ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-10-04 02:04:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ocsf): Add resource details to data (#3819)

Browse Source
This commit is contained in:
Pepe Fagoaga
2024-04-19 08:35:26 +02:00
committed by GitHub
parent f1e4cd3938
commit e4652d4339
3 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/tutorials/reporting.md
+5 -2
View File
@@ -136,7 +136,10 @@ The JSON-OCSF output format implements the [Detection Finding](https://schema.oc
"labels": [], "labels": [],
"name": "123456789012", "name": "123456789012",
"type": "AwsCloudTrailTrail", "type": "AwsCloudTrailTrail",
"uid": "arn:aws:cloudtrail:ap-northeast-1:123456789012:trail" "uid": "arn:aws:cloudtrail:ap-northeast-1:123456789012:trail",
"data": {
"details": ""
},
} }
], ],
"category_name": "Findings", "category_name": "Findings",
@@ -320,7 +323,7 @@ The following is the mapping between the native JSON and the Detection Finding f
| StatusExtended | status_detail | | StatusExtended | status_detail |
| Severity | severity | | Severity | severity |
| ResourceType | resources.type | | ResourceType | resources.type |
| ResourceDetails | _Not mapped yet_ | | ResourceDetails | resources.data.details |
| Description | finding_info.desc | | Description | finding_info.desc |
| Risk | risk_details _Available from OCSF 1.2_ | | Risk | risk_details _Available from OCSF 1.2_ |
| RelatedUrl | unmapped.related_url | | RelatedUrl | unmapped.related_url |
prowler/lib/outputs/json_ocsf/json_ocsf.py
+1
View File
@@ -96,6 +96,7 @@ def fill_json_ocsf(finding_output: FindingOutput) -> DetectionFinding:
# TODO: this should be included only if using the Cloud profile # TODO: this should be included only if using the Cloud profile
cloud_partition=finding_output.partition, cloud_partition=finding_output.partition,
region=finding_output.region, region=finding_output.region,
data={"details": finding_output.resource_details},
) )
], ],
metadata=Metadata( metadata=Metadata(
tests/lib/outputs/json_ocsf/json_ocsf_test.py
+1
View File
@@ -96,6 +96,7 @@ class TestOutputJSONOCSF:
assert resource_details[0].type == finding_output.resource_type assert resource_details[0].type == finding_output.resource_type
assert resource_details[0].cloud_partition == finding_output.partition assert resource_details[0].cloud_partition == finding_output.partition
assert resource_details[0].region == finding_output.region assert resource_details[0].region == finding_output.region
assert resource_details[0].data == {"details": finding_output.resource_details}
resource_details_group = resource_details[0].group resource_details_group = resource_details[0].group
assert isinstance(resource_details_group, Group) assert isinstance(resource_details_group, Group)