diff --git a/prowler/lib/outputs/json_asff/json_asff.py b/prowler/lib/outputs/json_asff/json_asff.py index 4f4e2a61f6..2ee6c8e574 100644 --- a/prowler/lib/outputs/json_asff/json_asff.py +++ b/prowler/lib/outputs/json_asff/json_asff.py @@ -11,16 +11,17 @@ from prowler.lib.outputs.json_asff.models import ( from prowler.lib.utils.utils import hash_sha512 -def generate_json_asff_status(status: str) -> str: +def generate_json_asff_status(status: str, muted: bool = False) -> str: json_asff_status = "" - if status == "PASS": - json_asff_status = "PASSED" - elif status == "FAIL": - json_asff_status = "FAILED" - elif status == "MUTED": + if muted: json_asff_status = "MUTED" else: - json_asff_status = "NOT_AVAILABLE" + if status == "PASS": + json_asff_status = "PASSED" + elif status == "FAIL": + json_asff_status = "FAILED" + else: + json_asff_status = "NOT_AVAILABLE" return json_asff_status @@ -84,7 +85,7 @@ def fill_json_asff(provider, finding): compliance_summary.append(item) # Ensures finding_status matches allowed values in ASFF - finding_status = generate_json_asff_status(finding.status) + finding_status = generate_json_asff_status(finding.status, finding.muted) json_asff_output = Check_Output_JSON_ASFF( # The following line cannot be changed because it is the format we use to generate unique findings for AWS Security Hub diff --git a/prowler/lib/outputs/outputs.py b/prowler/lib/outputs/outputs.py index 4aa019ad31..236cd6dc1c 100644 --- a/prowler/lib/outputs/outputs.py +++ b/prowler/lib/outputs/outputs.py @@ -173,12 +173,10 @@ def set_report_color(status: str, muted: bool = False) -> str: color = Fore.GREEN elif status == "FAIL": color = Fore.RED - elif status == "ERROR": - color = Fore.BLACK elif status == "MANUAL": color = Fore.YELLOW else: - raise Exception("Invalid Report Status. Must be PASS, FAIL, ERROR or MUTED") + raise Exception("Invalid Report Status. Must be PASS, FAIL or MANUAL.") return color diff --git a/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled.py b/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled.py index 75060b5a61..3c5516aabe 100644 --- a/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled.py +++ b/prowler/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled.py @@ -35,7 +35,7 @@ class accessanalyzer_enabled(Check): ) and not analyzer.region == accessanalyzer_client.region ): - report.status = "MUTED" + report.muted = True findings.append(report) diff --git a/prowler/providers/aws/services/config/config_recorder_all_regions_enabled/config_recorder_all_regions_enabled.py b/prowler/providers/aws/services/config/config_recorder_all_regions_enabled/config_recorder_all_regions_enabled.py index e4661391f7..94de66068a 100644 --- a/prowler/providers/aws/services/config/config_recorder_all_regions_enabled/config_recorder_all_regions_enabled.py +++ b/prowler/providers/aws/services/config/config_recorder_all_regions_enabled/config_recorder_all_regions_enabled.py @@ -39,7 +39,7 @@ class config_recorder_all_regions_enabled(Check): config_client.audit_config.get("mute_non_default_regions", False) and not recorder.region == config_client.region ): - report.status = "MUTED" + report.muted = True findings.append(report) diff --git a/prowler/providers/aws/services/drs/drs_job_exist/drs_job_exist.py b/prowler/providers/aws/services/drs/drs_job_exist/drs_job_exist.py index f262cb8eea..702da979b9 100644 --- a/prowler/providers/aws/services/drs/drs_job_exist/drs_job_exist.py +++ b/prowler/providers/aws/services/drs/drs_job_exist/drs_job_exist.py @@ -25,7 +25,7 @@ class drs_job_exist(Check): drs_client.audit_config.get("mute_non_default_regions", False) and not drs.region == drs_client.region ): - report.status = "MUTED" + report.muted = True findings.append(report) diff --git a/prowler/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled.py b/prowler/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled.py index 6aec8a90d5..610eb4a0ce 100644 --- a/prowler/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled.py +++ b/prowler/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled.py @@ -32,7 +32,7 @@ class guardduty_is_enabled(Check): guardduty_client.audit_config.get("mute_non_default_regions", False) and not detector.region == guardduty_client.region ): - report.status = "MUTED" + report.muted = True findings.append(report) diff --git a/prowler/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled.py b/prowler/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled.py index 390b4f781b..20f9ae1f56 100644 --- a/prowler/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled.py +++ b/prowler/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled.py @@ -29,7 +29,7 @@ class securityhub_enabled(Check): securityhub_client.audit_config.get("mute_non_default_regions", False) and not securityhub.region == securityhub_client.region ): - report.status = "MUTED" + report.muted = True findings.append(report) diff --git a/tests/lib/outputs/json_asff/json_asff_test.py b/tests/lib/outputs/json_asff/json_asff_test.py index c67e51724a..acc1b99bfe 100644 --- a/tests/lib/outputs/json_asff/json_asff_test.py +++ b/tests/lib/outputs/json_asff/json_asff_test.py @@ -442,7 +442,7 @@ class TestOutputJSONASFF: def test_generate_json_asff_status(self): assert generate_json_asff_status("PASS") == "PASSED" assert generate_json_asff_status("FAIL") == "FAILED" - assert generate_json_asff_status("MUTED") == "MUTED" + assert generate_json_asff_status("FAIL", True) == "MUTED" assert generate_json_asff_status("SOMETHING ELSE") == "NOT_AVAILABLE" def test_generate_json_asff_resource_tags(self): diff --git a/tests/lib/outputs/outputs_test.py b/tests/lib/outputs/outputs_test.py index 7ed4209cb6..c476c5715f 100644 --- a/tests/lib/outputs/outputs_test.py +++ b/tests/lib/outputs/outputs_test.py @@ -95,8 +95,8 @@ class TestOutputs: remove(expected[index][output_mode].name) def test_set_report_color(self): - test_status = ["PASS", "FAIL", "ERROR", "MANUAL"] - test_colors = [Fore.GREEN, Fore.RED, Fore.BLACK, Fore.YELLOW] + test_status = ["PASS", "FAIL", "MANUAL"] + test_colors = [Fore.GREEN, Fore.RED, Fore.YELLOW] for status in test_status: assert set_report_color(status) in test_colors @@ -107,9 +107,7 @@ class TestOutputs: with pytest.raises(Exception) as exc: set_report_color(test_status) - assert "Invalid Report Status. Must be PASS, FAIL, ERROR or MUTED" in str( - exc.value - ) + assert "Invalid Report Status. Must be PASS, FAIL or MANUAL" in str(exc.value) assert exc.type == Exception def test_generate_common_csv_fields(self): diff --git a/tests/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled_test.py b/tests/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled_test.py index eb663d8ba7..8588ef5e3d 100644 --- a/tests/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled_test.py +++ b/tests/providers/aws/services/accessanalyzer/accessanalyzer_enabled/accessanalyzer_enabled_test.py @@ -93,7 +93,8 @@ class Test_accessanalyzer_enabled: result = check.execute() assert len(result) == 1 - assert result[0].status == "MUTED" + assert result[0].status == "FAIL" + assert result[0].muted assert ( result[0].status_extended == f"IAM Access Analyzer in account {AWS_ACCOUNT_NUMBER} is not enabled." diff --git a/tests/providers/aws/services/config/config_recorder_all_regions_enabled/config_recorder_all_regions_enabled_test.py b/tests/providers/aws/services/config/config_recorder_all_regions_enabled/config_recorder_all_regions_enabled_test.py index d0dec52d20..5562182e8b 100644 --- a/tests/providers/aws/services/config/config_recorder_all_regions_enabled/config_recorder_all_regions_enabled_test.py +++ b/tests/providers/aws/services/config/config_recorder_all_regions_enabled/config_recorder_all_regions_enabled_test.py @@ -185,7 +185,8 @@ class Test_config_recorder_all_regions_enabled: # Search for the recorder just created for recorder in result: if recorder.region == AWS_REGION_US_EAST_1: - assert recorder.status == "MUTED" + assert recorder.muted + assert recorder.status == "FAIL" assert ( recorder.status_extended == f"AWS Config recorder {AWS_ACCOUNT_NUMBER} is disabled." diff --git a/tests/providers/aws/services/drs/drs_job_exist/drs_job_exist_test.py b/tests/providers/aws/services/drs/drs_job_exist/drs_job_exist_test.py index 2063e87bd0..ef6cc74707 100644 --- a/tests/providers/aws/services/drs/drs_job_exist/drs_job_exist_test.py +++ b/tests/providers/aws/services/drs/drs_job_exist/drs_job_exist_test.py @@ -176,7 +176,8 @@ class Test_drs_job_exist: result = check.execute() assert len(result) == 1 - assert result[0].status == "MUTED" + assert result[0].status == "FAIL" + assert result[0].muted assert result[0].status_extended == "DRS is not enabled for this region." assert result[0].resource_id == AWS_ACCOUNT_NUMBER assert ( diff --git a/tests/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled_test.py b/tests/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled_test.py index 4af746f645..3564ad3dbb 100644 --- a/tests/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled_test.py +++ b/tests/providers/aws/services/guardduty/guardduty_is_enabled/guardduty_is_enabled_test.py @@ -160,7 +160,8 @@ class Test_guardduty_is_enabled: check = guardduty_is_enabled() result = check.execute() assert len(result) == 1 - assert result[0].status == "MUTED" + assert result[0].status == "FAIL" + assert result[0].muted assert ( result[0].status_extended == f"GuardDuty detector {DETECTOR_ID} not configured." diff --git a/tests/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled_test.py b/tests/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled_test.py index f73003bb58..1438b048e0 100644 --- a/tests/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled_test.py +++ b/tests/providers/aws/services/securityhub/securityhub_enabled/securityhub_enabled_test.py @@ -173,7 +173,8 @@ class Test_securityhub_enabled: check = securityhub_enabled() result = check.execute() - assert result[0].status == "MUTED" + assert result[0].status == "FAIL" + assert result[0].muted assert ( result[0].status_extended == "Security Hub is enabled but without any standard or integration."