diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment.py b/prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment.py index b40fe088f0..112be23cc7 100644 --- a/prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment.py +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment.py @@ -11,22 +11,26 @@ class monitor_alert_create_policy_assignment(Check): subscription_name, activity_log_alerts, ) in monitor_client.alert_rules.items(): - report = Check_Report_Azure(self.metadata()) - report.status = "FAIL" - report.subscription = subscription_name - report.resource_name = "Monitor" - report.resource_id = "Monitor" - report.status_extended = f"There is not an alert for creating Policy Assignments in subscription {subscription_name}." for alert_rule in activity_log_alerts: if check_alert_rule( alert_rule, "Microsoft.Authorization/policyAssignments/write" ): - report.status = "PASS" - report.resource_name = alert_rule.name - report.resource_id = alert_rule.id + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=alert_rule + ) report.subscription = subscription_name + report.status = "PASS" report.status_extended = f"There is an alert configured for creating Policy Assignments in subscription {subscription_name}." break + else: + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata={} + ) + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status = "FAIL" + report.status_extended = f"There is not an alert for creating Policy Assignments in subscription {subscription_name}." findings.append(report) diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg.py b/prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg.py index 34890c2b3f..be6e361999 100644 --- a/prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg.py +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg.py @@ -11,22 +11,27 @@ class monitor_alert_create_update_nsg(Check): subscription_name, activity_log_alerts, ) in monitor_client.alert_rules.items(): - report = Check_Report_Azure(self.metadata()) - report.status = "FAIL" - report.subscription = subscription_name - report.resource_name = "Monitor" - report.resource_id = "Monitor" - report.status_extended = f"There is not an alert for creating/updating Network Security Groups in subscription {subscription_name}." for alert_rule in activity_log_alerts: if check_alert_rule( alert_rule, "Microsoft.Network/networkSecurityGroups/write" ): - report.status = "PASS" - report.resource_name = alert_rule.name - report.resource_id = alert_rule.id + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=alert_rule + ) report.subscription = subscription_name + report.status = "PASS" report.status_extended = f"There is an alert configured for creating/updating Network Security Groups in subscription {subscription_name}." break + else: + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata={} + ) + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status = "FAIL" + report.status_extended = f"There is not an alert for creating/updating Network Security Groups in subscription {subscription_name}." findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule.py b/prowler/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule.py index 4bf1a0b947..07f82099b8 100644 --- a/prowler/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule.py +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule.py @@ -11,22 +11,27 @@ class monitor_alert_create_update_public_ip_address_rule(Check): subscription_name, activity_log_alerts, ) in monitor_client.alert_rules.items(): - report = Check_Report_Azure(self.metadata()) - report.status = "FAIL" - report.subscription = subscription_name - report.resource_name = "Monitor" - report.resource_id = "Monitor" - report.status_extended = f"There is not an alert for creating/updating Public IP address rule in subscription {subscription_name}." for alert_rule in activity_log_alerts: if check_alert_rule( alert_rule, "Microsoft.Network/publicIPAddresses/write" ): - report.status = "PASS" - report.resource_name = alert_rule.name - report.resource_id = alert_rule.id + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=alert_rule + ) report.subscription = subscription_name + report.status = "PASS" report.status_extended = f"There is an alert configured for creating/updating Public IP address rule in subscription {subscription_name}." break + else: + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata={} + ) + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status = "FAIL" + report.status_extended = f"There is not an alert for creating/updating Public IP address rule in subscription {subscription_name}." findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution.py b/prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution.py index 90aab29b33..ba62b5b852 100644 --- a/prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution.py +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution.py @@ -11,22 +11,27 @@ class monitor_alert_create_update_security_solution(Check): subscription_name, activity_log_alerts, ) in monitor_client.alert_rules.items(): - report = Check_Report_Azure(self.metadata()) - report.status = "FAIL" - report.subscription = subscription_name - report.resource_name = "Monitor" - report.resource_id = "Monitor" - report.status_extended = f"There is not an alert for creating/updating Security Solution in subscription {subscription_name}." for alert_rule in activity_log_alerts: if check_alert_rule( alert_rule, "Microsoft.Security/securitySolutions/write" ): - report.status = "PASS" - report.resource_name = alert_rule.name - report.resource_id = alert_rule.id + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=alert_rule + ) report.subscription = subscription_name + report.status = "PASS" report.status_extended = f"There is an alert configured for creating/updating Security Solution in subscription {subscription_name}." break + else: + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata={} + ) + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status = "FAIL" + report.status_extended = f"There is not an alert for creating/updating Security Solution in subscription {subscription_name}." findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr.py b/prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr.py index 4c468486b4..28602df912 100644 --- a/prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr.py +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr.py @@ -11,22 +11,27 @@ class monitor_alert_create_update_sqlserver_fr(Check): subscription_name, activity_log_alerts, ) in monitor_client.alert_rules.items(): - report = Check_Report_Azure(self.metadata()) - report.status = "FAIL" - report.subscription = subscription_name - report.resource_name = "Monitor" - report.resource_id = "Monitor" - report.status_extended = f"There is not an alert for creating/updating SQL Server firewall rule in subscription {subscription_name}." for alert_rule in activity_log_alerts: if check_alert_rule( alert_rule, "Microsoft.Sql/servers/firewallRules/write" ): - report.status = "PASS" - report.resource_name = alert_rule.name - report.resource_id = alert_rule.id + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=alert_rule + ) report.subscription = subscription_name + report.status = "PASS" report.status_extended = f"There is an alert configured for creating/updating SQL Server firewall rule in subscription {subscription_name}." break + else: + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata={} + ) + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status = "FAIL" + report.status_extended = f"There is not an alert for creating/updating SQL Server firewall rule in subscription {subscription_name}." findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg.py index 7de7a9c7dd..eecead45c2 100644 --- a/prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg.py +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg.py @@ -11,24 +11,28 @@ class monitor_alert_delete_nsg(Check): subscription_name, activity_log_alerts, ) in monitor_client.alert_rules.items(): - report = Check_Report_Azure(self.metadata()) - report.status = "FAIL" - report.subscription = subscription_name - report.resource_name = "Monitor" - report.resource_id = "Monitor" - report.status_extended = f"There is not an alert for deleting Network Security Groups in subscription {subscription_name}." for alert_rule in activity_log_alerts: if check_alert_rule( alert_rule, "Microsoft.Network/networkSecurityGroups/delete" ) or check_alert_rule( alert_rule, "Microsoft.ClassicNetwork/networkSecurityGroups/delete" ): - report.status = "PASS" - report.resource_name = alert_rule.name - report.resource_id = alert_rule.id + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=alert_rule + ) report.subscription = subscription_name + report.status = "PASS" report.status_extended = f"There is an alert configured for deleting Network Security Groups in subscription {subscription_name}." break + else: + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata={} + ) + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status = "FAIL" + report.status_extended = f"There is not an alert for deleting Network Security Groups in subscription {subscription_name}." findings.append(report) diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment.py index 0898aaf9ab..84fcc91f1b 100644 --- a/prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment.py +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment.py @@ -11,22 +11,27 @@ class monitor_alert_delete_policy_assignment(Check): subscription_name, activity_log_alerts, ) in monitor_client.alert_rules.items(): - report = Check_Report_Azure(self.metadata()) - report.status = "FAIL" - report.subscription = subscription_name - report.resource_name = "Monitor" - report.resource_id = "Monitor" - report.status_extended = f"There is not an alert for deleting policy assignment in subscription {subscription_name}." for alert_rule in activity_log_alerts: if check_alert_rule( alert_rule, "Microsoft.Authorization/policyAssignments/delete" ): - report.status = "PASS" - report.resource_name = alert_rule.name - report.resource_id = alert_rule.id + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=alert_rule + ) report.subscription = subscription_name + report.status = "PASS" report.status_extended = f"There is an alert configured for deleting policy assignment in subscription {subscription_name}." break + else: + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata={} + ) + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status = "FAIL" + report.status_extended = f"There is not an alert for deleting policy assignment in subscription {subscription_name}." findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule.py index 845c5527d0..f2605677af 100644 --- a/prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule.py +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule.py @@ -11,22 +11,27 @@ class monitor_alert_delete_public_ip_address_rule(Check): subscription_name, activity_log_alerts, ) in monitor_client.alert_rules.items(): - report = Check_Report_Azure(self.metadata()) - report.status = "FAIL" - report.subscription = subscription_name - report.resource_name = "Monitor" - report.resource_id = "Monitor" - report.status_extended = f"There is not an alert for deleting public IP address rule in subscription {subscription_name}." for alert_rule in activity_log_alerts: if check_alert_rule( alert_rule, "Microsoft.Network/publicIPAddresses/delete" ): - report.status = "PASS" - report.resource_name = alert_rule.name - report.resource_id = alert_rule.id + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=alert_rule + ) report.subscription = subscription_name + report.status = "PASS" report.status_extended = f"There is an alert configured for deleting public IP address rule in subscription {subscription_name}." break + else: + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata={} + ) + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status = "FAIL" + report.status_extended = f"There is not an alert for deleting public IP address rule in subscription {subscription_name}." findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution.py index 5aa1883b9f..cac5a45f27 100644 --- a/prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution.py +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution.py @@ -11,22 +11,27 @@ class monitor_alert_delete_security_solution(Check): subscription_name, activity_log_alerts, ) in monitor_client.alert_rules.items(): - report = Check_Report_Azure(self.metadata()) - report.status = "FAIL" - report.subscription = subscription_name - report.resource_name = "Monitor" - report.resource_id = "Monitor" - report.status_extended = f"There is not an alert for deleting Security Solution in subscription {subscription_name}." for alert_rule in activity_log_alerts: if check_alert_rule( alert_rule, "Microsoft.Security/securitySolutions/delete" ): - report.status = "PASS" - report.resource_name = alert_rule.name - report.resource_id = alert_rule.id + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=alert_rule + ) report.subscription = subscription_name + report.status = "PASS" report.status_extended = f"There is an alert configured for deleting Security Solution in subscription {subscription_name}." break + else: + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata={} + ) + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status = "FAIL" + report.status_extended = f"There is not an alert for deleting Security Solution in subscription {subscription_name}." findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr.py index aeff8a6d02..0be174bbe6 100644 --- a/prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr.py +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr.py @@ -11,22 +11,27 @@ class monitor_alert_delete_sqlserver_fr(Check): subscription_name, activity_log_alerts, ) in monitor_client.alert_rules.items(): - report = Check_Report_Azure(self.metadata()) - report.status = "FAIL" - report.subscription = subscription_name - report.resource_name = "Monitor" - report.resource_id = "Monitor" - report.status_extended = f"There is not an alert for deleting SQL Server firewall rule in subscription {subscription_name}." for alert_rule in activity_log_alerts: if check_alert_rule( alert_rule, "Microsoft.Sql/servers/firewallRules/delete" ): - report.status = "PASS" - report.resource_name = alert_rule.name - report.resource_id = alert_rule.id + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=alert_rule + ) report.subscription = subscription_name + report.status = "PASS" report.status_extended = f"There is an alert configured for deleting SQL Server firewall rule in subscription {subscription_name}." break + else: + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata={} + ) + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status = "FAIL" + report.status_extended = f"There is not an alert for deleting SQL Server firewall rule in subscription {subscription_name}." findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_diagnostic_setting_with_appropriate_categories/monitor_diagnostic_setting_with_appropriate_categories.py b/prowler/providers/azure/services/monitor/monitor_diagnostic_setting_with_appropriate_categories/monitor_diagnostic_setting_with_appropriate_categories.py index 980026b490..f0ce0494f9 100644 --- a/prowler/providers/azure/services/monitor/monitor_diagnostic_setting_with_appropriate_categories/monitor_diagnostic_setting_with_appropriate_categories.py +++ b/prowler/providers/azure/services/monitor/monitor_diagnostic_setting_with_appropriate_categories/monitor_diagnostic_setting_with_appropriate_categories.py @@ -10,11 +10,13 @@ class monitor_diagnostic_setting_with_appropriate_categories(Check): subscription_name, diagnostic_settings, ) in monitor_client.diagnostics_settings.items(): - report = Check_Report_Azure(self.metadata()) - report.status = "FAIL" + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=diagnostic_settings + ) report.subscription = subscription_name report.resource_name = "Monitor" report.resource_id = "Monitor" + report.status = "FAIL" report.status_extended = f"There are no diagnostic settings capturing appropiate categories in subscription {subscription_name}." administrative_enabled = False security_enabled = False diff --git a/prowler/providers/azure/services/monitor/monitor_diagnostic_settings_exists/monitor_diagnostic_settings_exists.py b/prowler/providers/azure/services/monitor/monitor_diagnostic_settings_exists/monitor_diagnostic_settings_exists.py index e26d834868..ff08b7c76d 100644 --- a/prowler/providers/azure/services/monitor/monitor_diagnostic_settings_exists/monitor_diagnostic_settings_exists.py +++ b/prowler/providers/azure/services/monitor/monitor_diagnostic_settings_exists/monitor_diagnostic_settings_exists.py @@ -10,8 +10,10 @@ class monitor_diagnostic_settings_exists(Check): subscription_name, diagnostic_settings, ) in monitor_client.diagnostics_settings.items(): - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure(self.metadata(), diagnostic_settings) report.subscription = subscription_name + report.resource_name = "Diagnostic Settings" + report.resource_id = "diagnostic_settings" report.status = "FAIL" report.status_extended = ( f"No diagnostic settings found in subscription {subscription_name}." diff --git a/prowler/providers/azure/services/monitor/monitor_service.py b/prowler/providers/azure/services/monitor/monitor_service.py index 9bbd71efa2..abaca305f0 100644 --- a/prowler/providers/azure/services/monitor/monitor_service.py +++ b/prowler/providers/azure/services/monitor/monitor_service.py @@ -8,7 +8,6 @@ from prowler.providers.azure.azure_provider import AzureProvider from prowler.providers.azure.lib.service.service import AzureService -########################## Monitor class Monitor(AzureService): def __init__(self, provider: AzureProvider): super().__init__(MonitorManagementClient, provider) diff --git a/prowler/providers/azure/services/monitor/monitor_storage_account_with_activity_logs_cmk_encrypted/monitor_storage_account_with_activity_logs_cmk_encrypted.py b/prowler/providers/azure/services/monitor/monitor_storage_account_with_activity_logs_cmk_encrypted/monitor_storage_account_with_activity_logs_cmk_encrypted.py index d9c465faaf..dd61681047 100644 --- a/prowler/providers/azure/services/monitor/monitor_storage_account_with_activity_logs_cmk_encrypted/monitor_storage_account_with_activity_logs_cmk_encrypted.py +++ b/prowler/providers/azure/services/monitor/monitor_storage_account_with_activity_logs_cmk_encrypted/monitor_storage_account_with_activity_logs_cmk_encrypted.py @@ -16,11 +16,10 @@ class monitor_storage_account_with_activity_logs_cmk_encrypted(Check): subscription_name ]: if storage_account.name == diagnostic_setting.storage_account_name: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=storage_account + ) report.subscription = subscription_name - report.resource_name = storage_account.name - report.resource_id = storage_account.id - report.location = storage_account.location if storage_account.encryption_type == "Microsoft.Storage": report.status = "FAIL" report.status_extended = f"Storage account {storage_account.name} storing activity log in subscription {subscription_name} is not encrypted with Customer Managed Key." diff --git a/prowler/providers/azure/services/monitor/monitor_storage_account_with_activity_logs_is_private/monitor_storage_account_with_activity_logs_is_private.py b/prowler/providers/azure/services/monitor/monitor_storage_account_with_activity_logs_is_private/monitor_storage_account_with_activity_logs_is_private.py index 922101d399..98490a11f4 100644 --- a/prowler/providers/azure/services/monitor/monitor_storage_account_with_activity_logs_is_private/monitor_storage_account_with_activity_logs_is_private.py +++ b/prowler/providers/azure/services/monitor/monitor_storage_account_with_activity_logs_is_private/monitor_storage_account_with_activity_logs_is_private.py @@ -16,11 +16,10 @@ class monitor_storage_account_with_activity_logs_is_private(Check): subscription_name ]: if storage_account.name == diagnostic_setting.storage_account_name: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=storage_account + ) report.subscription = subscription_name - report.resource_name = storage_account.name - report.resource_id = storage_account.id - report.location = storage_account.location if storage_account.allow_blob_public_access: report.status = "FAIL" report.status_extended = f"Blob public access enabled in storage account {storage_account.name} storing activity logs in subscription {subscription_name}."