Export option for reference to ruleset item

[localh0rs7]

Hi folks,

Is there a general possibility to have a separate export column for a direct reference to the corresponding checked ruleset item (i.e. CIS Benchmark Item and exact numbering)?

The prowler documentation for possible output columns according to the csv header mappings from the documentation only lists the columns "CHECK_ID", "FINDINGS_UID", "REQUIREMENTS_ATTRIBUTES_SECTION" which is already close to the ruleset item, but I did not come across a unique mapping attribute so far:

https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/reporting/

If there is any attribute that will reference it for gcp and azure related audits, can somebody give me a hint on the attribute and if it is possible to integrate it into the csv export format?

Additionally, is there a way to get the Finding severity and the conformity attribute ("warning" or "fail") into the csv export format?
It would be also nice to know, if there is any metric to determine a warning or fail besides the general pass/fail attribute and how exactly they are evaluated.

Best,
Christian

[pedrooot]

Hi Christian,

Regarding the unique attribute that handles the mapping, REQUIREMENTS_ID contains the ID of the applicable requirement.

As for the severity, you can add the column to the CSV output, considering that the attribute information is included in the finding. Take a look at prowler/lib/outputs/compliance/cis/cis_azure.py and add the information you deem necessary for each compliance_row, keeping in mind that you'll need to modify the AzureCISModel.

Regarding the conformity attribute, I'm not sure what you mean exactly. Could you explain a bit more or provide an example?

Thanks, best regards.

[localh0rs7]

Hi Pedroot,

Thanks for the prompt answer.

I noticed that there are differences between the Export Output when explicitly flagging the compliance framework "cis_2.0_gcp" with prowler <provider> --compliance <compliance framework> vs. without the usage of the additional flag. What exactly is the default compliance framework without the flag?

In an example export using the gcp provider, by using the compliance framework "cis_2.0_gcp", the CIS Item Number is named REQUIREMENTS_ID and without the usage of the compliance flag, the CIS Item Number is contained in the attribute compliance (i.e. "MITRE-ATTACK: TXXXX | CIS-2.0: ").

Is there a way of using both combined attribute sets by getting the severity as well as the REQUIREMENTS_ATTRIBUTES_PROFILE (CIS Level) and the CHECK_TITLE into one identical export?

I only got 2 different exports with either the attribute Severity (low, high, critical) and the CHECK_TITLE OR the CIS Level (Level 1, Level 2) contained, but not both.

What is the reason for the differences, and which behavior or compliance framework applies per default, without the usage of the flag?

I did not found anything specific by reading the following resources:

https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/aws/v2_to_v3_checks_mapping/
https://docs.prowler.com/projects/prowler-open-source/en/latest/developer-guide/security-compliance-framework/
https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/reporting/

Is there anyone who could clarify this behavior?

[pedrooot]

Hi @localh0rs7 ! In the prowler docs, you can find information regarding running Prowler with compliance frameworks. By default, Prowler will execute all available compliances for a provider.

Regarding your comment about outputs with or without flags, keep in mind that if you add the flag, you'll only get the output for the specified compliance. On the other hand, if you don't use the flag, you'll get all the findings, and additionally, all the compliances for the provider. It's important to note that there are two types of outputs: generic outputs (which contain the findings and are placed inside the /output directory) and compliance-specific outputs (which contain findings associated with specific compliances and are placed inside the /output/compliance directory).

In the generic outputs, you will find a field for each finding specifying the compliances in which the check that generated the finding appears. In the compliance-specific outputs, you will receive the finding with all the information related to the compliance that the executed check belongs to, and which generated that finding.

Regarding this: "I only got 2 different exports with either the attribute Severity (low, high, critical) and the CHECK_TITLE OR the CIS Level (Level 1, Level 2) contained, but not both." Could you provide an example? In the compliance-specific outputs, you should receive all fields associated with the compliance.

I hope this helps.

[localh0rs7]

Thanks for the detailed explanation. Your answer helped to resolve my issues. Several fields that are generically audit relevant but not relevant to the respective compliance framework selectable, are thus not contained in the generic output format.