Skip to content

Commit 7c82b2a

Browse files
StefanFlStefanFl
authored
fix: create issues only for supply chain observations (#1)
* fix: create issues only for supply chain observations * fix: OCSF parser
1 parent f8643be commit 7c82b2a

File tree

3 files changed

+193
-2
lines changed

3 files changed

+193
-2
lines changed

‎backend/application/import_observations/parsers/ocsf/parser.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,10 @@ def get_observations(self, data: list, product: Product, branch: Optional[Branch
6464
if finding.status_id not in [StatusID.New, StatusID.InProgress]:
6565
continue
6666

67+
if finding.status_code in ["PASS", "MANUAL", "MUTED"]:
68+
# These are status codes set by Prowler
69+
continue
70+
6771
if finding.activity_id not in [ActivityID.Create, ActivityID.Update]:
6872
continue
6973

@@ -142,6 +146,8 @@ def get_origins(finding: DetectionFinding) -> list[Origin]:
142146
def get_description(finding: DetectionFinding) -> str:
143147
description = finding.finding_info.desc
144148

149+
if finding.status_code and finding.status_code != "FAIL":
150+
description += f"\n\n**Status code:** {finding.status_code}"
145151
if finding.status_detail:
146152
description += f"\n\n**Status detail:** {finding.status_detail}"
147153
if finding.risk_details:

‎backend/application/import_observations/services/import_observations.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -765,6 +765,9 @@ def _get_initial_status(product: Product) -> str:
765765

766766

767767
def _get_github_issue_id(observation: Observation) -> Optional[str]:
768+
if not observation.vulnerability_id:
769+
return None
770+
768771
github_pat = os.getenv("GITHUB_ISSUES_PAT")
769772
if not github_pat:
770773
return None

‎backend/unittests/import_observations/parsers/ocsf/files/prowler_kubernetes.ocsf.json‎

Lines changed: 184 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,188 @@
11
[
22
{
3-
"message": "Pod cert-manager does not use HostPorts.",
3+
"message": "Pod cert-manager does not use HostPorts. FAIL",
4+
"metadata": {
5+
"event_code": "core_minimize_admission_hostport_containers",
6+
"product": {
7+
"name": "Prowler",
8+
"uid": "prowler",
9+
"vendor_name": "Prowler",
10+
"version": "5.16.1"
11+
},
12+
"profiles": [
13+
"container",
14+
"datetime"
15+
],
16+
"version": "1.5.0"
17+
},
18+
"severity_id": 4,
19+
"severity": "High",
20+
"status": "New",
21+
"status_code": "FAIL",
22+
"status_detail": "Pod cert-manager does not use HostPorts.",
23+
"status_id": 1,
24+
"unmapped": {
25+
"related_url": "https://kubernetes.io/docs/concepts/security/pod-security-standards/",
26+
"categories": [
27+
"internet-exposed"
28+
],
29+
"depends_on": [],
30+
"related_to": [],
31+
"additional_urls": [],
32+
"notes": "Carefully evaluate the need for HostPorts in container configurations and prefer network policies for secure communication.",
33+
"compliance": {
34+
"PCI-4.0": [
35+
"1.2.5.17",
36+
"1.2.8.13",
37+
"1.2.8.16",
38+
"1.2.8.20",
39+
"1.2.8.28",
40+
"1.2.8.30",
41+
"1.2.8.41",
42+
"1.3.1.8",
43+
"1.3.1.29",
44+
"1.3.1.34",
45+
"1.3.2.18",
46+
"1.3.2.28",
47+
"1.3.2.45",
48+
"1.4.2.26",
49+
"1.4.2.43",
50+
"1.4.4.7",
51+
"1.5.1.16",
52+
"1.5.1.32",
53+
"1.5.1.40",
54+
"10.3.2.18",
55+
"10.3.2.19",
56+
"11.5.1.1.1",
57+
"2.2.5.17",
58+
"3.5.1.3.6",
59+
"3.5.1.3.14",
60+
"3.5.1.3.20",
61+
"3.5.1.3.23",
62+
"A1.1.3.26",
63+
"A1.1.3.40",
64+
"A3.4.1.8",
65+
"A3.4.1.18"
66+
],
67+
"CIS-1.11.1": [
68+
"5.2.13"
69+
],
70+
"ProwlerThreatScore-1.0": [
71+
"2.1.2"
72+
],
73+
"CIS-1.10": [
74+
"5.2.13"
75+
],
76+
"CIS-1.8": [
77+
"5.2.13"
78+
]
79+
}
80+
},
81+
"activity_name": "Create",
82+
"activity_id": 1,
83+
"finding_info": {
84+
"created_time": 1768388905,
85+
"created_time_dt": "2026-01-14T11:08:25.883259",
86+
"desc": "This check ensures that Kubernetes clusters are configured to minimize the admission of containers that require the use of HostPorts. This helps maintain network policy controls and reduce security risks.",
87+
"title": "Minimize the admission of containers which use HostPorts",
88+
"types": [],
89+
"uid": "prowler-kubernetes-core_minimize_admission_hostport_containers-cluster_node-namespace: cert-manager-cert-manager"
90+
},
91+
"resources": [
92+
{
93+
"data": {
94+
"details": "",
95+
"metadata": {
96+
"name": "cert-manager",
97+
"uid": "aa8f6baf-1b52-4023-adca-4bef65a59e51",
98+
"namespace": "cert-manager",
99+
"labels": {
100+
"app": "cert-manager",
101+
"app.kubernetes.io/component": "controller",
102+
"app.kubernetes.io/instance": "cert-manager",
103+
"app.kubernetes.io/managed-by": "Helm",
104+
"app.kubernetes.io/name": "cert-manager",
105+
"app.kubernetes.io/version": "v1.7.0",
106+
"helm.sh/chart": "cert-manager-v1.7.0",
107+
"pod-template-hash": "67644fb9d8"
108+
},
109+
"annotations": {
110+
"prometheus.io/path": "/metrics",
111+
"prometheus.io/port": "9402",
112+
"prometheus.io/scrape": "true"
113+
},
114+
"node_name": "cluster_node-jlze6bf4fi",
115+
"service_account": "cert-manager",
116+
"status_phase": "Running",
117+
"pod_ip": "242.59.13.70",
118+
"host_ip": "109.0.85.203",
119+
"host_pid": null,
120+
"host_ipc": null,
121+
"host_network": null,
122+
"security_context": {
123+
"app_armor_profile": null,
124+
"fs_group": null,
125+
"fs_group_change_policy": null,
126+
"run_as_group": null,
127+
"run_as_non_root": true,
128+
"run_as_user": null,
129+
"se_linux_change_policy": null,
130+
"se_linux_options": null,
131+
"seccomp_profile": null,
132+
"supplemental_groups": null,
133+
"supplemental_groups_policy": null,
134+
"sysctls": null,
135+
"windows_options": null
136+
},
137+
"containers": {
138+
"cert-manager": {
139+
"name": "cert-manager",
140+
"image": "quay.io/jetstack/cert-manager-controller@sha256:d6d12274f4b9c9c9cae2bcdc837744006d5f301c1dfa3e50f4a67d08f3bf9589",
141+
"command": null,
142+
"ports": [
143+
{
144+
"containerPort": 1234
145+
}
146+
],
147+
"env": [
148+
{
149+
"name": "POD_NAMESPACE",
150+
"value": null
151+
}
152+
],
153+
"security_context": {}
154+
}
155+
}
156+
}
157+
},
158+
"group": {
159+
"name": "core"
160+
},
161+
"labels": [],
162+
"name": "cert-manager",
163+
"namespace": "cert-manager-namespace",
164+
"type": "KubernetesPod",
165+
"uid": "aa8f6baf-1b52-4023-adca-4bef65a59e51"
166+
}
167+
],
168+
"category_name": "Findings",
169+
"class_name": "Detection Finding",
170+
"remediation": {
171+
"desc": "Limit the use of HostPorts in Kubernetes containers to maintain network security.",
172+
"references": [
173+
"https://kubernetes.io/docs/concepts/security/pod-security-standards/"
174+
]
175+
},
176+
"risk_details": "Permitting containers with HostPorts can bypass network policy controls, increasing the risk of unauthorized network access.",
177+
"time": 1768388905,
178+
"time_dt": "2026-01-14T11:08:25.883259",
179+
"type_uid": 200401,
180+
"type_name": "Detection Finding: Create",
181+
"category_uid": 2,
182+
"class_uid": 2004
183+
},
184+
{
185+
"message": "Pod cert-manager does not use HostPorts. PASS",
4186
"metadata": {
5187
"event_code": "core_minimize_admission_hostport_containers",
6188
"product": {
@@ -181,4 +363,4 @@
181363
"category_uid": 2,
182364
"class_uid": 2004
183365
}
184-
]
366+
]

0 commit comments

Comments
 (0)