Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: solve various issues #58

Merged
merged 2 commits into from
Dec 24, 2024
Merged

Conversation

marwinbaumannsbp
Copy link
Collaborator

@marwinbaumannsbp marwinbaumannsbp commented Dec 24, 2024

(1) Bump awsfindingsmanagerlib to 1.2.0

  • Updates default SecurityHub filter to fix issues with SecurityHub Integration findings support.
  • Adjusted filtering logic to align with SecurityHub filtering: When both match_on options: tags and resource_id_regexps are specified, they are now combined using an AND condition instead of an OR condition.
  • Introduce pagesize.

(2) Update the EventBridge rule for detecting Security Hub findings events, triggering the findings manager events lambda.

With the current filter structure, the support for SecurityHub integrations is not working.

  • See: chore: updates default SecurityHub filter awsfindingsmanagerlib#26
  • ComplianceStatus is not available in findings coming from integrated services such as GuardDuty and Inspector. This means that these findings are never returned and can't be suppressed.
  • the final indicator that a finding that matches a suppression rule is still not suppressed is having WorkflowStatus equals NEW or NOTIFIED.

If the end user is using the jira integration nothing changes. The query then already includes all possible compliance statusses. If the end user is not using the jira integration now also compliance status PASSED and NOT_AVAILABLE are included, but this should not lead to many more invoications since the PASSED compliance status is not possible incombination with the NEW or NOTIFIED workflow status.

More information:
https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Workflow.html
https://docs.aws.amazon.com/securityhub/latest/userguide/controls-overall-status.html

@github-actions github-actions bot added the bug Something isn't working label Dec 24, 2024
@marwinbaumannsbp marwinbaumannsbp added the enhancement New feature or request label Dec 24, 2024
Copy link
Contributor

Terraform Format and Style 🖌success

Terraform Initialization ⚙️``

Terraform Lint 📖success

Terraform Validation 🤖success

Validation Output

Success! The configuration is valid.


Copy link
Contributor

@fernandogoncalves-me fernandogoncalves-me left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@marwinbaumannsbp marwinbaumannsbp merged commit e1d1964 into main Dec 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants