Skip to content

IT-4081: suppress cis-aws-foundations-benchmark/v/1.4.0/3.9 since we use GuardDuty to monitor flow logs #1319

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
brucehoff wants to merge 7 commits into from
Closed

IT-4081: suppress cis-aws-foundations-benchmark/v/1.4.0/3.9 since we use GuardDuty to monitor flow logs #1319

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c55cf2d
Run nessus script installation daily, not hourly
brucehoff Nov 7, 2024
da1dfef
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Nov 14, 2024
5b04ff6
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Nov 16, 2024
3b977ee
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Dec 18, 2024
7eba7ec
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Dec 19, 2024
2a39c53
Merge branch 'master' of https://github.com/Sage-Bionetworks-IT/organ…
brucehoff Jan 9, 2025
4af98fd
IT-4081: suppress cis-aws-foundations-benchmark/v/1.4.0/3.9 since we …
brucehoff Jan 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions org-formation/075-security-hub/security-hub-suppress-infra.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -377,6 +377,8 @@ Resources:
- 'arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/4.1'
- 'arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/4.2'
- 'cis-aws-foundations-benchmark/v/1.4.0/3.5' # (IT-3619) "3.5 Ensure AWS Config is enabled in all regions"
# suppress cis-aws-foundations-benchmark/v/1.4.0/3.9 since we use GuardDuty to monitor flow logs:
- 'cis-aws-foundations-benchmark/v/1.4.0/3.9'
Copy link
Member

@ConsoleCatzirl ConsoleCatzirl Jan 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My understanding is that guard duty is good for detection but not for investigation so I think we should enforce this finding at least for production accounts, but I'm ok with suppressing it in non-prod accounts

Copy link
Contributor

@zaro0508 zaro0508 Jan 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it would probably be beneficial if you could add a reference to issue IT-4081 and provide justification for this suppression in the issue.

Workflow:
Status:
- NEW
Expand Down
Loading