Include OS type (Linux/Windows) in Cloud Custodian's EC2 findings for AWS Security Hub

Viewed 49

We have a Cloud Custodian policy for AWS EC2 that posts its findings to AWS Security Hub.

Is there a way to include the EC2 OS type (Linux/Windows) in the details that are sent to Security Hub by Cloud Custodian?

We're pushing Security Hub findings to Sumo Logic & need to query these findings by OS.

Here's our policy:

policies:
- name: ec2-report-compliant-base-linux
  resource: ec2
  mode:
    type: periodic
    schedule: rate(1 hour)
  filters:
  - PlatformDetails: Linux/UNIX
  - type: value
    key: ImageId
    op: in
    value:
    - ami-0123456789
    - ami-1234567890
    - ami-2345678901
  actions:
  - type: post-finding
    confidence: 100
    severity: 0
    severity_normalized: 0
    compliance_status: PASSED
    title: Compliant AMI
    types:
    - "Software and Configuration Checks/AWS Security Best Practices/Compliant Linux AMI"

Although it's technically possible to query by the "type" in this example to get Linux instances...

%Type = Software and Configuration Checks/AWS Security Best Practices/Compliant Linux AMI

...there are other similar use cases we have, where we need to query by OS type directly in Sumo Logic.

So, is there a way to include OS type in the findings posted by Cloud Custodian to Security Hub?

0 Answers
Related