Skip to content

Commit

Permalink
add mitigation
Browse files Browse the repository at this point in the history
  • Loading branch information
manuel-sommer committed Feb 12, 2024
1 parent bc38bf5 commit 5ba0dd4
Showing 1 changed file with 9 additions and 2 deletions.
11 changes: 9 additions & 2 deletions dojo/tools/awssecurityhub/parser.py
Original file line number Diff line number Diff line change
Expand Up @@ -81,11 +81,18 @@ def get_item(finding: dict, test):
mitigated = datetime.strptime(finding.get("LastObservedAt"), "%Y-%m-%dT%H:%M:%fZ")
else:
mitigated = datetime.utcnow()

elif aws_scanner_type == "GuardDuty":
mitigations = finding.get("FindingProviderFields", {}).get("Types")
for mitigate in mitigations:
mitigation += mitigate + "\n"
active = True #TODO

Check notice on line 88 in dojo/tools/awssecurityhub/parser.py

View workflow job for this annotation

GitHub Actions / flake8-your-pr

dojo/tools/awssecurityhub/parser.py#L88

at least two spaces before inline comment (E261)

Check notice on line 88 in dojo/tools/awssecurityhub/parser.py

View workflow job for this annotation

GitHub Actions / flake8-your-pr

dojo/tools/awssecurityhub/parser.py#L88

inline comment should start with '# ' (E262)
is_Mitigated = False #TODO

Check notice on line 89 in dojo/tools/awssecurityhub/parser.py

View workflow job for this annotation

GitHub Actions / flake8-your-pr

dojo/tools/awssecurityhub/parser.py#L89

at least two spaces before inline comment (E261)

Check notice on line 89 in dojo/tools/awssecurityhub/parser.py

View workflow job for this annotation

GitHub Actions / flake8-your-pr

dojo/tools/awssecurityhub/parser.py#L89

inline comment should start with '# ' (E262)
mitigated = None #TODO

Check notice on line 90 in dojo/tools/awssecurityhub/parser.py

View workflow job for this annotation

GitHub Actions / flake8-your-pr

dojo/tools/awssecurityhub/parser.py#L90

at least two spaces before inline comment (E261)

Check notice on line 90 in dojo/tools/awssecurityhub/parser.py

View workflow job for this annotation

GitHub Actions / flake8-your-pr

dojo/tools/awssecurityhub/parser.py#L90

inline comment should start with '# ' (E262)
mitigation += "https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html"

Check notice on line 91 in dojo/tools/awssecurityhub/parser.py

View workflow job for this annotation

GitHub Actions / flake8-your-pr

dojo/tools/awssecurityhub/parser.py#L91

multiple spaces after operator (E222)
description = f"This is a GuardDuty Finding\n{finding.get('Description', '')}"
else:
mitigation = finding.get("Remediation", {}).get("Recommendation", {}).get("Text", "")
description = "This is a Security Hub Finding \n" + finding.get("Description", "")

if finding.get("Compliance", {}).get("Status", "PASSED") == "PASSED":
is_Mitigated = True
active = False
Expand Down

0 comments on commit 5ba0dd4

Please sign in to comment.