diff --git a/prowler/lib/outputs/ocsf/ocsf.py b/prowler/lib/outputs/ocsf/ocsf.py index d7ee58cd9c..48b44c6b00 100644 --- a/prowler/lib/outputs/ocsf/ocsf.py +++ b/prowler/lib/outputs/ocsf/ocsf.py @@ -57,14 +57,16 @@ class OCSF(Output): if not findings: return - scan_ids_by_provider = {} + scan_ids_by_provider_account = {} for finding in findings: provider = finding.metadata.Provider - if provider not in scan_ids_by_provider: - scan_ids_by_provider[provider] = _uuid7_from_timestamp( + account_uid = finding.account_uid + scan_key = (provider, account_uid) + if scan_key not in scan_ids_by_provider_account: + scan_ids_by_provider_account[scan_key] = _uuid7_from_timestamp( finding.timestamp ) - scan_id = scan_ids_by_provider[provider] + scan_id = scan_ids_by_provider_account[scan_key] finding_activity = ActivityID.Create cloud_account_type = self.get_account_type_id_by_provider( finding.metadata.Provider diff --git a/tests/lib/outputs/ocsf/ocsf_test.py b/tests/lib/outputs/ocsf/ocsf_test.py index f9ea61ec82..3199443b13 100644 --- a/tests/lib/outputs/ocsf/ocsf_test.py +++ b/tests/lib/outputs/ocsf/ocsf_test.py @@ -123,11 +123,11 @@ class TestOCSF: 1619600000, tz=timezone.utc ) - def test_scan_id_is_unique_per_provider(self): + def test_scan_id_is_unique_per_provider_and_account(self): findings = [ - generate_finding_output(provider="aws"), - generate_finding_output(provider="azure"), - generate_finding_output(provider="aws"), + generate_finding_output(provider="aws", account_uid="111111111111"), + generate_finding_output(provider="aws", account_uid="222222222222"), + generate_finding_output(provider="aws", account_uid="111111111111"), ] ocsf = OCSF(findings)