From 64fb8232765043ff34012bc7bc6fb3aadca4b775 Mon Sep 17 00:00:00 2001
From: Sergio Garcia <38561120+sergargar@users.noreply.github.com>
Date: Fri, 25 Oct 2024 09:32:46 -0700
Subject: [PATCH] fix(aws): review checks in compliance frameworks (#5513)

---
 .../compliance/aws/aws_account_security_onboarding_aws.json  | 5 +++--
 prowler/compliance/aws/kisa_isms_p_2023_aws.json             | 2 --
 prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json      | 2 --
 3 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/prowler/compliance/aws/aws_account_security_onboarding_aws.json b/prowler/compliance/aws/aws_account_security_onboarding_aws.json
index 53f8fbb3e0..e9df008752 100644
--- a/prowler/compliance/aws/aws_account_security_onboarding_aws.json
+++ b/prowler/compliance/aws/aws_account_security_onboarding_aws.json
@@ -557,7 +557,7 @@
         }
       ],
       "Checks": [
-        "inspector2_findings_exist"
+        "inspector2_is_enabled"
       ]
     },
     {
@@ -587,7 +587,8 @@
         }
       ],
       "Checks": [
-        "inspector2_findings_exist",
+        "inspector2_active_findings_exist",
+        "inspector2_is_enabled",
         "ecr_registry_scan_images_on_push_enabled",
         "ecr_repositories_scan_vulnerabilities_in_latest_image",
         "ecr_repositories_scan_images_on_push_enabled"
diff --git a/prowler/compliance/aws/kisa_isms_p_2023_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_aws.json
index c64c4195e6..2411836fc8 100644
--- a/prowler/compliance/aws/kisa_isms_p_2023_aws.json
+++ b/prowler/compliance/aws/kisa_isms_p_2023_aws.json
@@ -1192,7 +1192,6 @@
       "Checks": [
         "organizations_scp_check_deny_regions",
         "cognito_user_pool_self_registration_disabled",
-        "cloudtrail_threat_detection_privilege_escalation",
         "iam_user_administrator_access_policy",
         "iam_customer_unattached_policy_no_administrative_privileges",
         "iam_inline_policy_allows_privilege_escalation",
@@ -2654,7 +2653,6 @@
         "accessanalyzer_enabled_without_findings",
         "cloudtrail_insights_exist",
         "cloudtrail_threat_detection_enumeration",
-        "cloudtrail_threat_detection_privilege_escalation",
         "guardduty_no_high_severity_findings",
         "trustedadvisor_errors_and_warnings"
       ],
diff --git a/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
index 5e4897a0fa..767a450a62 100644
--- a/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
+++ b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
@@ -1192,7 +1192,6 @@
       "Checks": [
         "organizations_scp_check_deny_regions",
         "cognito_user_pool_self_registration_disabled",
-        "cloudtrail_threat_detection_privilege_escalation",
         "iam_user_administrator_access_policy",
         "iam_customer_unattached_policy_no_administrative_privileges",
         "iam_inline_policy_allows_privilege_escalation",
@@ -2654,7 +2653,6 @@
         "accessanalyzer_enabled_without_findings",
         "cloudtrail_insights_exist",
         "cloudtrail_threat_detection_enumeration",
-        "cloudtrail_threat_detection_privilege_escalation",
         "guardduty_no_high_severity_findings",
         "trustedadvisor_errors_and_warnings"
       ],