How to download Security Hub csv file containing 21+ records

0

Hi guys,

I'm trying to download a Security Hub csv file containing 21+ records. Are there any ways to realize that?

By default, the number of max records is 20. If I want to check 200 records for a certain vulnerability (e.g. s3.x), I have to do that 20 times! Bothering to me.

Thank you for your cooperation!

Karl

質問済み 4ヶ月前225ビュー
2回答
1

I would look to use AWS cli with pagination so that you can pull all results to a file.

https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/get-findings.html

profile picture
エキスパート
回答済み 4ヶ月前
profile picture
エキスパート
レビュー済み 4ヶ月前
  • Hello.
    I think you can solve it by implementing the architecture described in the blog below or by writing a script using the AWS CLI. https://aws.amazon.com/jp/blogs/security/how-to-export-aws-security-hub-findings-to-csv-format/
    Using the AWS CLI, you can use the following command to search for SecurityHub detection results whose first detection date is within 30 days and whose severity is CRITICAL or HIGH and ACTIVE, and to output them as CSV.

    DATE=$(date --date="-30 days" +%Y-%m-%d);aws securityhub get-findings --filters '{"SeverityLabel":[{"Value": "CRITICAL","Comparison":"EQUALS"},{"Value":"HIGH","Comparison":"EQUALS"}],"RecordState": [{"Value": "ACTIVE","Comparison":"EQUALS"}]}' --query "Findings[?FirstObservedAt>=\`$DATE\`]" | jq -r '.[] | [.ProductName, .Region, .GeneratorId, .AwsAccountId, .Compliance.Status, .Severity.Label, .Resources[0].Region, .Resources[0].Id, .UpdatedAt, .Title, .Description] | @csv' > securityhub-findings.csv
    
  • Thanks for the additional info Riku. Nice blog

0

Gary, Riku, Thank you for your comments! I will give it a try!

回答済み 4ヶ月前

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ