ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 13:01:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: rename and adapt logic

Browse Source
This commit is contained in:
HugoPBrito
2025-02-12 16:37:50 +01:00
parent 4aa6e220b0
commit 2b7dead1f8
5 changed files with 55 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/microsoft365/services/entra/entra_security_defaults_enabled/__init__.py → prowler/providers/microsoft365/services/entra/entra_security_defaults_disabled/__init__.py
View File
prowler/providers/microsoft365/services/entra/entra_security_defaults_disabled/entra_security_defaults_disabled.metadata.json
+30
View File
@@ -0,0 +1,30 @@
{
"Provider": "microsoft365",
"CheckID": "entra_security_defaults_disabled",
"CheckTitle": "Ensure Security Defaults is disabled on Microsoft Entra ID",
"CheckType": [],
"ServiceName": "entra",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "#microsoft.graph.identitySecurityDefaultsEnforcementPolicy",
"Description": "Disabling Security Defaults allows organizations to implement more granular and advanced security controls beyond the predefined settings. This ensures that security policies are aligned with organizational requirements rather than relying on a one-size-fits-all approach.",
"Risk": "Security Defaults in Microsoft Entra ID provide preconfigured security settings to protect organizations from common attacks. While these defaults enhance security by enforcing MFA, blocking legacy authentication, and implementing other protections, they may also prevent organizations from applying custom security policies tailored to their specific needs.",
"RelatedUrl": "https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults",
"Remediation": {
"Code": {
"CLI": "Update-MgPolicyIdentitySecurityDefaultEnforcementPolicy -BodyParameter @{ IsEnabled = $false }",
"NativeIaC": "",
"Other": "",
"Terraform": ""
},
"Recommendation": {
"Text": "1. Navigate to Microsoft Entra admin center. 2. Click to expand Identity > Overview 3. Click Propierties 4. Click Manage security defaults 5. Set the Security defaults dropdown to Disabled 6. Select Save",
"Url": "https://techcommunity.microsoft.com/t5/microsoft-entra-blog/introducing-security-defaults/ba-p/1061414"
}
},
"Categories": [],
"DependsOn": [],
"RelatedTo": [],
"Notes": "Before disabling Security Defaults, ensure robust security measures are in place, including enforced MFA, blocked legacy authentication, Conditional Access policies, and continuous identity threat monitoring.. Administrators should also be aware that certain configurations in Microsoft Entra ID may impact other Microsoft services such as Azure."
}
prowler/providers/microsoft365/services/entra/entra_security_defaults_enabled/entra_security_defaults_enabled.py → prowler/providers/microsoft365/services/entra/entra_security_defaults_disabled/entra_security_defaults_disabled.py
+4 -4
View File
@@ -2,21 +2,21 @@ from prowler.lib.check.models import Check, Check_Report_Microsoft365
from prowler.providers.microsoft365.services.entra.entra_client import entra_client
class entra_security_defaults_enabled(Check):
class entra_security_defaults_disabled(Check):
def execute(self) -> Check_Report_Microsoft365:
findings = []
report = Check_Report_Microsoft365(
metadata=self.metadata(), resource=entra_client.security_defaults
)
report.status = "FAIL"
report.status_extended = "Entra Security Defaults is disabled."
report.status_extended = "Entra Security Defaults is not disabled."
if (
entra_client.security_defaults is not None
and entra_client.security_defaults.is_enabled
and not entra_client.security_defaults.is_enabled
):
report.status = "PASS"
report.status_extended = "Entra Security Defaults is enabled."
report.status_extended = "Entra Security Defaults is disabled."
findings.append(report)
return findings
prowler/providers/microsoft365/services/entra/entra_security_defaults_enabled/entra_security_defaults_enabled.metadata.json
-30
View File
@@ -1,30 +0,0 @@
{
"Provider": "microsoft365",
"CheckID": "entra_security_defaults_enabled",
"CheckTitle": "Ensure Security Defaults is enabled on Microsoft Entra ID",
"CheckType": [],
"ServiceName": "entra",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "high",
"ResourceType": "#microsoft.graph.identitySecurityDefaultsEnforcementPolicy",
"Description": "Security defaults in Microsoft Entra ID make it easier to be secure and help protect your organization. Security defaults contain preconfigured security settings for common attacks. Security defaults is available to everyone. The goal is to ensure that all organizations have a basic level of security enabled at no extra cost. You may turn on security defaults in the Azure portal.",
"Risk": "Security defaults provide secure default settings that we manage on behalf of organizations to keep customers safe until they are ready to manage their own identity security settings. For example, doing the following: - Requiring all users and admins to register for MFA. - Challenging users with MFA - when necessary, based on factors such as location, device, role, and task. - Disabling authentication from legacy authentication clients, which can’t do MFA.",
"RelatedUrl": "https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults",
"Remediation": {
"Code": {
"CLI": "",
"NativeIaC": "",
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/ActiveDirectory/security-defaults-enabled.html#",
"Terraform": ""
},
"Recommendation": {
"Text": "1. From Azure Home select the Portal Menu. 2. Browse to Microsoft Entra ID > Properties 3. Select Manage security defaults 4. Set the Enable security defaults to Enabled 5. Select Save",
"Url": "https://techcommunity.microsoft.com/t5/microsoft-entra-blog/introducing-security-defaults/ba-p/1061414"
}
},
"Categories": [],
"DependsOn": [],
"RelatedTo": [],
"Notes": "This recommendation should be implemented initially and then may be overridden by other service/product specific CIS Benchmarks. Administrators should also be aware that certain configurations in Microsoft Entra ID may impact other Microsoft services such as Microsoft 365."
}
tests/providers/microsoft365/services/entra/entra_security_defaults_enabled/microsoft365_entra_security_defaults_enabled_test.py → tests/providers/microsoft365/services/entra/entra_security_defaults_disabled/entra_security_defaults_disabled_test.py
+21 -17
View File
@@ -6,7 +6,7 @@ from tests.providers.microsoft365.microsoft365_fixtures import (
)
class Test_entra_security_defaults_enabled:
class Test_entra_security_defaults_disabled:
def test_entra_tenant_empty(self):
entra_client = mock.MagicMock
@@ -14,20 +14,22 @@ class Test_entra_security_defaults_enabled:
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_microsoft365_provider(),
), mock.patch(
"prowler.providers.microsoft365.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled.entra_client",
"prowler.providers.microsoft365.services.entra.entra_security_defaults_disabled.entra_security_defaults_disabled.entra_client",
new=entra_client,
):
from prowler.providers.microsoft365.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled import (
entra_security_defaults_enabled,
from prowler.providers.microsoft365.services.entra.entra_security_defaults_disabled.entra_security_defaults_disabled import (
entra_security_defaults_disabled,
)
entra_client.security_defaults = None
check = entra_security_defaults_enabled()
check = entra_security_defaults_disabled()
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].status_extended == "Entra Security Defaults is disabled."
assert (
result[0].status_extended == "Entra Security Defaults is not disabled."
)
assert result[0].resource_name == ""
assert result[0].resource_id == ""
@@ -38,11 +40,11 @@ class Test_entra_security_defaults_enabled:
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_microsoft365_provider(),
), mock.patch(
"prowler.providers.microsoft365.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled.entra_client",
"prowler.providers.microsoft365.services.entra.entra_security_defaults_disabled.entra_security_defaults_disabled.entra_client",
new=entra_client,
):
from prowler.providers.microsoft365.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled import (
entra_security_defaults_enabled,
from prowler.providers.microsoft365.services.entra.entra_security_defaults_disabled.entra_security_defaults_disabled import (
entra_security_defaults_disabled,
)
from prowler.providers.microsoft365.services.entra.entra_service import (
SecurityDefaults,
@@ -54,11 +56,13 @@ class Test_entra_security_defaults_enabled:
id=id, name="Sec Default", is_enabled=True
)
check = entra_security_defaults_enabled()
check = entra_security_defaults_disabled()
result = check.execute()
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].status_extended == "Entra Security Defaults is enabled."
assert result[0].status == "FAIL"
assert (
result[0].status_extended == "Entra Security Defaults is not disabled."
)
assert result[0].resource_name == "Sec Default"
assert result[0].resource_id == id
@@ -69,11 +73,11 @@ class Test_entra_security_defaults_enabled:
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_microsoft365_provider(),
), mock.patch(
"prowler.providers.microsoft365.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled.entra_client",
"prowler.providers.microsoft365.services.entra.entra_security_defaults_disabled.entra_security_defaults_disabled.entra_client",
new=entra_client,
):
from prowler.providers.microsoft365.services.entra.entra_security_defaults_enabled.entra_security_defaults_enabled import (
entra_security_defaults_enabled,
from prowler.providers.microsoft365.services.entra.entra_security_defaults_disabled.entra_security_defaults_disabled import (
entra_security_defaults_disabled,
)
from prowler.providers.microsoft365.services.entra.entra_service import (
SecurityDefaults,
@@ -85,10 +89,10 @@ class Test_entra_security_defaults_enabled:
id=id, name="Sec Default", is_enabled=False
)
check = entra_security_defaults_enabled()
check = entra_security_defaults_disabled()
result = check.execute()
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].status == "PASS"
assert result[0].status_extended == "Entra Security Defaults is disabled."
assert result[0].resource_name == "Sec Default"
assert result[0].resource_id == id