Repository: bridgecrewio/checkov

Issue:
Feature Request: another flag to display failed checks
**Is your feature request related to a problem? Please describe.**

it seems that  -o github_failed_only only returns failed but with plain text. if I use -o json then I get all checks(failed and success). 
**Describe the solution you'd like**

Apart from  json and github_failed_only parameters.  It might be good to have  to  another flag to display failed only reports.  It can be used with json output. Something like to see failed checks in json format.
```
$ checkov --display-failed-checks -o json -d .
```




Discussion:
Hi @ismailyenigul

Would something like the following allow you to just get the failed checks section of the json without a new flag?

```
checkov -o json -f terraform/aws/ec2.tf | jq .results.failed_checks 
```
```
checkov -o json -f terraform/aws/ec2.tf | jq .results.failed_checks > just_failed.json
```
Thanks @metahertz 
That works too :)
But it will fail if tf and json files  ("check_type": "terraform", "check_type": "terraform_plan")
 are in the same directory.

 ```
 $ checkov -d .  -o json | jq .results.failed_checks
jq: error (at <stdin>:256): Cannot index array with string "results"

```

example: 
```
~/d/iam [1] $ checkov -d .  -o json
[
    {
        "check_type": "terraform",
        "results": {
            "passed_checks": [
                {
                    "check_id": "CKV_AWS_41",
                    "check_name": "Ensure no hard coded AWS access key and secret key exists in provider",
                    "check_result": {
                        "result": "PASSED",
                        "evaluated_keys": []
                    },
                    "code_block": [
                        [
                            2,
                            "provider \"aws\" {\n"
                        ],
                        [
                            3,
                            "  # Make it faster by skipping something\n"
                        ],
                        [
                            4,
                            "  skip_get_ec2_platforms      = true\n"
                        ],
                        [
                            5,
                            "  skip_metadata_api_check     = true\n"
                        ],
                        [
                            6,
                            "  skip_region_validation      = true\n"
                        ],
                        [
                            7,
                            "  skip_credentials_validation = true\n"
                        ],
                        [
                            8,
                            "  skip_requesting_account_id  = true\n"
                        ],
                        [
                            9,
                            "  region                      = \"eu-west-1\"\n"
                        ],
                        [
                            10,
                            "}\n"
                        ]
                    ],
                    "file_path": "/main.tf",
                    "repo_file_path": "/main.tf",
                    "file_line_range": [
                        2,
                        10
                    ],
                    "resource": "aws.default",
                    "evaluations": null,
                    "check_class": "checkov.terraform.checks.provider.aws.credentials",
                    "fixed_definition": null,
                    "entity_tags": null,
                    "guideline": "https://docs.bridgecrew.io/docs/bc_aws_secrets_5"
                }
            ],
            "failed_checks": [],
            "skipped_checks": [],
            "parsing_errors": []
        },
        "summary": {
            "passed": 1,
            "failed": 0,
            "skipped": 0,
            "parsing_errors": 0,
            "checkov_version": "1.0.771"
        }
    },
    {
        "check_type": "terraform_plan",
        "results": {
            "passed_checks": [
                {
                    "check_id": "CKV_AWS_11",
                    "check_name": "Ensure IAM password policy requires at least one lowercase letter",
                    "check_result": {
                        "result": "PASSED",
                        "evaluated_keys": [
                            "require_lowercase_characters"
                        ]
                    },
                    "code_block": [],
                    "file_path": "/tf.json",
                    "repo_file_path": "/tf.json",
                    "file_line_range": [
                        0,
                        0
                    ],
                    "resource": "aws_iam_account_password_policy.default",
                    "evaluations": null,
                    "check_class": "checkov.terraform.checks.resource.aws.PasswordPolicyLowercaseLetter",
                    "fixed_definition": null,
                    "entity_tags": null,
                    "guideline": "https://docs.bridgecrew.io/docs/iam_6"
                },
                {
                    "check_id": "CKV_AWS_15",
                    "check_name": "Ensure IAM password policy requires at least one uppercase letter",
                    "check_result": {
                        "result": "PASSED",
                        "evaluated_keys": [
                            "require_uppercase_characters"
                        ]
                    },
                    "code_block": [],
                    "file_path": "/tf.json",
                    "repo_file_path": "/tf.json",
                    "file_line_range": [
                        0,
                        0
                    ],
                    "resource": "aws_iam_account_password_policy.default",
                    "evaluations": null,
                    "check_class": "checkov.terraform.checks.resource.aws.PasswordPolicyUppercaseLetter",
                    "fixed_definition": null,
                    "entity_tags": null,
                    "guideline": "https://docs.bridgecrew.io/docs/iam_5"
                },
                {
                    "check_id": "CKV_AWS_12",
                    "check_name": "Ensure IAM password policy requires at least one number",
                    "check_result": {
                        "result": "PASSED",
                        "evaluated_keys": [
                            "require_numbers"
                        ]
                    },
                    "code_block": [],
                    "file_path": "/tf.json",
                    "repo_file_path": "/tf.json",
                    "file_line_range": [
                        0,
                        0
                    ],
                    "resource": "aws_iam_account_password_policy.default",
                    "evaluations": null,
                    "check_class": "checkov.terraform.checks.resource.aws.PasswordPolicyNumber",
                    "fixed_definition": null,
                    "entity_tags": null,
                    "guideline": "https://docs.bridgecrew.io/docs/iam_8"
                },
                {
                    "check_id": "CKV_AWS_14",
                    "check_name": "Ensure IAM password policy requires at least one symbol",
                    "check_result": {
                        "result": "PASSED",
                        "evaluated_keys": [
                            "require_symbols"
                        ]
                    },
                    "code_block": [],
                    "file_path": "/tf.json",
                    "repo_file_path": "/tf.json",
                    "file_line_range": [
                        0,
                        0
                    ],
                    "resource": "aws_iam_account_password_policy.default",
                    "evaluations": null,
                    "check_class": "checkov.terraform.checks.resource.aws.PasswordPolicySymbol",
                    "fixed_definition": null,
                    "entity_tags": null,
                    "guideline": "https://docs.bridgecrew.io/docs/iam_7"
                }
            ],
            "failed_checks": [
                {
                    "check_id": "CKV_AWS_9",
                    "check_name": "Ensure IAM password policy expires passwords within 90 days or less",
                    "check_result": {
                        "result": "FAILED",
                        "evaluated_keys": [
                            "max_password_age"
                        ]
                    },
                    "code_block": [],
                    "file_path": "/tf.json",
                    "repo_file_path": "/tf.json",
                    "file_line_range": [
                        0,
                        0
                    ],
                    "resource": "aws_iam_account_password_policy.default",
                    "evaluations": null,
                    "check_class": "checkov.terraform.checks.resource.aws.PasswordPolicyExpiration",
                    "fixed_definition": null,
                    "entity_tags": null,
                    "guideline": "https://docs.bridgecrew.io/docs/iam_11"
                },
                {
                    "check_id": "CKV_AWS_13",
                    "check_name": "Ensure IAM password policy prevents password reuse",
                    "check_result": {
                        "result": "FAILED",
                        "evaluated_keys": [
                            "password_reuse_prevention"
                        ]
                    },
                    "code_block": [],
                    "file_path": "/tf.json",
                    "repo_file_path": "/tf.json",
                    "file_line_range": [
                        0,
                        0
                    ],
                    "resource": "aws_iam_account_password_policy.default",
                    "evaluations": null,
                    "check_class": "checkov.terraform.checks.resource.aws.PasswordPolicyReuse",
                    "fixed_definition": null,
                    "entity_tags": null,
                    "guideline": "https://docs.bridgecrew.io/docs/iam_10"
                },
                {
                    "check_id": "CKV_AWS_10",
                    "check_name": "Ensure IAM password policy requires minimum length of 14 or greater",
                    "check_result": {
                        "result": "FAILED",
                        "evaluated_keys": [
                            "minimum_password_length"
                        ]
                    },
                    "code_block": [],
                    "file_path": "/tf.json",
                    "repo_file_path": "/tf.json",
                    "file_line_range": [
                        0,
                        0
                    ],
                    "resource": "aws_iam_account_password_policy.default",
                    "evaluations": null,
                    "check_class": "checkov.terraform.checks.resource.aws.PasswordPolicyLength",
                    "fixed_definition": null,
                    "entity_tags": null,
                    "guideline": "https://docs.bridgecrew.io/docs/iam_9-1"
                }
            ],
            "skipped_checks": [],
            "parsing_errors": []
        },
        "summary": {
            "passed": 4,
            "failed": 3,
            "skipped": 0,
            "parsing_errors": 0,
            "checkov_version": "1.0.771"
        }
    }
]
 
 ```
 
 

 
 
Thats a fair point, you could always do the below in this case, but that would fail on non array, so it depends if you always know your output?

``` 
|  jq '[].results.failed_checks' 
```

If not, we have a flag for CLI called `--quiet` which just shows failed checks, makes sense to extend this to the json output too rather that a new flag? ie `checkov -o json --quiet`?


Hi @metahertz 
 `checkov -o json --quiet` works for me.
I'm thinking of leaving the json format similar, with a summary, but just failed checks section, so that the formats are compatible/mergeable across `--quiet` and normal, something like this for the `--quiet` option:

```
                "check_type": 
                "results": {
                    "failed_checks":
                },
                "summary": 
```

Resolving patch:
diff --git a/checkov/common/output/report.py b/checkov/common/output/report.py
--- a/checkov/common/output/report.py
+++ b/checkov/common/output/report.py
@@ -49,17 +49,26 @@ def get_summary(self):
     def get_json(self):
         return json.dumps(self.get_dict(), indent=4)
 
-    def get_dict(self):
-        return {
-            "check_type": self.check_type,
-            "results": {
-                "passed_checks": [check.__dict__ for check in self.passed_checks],
-                "failed_checks": [check.__dict__ for check in self.failed_checks],
-                "skipped_checks": [check.__dict__ for check in self.skipped_checks],
-                "parsing_errors": list(self.parsing_errors)
-            },
-            "summary": self.get_summary()
+    def get_dict(self, is_quiet=False):
+        if is_quiet:
+            return {
+                "check_type": self.check_type,
+                "results": {
+                    "failed_checks": [check.__dict__ for check in self.failed_checks]
+                },
+                "summary": self.get_summary()
         }
+        else: 
+            return {
+                "check_type": self.check_type,
+                "results": {
+                    "passed_checks": [check.__dict__ for check in self.passed_checks],
+                    "failed_checks": [check.__dict__ for check in self.failed_checks],
+                    "skipped_checks": [check.__dict__ for check in self.skipped_checks],
+                    "parsing_errors": list(self.parsing_errors)
+                },
+                "summary": self.get_summary()
+            }
 
     def get_exit_code(self, soft_fail):
         if soft_fail:
diff --git a/checkov/common/runners/runner_registry.py b/checkov/common/runners/runner_registry.py
--- a/checkov/common/runners/runner_registry.py
+++ b/checkov/common/runners/runner_registry.py
@@ -48,7 +48,7 @@ def print_reports(self, scan_reports, args, url=None):
         for report in scan_reports:
             if not report.is_empty():
                 if args.output == "json":
-                    report_jsons.append(report.get_dict())
+                    report_jsons.append(report.get_dict(is_quiet=args.quiet))
                 elif args.output == "junitxml":
                     junit_reports.append(report)
                     # report.print_junit_xml()


Test patch:
diff --git a/integration_tests/test_checkov_json_report.py b/integration_tests/test_checkov_json_report.py
--- a/integration_tests/test_checkov_json_report.py
+++ b/integration_tests/test_checkov_json_report.py
@@ -33,6 +33,13 @@ def validate_report(self, report_path):
             self.assertEqual(data["summary"]["parsing_errors"], 0, "expecting 0 parsing errors")
             self.assertGreater(data["summary"]["failed"], 1, "expecting more then 1 failed checks")
 
+    def validate_json_quiet(self):
+        report_path = current_dir + "/../checkov_report_cfngoat_quiet.json"
+        with open(report_path) as json_file:
+            data = json.load(json_file)
+            self.assertTrue(data["results"]["failed_checks"])
+            self.assertFalse(data["results"]["passed_checks"])
+            self.assertTrue(data["summary"])
 
 if __name__ == '__main__':
     unittest.main()