[Bug]: Output formats for JSON, HTML not accepted about prowler

[jmanduca-psfy]

This new OCSF-JSON does not include the Compliance Info, which was previously included in the previous JSON option. It is a requirement for the Compliance Finding [2003] Class but not in the Detection Finding [2004] Class which appears to be in use per @pr3l14t0r .
We were using this field to help sort through findings for our compliance requirements, now that it is gone it will create additional work or duplication of scans to sort them out in this version.

[jfagoagas]

@pr3l14t0r we decided to use Detection Finding since it is the most accurate event for a Prowler finding. Regarding compliance we are evaluating the option to generate a Compliance Finding since as it happens with Prowler outputs, compliance and findings cannot be mapped into the same output.

CC: @jmanduca-psfy

[jfagoagas]

@pr3l14t0r @jmanduca-psfy We are going to include the JSON v3 Compliance key in the Detection Finding at unmapped.compliance probably tomorrow. Sorry for the incovenience.

[jfagoagas]

#3753

CC: @pr3l14t0r @jmanduca-psfy

[jmanduca-psfy]

Working great, thank you @jfagoagas !

[adv4000]

Same issue here, Version 4.0.1 removed support for HTML:

prowler aws -M html
prowler aws: error: argument --output-formats/--output-modes/-M: invalid choice: 'html' (choose from 'csv', 'json-asff', 'json-ocsf')

[jfagoagas]

Hi @jmanduca-psfy @adv4000, since v4 we have been deprecated the following outputs:

• The HTML is replaced for the new Prowler Dashboard, you can try it with prowler dashboard.
• The native JSON is replaced for the JSON OCSF v1.1.0, common for all the providers.

Thanks for using Prowler 🚀

[christiandavilakoobin]

I tried the dashboard, and is very handy, but it requieres some extra steps to view the results. The html version was very useful for a quick view.

[pr3l14t0r]

@jfagoagas Thanks for that information, i have absolutely overseen the prowler dashboard functionality.

Quick question if allowed: Is there a reason why you/the team have chosen the Detection Finding [2004] Class over Compliance Finding [2003] Class in OCSF-JSON? I can't find a discussion for that anywhere.

[pr3l14t0r]

@jfagoagas Thanks for the explanation, highly appreciated! :)

[jfagoagas]

@jfagoagas Thanks for the explanation, highly appreciated! :)

It's nothing! Always here to help 🙌

[jfagoagas]

We are going to close this issue once the above PR gets merged. Please let us know if everything works fine and feel free to reopen it if notice something not expected.

Thanks for using Prowler 🚀