From 571f3ebe1d57708e00a344959275d896e8922aff Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Wed, 10 Apr 2024 15:51:48 +0200 Subject: [PATCH] fix(ocsf): Include check_id as metadata.event_code (#3748) --- docs/tutorials/reporting.md | 4 ++-- prowler/lib/outputs/json_ocsf/json_ocsf.py | 2 +- tests/lib/outputs/json_ocsf/json_ocsf_test.py | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/tutorials/reporting.md b/docs/tutorials/reporting.md index a3987b4399..a07d78e430 100644 --- a/docs/tutorials/reporting.md +++ b/docs/tutorials/reporting.md @@ -268,7 +268,7 @@ The following is the mapping between the native JSON and the Detection Finding f | AssessmentStartTime | event_time | | FindingUniqueId | finding_info.uid | | Provider | cloud.account.type | -| CheckID | unmapped.check_id | +| CheckID | metadata.event_code | | CheckTitle | finding_info.title | | CheckType | unmapped.check_type | | ServiceName | resources.group.name | @@ -297,7 +297,7 @@ The following is the mapping between the native JSON and the Detection Finding f | OrganizationsInfo.account_name | cloud.account.name | | OrganizationsInfo.account_email | _Not mapped yet_ | | OrganizationsInfo.account_arn | _Not mapped yet_ | -| OrganizationsInfo.account_org | cloud.org.name | +| OrganizationsInfo.account_org | cloud.org.name | | OrganizationsInfo.account_tags | cloud.account.labels _Available from OCSF 1.2_ | | Region | resources.region | | ResourceId | resources.name | diff --git a/prowler/lib/outputs/json_ocsf/json_ocsf.py b/prowler/lib/outputs/json_ocsf/json_ocsf.py index 560345fe26..fb764de4f8 100644 --- a/prowler/lib/outputs/json_ocsf/json_ocsf.py +++ b/prowler/lib/outputs/json_ocsf/json_ocsf.py @@ -99,6 +99,7 @@ def fill_json_ocsf(finding_output: FindingOutput) -> DetectionFinding: ) ], metadata=Metadata( + event_code=finding_output.check_id, product=Product( name="Prowler", vendor_name="Prowler", @@ -108,7 +109,6 @@ def fill_json_ocsf(finding_output: FindingOutput) -> DetectionFinding: type_uid=DetectionFindingTypeID.Create, type_name=DetectionFindingTypeID.Create.name, unmapped={ - "check_id": finding_output.check_id, "check_type": finding_output.check_type, "risk": finding_output.risk, "related_url": finding_output.related_url, diff --git a/tests/lib/outputs/json_ocsf/json_ocsf_test.py b/tests/lib/outputs/json_ocsf/json_ocsf_test.py index e17d095a9f..c10607acfc 100644 --- a/tests/lib/outputs/json_ocsf/json_ocsf_test.py +++ b/tests/lib/outputs/json_ocsf/json_ocsf_test.py @@ -75,7 +75,6 @@ class TestOutputJSONOCSF: # Unmapped Data assert finding_json_ocsf.unmapped == { - "check_id": finding_output.check_id, "check_type": finding_output.check_type, "risk": finding_output.risk, "related_url": finding_output.related_url, @@ -105,6 +104,7 @@ class TestOutputJSONOCSF: # Metadata metadata = finding_json_ocsf.metadata assert isinstance(metadata, Metadata) + assert metadata.event_code == finding_output.check_id metadata_product = metadata.product assert isinstance(metadata_product, Product)