How to download Security Hub csv file containing 21+ records

0

Hi guys,

I'm trying to download a Security Hub csv file containing 21+ records. Are there any ways to realize that?

By default, the number of max records is 20. If I want to check 200 records for a certain vulnerability (e.g. s3.x), I have to do that 20 times! Bothering to me.

Thank you for your cooperation!

Karl

posta 4 mesi fa225 visualizzazioni
2 Risposte
1

I would look to use AWS cli with pagination so that you can pull all results to a file.

https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/get-findings.html

profile picture
ESPERTO
con risposta 4 mesi fa
profile picture
ESPERTO
verificato 4 mesi fa
  • Hello.
    I think you can solve it by implementing the architecture described in the blog below or by writing a script using the AWS CLI. https://aws.amazon.com/jp/blogs/security/how-to-export-aws-security-hub-findings-to-csv-format/
    Using the AWS CLI, you can use the following command to search for SecurityHub detection results whose first detection date is within 30 days and whose severity is CRITICAL or HIGH and ACTIVE, and to output them as CSV.

    DATE=$(date --date="-30 days" +%Y-%m-%d);aws securityhub get-findings --filters '{"SeverityLabel":[{"Value": "CRITICAL","Comparison":"EQUALS"},{"Value":"HIGH","Comparison":"EQUALS"}],"RecordState": [{"Value": "ACTIVE","Comparison":"EQUALS"}]}' --query "Findings[?FirstObservedAt>=\`$DATE\`]" | jq -r '.[] | [.ProductName, .Region, .GeneratorId, .AwsAccountId, .Compliance.Status, .Severity.Label, .Resources[0].Region, .Resources[0].Id, .UpdatedAt, .Title, .Description] | @csv' > securityhub-findings.csv
    
  • Thanks for the additional info Riku. Nice blog

0

Gary, Riku, Thank you for your comments! I will give it a try!

con risposta 4 mesi fa

Accesso non effettuato. Accedi per postare una risposta.

Una buona risposta soddisfa chiaramente la domanda, fornisce un feedback costruttivo e incoraggia la crescita professionale del richiedente.

Linee guida per rispondere alle domande