@mitre/hdf-converters 2.12.2 → 2.13.0

package/lib/src/asff-mapper/asff-mapper.js

@@ -1,4 +1,6 @@
 "use strict";
+// ASFF (AWS Security Finding Format) is intended as being another data exchange format to be used in displaying data within AWS SecurityHub - in this regard, it is analogous to HDF and Heimdall.
+// Like in every scenario where there is an open specification, people interpret the intent of each of the attributes in slightly different ways.  Consequently, while many products provide 'ASFF' output, providing a mapper back to HDF can be complicated.
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -15,15 +17,26 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ASFFResults = exports.ASFFMapper = exports.consolidate = exports.SpecialCasing = void 0;
+exports.ASFFResults = exports.ASFFMapper = exports.SpecialCasing = void 0;
+exports.consolidate = consolidate;
 const compare_versions_1 = require("compare-versions");
 const html_entities_1 = require("html-entities");
 const inspecjs_1 = require("inspecjs");
@@ -48,6 +61,7 @@ const IMPACT_MAPPING = new Map([
 ]);
 const SEVERITY_LABEL = 'Severity.Label';
 const COMPLIANCE_STATUS = 'Compliance.Status';
+// Sometimes certain ASFF file types require massaging in order to generate good HDF files.  These are the supported special cases and a catchall 'Default'.  'Default' files and non-special cased methods for otherwise special cased files do the pre-defined default behaviors when generating the HDF file.
 var SpecialCasing;
 (function (SpecialCasing) {
     SpecialCasing["CMSInSpec"] = "CMS Chef InSpec";
@@ -59,7 +73,8 @@ var SpecialCasing;
     SpecialCasing["Trivy"] = "Aqua Trivy";
     SpecialCasing["PreviouslyHDF"] = "MITRE SAF HDF2ASFF";
     SpecialCasing["Default"] = "Default";
-})(SpecialCasing = exports.SpecialCasing || (exports.SpecialCasing = {}));
+})(SpecialCasing || (exports.SpecialCasing = SpecialCasing = {}));
+// typically you can just look at the ProductArn field to get information on the product type but we also support some custom formats/products that require alternative means of identification
 function whichSpecialCase(finding) {
     const productArn = _.get(finding, 'ProductArn');
     if (_.get(finding, 'ProductName') === 'Default' &&
@@ -73,12 +88,12 @@ function whichSpecialCase(finding) {
         return SpecialCasing.GuardDuty;
     }
     else if (_.some(_.get(finding, 'FindingProviderFields.Types'), (type) => {
-        var _a, _b;
+        // 'type' should look like "MITRE/SAF/2.6.29-hdf2asff"
         if (!_.startsWith(type, 'MITRE/SAF/')) {
             return false;
         }
-        const version = (_b = (_a = type.split('/').pop()) === null || _a === void 0 ? void 0 : _a.split('-')[0]) !== null && _b !== void 0 ? _b : '';
-        return (0, compare_versions_1.validate)(version) && (0, compare_versions_1.compare)(version, '2.6.20', '>');
+        const version = type.split('/').pop()?.split('-')[0] ?? '';
+        return (0, compare_versions_1.validate)(version) && (0, compare_versions_1.compare)(version, '2.6.20', '>'); // older versions aren't supported by the 'PreviouslyHDF' specialcasing and instead use the default casing
     })) {
         return SpecialCasing.PreviouslyHDF;
     }
@@ -108,15 +123,15 @@ const SPECIAL_CASE_MAPPING = new Map([
     [SpecialCasing.SecurityHub, (0, case_security_hub_1.getSecurityHub)()],
     [SpecialCasing.Trivy, (0, case_trivy_1.getTrivy)()]
 ]);
+// If a special casing has a function override, then do the override, otherwise return the default value.  This is how the 'massaging' described above is implemented.
 function externalProductHandler(context, product, data, func, defaultVal) {
-    var _a;
     if (product !== SpecialCasing.Default &&
         _.has(SPECIAL_CASE_MAPPING.get(product), func)) {
         let keywords = {};
         if (context.supportingDocs.has(product)) {
             keywords = { ...context.supportingDocs.get(product) };
         }
-        return (_a = _.get(SPECIAL_CASE_MAPPING.get(product), func)) === null || _a === void 0 ? void 0 : _a.apply(context, [
+        return _.get(SPECIAL_CASE_MAPPING.get(product), func)?.apply(context, [
             data,
             keywords
         ]);
@@ -130,6 +145,7 @@ function externalProductHandler(context, product, data, func, defaultVal) {
         }
     }
 }
+// helper function to take all the controls that have the same id and turn them into results/subtests within an overarching control
 function handleIdGroup(context, idGroup) {
     const [id, data] = idGroup;
     const group = data.map((d) => d[0]);
@@ -162,7 +178,8 @@ function handleIdGroup(context, idGroup) {
             .filter((element, index, arr) => element &&
             element.data !== '' &&
             index ===
-                arr.findIndex((e) => e !== null && e !== undefined && e.data === element.data)),
+                arr.findIndex((e) => e !== null && e !== undefined && e.data === element.data) // https://stackoverflow.com/a/36744732/645647
+        ),
         refs: group
             .map((d) => d.refs)
             .flat()
@@ -186,7 +203,10 @@ function handleIdGroup(context, idGroup) {
         results: group.map((d) => d.results).flat()
     };
 }
+// consolidate the array of controls which were generated 1:1 with findings in order to have subfindings/results
+// the way it does this is to group by HDF id which by default is the ASFF GeneratorId field
 function consolidate(context, input, file) {
+    // Group Sub-findings by HDF ID
     const allFindings = _.get(file, 'Findings');
     if (input.length !== allFindings.length) {
         throw new Error('The number of generated controls should be the same as the number of findings while consolidating.');
@@ -197,7 +217,7 @@ function consolidate(context, input, file) {
     });
     return Object.entries(idGroups || {}).map((idGroup) => handleIdGroup(context, idGroup));
 }
-exports.consolidate = consolidate;
+// the schema specifies that the file should be `{ "Findings": [... findings array ...] }` but sometimes only the array or even a single finding is provided so this function corrects for those cases
 function wrapWithFindingsObject(output) {
     if (!_.has(output, 'Findings')) {
         if (Array.isArray(output)) {
@@ -209,6 +229,7 @@ function wrapWithFindingsObject(output) {
     }
     return output;
 }
+// some applications (like Prowler) give us new line seperated JSON objects (see JSON Lines or ndjson) but we need regular JSON
 function fixFileInput(asffJson) {
     let output = {};
     try {
@@ -224,276 +245,289 @@ function fixFileInput(asffJson) {
     return wrapWithFindingsObject(output);
 }
 class ASFFMapper extends base_converter_1.BaseConverter {
-    statusReason(finding) {
-        const statusReasons = _.get(finding, 'Compliance.StatusReasons');
-        if (statusReasons !== undefined &&
-            statusReasons !== null &&
-            _.isArray(statusReasons)) {
-            return statusReasons
-                .map((reason) => Object.entries(reason || {}).map(([key, value]) => {
-                return `${(0, html_entities_1.encode)(key)}: ${(0, html_entities_1.encode)(value)}`;
-            }))
-                .flat()
-                .join('\n');
-        }
-        else {
-            return undefined;
-        }
-    }
-    setMappings() {
-        this.mappings = externalProductHandler(this, whichSpecialCase(_.get(this.data, 'Findings[0]')), this, 'mapping', this.defaultMappings);
-    }
-    constructor(asff, supportingDocs, meta = undefined) {
-        super(asff);
-        this.defaultMappings = {
-            platform: {
-                name: 'Heimdall Tools',
-                release: package_json_1.version,
-                target_id: {
-                    transformer: (record) => {
-                        const productInfo = _.get(record, 'Findings[0].ProductArn')
-                            .split(':')
-                            .slice(-1)[0]
-                            .split('/');
-                        const defaultTargetId = `${productInfo[1]} - ${productInfo[2]}`;
-                        return externalProductHandler(this, whichSpecialCase(_.get(record, 'Findings[0]')), [_.get(record, 'Findings[0]'), record.Findings], 'productName', (0, html_entities_1.encode)(defaultTargetId));
-                    }
+    meta;
+    supportingDocs;
+    defaultMappings = {
+        platform: {
+            name: 'Heimdall Tools',
+            release: package_json_1.version,
+            target_id: {
+                transformer: (record) => {
+                    const productInfo = _.get(record, 'Findings[0].ProductArn')
+                        .split(':')
+                        .slice(-1)[0]
+                        .split('/');
+                    const defaultTargetId = `${productInfo[1]} - ${productInfo[2]}`;
+                    return externalProductHandler(this, whichSpecialCase(_.get(record, 'Findings[0]')), [_.get(record, 'Findings[0]'), record.Findings], 'productName', (0, html_entities_1.encode)(defaultTargetId));
                 }
-            },
-            version: package_json_1.version,
-            statistics: {
-                duration: null
-            },
-            profiles: [
-                {
-                    name: {
-                        transformer: () => {
-                            var _a;
-                            return ((_a = this.meta) === null || _a === void 0 ? void 0 : _a.name) || 'AWS Security Finding Format';
-                        }
-                    },
-                    version: '',
-                    title: {
-                        transformer: () => {
-                            return _.get(this.meta, 'title') || 'ASFF Findings';
-                        }
-                    },
-                    maintainer: null,
-                    summary: '',
-                    license: null,
-                    copyright: null,
-                    copyright_email: null,
-                    supports: [],
-                    attributes: [],
-                    depends: [],
-                    groups: [],
-                    status: 'loaded',
-                    controls: [
-                        {
-                            path: 'Findings',
-                            key: 'id',
-                            arrayTransformer: consolidate.bind(this, this),
-                            id: {
-                                transformer: (finding) => externalProductHandler(this, whichSpecialCase(finding), finding, 'findingId', (0, html_entities_1.encode)(_.get(finding, 'GeneratorId')))
-                            },
-                            title: {
-                                transformer: (finding) => externalProductHandler(this, whichSpecialCase(finding), finding, 'findingTitle', (0, html_entities_1.encode)(_.get(finding, 'Title')))
-                            },
-                            desc: {
-                                transformer: (finding) => externalProductHandler(this, whichSpecialCase(finding), finding, 'findingDescription', (0, html_entities_1.encode)(_.get(finding, 'Description')))
-                            },
-                            impact: {
+            }
+        },
+        version: package_json_1.version,
+        statistics: {
+            duration: null
+        },
+        profiles: [
+            {
+                name: {
+                    transformer: () => {
+                        return this.meta?.name || 'AWS Security Finding Format';
+                    }
+                },
+                version: '',
+                title: {
+                    transformer: () => {
+                        return _.get(this.meta, 'title') || 'ASFF Findings';
+                    }
+                },
+                maintainer: null,
+                summary: '',
+                license: null,
+                copyright: null,
+                copyright_email: null,
+                supports: [],
+                attributes: [],
+                depends: [],
+                groups: [],
+                status: 'loaded',
+                controls: [
+                    {
+                        path: 'Findings',
+                        key: 'id',
+                        arrayTransformer: consolidate.bind(this, this),
+                        id: {
+                            transformer: (finding) => externalProductHandler(this, whichSpecialCase(finding), finding, 'findingId', (0, html_entities_1.encode)(_.get(finding, 'GeneratorId')))
+                        },
+                        title: {
+                            transformer: (finding) => externalProductHandler(this, whichSpecialCase(finding), finding, 'findingTitle', (0, html_entities_1.encode)(_.get(finding, 'Title')))
+                        },
+                        desc: {
+                            transformer: (finding) => externalProductHandler(this, whichSpecialCase(finding), finding, 'findingDescription', (0, html_entities_1.encode)(_.get(finding, 'Description')))
+                        },
+                        impact: {
+                            transformer: (finding) => {
+                                // There can be findings listed that are intentionally ignored due to the underlying control being superseded by a control from a different standard
+                                let impact;
+                                if (_.get(finding, 'Workflow.Status') === 'SUPPRESSED') {
+                                    impact = 'INFORMATIONAL';
+                                }
+                                else {
+                                    // Severity is required, but can be either 'label' or 'normalized' internally with 'label' being preferred.  other values can be in here too such as the original severity rating.
+                                    const defaultFunc = () => _.get(finding, SEVERITY_LABEL)
+                                        ? _.get(finding, SEVERITY_LABEL)
+                                        : _.get(finding, 'Severity.Normalized') /
+                                            100.0;
+                                    impact = externalProductHandler(this, whichSpecialCase(finding), finding, 'findingImpact', defaultFunc);
+                                }
+                                return typeof impact === 'string'
+                                    ? IMPACT_MAPPING.get(impact) || 0
+                                    : impact;
+                            }
+                        },
+                        tags: {
+                            transformer: (finding) => externalProductHandler(this, whichSpecialCase(finding), finding, 'findingTags', {}),
+                            cci: {
                                 transformer: (finding) => {
-                                    let impact;
-                                    if (_.get(finding, 'Workflow.Status') === 'SUPPRESSED') {
-                                        impact = 'INFORMATIONAL';
+                                    const tags = externalProductHandler(this, whichSpecialCase(finding), finding, 'findingNistTag', []);
+                                    if (tags.length === 0) {
+                                        return (0, global_1.getCCIsForNISTTags)(global_1.DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS);
                                     }
                                     else {
-                                        const defaultFunc = () => _.get(finding, SEVERITY_LABEL)
-                                            ? _.get(finding, SEVERITY_LABEL)
-                                            : _.get(finding, 'Severity.Normalized') /
-                                                100.0;
-                                        impact = externalProductHandler(this, whichSpecialCase(finding), finding, 'findingImpact', defaultFunc);
+                                        return (0, global_1.getCCIsForNISTTags)(tags);
                                     }
-                                    return typeof impact === 'string'
-                                        ? IMPACT_MAPPING.get(impact) || 0
-                                        : impact;
                                 }
                             },
-                            tags: {
-                                transformer: (finding) => externalProductHandler(this, whichSpecialCase(finding), finding, 'findingTags', {}),
-                                cci: {
-                                    transformer: (finding) => {
-                                        const tags = externalProductHandler(this, whichSpecialCase(finding), finding, 'findingNistTag', []);
-                                        if (tags.length === 0) {
-                                            return (0, global_1.getCCIsForNISTTags)(global_1.DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS);
-                                        }
-                                        else {
-                                            return (0, global_1.getCCIsForNISTTags)(tags);
-                                        }
+                            nist: {
+                                transformer: (finding) => {
+                                    const tags = externalProductHandler(this, whichSpecialCase(finding), finding, 'findingNistTag', []);
+                                    if (tags.length === 0) {
+                                        return global_1.DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS;
                                     }
-                                },
-                                nist: {
-                                    transformer: (finding) => {
-                                        const tags = externalProductHandler(this, whichSpecialCase(finding), finding, 'findingNistTag', []);
-                                        if (tags.length === 0) {
-                                            return global_1.DEFAULT_STATIC_CODE_ANALYSIS_NIST_TAGS;
-                                        }
-                                        else {
-                                            return tags;
-                                        }
+                                    else {
+                                        return tags;
                                     }
                                 }
-                            },
-                            descriptions: [
-                                {
-                                    data: {
-                                        path: 'Remediation.Recommendation',
-                                        transformer: (input) => {
-                                            const data = [];
-                                            if (_.has(input, 'Text')) {
-                                                data.push(_.get(input, 'Text'));
-                                            }
-                                            if (_.has(input, 'Url')) {
-                                                data.push(_.get(input, 'Url'));
-                                            }
-                                            return data.join('\n');
+                            }
+                        },
+                        descriptions: [
+                            {
+                                data: {
+                                    path: 'Remediation.Recommendation',
+                                    transformer: (input) => {
+                                        const data = [];
+                                        if (_.has(input, 'Text')) {
+                                            data.push(_.get(input, 'Text'));
                                         }
-                                    },
-                                    label: 'fix'
-                                }
-                            ],
-                            refs: [
-                                {
-                                    transformer: (finding) => {
-                                        return {
-                                            ...(_.has(finding, 'SourceUrl') && {
-                                                url: _.get(finding, 'SourceUrl')
-                                            })
-                                        };
+                                        if (_.has(input, 'Url')) {
+                                            data.push(_.get(input, 'Url'));
+                                        }
+                                        return data.join('\n');
                                     }
+                                },
+                                label: 'fix'
+                            }
+                        ],
+                        refs: [
+                            {
+                                transformer: (finding) => {
+                                    return {
+                                        ...(_.has(finding, 'SourceUrl') && {
+                                            url: _.get(finding, 'SourceUrl')
+                                        })
+                                    };
                                 }
-                            ],
-                            source_location: {},
-                            code: '',
-                            results: [
-                                {
-                                    status: {
-                                        transformer: (finding) => {
-                                            const defaultFunc = () => {
-                                                if (_.has(finding, COMPLIANCE_STATUS)) {
-                                                    switch (_.get(finding, COMPLIANCE_STATUS)) {
-                                                        case 'PASSED':
-                                                            return inspecjs_1.ExecJSON.ControlResultStatus.Passed;
-                                                        case 'WARNING':
-                                                            return inspecjs_1.ExecJSON.ControlResultStatus.Skipped;
-                                                        case 'FAILED':
-                                                            return inspecjs_1.ExecJSON.ControlResultStatus.Failed;
-                                                        case 'NOT_AVAILABLE':
-                                                            return inspecjs_1.ExecJSON.ControlResultStatus.Skipped;
-                                                        default:
-                                                            return inspecjs_1.ExecJSON.ControlResultStatus.Error;
-                                                    }
-                                                }
-                                                else {
-                                                    return inspecjs_1.ExecJSON.ControlResultStatus.Failed;
-                                                }
-                                            };
-                                            return externalProductHandler(this, whichSpecialCase(finding), finding, 'subfindingsStatus', defaultFunc);
-                                        }
-                                    },
-                                    code_desc: {
-                                        transformer: (finding) => {
-                                            let output = externalProductHandler(this, whichSpecialCase(finding), finding, 'subfindingsCodeDesc', '');
-                                            if (output) {
-                                                output += '; ';
-                                            }
-                                            const resources = _.get(finding, 'Resources')
-                                                .map((resource) => {
-                                                let hash = `Type: ${(0, html_entities_1.encode)(_.get(resource, 'Type'))}, Id: ${(0, html_entities_1.encode)(_.get(resource, 'Id'))}`;
-                                                if (_.has(resource, 'Partition')) {
-                                                    hash += `, Partition: ${(0, html_entities_1.encode)(_.get(resource, 'Partition'))}`;
-                                                }
-                                                if (_.has(resource, 'Region')) {
-                                                    hash += `, Region: ${(0, html_entities_1.encode)(_.get(resource, 'Region'))}`;
-                                                }
-                                                return hash;
-                                            })
-                                                .join(', ');
-                                            output += `Resources: [${resources}]`;
-                                            return output;
-                                        }
-                                    },
+                            }
+                        ],
+                        source_location: {},
+                        code: '',
+                        results: [
+                            {
+                                status: {
                                     transformer: (finding) => {
-                                        const message = (() => {
-                                            const defaultFunc = () => {
-                                                const statusReason = this.statusReason(finding);
+                                        const defaultFunc = () => {
+                                            if (_.has(finding, COMPLIANCE_STATUS)) {
                                                 switch (_.get(finding, COMPLIANCE_STATUS)) {
-                                                    case undefined:
-                                                        return undefined;
                                                     case 'PASSED':
-                                                        return statusReason;
+                                                        return inspecjs_1.ExecJSON.ControlResultStatus.Passed;
                                                     case 'WARNING':
-                                                        return undefined;
+                                                        return inspecjs_1.ExecJSON.ControlResultStatus.Skipped;
                                                     case 'FAILED':
-                                                        return statusReason;
+                                                        return inspecjs_1.ExecJSON.ControlResultStatus.Failed;
                                                     case 'NOT_AVAILABLE':
-                                                        return undefined;
+                                                        // primary meaning is that the check could not be performed due to a service outage or API error, but it's also overloaded to mean NOT_APPLICABLE so technically 'skipped' or 'error' could be applicable, but AWS seems to do the equivalent of skipped
+                                                        return inspecjs_1.ExecJSON.ControlResultStatus.Skipped;
                                                     default:
-                                                        return statusReason;
+                                                        // not a valid value for the status enum
+                                                        return inspecjs_1.ExecJSON.ControlResultStatus.Error;
                                                 }
-                                            };
-                                            return externalProductHandler(this, whichSpecialCase(finding), finding, 'subfindingsMessage', defaultFunc);
-                                        })();
-                                        const skipMessage = (() => {
+                                            }
+                                            else {
+                                                // if no compliance status is provided which is a weird but possible case, then fail
+                                                return inspecjs_1.ExecJSON.ControlResultStatus.Failed;
+                                            }
+                                        };
+                                        return externalProductHandler(this, whichSpecialCase(finding), finding, 'subfindingsStatus', defaultFunc);
+                                    }
+                                },
+                                code_desc: {
+                                    transformer: (finding) => {
+                                        let output = externalProductHandler(this, whichSpecialCase(finding), finding, 'subfindingsCodeDesc', '');
+                                        if (output) {
+                                            output += '; ';
+                                        }
+                                        const resources = _.get(finding, 'Resources')
+                                            .map((resource) => {
+                                            let hash = `Type: ${(0, html_entities_1.encode)(_.get(resource, 'Type'))}, Id: ${(0, html_entities_1.encode)(_.get(resource, 'Id'))}`;
+                                            if (_.has(resource, 'Partition')) {
+                                                hash += `, Partition: ${(0, html_entities_1.encode)(_.get(resource, 'Partition'))}`;
+                                            }
+                                            if (_.has(resource, 'Region')) {
+                                                hash += `, Region: ${(0, html_entities_1.encode)(_.get(resource, 'Region'))}`;
+                                            }
+                                            return hash;
+                                        })
+                                            .join(', ');
+                                        output += `Resources: [${resources}]`;
+                                        return output;
+                                    }
+                                },
+                                transformer: (finding) => {
+                                    const message = (() => {
+                                        const defaultFunc = () => {
                                             const statusReason = this.statusReason(finding);
                                             switch (_.get(finding, COMPLIANCE_STATUS)) {
-                                                case undefined:
-                                                    return statusReason;
-                                                case 'PASSED':
+                                                case undefined: // Possible for Compliance.Status to not be there, in which case it's a skip_message
                                                     return undefined;
-                                                case 'WARNING':
+                                                case 'PASSED':
                                                     return statusReason;
-                                                case 'FAILED':
+                                                case 'WARNING':
                                                     return undefined;
-                                                case 'NOT_AVAILABLE':
+                                                case 'FAILED':
                                                     return statusReason;
-                                                default:
+                                                case 'NOT_AVAILABLE':
                                                     return undefined;
+                                                default:
+                                                    return statusReason;
                                             }
-                                        })();
-                                        return {
-                                            ...(message !== undefined && { message }),
-                                            ...(skipMessage !== undefined && {
-                                                skip_message: skipMessage
-                                            })
                                         };
-                                    },
-                                    start_time: {
-                                        transformer: (finding) => _.get(finding, 'LastObservedAt') ||
-                                            _.get(finding, 'UpdatedAt')
-                                    }
+                                        return externalProductHandler(this, whichSpecialCase(finding), finding, 'subfindingsMessage', defaultFunc);
+                                    })();
+                                    const skipMessage = (() => {
+                                        const statusReason = this.statusReason(finding);
+                                        switch (_.get(finding, COMPLIANCE_STATUS)) {
+                                            case undefined: // Possible for Compliance.Status to not be there, in which case it's a skip_message
+                                                return statusReason;
+                                            case 'PASSED':
+                                                return undefined;
+                                            case 'WARNING':
+                                                return statusReason;
+                                            case 'FAILED':
+                                                return undefined;
+                                            case 'NOT_AVAILABLE':
+                                                // primary meaning is that the check could not be performed due to a service outage or API error, but it's also overloaded to mean NOT_APPLICABLE so technically 'skipped' or 'error' could be applicable, but AWS seems to do the equivalent of skipped
+                                                return statusReason;
+                                            default:
+                                                return undefined;
+                                        }
+                                    })();
+                                    return {
+                                        ...(message !== undefined && { message }),
+                                        ...(skipMessage !== undefined && {
+                                            skip_message: skipMessage
+                                        })
+                                    };
+                                },
+                                start_time: {
+                                    transformer: (finding) => _.get(finding, 'LastObservedAt') ||
+                                        _.get(finding, 'UpdatedAt')
                                 }
-                            ]
-                        }
-                    ],
-                    sha256: ''
-                }
-            ]
-        };
+                            }
+                        ]
+                    }
+                ],
+                sha256: ''
+            }
+        ]
+    };
+    statusReason(finding) {
+        const statusReasons = _.get(finding, 'Compliance.StatusReasons');
+        if (statusReasons !== undefined &&
+            statusReasons !== null &&
+            _.isArray(statusReasons)) {
+            return statusReasons
+                .map((reason) => Object.entries(reason || {}).map(([key, value]) => {
+                return `${(0, html_entities_1.encode)(key)}: ${(0, html_entities_1.encode)(value)}`;
+            }))
+                .flat()
+                .join('\n');
+        }
+        else {
+            return undefined;
+        }
+    }
+    setMappings() {
+        this.mappings = externalProductHandler(this, whichSpecialCase(_.get(this.data, 'Findings[0]')), this, 'mapping', this.defaultMappings);
+    }
+    constructor(asff, supportingDocs, meta = undefined) {
+        super(asff);
         this.meta = meta;
         this.supportingDocs = supportingDocs;
         this.setMappings();
     }
 }
 exports.ASFFMapper = ASFFMapper;
+// sometimes there is a need to change certain meta level information such as the profile name to make it clearer that the original ASFF file came from an external tool instead of SecHub
+// some special cases can take in additional files aside from findings, ex. the guidelines which contain correct severity information
 class ASFFResults {
+    data;
+    meta;
+    supportingDocs;
     constructor(asffJson, securityhubStandardsJsonArray = undefined, meta = undefined) {
         this.meta = meta;
         this.supportingDocs = new Map();
         this.supportingDocs.set(SpecialCasing.SecurityHub, _.get(SPECIAL_CASE_MAPPING.get(SpecialCasing.SecurityHub), 'securityhubSupportingDocs', (standards) => {
             throw new Error(`supportingDocs function should've been defined: ${standards}`);
         })(securityhubStandardsJsonArray));
+        // split input findings via product, each of which will get their own resultant HDF file
         const findings = _.get(fixFileInput(asffJson), 'Findings');
         this.data = _.groupBy(findings, (finding) => {
             const productInfo = _.get(finding, 'ProductArn')