False Negative For check31 about prowler

[toniblyx]

Thanks @virtualjj working through checks 3.x now, I'll keep you posted

[virtualjj]

Cool - I'm slowing going through each control but I'm finding issues with the actual CIS recommendations. For example this filter will actually return a bunch of hits from the following AWS services:

kms.amazonaws.com
elasticloadbalancing.amazonaws.com
s3.amazonaws.com
acm.amazonaws.com
cloudtrail.amazonaws.com
cloudtrail.amazonaws.com
rds.amazonaws.com
logs.amazonaws.com
acm.amazonaws.com
ec2.amazonaws.com
iam.amazonaws.com

Especially kms.amazonaws.com if control 2.7 (Encrypted CloudTrail Logs) is enabled.

I think this metric filter below is actually better to reduce false positives but I have opened a support case with AWS to confirm:

{ $.userIdentity.sessionContext.attributes.mfaAuthenticated != "true" && $.eventSource != *.amazonaws.com }

UPDATE: AWS has acknowledged this issue (Case 1909332871) and will contact their teams to review the CIS white paper. This filter pattern has been suggested instead:

{ ($.additionalEventData.MFAUsed = "No") && ($.eventName = "ConsoleLogin") }

[toniblyx]

Thanks @virtualjj. Are you using something to implement all these changes? I mean, commands or a CFN template? I have found a template here that may create some alarms but it is not fully covering all CIS 3.X checks. https://s3-us-west-2.amazonaws.com/awscloudtrail/cloudwatch-alarms-for-cloudtrail-api-activity/CloudWatch_Alarms_for_CloudTrail_API_Activity.json

[virtualjj]

Awesome - thanks for this. I'm actually doing the changes with my own scripts but once I have everything cleaned up, planning on sharing my templates on GitHub.

[toniblyx]

That would be great. I'm also thinking to make public content here or write an blog post about how to fix all these WARNINGS with real commands or assets since what it comes in the CIS document is very vague. If you are interested let me know and we can put them toguether. I will keep you posted about my work on that template in the next days.

[virtualjj]

Sounds great - just followed you on Twitter. Not sure how quick I can contribute but will throw ideas your way in the meantime! Will close this issue - thanks again!