidentiality and control over the log data" CHECK_REMEDITATION_extra7164="Associate KMS Key with Cloudwatch log group." CHECK_DOC_extra7164="https://docs.aws.amazon.com/cli/latest/reference/logs/associate-kms-key.html" CHECK_CAF_EPIC_extra7164="Data Protection"