From 783ce136f4930ca834387b4830bd0e02c1f5dc63 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Thu, 16 Jan 2025 18:41:02 +0100 Subject: [PATCH] feat(network): extract Network resource metadata automated (#6555) Co-authored-by: Sergio Garcia --- .../network_bastion_host_exists.py | 4 +++- .../network_flow_log_captured_sent.py | 7 +++---- .../network_flow_log_more_than_90_days.py | 7 +++---- .../network_http_internet_access_restricted.py | 7 +++---- .../network_public_ip_shodan/network_public_ip_shodan.py | 7 +++---- .../network_rdp_internet_access_restricted.py | 7 +++---- .../network_ssh_internet_access_restricted.py | 7 +++---- .../network_udp_internet_access_restricted.py | 7 +++---- .../network_watcher_enabled/network_watcher_enabled.py | 4 +++- 9 files changed, 27 insertions(+), 30 deletions(-) diff --git a/prowler/providers/azure/services/network/network_bastion_host_exists/network_bastion_host_exists.py b/prowler/providers/azure/services/network/network_bastion_host_exists/network_bastion_host_exists.py index bac21226db..d6a4ef52a9 100644 --- a/prowler/providers/azure/services/network/network_bastion_host_exists/network_bastion_host_exists.py +++ b/prowler/providers/azure/services/network/network_bastion_host_exists/network_bastion_host_exists.py @@ -18,7 +18,9 @@ class network_bastion_host_exists(Check): status = "PASS" status_extended = f"Bastion Host from subscription {subscription} available are: {bastion_names}" - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=bastion_hosts + ) report.subscription = subscription report.resource_name = "Bastion Host" report.resource_id = "Bastion Host" diff --git a/prowler/providers/azure/services/network/network_flow_log_captured_sent/network_flow_log_captured_sent.py b/prowler/providers/azure/services/network/network_flow_log_captured_sent/network_flow_log_captured_sent.py index 8a2d5e566c..0dec9322e3 100644 --- a/prowler/providers/azure/services/network/network_flow_log_captured_sent/network_flow_log_captured_sent.py +++ b/prowler/providers/azure/services/network/network_flow_log_captured_sent/network_flow_log_captured_sent.py @@ -7,12 +7,11 @@ class network_flow_log_captured_sent(Check): findings = [] for subscription, network_watchers in network_client.network_watchers.items(): for network_watcher in network_watchers: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=network_watcher + ) report.subscription = subscription - report.resource_name = network_watcher.name - report.resource_id = network_watcher.id report.status = "FAIL" - report.location = network_watcher.location report.status_extended = f"Network Watcher {network_watcher.name} from subscription {subscription} has no flow logs" if network_watcher.flow_logs: report.status = "FAIL" diff --git a/prowler/providers/azure/services/network/network_flow_log_more_than_90_days/network_flow_log_more_than_90_days.py b/prowler/providers/azure/services/network/network_flow_log_more_than_90_days/network_flow_log_more_than_90_days.py index 1543a1be8d..eafd32b0ab 100644 --- a/prowler/providers/azure/services/network/network_flow_log_more_than_90_days/network_flow_log_more_than_90_days.py +++ b/prowler/providers/azure/services/network/network_flow_log_more_than_90_days/network_flow_log_more_than_90_days.py @@ -7,11 +7,10 @@ class network_flow_log_more_than_90_days(Check): findings = [] for subscription, network_watchers in network_client.network_watchers.items(): for network_watcher in network_watchers: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=network_watcher + ) report.subscription = subscription - report.resource_name = network_watcher.name - report.resource_id = network_watcher.id - report.location = network_watcher.location if network_watcher.flow_logs: report.status = "PASS" report.status_extended = f"Network Watcher {network_watcher.name} from subscription {subscription} has flow logs enabled for more than 90 days" diff --git a/prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py b/prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py index 6833c37591..c259dad7b3 100644 --- a/prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py +++ b/prowler/providers/azure/services/network/network_http_internet_access_restricted/network_http_internet_access_restricted.py @@ -7,12 +7,11 @@ class network_http_internet_access_restricted(Check): findings = [] for subscription, security_groups in network_client.security_groups.items(): for security_group in security_groups: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=security_group + ) report.subscription = subscription - report.resource_name = security_group.name - report.resource_id = security_group.id report.status = "PASS" - report.location = security_group.location report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has HTTP internet access restricted." rule_fail_condition = any( ( diff --git a/prowler/providers/azure/services/network/network_public_ip_shodan/network_public_ip_shodan.py b/prowler/providers/azure/services/network/network_public_ip_shodan/network_public_ip_shodan.py index 5c8a3b144e..f3077c8acc 100644 --- a/prowler/providers/azure/services/network/network_public_ip_shodan/network_public_ip_shodan.py +++ b/prowler/providers/azure/services/network/network_public_ip_shodan/network_public_ip_shodan.py @@ -13,11 +13,10 @@ class network_public_ip_shodan(Check): api = shodan.Shodan(shodan_api_key) for subscription, public_ips in network_client.public_ip_addresses.items(): for ip in public_ips: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=ip + ) report.subscription = subscription - report.resource_name = ip.name - report.resource_id = ip.id - report.location = ip.location try: shodan_info = api.host(ip.ip_address) report.status = "FAIL" diff --git a/prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py b/prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py index 27e2bd5058..112f63fff4 100644 --- a/prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py +++ b/prowler/providers/azure/services/network/network_rdp_internet_access_restricted/network_rdp_internet_access_restricted.py @@ -7,12 +7,11 @@ class network_rdp_internet_access_restricted(Check): findings = [] for subscription, security_groups in network_client.security_groups.items(): for security_group in security_groups: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=security_group + ) report.subscription = subscription - report.resource_name = security_group.name - report.resource_id = security_group.id report.status = "PASS" - report.location = security_group.location report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has RDP internet access restricted." rule_fail_condition = any( ( diff --git a/prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py b/prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py index f60ea13958..4aa65103fe 100644 --- a/prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py +++ b/prowler/providers/azure/services/network/network_ssh_internet_access_restricted/network_ssh_internet_access_restricted.py @@ -7,12 +7,11 @@ class network_ssh_internet_access_restricted(Check): findings = [] for subscription, security_groups in network_client.security_groups.items(): for security_group in security_groups: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=security_group + ) report.subscription = subscription - report.resource_name = security_group.name - report.resource_id = security_group.id report.status = "PASS" - report.location = security_group.location report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has SSH internet access restricted." rule_fail_condition = any( ( diff --git a/prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py b/prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py index 387c9f4483..55e465c230 100644 --- a/prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py +++ b/prowler/providers/azure/services/network/network_udp_internet_access_restricted/network_udp_internet_access_restricted.py @@ -7,12 +7,11 @@ class network_udp_internet_access_restricted(Check): findings = [] for subscription, security_groups in network_client.security_groups.items(): for security_group in security_groups: - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=security_group + ) report.subscription = subscription - report.resource_name = security_group.name - report.resource_id = security_group.id report.status = "PASS" - report.location = security_group.location report.status_extended = f"Security Group {security_group.name} from subscription {subscription} has UDP internet access restricted." rule_fail_condition = any( rule.protocol in ["UDP", "Udp"] diff --git a/prowler/providers/azure/services/network/network_watcher_enabled/network_watcher_enabled.py b/prowler/providers/azure/services/network/network_watcher_enabled/network_watcher_enabled.py index d16798c8f3..aba3c2d3d2 100644 --- a/prowler/providers/azure/services/network/network_watcher_enabled/network_watcher_enabled.py +++ b/prowler/providers/azure/services/network/network_watcher_enabled/network_watcher_enabled.py @@ -6,7 +6,9 @@ class network_watcher_enabled(Check): def execute(self) -> list[Check_Report_Azure]: findings = [] for subscription, network_watchers in network_client.network_watchers.items(): - report = Check_Report_Azure(self.metadata()) + report = Check_Report_Azure( + metadata=self.metadata(), resource_metadata=network_watchers + ) report.subscription = subscription report.resource_name = "Network Watcher" report.location = "global"