mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-23 20:42:02 +00:00
feat(monitor): extract monitor resource metadata automated (#6554)
Co-authored-by: Sergio Garcia <hello@mistercloudsec.com>
This commit is contained in:
Rubén De la Torre Vico
committed by
GitHub
GitHub
parent
8821a91f3f
commit
43fd9ee94e
+13
-9
@@ -11,22 +11,26 @@ class monitor_alert_create_policy_assignment(Check):
|
||||
subscription_name,
|
||||
activity_log_alerts,
|
||||
) in monitor_client.alert_rules.items():
|
||||
report = Check_Report_Azure(self.metadata())
|
||||
report.status = "FAIL"
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status_extended = f"There is not an alert for creating Policy Assignments in subscription {subscription_name}."
|
||||
for alert_rule in activity_log_alerts:
|
||||
if check_alert_rule(
|
||||
alert_rule, "Microsoft.Authorization/policyAssignments/write"
|
||||
):
|
||||
report.status = "PASS"
|
||||
report.resource_name = alert_rule.name
|
||||
report.resource_id = alert_rule.id
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata=alert_rule
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"There is an alert configured for creating Policy Assignments in subscription {subscription_name}."
|
||||
break
|
||||
else:
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata={}
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status = "FAIL"
|
||||
report.status_extended = f"There is not an alert for creating Policy Assignments in subscription {subscription_name}."
|
||||
|
||||
findings.append(report)
|
||||
|
||||
|
||||
+14
-9
@@ -11,22 +11,27 @@ class monitor_alert_create_update_nsg(Check):
|
||||
subscription_name,
|
||||
activity_log_alerts,
|
||||
) in monitor_client.alert_rules.items():
|
||||
report = Check_Report_Azure(self.metadata())
|
||||
report.status = "FAIL"
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status_extended = f"There is not an alert for creating/updating Network Security Groups in subscription {subscription_name}."
|
||||
for alert_rule in activity_log_alerts:
|
||||
if check_alert_rule(
|
||||
alert_rule, "Microsoft.Network/networkSecurityGroups/write"
|
||||
):
|
||||
report.status = "PASS"
|
||||
report.resource_name = alert_rule.name
|
||||
report.resource_id = alert_rule.id
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata=alert_rule
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"There is an alert configured for creating/updating Network Security Groups in subscription {subscription_name}."
|
||||
break
|
||||
else:
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata={}
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status = "FAIL"
|
||||
report.status_extended = f"There is not an alert for creating/updating Network Security Groups in subscription {subscription_name}."
|
||||
|
||||
findings.append(report)
|
||||
|
||||
return findings
|
||||
|
||||
+14
-9
@@ -11,22 +11,27 @@ class monitor_alert_create_update_public_ip_address_rule(Check):
|
||||
subscription_name,
|
||||
activity_log_alerts,
|
||||
) in monitor_client.alert_rules.items():
|
||||
report = Check_Report_Azure(self.metadata())
|
||||
report.status = "FAIL"
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status_extended = f"There is not an alert for creating/updating Public IP address rule in subscription {subscription_name}."
|
||||
for alert_rule in activity_log_alerts:
|
||||
if check_alert_rule(
|
||||
alert_rule, "Microsoft.Network/publicIPAddresses/write"
|
||||
):
|
||||
report.status = "PASS"
|
||||
report.resource_name = alert_rule.name
|
||||
report.resource_id = alert_rule.id
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata=alert_rule
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"There is an alert configured for creating/updating Public IP address rule in subscription {subscription_name}."
|
||||
break
|
||||
else:
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata={}
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status = "FAIL"
|
||||
report.status_extended = f"There is not an alert for creating/updating Public IP address rule in subscription {subscription_name}."
|
||||
|
||||
findings.append(report)
|
||||
|
||||
return findings
|
||||
|
||||
+14
-9
@@ -11,22 +11,27 @@ class monitor_alert_create_update_security_solution(Check):
|
||||
subscription_name,
|
||||
activity_log_alerts,
|
||||
) in monitor_client.alert_rules.items():
|
||||
report = Check_Report_Azure(self.metadata())
|
||||
report.status = "FAIL"
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status_extended = f"There is not an alert for creating/updating Security Solution in subscription {subscription_name}."
|
||||
for alert_rule in activity_log_alerts:
|
||||
if check_alert_rule(
|
||||
alert_rule, "Microsoft.Security/securitySolutions/write"
|
||||
):
|
||||
report.status = "PASS"
|
||||
report.resource_name = alert_rule.name
|
||||
report.resource_id = alert_rule.id
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata=alert_rule
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"There is an alert configured for creating/updating Security Solution in subscription {subscription_name}."
|
||||
break
|
||||
else:
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata={}
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status = "FAIL"
|
||||
report.status_extended = f"There is not an alert for creating/updating Security Solution in subscription {subscription_name}."
|
||||
|
||||
findings.append(report)
|
||||
|
||||
return findings
|
||||
|
||||
+14
-9
@@ -11,22 +11,27 @@ class monitor_alert_create_update_sqlserver_fr(Check):
|
||||
subscription_name,
|
||||
activity_log_alerts,
|
||||
) in monitor_client.alert_rules.items():
|
||||
report = Check_Report_Azure(self.metadata())
|
||||
report.status = "FAIL"
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status_extended = f"There is not an alert for creating/updating SQL Server firewall rule in subscription {subscription_name}."
|
||||
for alert_rule in activity_log_alerts:
|
||||
if check_alert_rule(
|
||||
alert_rule, "Microsoft.Sql/servers/firewallRules/write"
|
||||
):
|
||||
report.status = "PASS"
|
||||
report.resource_name = alert_rule.name
|
||||
report.resource_id = alert_rule.id
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata=alert_rule
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"There is an alert configured for creating/updating SQL Server firewall rule in subscription {subscription_name}."
|
||||
break
|
||||
else:
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata={}
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status = "FAIL"
|
||||
report.status_extended = f"There is not an alert for creating/updating SQL Server firewall rule in subscription {subscription_name}."
|
||||
|
||||
findings.append(report)
|
||||
|
||||
return findings
|
||||
|
||||
+13
-9
@@ -11,24 +11,28 @@ class monitor_alert_delete_nsg(Check):
|
||||
subscription_name,
|
||||
activity_log_alerts,
|
||||
) in monitor_client.alert_rules.items():
|
||||
report = Check_Report_Azure(self.metadata())
|
||||
report.status = "FAIL"
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status_extended = f"There is not an alert for deleting Network Security Groups in subscription {subscription_name}."
|
||||
for alert_rule in activity_log_alerts:
|
||||
if check_alert_rule(
|
||||
alert_rule, "Microsoft.Network/networkSecurityGroups/delete"
|
||||
) or check_alert_rule(
|
||||
alert_rule, "Microsoft.ClassicNetwork/networkSecurityGroups/delete"
|
||||
):
|
||||
report.status = "PASS"
|
||||
report.resource_name = alert_rule.name
|
||||
report.resource_id = alert_rule.id
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata=alert_rule
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"There is an alert configured for deleting Network Security Groups in subscription {subscription_name}."
|
||||
break
|
||||
else:
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata={}
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status = "FAIL"
|
||||
report.status_extended = f"There is not an alert for deleting Network Security Groups in subscription {subscription_name}."
|
||||
|
||||
findings.append(report)
|
||||
|
||||
|
||||
+14
-9
@@ -11,22 +11,27 @@ class monitor_alert_delete_policy_assignment(Check):
|
||||
subscription_name,
|
||||
activity_log_alerts,
|
||||
) in monitor_client.alert_rules.items():
|
||||
report = Check_Report_Azure(self.metadata())
|
||||
report.status = "FAIL"
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status_extended = f"There is not an alert for deleting policy assignment in subscription {subscription_name}."
|
||||
for alert_rule in activity_log_alerts:
|
||||
if check_alert_rule(
|
||||
alert_rule, "Microsoft.Authorization/policyAssignments/delete"
|
||||
):
|
||||
report.status = "PASS"
|
||||
report.resource_name = alert_rule.name
|
||||
report.resource_id = alert_rule.id
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata=alert_rule
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"There is an alert configured for deleting policy assignment in subscription {subscription_name}."
|
||||
break
|
||||
else:
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata={}
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status = "FAIL"
|
||||
report.status_extended = f"There is not an alert for deleting policy assignment in subscription {subscription_name}."
|
||||
|
||||
findings.append(report)
|
||||
|
||||
return findings
|
||||
|
||||
+14
-9
@@ -11,22 +11,27 @@ class monitor_alert_delete_public_ip_address_rule(Check):
|
||||
subscription_name,
|
||||
activity_log_alerts,
|
||||
) in monitor_client.alert_rules.items():
|
||||
report = Check_Report_Azure(self.metadata())
|
||||
report.status = "FAIL"
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status_extended = f"There is not an alert for deleting public IP address rule in subscription {subscription_name}."
|
||||
for alert_rule in activity_log_alerts:
|
||||
if check_alert_rule(
|
||||
alert_rule, "Microsoft.Network/publicIPAddresses/delete"
|
||||
):
|
||||
report.status = "PASS"
|
||||
report.resource_name = alert_rule.name
|
||||
report.resource_id = alert_rule.id
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata=alert_rule
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"There is an alert configured for deleting public IP address rule in subscription {subscription_name}."
|
||||
break
|
||||
else:
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata={}
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status = "FAIL"
|
||||
report.status_extended = f"There is not an alert for deleting public IP address rule in subscription {subscription_name}."
|
||||
|
||||
findings.append(report)
|
||||
|
||||
return findings
|
||||
|
||||
+14
-9
@@ -11,22 +11,27 @@ class monitor_alert_delete_security_solution(Check):
|
||||
subscription_name,
|
||||
activity_log_alerts,
|
||||
) in monitor_client.alert_rules.items():
|
||||
report = Check_Report_Azure(self.metadata())
|
||||
report.status = "FAIL"
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status_extended = f"There is not an alert for deleting Security Solution in subscription {subscription_name}."
|
||||
for alert_rule in activity_log_alerts:
|
||||
if check_alert_rule(
|
||||
alert_rule, "Microsoft.Security/securitySolutions/delete"
|
||||
):
|
||||
report.status = "PASS"
|
||||
report.resource_name = alert_rule.name
|
||||
report.resource_id = alert_rule.id
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata=alert_rule
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"There is an alert configured for deleting Security Solution in subscription {subscription_name}."
|
||||
break
|
||||
else:
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata={}
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status = "FAIL"
|
||||
report.status_extended = f"There is not an alert for deleting Security Solution in subscription {subscription_name}."
|
||||
|
||||
findings.append(report)
|
||||
|
||||
return findings
|
||||
|
||||
+14
-9
@@ -11,22 +11,27 @@ class monitor_alert_delete_sqlserver_fr(Check):
|
||||
subscription_name,
|
||||
activity_log_alerts,
|
||||
) in monitor_client.alert_rules.items():
|
||||
report = Check_Report_Azure(self.metadata())
|
||||
report.status = "FAIL"
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status_extended = f"There is not an alert for deleting SQL Server firewall rule in subscription {subscription_name}."
|
||||
for alert_rule in activity_log_alerts:
|
||||
if check_alert_rule(
|
||||
alert_rule, "Microsoft.Sql/servers/firewallRules/delete"
|
||||
):
|
||||
report.status = "PASS"
|
||||
report.resource_name = alert_rule.name
|
||||
report.resource_id = alert_rule.id
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata=alert_rule
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.status = "PASS"
|
||||
report.status_extended = f"There is an alert configured for deleting SQL Server firewall rule in subscription {subscription_name}."
|
||||
break
|
||||
else:
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata={}
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status = "FAIL"
|
||||
report.status_extended = f"There is not an alert for deleting SQL Server firewall rule in subscription {subscription_name}."
|
||||
|
||||
findings.append(report)
|
||||
|
||||
return findings
|
||||
|
||||
+4
-2
@@ -10,11 +10,13 @@ class monitor_diagnostic_setting_with_appropriate_categories(Check):
|
||||
subscription_name,
|
||||
diagnostic_settings,
|
||||
) in monitor_client.diagnostics_settings.items():
|
||||
report = Check_Report_Azure(self.metadata())
|
||||
report.status = "FAIL"
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata=diagnostic_settings
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Monitor"
|
||||
report.resource_id = "Monitor"
|
||||
report.status = "FAIL"
|
||||
report.status_extended = f"There are no diagnostic settings capturing appropiate categories in subscription {subscription_name}."
|
||||
administrative_enabled = False
|
||||
security_enabled = False
|
||||
|
||||
+3
-1
@@ -10,8 +10,10 @@ class monitor_diagnostic_settings_exists(Check):
|
||||
subscription_name,
|
||||
diagnostic_settings,
|
||||
) in monitor_client.diagnostics_settings.items():
|
||||
report = Check_Report_Azure(self.metadata())
|
||||
report = Check_Report_Azure(self.metadata(), diagnostic_settings)
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = "Diagnostic Settings"
|
||||
report.resource_id = "diagnostic_settings"
|
||||
report.status = "FAIL"
|
||||
report.status_extended = (
|
||||
f"No diagnostic settings found in subscription {subscription_name}."
|
||||
|
||||
@@ -8,7 +8,6 @@ from prowler.providers.azure.azure_provider import AzureProvider
|
||||
from prowler.providers.azure.lib.service.service import AzureService
|
||||
|
||||
|
||||
########################## Monitor
|
||||
class Monitor(AzureService):
|
||||
def __init__(self, provider: AzureProvider):
|
||||
super().__init__(MonitorManagementClient, provider)
|
||||
|
||||
+3
-4
@@ -16,11 +16,10 @@ class monitor_storage_account_with_activity_logs_cmk_encrypted(Check):
|
||||
subscription_name
|
||||
]:
|
||||
if storage_account.name == diagnostic_setting.storage_account_name:
|
||||
report = Check_Report_Azure(self.metadata())
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata=storage_account
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = storage_account.name
|
||||
report.resource_id = storage_account.id
|
||||
report.location = storage_account.location
|
||||
if storage_account.encryption_type == "Microsoft.Storage":
|
||||
report.status = "FAIL"
|
||||
report.status_extended = f"Storage account {storage_account.name} storing activity log in subscription {subscription_name} is not encrypted with Customer Managed Key."
|
||||
|
||||
+3
-4
@@ -16,11 +16,10 @@ class monitor_storage_account_with_activity_logs_is_private(Check):
|
||||
subscription_name
|
||||
]:
|
||||
if storage_account.name == diagnostic_setting.storage_account_name:
|
||||
report = Check_Report_Azure(self.metadata())
|
||||
report = Check_Report_Azure(
|
||||
metadata=self.metadata(), resource_metadata=storage_account
|
||||
)
|
||||
report.subscription = subscription_name
|
||||
report.resource_name = storage_account.name
|
||||
report.resource_id = storage_account.id
|
||||
report.location = storage_account.location
|
||||
if storage_account.allow_blob_public_access:
|
||||
report.status = "FAIL"
|
||||
report.status_extended = f"Blob public access enabled in storage account {storage_account.name} storing activity logs in subscription {subscription_name}."
|
||||
|
||||
Reference in New Issue
Block a user