Severity Scoring and Informational results?

[JArmandoG]

Hi, my question is about 2 markers of Prowler's results: CHECK_SEVERITY and CHECK_RESULT

What's the rationale for scoring (Critical, high, medium, etc.), or what is this based on?

Also, why do I have results that are "INFO", but Critical/High, instead of "FAIL"?

[jfagoagas]

HI @JArmandoG, I'm going to answer your questions here below.

Hi, my question is about 2 markers of Prowler's results: CHECK_SEVERITY and CHECK_RESULT

What's the rationale for scoring (Critical, high, medium, etc.), or what is this based on?

We use a combination of the CVSS 3.0 (https://www.first.org/cvss/calculator/3.0) and the context of the check inside AWS to set the severity.

Also, why do I have results that are "INFO", but Critical/High, instead of "FAIL"?

This is because the check has three different status: INFO, PASS and FAIL. The INFO ones are used to show errors/information in the case Prowler cannot determine if the check is a PASS or a FAIL. For that reason, e.g. if you don't have permissions to call AWS using some check with critical severity, Prowler is going to generate INFO messages with the related errors.

I hope I've answered your question. If you need more details please let us know.

Thanks!