Understanding how often findings are sent to security hub? #5313

qadri99-max · 2024-10-07T19:19:55Z

qadri99-max
Oct 7, 2024

1 - I want to understand a bit more how findings are sent to the Security Hub. For my scans I can see a log entry that says: '0 findings sent to AWS Security Hub'.

Does that mean that if the same findings are found, Prowler does not send the same finding again to Security Hub?

Under Security Hub, I can see findings that says Updated at: 7 days ago

2 - Can you please explain what does this mean:
"31m30.91% (484) Failed [0m]....."

thanks

jfagoagas · 2024-10-09T12:47:11Z

jfagoagas
Oct 9, 2024
Maintainer

Hello @qadri99-max again, as with the other discussion, I apologise for the late notice.

Regarding your questions:

By default all findings are sent to AWS Security Hub if you input the flag to enable it. Are you doing it? Also by default we archive the previous findings if they are not present in the new Scan to reduce the results since if they are not present means that those findings are no longer an issue.

What version of Prowler are you using?

These characters are the colors used in the CLI which are not rendered by AWS CloudWatch in their logs. There is a workaround here to remove those values prowler <...> | sed -r "s/\x1B\[([0-9]{1,3}(;[0-9]{1,2};?)?)?[mGK]//g".. By the way we have a feature request to remove the color output from the CLI Add flag to disable color output #5294 so you can keep track of it there.

Thanks for using Prowler 🚀

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Understanding how often findings are sent to security hub? #5313

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 1 comment

{{title}}

Select a reply

Understanding how often findings are sent to security hub? #5313

qadri99-max Oct 7, 2024

Replies: 1 comment

jfagoagas Oct 9, 2024 Maintainer

qadri99-max
Oct 7, 2024

jfagoagas
Oct 9, 2024
Maintainer