How to download Security Hub csv file containing 21+ records

0

Hi guys,

I'm trying to download a Security Hub csv file containing 21+ records. Are there any ways to realize that?

By default, the number of max records is 20. If I want to check 200 records for a certain vulnerability (e.g. s3.x), I have to do that 20 times! Bothering to me.

Thank you for your cooperation!

Karl

已提問 4 個月前檢視次數 234 次
2 個答案
1

I would look to use AWS cli with pagination so that you can pull all results to a file.

https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/get-findings.html

profile picture
專家
已回答 4 個月前
profile picture
專家
已審閱 4 個月前
  • Hello.
    I think you can solve it by implementing the architecture described in the blog below or by writing a script using the AWS CLI. https://aws.amazon.com/jp/blogs/security/how-to-export-aws-security-hub-findings-to-csv-format/
    Using the AWS CLI, you can use the following command to search for SecurityHub detection results whose first detection date is within 30 days and whose severity is CRITICAL or HIGH and ACTIVE, and to output them as CSV.

    DATE=$(date --date="-30 days" +%Y-%m-%d);aws securityhub get-findings --filters '{"SeverityLabel":[{"Value": "CRITICAL","Comparison":"EQUALS"},{"Value":"HIGH","Comparison":"EQUALS"}],"RecordState": [{"Value": "ACTIVE","Comparison":"EQUALS"}]}' --query "Findings[?FirstObservedAt>=\`$DATE\`]" | jq -r '.[] | [.ProductName, .Region, .GeneratorId, .AwsAccountId, .Compliance.Status, .Severity.Label, .Resources[0].Region, .Resources[0].Id, .UpdatedAt, .Title, .Description] | @csv' > securityhub-findings.csv
    
  • Thanks for the additional info Riku. Nice blog

0

Gary, Riku, Thank you for your comments! I will give it a try!

已回答 4 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南