Notification 3.2 - filter/alarm in place, but still get WARNING about prowler

[toniblyx]

Hi @modelenoir, thanks for your feedback. I haven't tested Prowler in GovCloud but not sure if this issue may be related to #112, can you take a look and see if it has anything to do with it? I'll also like to see a sample output of the basic command (without parsing) and see how to improve it. Thanks.

[morningseal]

It is related to #112, fix #117 doesn't validate the CIS filter pattern so the false 'Warning' persists (based on code pull 2-Nov) unless one changed the filer to meet Prowler criteria.

[toniblyx]

Can you please suggest a better way to validate it? I guess it is a matter of regexp. I played with this awk '/.userIdentity.type/&&/IAMUser/||/root/&&/.responseElements.ConsoleLogin/&&/.additionalEventData.MFAUsed/&&/Yes/' but it is not very accurate.

[morningseal]

This seems to work:
'/ConsoleLogin/ && ( (/additionalEventData.MFAUsed.*\!=.*\"Yes/) || (/additionalEventData.MFAUsed.*\=.*\"No/ && !/!/) )’

CIS Benchmark construct

> aws logs describe-metric-filters | grep MFAUsed
            "filterPattern": "{ ($.eventName = \"ConsoleLogin\") && ($.additionalEventData.MFAUsed != \"Yes\") }", 
> aws logs describe-metric-filters | grep MFAUsed | awk '/ConsoleLogin/ && (/additionalEventData.MFAUsed.*\!=.*\"Yes/) {print $1}' 
"filterPattern":

AWS CloudWatch alarm additional example construct

filterPattern: { ($.eventName = "ConsoleLogin") && ($.additionalEventData.MFAUsed="No") },
> cat t | awk '/ConsoleLogin/ && (/additionalEventData.MFAUsed.*\=.*\"No/ && !/!/) {print $1}'
"filterPattern":

When print $1 outputs <"filterPattern":> the pattern matched.

Thank you for prowler, it has been helpful.

[toniblyx]

Thanks @morningseal I'll add it asap and make a PR.

[toniblyx]

Ok, now thanks to @morningseal comments it seems to work. I'll close this issue but please feel free to open it again if you find any issue with check32. Thanks you too @modelenoir for your comments.