From af069104bf951fae45b5270353011b3f5a0658c3 Mon Sep 17 00:00:00 2001
From: MrCloudSec <hello@mistercloudsec.com>
Date: Tue, 30 Sep 2025 16:33:56 -0400
Subject: [PATCH] chore: retrieve findings in batches

---
 .../aws/lib/security_hub/security_hub.py      | 44 ++++++++++++++-----
 1 file changed, 34 insertions(+), 10 deletions(-)

diff --git a/prowler/providers/aws/lib/security_hub/security_hub.py b/prowler/providers/aws/lib/security_hub/security_hub.py
index 26d1f4720d..825d2d037a 100644
--- a/prowler/providers/aws/lib/security_hub/security_hub.py
+++ b/prowler/providers/aws/lib/security_hub/security_hub.py
@@ -401,16 +401,12 @@ class SecurityHub:
                     "get_findings"
                 )
 
-                for page in get_findings_paginator.paginate(
-                    Filters=findings_filter, PaginationConfig={"PageSize": 100}
-                ):
-                    for finding in page["Findings"]:
-                        finding_id = finding["Id"]
-                        existing_findings_timestamps[finding_id] = {
-                            "FirstObservedAt": finding.get("FirstObservedAt"),
-                            "CreatedAt": finding.get("CreatedAt"),
-                            "UpdatedAt": finding.get("UpdatedAt"),
-                        }
+                # Use the same batching pattern as _send_findings_in_batches
+                self._retrieve_findings_in_batches(
+                    get_findings_paginator,
+                    findings_filter,
+                    existing_findings_timestamps,
+                )
 
             except Exception as error:
                 logger.error(
@@ -476,6 +472,34 @@ class SecurityHub:
                 )
         return success_count
 
+    def _retrieve_findings_in_batches(
+        self, paginator, findings_filter: dict, existing_findings_timestamps: dict
+    ) -> None:
+        """
+        Retrieves findings from AWS Security Hub in batches using the same pattern as _send_findings_in_batches.
+
+        Args:
+            paginator: The paginator object for get_findings.
+            findings_filter (dict): The filter to apply when retrieving findings.
+            existing_findings_timestamps (dict): Dictionary to store the retrieved findings timestamps.
+        """
+        try:
+            for page in paginator.paginate(
+                Filters=findings_filter,
+                PaginationConfig={"PageSize": SECURITY_HUB_MAX_BATCH},
+            ):
+                for finding in page["Findings"]:
+                    finding_id = finding["Id"]
+                    existing_findings_timestamps[finding_id] = {
+                        "FirstObservedAt": finding.get("FirstObservedAt"),
+                        "CreatedAt": finding.get("CreatedAt"),
+                        "UpdatedAt": finding.get("UpdatedAt"),
+                    }
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__} -- [{error.__traceback__.tb_lineno}]: {error}"
+            )
+
     def _send_findings_in_batches(
         self, findings: list[AWSSecurityFindingFormat], region: str
     ) -> int: