{"id":22327466,"url":"https://github.com/rewindio/scheduled_security_hub_prowler_findings","last_synced_at":"2025-07-29T18:31:08.617Z","repository":{"id":53188019,"uuid":"351829447","full_name":"rewindio/scheduled_security_hub_prowler_findings","owner":"rewindio","description":"YAML template which deploys a stack that runs scheduled ECS (Fargate) tasks that push Prowler findings to Security Hub.","archived":false,"fork":false,"pushed_at":"2021-04-01T22:42:17.000Z","size":25,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":19,"default_branch":"main","last_synced_at":"2023-03-02T22:56:13.025Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rewindio.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-03-26T15:34:08.000Z","updated_at":"2021-10-18T19:43:02.000Z","dependencies_parsed_at":"2022-09-14T14:10:36.357Z","dependency_job_id":null,"html_url":"https://github.com/rewindio/scheduled_security_hub_prowler_findings","commit_stats":null,"previous_names":[],"tags_count":null,"template":null,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rewindio%2Fscheduled_security_hub_prowler_findings","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rewindio%2Fscheduled_security_hub_prowler_findings/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rewindio%2Fscheduled_security_hub_prowler_findings/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rewindio%2Fscheduled_security_hub_prowler_findings/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rewindio","download_url":"https://codeload.github.com/rewindio/scheduled_security_hub_prowler_findings/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":228034990,"owners_count":17859245,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-04T03:09:31.857Z","updated_at":"2024-12-04T03:09:32.421Z","avatar_url":"https://github.com/rewindio.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# scheduled_security_hub_prowler_findings\n\n- [Purpose](#purpose)\n- [Deploying to AWS](#deploying-to-aws)\n  - [Requirements](#requirements)\n  - [Parameters](#parameters)\n  - [Deployment](#deployment)\n\n## Purpose\n\nThis YAML template deploys cross-referenced stacks which allows for scheduled tasks that run Prowler (https://github.com/toniblyx/prowler) on a regular basis in any intended region(s). The Prowler findings get pushed to AWS Security Hub to allow for a comprehensive view of the findings. The prowler.yml template contains all the common resources and must be deployed first and only needs to be deployed once. The event-rules.yml template contains the event rule resource which runs scheduled Prowler tasks in a given region and is dependent on outputs from the prowler.yml stack. Thus, event-rules.yml must be deployed after prowler.yml and can be deployed as many times as there are regions you intend to run scheduled Prowler tasks in.\n\n## Deploying to AWS\n\nThe following steps outline how to deploy this stack to AWS.\n\n### Requirements\n\nThe following requirements must be satisfied prior to deploying this stack:\n- Security Hub and Prowler integration enabled in us-east-1 (this is a must as Prowler pushes non-region specific findings to us-east-1)\n- Security Hub and Prowler integration (in Security Hub) enabled in all of the regions you want to push Prowler findings\n- An existing ECS cluster for the tasks to run in (this stack does not create an ECS cluster)\n- An existing VPC to run the ECS tasks from\n- An existing public subnet to run the ECS tasks from\n- A clone of this repository on your local machine\n\n### Parameters\n\nThe following parameters are the required parameters for deploying the **prowler.yml** YAML template and have to be defined upon deployment:\n- **EcsClusterName** - The name of the ECS cluster to be used\n- **ScheduleRate** - The rate at which the Prowler tasks will run (e.g. daily, weekly, monthly. Default is weekly). This must follow the syntax of a schedule expression (https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-schedule-expressions.html)\n- **Subnets** - The subnet ID(s) to be used by the Prowler tasks\n- **VpcID** - The VPC ID to be used by the Prowler tasks\n\nThe following parameter is required for deploying the **event-rules.yml** YAML template and has to be defined upon deployment:\n- **ProwlerTargetRegion** - The AWS region to run scheduled Prowler tasks in\n\n### Deployment\n\nBecause these are cross-referenced stacks, the event-rules.yml stacks are dependent on outputs from the prowler.yml stack. Therefore, prowler.yml must be deployed first and then event-rules.yml can be deployed as many times as intended afterwards.\n\nDeploying the prowler.yml stack from the YAML file requires the use of CloudFormation. There are two options for deploying:\n1. You can deploy this via the AWS CloudFormation console. This would be deployed via creating a stack with new resources (standard) and providing the parameters required.\n2. You can deploy this via the AWS CLI. Use the following command template to run the appropriate CLI command from the directory of the copy of this repository.\n```\naws cloudformation deploy \\\n        --template-file ./prowler.yml \\\n        --capabilities CAPABILITY_IAM \\\n        --parameter-overrides \\\n            EcsClusterName={the ECS cluster name}  \\\n            ScheduleRate={the intended schedule rate}\\\n            Subnets={the intended subnet} \\\n            VpcID={the intended VPC} \\\n        --stack-name {the intended name for the stack (can be anything)} \\\n        --profile {the AWS profile to use} \\\n        --region {the AWS region to deploy to}\n```\n\nThe following is an example command for deploying via AWS CLI:\n\n```\naws cloudformation deploy \\\n        --template-file ./prowler.yml \\\n        --capabilities CAPABILITY_IAM \\\n        --parameter-overrides \\\n            ECSClusterName=ProwlerCluster \\\n            scheduleRate=\"rate(7 days)\" \\\n            subnets=subnet-1a2b3c4b \\\n            vpcID=vpc-1a2b3c4d \\\n        --stack-name ScheduledProwler \\\n        --profile staging \\\n        --region us-east-1\n```\n\nOnce prowler.yml has been deployed, you can now deploy event-rules.yml as many times as there are regions you want to run scheduled Prowler tasks. For example, if you want to have scheduled Prowler tasks in us-east-1, us-east-2, us-west-1, and us-west-2, you would want to deploy event-rules.yml 4 times.\n\nDeploying the event-rules.yml stack from the YAML file requires the use of CloudFormation. There are two options for deploying:\n1. You can deploy this via the AWS CloudFormation console. This would be deployed via creating a stack with new resources (standard) and providing the parameters required.\n2. You can deploy this via the AWS CLI. Use the following command template to run the appropriate CLI command from the directory of the copy of this repository.\n```\naws cloudformation deploy \\\n        --template-file ./event-rules.yml \\\n        --capabilities CAPABILITY_IAM \\\n        --parameter-overrides \\\n            ProwlerTargetRegion={the intended AWS region}\\\n        --stack-name {the intended name for the stack (can be anything)} \\\n        --profile {the AWS profile to use} \\\n        --region {the AWS region to deploy to}\n```\n\nThe following is an example command for deploying via AWS CLI:\n\n```\naws cloudformation deploy \\\n        --template-file ./event-rules.yml \\\n        --capabilities CAPABILITY_IAM \\\n        --parameter-overrides \\\n            ProwlerTargetRegion=us-east-1\n        --stack-name ScheduledProwlerUsEast1 \\\n        --profile staging \\\n        --region us-east-1\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frewindio%2Fscheduled_security_hub_prowler_findings","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frewindio%2Fscheduled_security_hub_prowler_findings","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frewindio%2Fscheduled_security_hub_prowler_findings/lists"}