Understanding how often findings are sent to security hub?

[qadri99-max]

1 - I want to understand a bit more how findings are sent to the Security Hub. For my scans I can see a log entry that says: '0 findings sent to AWS Security Hub'.

Does that mean that if the same findings are found, Prowler does not send the same finding again to Security Hub?

Under Security Hub, I can see findings that says Updated at: 7 days ago

2 - Can you please explain what does this mean:
"31m30.91% (484) Failed [0m]....."

thanks

[jfagoagas]

Hello @qadri99-max again, as with the other discussion, I apologise for the late notice.

Regarding your questions:

1. By default all findings are sent to AWS Security Hub if you input the flag to enable it. Are you doing it? Also by default we archive the previous findings if they are not present in the new Scan to reduce the results since if they are not present means that those findings are no longer an issue.

What version of Prowler are you using?

3. These characters are the colors used in the CLI which are not rendered by AWS CloudWatch in their logs. There is a workaround here to remove those values prowler <...> | sed -r "s/\x1B\[([0-9]{1,3}(;[0-9]{1,2};?)?)?[mGK]//g".. By the way we have a feature request to remove the color output from the CLI Add flag to disable color output #5294 so you can keep track of it there.

Thanks for using Prowler 🚀