Skip to content

Commit 2c942c6

Browse files
StefanFlStefanFl
committed
fix: OCSF parser
1 parent 9987ebc commit 2c942c6

File tree

2 files changed

+190
-2
lines changed

2 files changed

+190
-2
lines changed

‎backend/application/import_observations/parsers/ocsf/parser.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,10 @@ def get_observations(self, data: list, product: Product, branch: Optional[Branch
6464
if finding.status_id not in [StatusID.New, StatusID.InProgress]:
6565
continue
6666

67+
if finding.status_code in ["PASS", "MANUAL", "MUTED"]:
68+
# These are status codes set by Prowler
69+
continue
70+
6771
if finding.activity_id not in [ActivityID.Create, ActivityID.Update]:
6872
continue
6973

@@ -142,6 +146,8 @@ def get_origins(finding: DetectionFinding) -> list[Origin]:
142146
def get_description(finding: DetectionFinding) -> str:
143147
description = finding.finding_info.desc
144148

149+
if finding.status_code and finding.status_code != "FAIL":
150+
description += f"\n\n**Status code:** {finding.status_code}"
145151
if finding.status_detail:
146152
description += f"\n\n**Status detail:** {finding.status_detail}"
147153
if finding.risk_details:

‎backend/unittests/import_observations/parsers/ocsf/files/prowler_kubernetes.ocsf.json‎

Lines changed: 184 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,188 @@
11
[
22
{
3-
"message": "Pod cert-manager does not use HostPorts.",
3+
"message": "Pod cert-manager does not use HostPorts. FAIL",
4+
"metadata": {
5+
"event_code": "core_minimize_admission_hostport_containers",
6+
"product": {
7+
"name": "Prowler",
8+
"uid": "prowler",
9+
"vendor_name": "Prowler",
10+
"version": "5.16.1"
11+
},
12+
"profiles": [
13+
"container",
14+
"datetime"
15+
],
16+
"version": "1.5.0"
17+
},
18+
"severity_id": 4,
19+
"severity": "High",
20+
"status": "New",
21+
"status_code": "FAIL",
22+
"status_detail": "Pod cert-manager does not use HostPorts.",
23+
"status_id": 1,
24+
"unmapped": {
25+
"related_url": "https://kubernetes.io/docs/concepts/security/pod-security-standards/",
26+
"categories": [
27+
"internet-exposed"
28+
],
29+
"depends_on": [],
30+
"related_to": [],
31+
"additional_urls": [],
32+
"notes": "Carefully evaluate the need for HostPorts in container configurations and prefer network policies for secure communication.",
33+
"compliance": {
34+
"PCI-4.0": [
35+
"1.2.5.17",
36+
"1.2.8.13",
37+
"1.2.8.16",
38+
"1.2.8.20",
39+
"1.2.8.28",
40+
"1.2.8.30",
41+
"1.2.8.41",
42+
"1.3.1.8",
43+
"1.3.1.29",
44+
"1.3.1.34",
45+
"1.3.2.18",
46+
"1.3.2.28",
47+
"1.3.2.45",
48+
"1.4.2.26",
49+
"1.4.2.43",
50+
"1.4.4.7",
51+
"1.5.1.16",
52+
"1.5.1.32",
53+
"1.5.1.40",
54+
"10.3.2.18",
55+
"10.3.2.19",
56+
"11.5.1.1.1",
57+
"2.2.5.17",
58+
"3.5.1.3.6",
59+
"3.5.1.3.14",
60+
"3.5.1.3.20",
61+
"3.5.1.3.23",
62+
"A1.1.3.26",
63+
"A1.1.3.40",
64+
"A3.4.1.8",
65+
"A3.4.1.18"
66+
],
67+
"CIS-1.11.1": [
68+
"5.2.13"
69+
],
70+
"ProwlerThreatScore-1.0": [
71+
"2.1.2"
72+
],
73+
"CIS-1.10": [
74+
"5.2.13"
75+
],
76+
"CIS-1.8": [
77+
"5.2.13"
78+
]
79+
}
80+
},
81+
"activity_name": "Create",
82+
"activity_id": 1,
83+
"finding_info": {
84+
"created_time": 1768388905,
85+
"created_time_dt": "2026-01-14T11:08:25.883259",
86+
"desc": "This check ensures that Kubernetes clusters are configured to minimize the admission of containers that require the use of HostPorts. This helps maintain network policy controls and reduce security risks.",
87+
"title": "Minimize the admission of containers which use HostPorts",
88+
"types": [],
89+
"uid": "prowler-kubernetes-core_minimize_admission_hostport_containers-cluster_node-namespace: cert-manager-cert-manager"
90+
},
91+
"resources": [
92+
{
93+
"data": {
94+
"details": "",
95+
"metadata": {
96+
"name": "cert-manager",
97+
"uid": "aa8f6baf-1b52-4023-adca-4bef65a59e51",
98+
"namespace": "cert-manager",
99+
"labels": {
100+
"app": "cert-manager",
101+
"app.kubernetes.io/component": "controller",
102+
"app.kubernetes.io/instance": "cert-manager",
103+
"app.kubernetes.io/managed-by": "Helm",
104+
"app.kubernetes.io/name": "cert-manager",
105+
"app.kubernetes.io/version": "v1.7.0",
106+
"helm.sh/chart": "cert-manager-v1.7.0",
107+
"pod-template-hash": "67644fb9d8"
108+
},
109+
"annotations": {
110+
"prometheus.io/path": "/metrics",
111+
"prometheus.io/port": "9402",
112+
"prometheus.io/scrape": "true"
113+
},
114+
"node_name": "cluster_node-jlze6bf4fi",
115+
"service_account": "cert-manager",
116+
"status_phase": "Running",
117+
"pod_ip": "242.59.13.70",
118+
"host_ip": "109.0.85.203",
119+
"host_pid": null,
120+
"host_ipc": null,
121+
"host_network": null,
122+
"security_context": {
123+
"app_armor_profile": null,
124+
"fs_group": null,
125+
"fs_group_change_policy": null,
126+
"run_as_group": null,
127+
"run_as_non_root": true,
128+
"run_as_user": null,
129+
"se_linux_change_policy": null,
130+
"se_linux_options": null,
131+
"seccomp_profile": null,
132+
"supplemental_groups": null,
133+
"supplemental_groups_policy": null,
134+
"sysctls": null,
135+
"windows_options": null
136+
},
137+
"containers": {
138+
"cert-manager": {
139+
"name": "cert-manager",
140+
"image": "quay.io/jetstack/cert-manager-controller@sha256:d6d12274f4b9c9c9cae2bcdc837744006d5f301c1dfa3e50f4a67d08f3bf9589",
141+
"command": null,
142+
"ports": [
143+
{
144+
"containerPort": 1234
145+
}
146+
],
147+
"env": [
148+
{
149+
"name": "POD_NAMESPACE",
150+
"value": null
151+
}
152+
],
153+
"security_context": {}
154+
}
155+
}
156+
}
157+
},
158+
"group": {
159+
"name": "core"
160+
},
161+
"labels": [],
162+
"name": "cert-manager",
163+
"namespace": "cert-manager-namespace",
164+
"type": "KubernetesPod",
165+
"uid": "aa8f6baf-1b52-4023-adca-4bef65a59e51"
166+
}
167+
],
168+
"category_name": "Findings",
169+
"class_name": "Detection Finding",
170+
"remediation": {
171+
"desc": "Limit the use of HostPorts in Kubernetes containers to maintain network security.",
172+
"references": [
173+
"https://kubernetes.io/docs/concepts/security/pod-security-standards/"
174+
]
175+
},
176+
"risk_details": "Permitting containers with HostPorts can bypass network policy controls, increasing the risk of unauthorized network access.",
177+
"time": 1768388905,
178+
"time_dt": "2026-01-14T11:08:25.883259",
179+
"type_uid": 200401,
180+
"type_name": "Detection Finding: Create",
181+
"category_uid": 2,
182+
"class_uid": 2004
183+
},
184+
{
185+
"message": "Pod cert-manager does not use HostPorts. PASS",
4186
"metadata": {
5187
"event_code": "core_minimize_admission_hostport_containers",
6188
"product": {
@@ -181,4 +363,4 @@
181363
"category_uid": 2,
182364
"class_uid": 2004
183365
}
184-
]
366+
]

0 commit comments

Comments
 (0)