From 2fbb47d8399477ef92ec1fad37b1cddde7f5a038 Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@prowler.com>
Date: Mon, 6 May 2024 11:07:51 +0200
Subject: [PATCH] fix(security-hub): Send only Fails if muted and
 send-only-fails (#3925)

---
 .../aws/lib/security_hub/security_hub.py      | 14 ++++--
 .../aws/lib/security_hub/security_hub_test.py | 49 +++++++++++++++++--
 2 files changed, 55 insertions(+), 8 deletions(-)

diff --git a/prowler/providers/aws/lib/security_hub/security_hub.py b/prowler/providers/aws/lib/security_hub/security_hub.py
index f1ab8ea7fc..65e2ac1240 100644
--- a/prowler/providers/aws/lib/security_hub/security_hub.py
+++ b/prowler/providers/aws/lib/security_hub/security_hub.py
@@ -27,12 +27,18 @@ def prepare_security_hub_findings(
         if finding.region not in enabled_regions:
             continue
 
-        # Handle status filters, if any
-        if (finding.status != "FAIL" and output_options.send_sh_only_fails) or (
-            output_options.status and finding.status not in output_options.status
-        ):
+        if (
+            finding.status != "FAIL" or finding.muted
+        ) and output_options.send_sh_only_fails:
             continue
 
+        if output_options.status:
+            if finding.status not in output_options.status:
+                continue
+
+            if finding.muted:
+                continue
+
         # Get the finding region
         region = finding.region
 
diff --git a/tests/providers/aws/lib/security_hub/security_hub_test.py b/tests/providers/aws/lib/security_hub/security_hub_test.py
index 2f4f9ed6c1..ad14dba694 100644
--- a/tests/providers/aws/lib/security_hub/security_hub_test.py
+++ b/tests/providers/aws/lib/security_hub/security_hub_test.py
@@ -93,7 +93,7 @@ def mock_make_api_call(self, operation_name, kwarg):
 
 
 class Test_SecurityHub:
-    def generate_finding(self, status, region):
+    def generate_finding(self, status, region, muted=False):
         finding = Check_Report(
             load_check_metadata(
                 f"{path.dirname(path.realpath(__file__))}/fixtures/metadata.json"
@@ -104,6 +104,7 @@ class Test_SecurityHub:
         finding.resource_id = "test"
         finding.resource_arn = "test"
         finding.region = region
+        finding.muted = muted
 
         return finding
 
@@ -160,7 +161,7 @@ class Test_SecurityHub:
                 (
                     "root",
                     WARNING,
-                    f"ClientError -- [64]: An error occurred ({error_code}) when calling the {operation_name} operation: {error_message}",
+                    f"ClientError -- [70]: An error occurred ({error_code}) when calling the {operation_name} operation: {error_message}",
                 )
             ]
 
@@ -220,7 +221,7 @@ class Test_SecurityHub:
                 (
                     "root",
                     ERROR,
-                    f"ClientError -- [64]: An error occurred ({error_code}) when calling the {operation_name} operation: {error_message}",
+                    f"ClientError -- [70]: An error occurred ({error_code}) when calling the {operation_name} operation: {error_message}",
                 )
             ]
 
@@ -246,7 +247,7 @@ class Test_SecurityHub:
                 (
                     "root",
                     ERROR,
-                    f"Exception -- [64]: {error_message}",
+                    f"Exception -- [70]: {error_message}",
                 )
             ]
 
@@ -372,6 +373,46 @@ class Test_SecurityHub:
             AWS_REGION_EU_WEST_1: [get_security_hub_finding("PASSED")],
         }
 
+    def test_prepare_security_hub_findings_muted_fail_with_send_sh_only_fails(self):
+        enabled_regions = [AWS_REGION_EU_WEST_1]
+        output_options = self.set_mocked_output_options(
+            send_sh_only_fails=True,
+        )
+        findings = [
+            self.generate_finding(
+                status="FAIL", region=AWS_REGION_EU_WEST_1, muted=True
+            )
+        ]
+        aws_provider = set_mocked_aws_provider()
+
+        assert prepare_security_hub_findings(
+            findings,
+            aws_provider,
+            output_options,
+            enabled_regions,
+        ) == {
+            AWS_REGION_EU_WEST_1: [],
+        }
+
+    def test_prepare_security_hub_findings_muted_fail_with_status_FAIL(self):
+        enabled_regions = [AWS_REGION_EU_WEST_1]
+        output_options = self.set_mocked_output_options(status=["FAIL"])
+        findings = [
+            self.generate_finding(
+                status="FAIL", region=AWS_REGION_EU_WEST_1, muted=True
+            )
+        ]
+        aws_provider = set_mocked_aws_provider()
+
+        assert prepare_security_hub_findings(
+            findings,
+            aws_provider,
+            output_options,
+            enabled_regions,
+        ) == {
+            AWS_REGION_EU_WEST_1: [],
+        }
+
     @patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
     def test_batch_send_to_security_hub_one_finding(self):
         enabled_regions = [AWS_REGION_EU_WEST_1]