How to download Security Hub csv file containing 21+ records

0

Hi guys,

I'm trying to download a Security Hub csv file containing 21+ records. Are there any ways to realize that?

By default, the number of max records is 20. If I want to check 200 records for a certain vulnerability (e.g. s3.x), I have to do that 20 times! Bothering to me.

Thank you for your cooperation!

Karl

已提问 4 个月前222 查看次数
2 回答
1

I would look to use AWS cli with pagination so that you can pull all results to a file.

https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/get-findings.html

profile picture
专家
已回答 4 个月前
profile picture
专家
已审核 4 个月前
  • Hello.
    I think you can solve it by implementing the architecture described in the blog below or by writing a script using the AWS CLI. https://aws.amazon.com/jp/blogs/security/how-to-export-aws-security-hub-findings-to-csv-format/
    Using the AWS CLI, you can use the following command to search for SecurityHub detection results whose first detection date is within 30 days and whose severity is CRITICAL or HIGH and ACTIVE, and to output them as CSV.

    DATE=$(date --date="-30 days" +%Y-%m-%d);aws securityhub get-findings --filters '{"SeverityLabel":[{"Value": "CRITICAL","Comparison":"EQUALS"},{"Value":"HIGH","Comparison":"EQUALS"}],"RecordState": [{"Value": "ACTIVE","Comparison":"EQUALS"}]}' --query "Findings[?FirstObservedAt>=\`$DATE\`]" | jq -r '.[] | [.ProductName, .Region, .GeneratorId, .AwsAccountId, .Compliance.Status, .Severity.Label, .Resources[0].Region, .Resources[0].Id, .UpdatedAt, .Title, .Description] | @csv' > securityhub-findings.csv
    
  • Thanks for the additional info Riku. Nice blog

0

Gary, Riku, Thank you for your comments! I will give it a try!

已回答 4 个月前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则