feat: updated implementation to take only active findings

someengineering · Dec 9, 2024 · e3b6959 · e3b6959
1 parent d61bb36
commit e3b6959
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 3 deletions.
diff --git a/plugins/aws/fix_plugin_aws/resource/guardduty.py b/plugins/aws/fix_plugin_aws/resource/guardduty.py
@@ -699,7 +699,9 @@ def add_finding(
                     "FindingIds",
                     expected_errors=["BadRequestException"],
                     DetectorId=detector_id,
-                    FindingCriteria={"Criterion": {"accountId": {"Eq": [builder.account.id]}}},
+                    FindingCriteria={
+                        "Criterion": {"accountId": {"Eq": [builder.account.id]}, "service.archived": {"Eq": ["false"]}},
+                    },
                 ): detector_id
                 for detector_id in detector_ids
             }

diff --git a/plugins/aws/fix_plugin_aws/resource/inspector.py b/plugins/aws/fix_plugin_aws/resource/inspector.py
@@ -151,7 +151,10 @@ def add_finding(
                 action="list-findings",
                 result_name="findings",
                 expected_errors=["AccessDeniedException"],
-                filterCriteria={"awsAccountId": [{"comparison": "EQUALS", "value": f"{builder.account.id}"}]},
+                filterCriteria={
+                    "awsAccountId": [{"comparison": "EQUALS", "value": f"{builder.account.id}"}],
+                    "findingStatus": [{"comparison": "EQUALS", "value": "ACTIVE"}],
+                },
             ):
                 if finding := AwsInspectorFinding.from_api(item, builder):
                     for fr in finding.finding_resources or []:

diff --git a/plugins/aws/fix_plugin_aws/resource/ssm.py b/plugins/aws/fix_plugin_aws/resource/ssm.py
@@ -384,7 +384,7 @@ class AwsSSMResourceCompliance(AwsResource, PhantomBaseResource):
     compliance_details: Optional[Dict[str, str]] = field(default=None, metadata={"description": "A Key:Value tag combination for the compliance item."})  # fmt: skip
 
     def parse_finding(self) -> Finding:
-        title = self.title or ""
+        title = self.title or (self.compliance_details or {}).get("DocumentName") or ""
         severity = SEVERITY_MAPPING.get(self.severity or "", Severity.medium)
         details = self.compliance_details
         if self.execution_summary: