From 7ad152f5fefe3a6c8c659a08e8bdc9214f013d29 Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Wed, 30 Jul 2025 14:10:31 +0200 Subject: [PATCH] fix(prowler-threatscore): remove and add requirements (#8403) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Pedro Martín --- prowler/CHANGELOG.md | 2 +- .../azure/prowler_threatscore_azure.json | 26 +++---------------- .../m365/prowler_threatscore_m365.json | 18 +++++++++++++ 3 files changed, 23 insertions(+), 23 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 4e45812f3c..816b614c20 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -18,7 +18,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Remove typo from description req 1.2.3 - Prowler ThreatScore m365 [(#8384)](https://github.com/prowler-cloud/prowler/pull/8384) - Way of counting FAILED/PASS reqs from `kisa_isms_p_2023_aws` table [(#8382)](https://github.com/prowler-cloud/prowler/pull/8382) - Avoid multiple module error calls in M365 provider [(#8353)](https://github.com/prowler-cloud/prowler/pull/8353) - +- Tweaks from Prowler ThreatScore in order to handle the correct reqs [(#8401)](https://github.com/prowler-cloud/prowler/pull/8401) --- ## [v5.9.2] (Prowler v5.9.2) diff --git a/prowler/compliance/azure/prowler_threatscore_azure.json b/prowler/compliance/azure/prowler_threatscore_azure.json index c6bc06b7e4..667bf55d1b 100644 --- a/prowler/compliance/azure/prowler_threatscore_azure.json +++ b/prowler/compliance/azure/prowler_threatscore_azure.json @@ -6,24 +6,6 @@ "Requirements": [ { "Id": "1.1.1", - "Description": "Ensure Security Defaults is enabled on Microsoft Entra ID", - "Checks": [ - "entra_security_defaults_enabled" - ], - "Attributes": [ - { - "Title": "Security Defaults enabled on Entra ID", - "Section": "1. IAM", - "SubSection": "1.1 Authentication", - "AttributeDescription": "Microsoft Entra ID Security Defaults offer preconfigured security settings designed to protect organizations from common identity attacks at no additional cost. These settings enforce basic security measures such as MFA registration, risk-based authentication prompts, and blocking legacy authentication clients that do not support MFA. Security defaults are available to all organizations and can be enabled via the Azure portal to strengthen authentication security.", - "AdditionalInformation": "Security defaults provide built-in protections to reduce the risk of unauthorized access until organizations configure their own identity security policies. By requiring MFA, blocking weak authentication methods, and adapting authentication challenges based on risk factors, these settings create a stronger security foundation without additional licensing requirements.", - "LevelOfRisk": 4, - "Weight": 100 - } - ] - }, - { - "Id": "1.1.2", "Description": "Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Privileged Users", "Checks": [ "entra_privileged_user_has_mfa" @@ -41,7 +23,7 @@ ] }, { - "Id": "1.1.3", + "Id": "1.1.2", "Description": "Ensure that 'Multi-Factor Auth Status' is 'Enabled' for all Non-Privileged Users", "Checks": [ "entra_non_privileged_user_has_mfa" @@ -59,7 +41,7 @@ ] }, { - "Id": "1.1.4", + "Id": "1.1.3", "Description": "Ensure Multi-factor Authentication is Required for Windows Azure Service Management API", "Checks": [ "entra_conditional_access_policy_require_mfa_for_management_api" @@ -77,7 +59,7 @@ ] }, { - "Id": "1.1.5", + "Id": "1.1.4", "Description": "Ensure Multi-factor Authentication is Required to access Microsoft Admin Portals", "Checks": [ "defender_ensure_defender_for_server_is_on" @@ -95,7 +77,7 @@ ] }, { - "Id": "1.1.6", + "Id": "1.1.5", "Description": "Ensure only MFA enabled identities can access privileged Virtual Machine", "Checks": [ "entra_user_with_vm_access_has_mfa" diff --git a/prowler/compliance/m365/prowler_threatscore_m365.json b/prowler/compliance/m365/prowler_threatscore_m365.json index e34d63364e..02ca5d9491 100644 --- a/prowler/compliance/m365/prowler_threatscore_m365.json +++ b/prowler/compliance/m365/prowler_threatscore_m365.json @@ -310,6 +310,24 @@ } ] }, + { + "Id": "1.1.18", + "Description": "Ensure that only administrative roles have access to Microsoft Admin Portals", + "Checks": [ + "entra_admin_portals_access_restriction" + ], + "Attributes": [ + { + "Title": "Only administrative roles have access to Microsoft Admin Portals", + "Section": "1. IAM", + "SubSection": "1.1 Authentication", + "AttributeDescription": "Restrict access to Microsoft Admin Portals exclusively to administrative roles to prevent unauthorized modifications, privilege escalation, and security misconfigurations", + "AdditionalInformation": "Granting non-administrative users access to Microsoft Admin Portals exposes the environment to unauthorized changes, potential elevation of privileges, and misconfigured security settings. This could allow attackers to alter configurations, disable protections, or gain access to sensitive information.", + "LevelOfRisk": 4, + "Weight": 100 + } + ] + }, { "Id": "1.2.1", "Description": "Ensure that only organizationally managed/approved public groups exist",