ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-14 16:11:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ocsf): Include check_id as metadata.event_code (#3748)

Browse Source
This commit is contained in:
Pepe Fagoaga
2024-04-10 15:51:48 +02:00
committed by GitHub
parent c7f09df4e7
commit 571f3ebe1d
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tutorials/reporting.md
+2 -2
View File
@@ -268,7 +268,7 @@ The following is the mapping between the native JSON and the Detection Finding f
| AssessmentStartTime | event_time |
| FindingUniqueId | finding_info.uid |
| Provider | cloud.account.type |
| CheckID | unmapped.check_id |
| CheckID | metadata.event_code |
| CheckTitle | finding_info.title |
| CheckType | unmapped.check_type |
| ServiceName | resources.group.name |
@@ -297,7 +297,7 @@ The following is the mapping between the native JSON and the Detection Finding f
| OrganizationsInfo.account_name | cloud.account.name |
| OrganizationsInfo.account_email | _Not mapped yet_ |
| OrganizationsInfo.account_arn | _Not mapped yet_ |
| OrganizationsInfo.account_org | cloud.org.name |
| OrganizationsInfo.account_org | cloud.org.name |
| OrganizationsInfo.account_tags | cloud.account.labels _Available from OCSF 1.2_ |
| Region | resources.region |
| ResourceId | resources.name |
prowler/lib/outputs/json_ocsf/json_ocsf.py
+1 -1
View File
@@ -99,6 +99,7 @@ def fill_json_ocsf(finding_output: FindingOutput) -> DetectionFinding:
)
],
metadata=Metadata(
event_code=finding_output.check_id,
product=Product(
name="Prowler",
vendor_name="Prowler",
@@ -108,7 +109,6 @@ def fill_json_ocsf(finding_output: FindingOutput) -> DetectionFinding:
type_uid=DetectionFindingTypeID.Create,
type_name=DetectionFindingTypeID.Create.name,
unmapped={
"check_id": finding_output.check_id,
"check_type": finding_output.check_type,
"risk": finding_output.risk,
"related_url": finding_output.related_url,
tests/lib/outputs/json_ocsf/json_ocsf_test.py
+1 -1
View File
@@ -75,7 +75,6 @@ class TestOutputJSONOCSF:
# Unmapped Data
assert finding_json_ocsf.unmapped == {
"check_id": finding_output.check_id,
"check_type": finding_output.check_type,
"risk": finding_output.risk,
"related_url": finding_output.related_url,
@@ -105,6 +104,7 @@ class TestOutputJSONOCSF:
# Metadata
metadata = finding_json_ocsf.metadata
assert isinstance(metadata, Metadata)
assert metadata.event_code == finding_output.check_id
metadata_product = metadata.product
assert isinstance(metadata_product, Product)