From 8b8e1e2ca3256fc8b3a4dcb2722b5142967470bc Mon Sep 17 00:00:00 2001 From: Hugo966 <148140670+Hugo966@users.noreply.github.com> Date: Thu, 14 Mar 2024 15:14:39 +0100 Subject: [PATCH] feat(azure): 10 new checks related with alerts in monitoring (#3516) --- .../services/monitor/lib/monitor_alerts.py | 23 ++++ .../__init__.py | 0 ...ert_create_policy_assignment.metadata.json | 30 +++++ .../monitor_alert_create_policy_assignment.py | 33 ++++++ .../__init__.py | 0 ...itor_alert_create_update_nsg.metadata.json | 30 +++++ .../monitor_alert_create_update_nsg.py | 32 ++++++ ...pdate_public_ip_address_rule.metadata.json | 30 +++++ ...rt_create_update_public_ip_address_rule.py | 33 ++++++ .../__init__.py | 0 ...ate_update_security_solution.metadata.json | 30 +++++ ...r_alert_create_update_security_solution.py | 32 ++++++ .../__init__.py | 0 ...t_create_update_sqlserver_fr.metadata.json | 30 +++++ ...onitor_alert_create_update_sqlserver_fr.py | 32 ++++++ .../monitor_alert_delete_nsg/__init__.py | 0 .../monitor_alert_delete_nsg.metadata.json | 30 +++++ .../monitor_alert_delete_nsg.py | 35 ++++++ .../__init__.py | 0 ...ert_delete_policy_assignment.metadata.json | 30 +++++ .../monitor_alert_delete_policy_assignment.py | 32 ++++++ .../__init__.py | 0 ...elete_public_ip_address_rule.metadata.json | 30 +++++ ...tor_alert_delete_public_ip_address_rule.py | 32 ++++++ .../__init__.py | 0 ...ert_delete_security_solution.metadata.json | 30 +++++ .../monitor_alert_delete_security_solution.py | 32 ++++++ .../__init__.py | 0 ...or_alert_delete_sqlserver_fr.metadata.json | 30 +++++ .../monitor_alert_delete_sqlserver_fr.py | 32 ++++++ .../azure/services/monitor/monitor_service.py | 35 +++++- ...tor_alert_create_policy_assignment_test.py | 106 ++++++++++++++++++ .../monitor_alert_create_update_nsg_test.py | 105 +++++++++++++++++ ...eate_update_public_ip_address_rule_test.py | 105 +++++++++++++++++ ...rt_create_update_security_solution_test.py | 105 +++++++++++++++++ ...r_alert_create_update_sqlserver_fr_test.py | 105 +++++++++++++++++ .../monitor_alert_delete_nsg_test.py | 105 +++++++++++++++++ ...tor_alert_delete_policy_assignment_test.py | 106 ++++++++++++++++++ ...lert_delete_public_ip_address_rule_test.py | 105 +++++++++++++++++ ...tor_alert_delete_security_solution_test.py | 105 +++++++++++++++++ .../monitor_alert_delete_sqlserver_fr_test.py | 105 +++++++++++++++++ .../services/monitor/monitor_service_test.py | 68 +++++++++++ 42 files changed, 1802 insertions(+), 1 deletion(-) create mode 100644 prowler/providers/azure/services/monitor/lib/monitor_alerts.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/__init__.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment.metadata.json create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/__init__.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg.metadata.json create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule.metadata.json create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/__init__.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution.metadata.json create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/__init__.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr.metadata.json create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/__init__.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg.metadata.json create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/__init__.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment.metadata.json create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/__init__.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule.metadata.json create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/__init__.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution.metadata.json create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/__init__.py create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr.metadata.json create mode 100644 prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr.py create mode 100644 tests/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment_test.py create mode 100644 tests/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg_test.py create mode 100644 tests/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule_test.py create mode 100644 tests/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution_test.py create mode 100644 tests/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr_test.py create mode 100644 tests/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg_test.py create mode 100644 tests/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment_test.py create mode 100644 tests/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule_test.py create mode 100644 tests/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution_test.py create mode 100644 tests/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr_test.py diff --git a/prowler/providers/azure/services/monitor/lib/monitor_alerts.py b/prowler/providers/azure/services/monitor/lib/monitor_alerts.py new file mode 100644 index 0000000000..87a34b3a50 --- /dev/null +++ b/prowler/providers/azure/services/monitor/lib/monitor_alerts.py @@ -0,0 +1,23 @@ +""" +This module contains functions related to monitoring alerts in Azure. +""" + + +def check_alert_rule(alert_rule, expected_equal) -> bool: + """ + Checks if an alert rule meets the specified condition. + + Args: + alert_rule: An object representing the alert rule to be checked. + expected_equal: The expected value for the "operationName" field. + + Returns: + A boolean value indicating whether the alert rule meets the condition. + """ + + if alert_rule.enabled: + for element in alert_rule.condition.all_of: + if element.field == "operationName" and element.equals == expected_equal: + return True + + return False diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/__init__.py b/prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment.metadata.json b/prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment.metadata.json new file mode 100644 index 0000000000..ad102df518 --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "azure", + "CheckID": "monitor_alert_create_policy_assignment", + "CheckTitle": "Ensure that Activity Log Alert exists for Create Policy Assignment", + "CheckType": [], + "ServiceName": "monitor", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Monitor", + "Description": "Create an activity log alert for the Create Policy Assignment event.", + "Risk": "Monitoring for create policy assignment events gives insight into changes done in 'Azure policy - assignments' and can reduce the time it takes to detect unsolicited changes.", + "RelatedUrl": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement", + "Remediation": { + "Code": { + "CLI": "az monitor activity-log alert create --resource-group '' --condition category=Administrative and operationName=Microsoft.Authorization/policyAssignments/write and level= --scope '/subscriptions/' --name '' -- subscription --action-group --location global", + "NativeIaC": "", + "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/create-alert-for-create-policy-assignment-events.html#trendmicro", + "Terraform": "" + }, + "Recommendation": { + "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Policy assignment (policyAssignments). 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Create policy assignment (Microsoft.Authorization/policyAssignments). 12. Select the Actions tab. 13. To use an existing action group, click elect action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.", + "Url": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "By default, no monitoring alerts are created." +} diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment.py b/prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment.py new file mode 100644 index 0000000000..b40fe088f0 --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment.py @@ -0,0 +1,33 @@ +from prowler.lib.check.models import Check, Check_Report_Azure +from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule +from prowler.providers.azure.services.monitor.monitor_client import monitor_client + + +class monitor_alert_create_policy_assignment(Check): + def execute(self) -> Check_Report_Azure: + findings = [] + + for ( + subscription_name, + activity_log_alerts, + ) in monitor_client.alert_rules.items(): + report = Check_Report_Azure(self.metadata()) + report.status = "FAIL" + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status_extended = f"There is not an alert for creating Policy Assignments in subscription {subscription_name}." + for alert_rule in activity_log_alerts: + if check_alert_rule( + alert_rule, "Microsoft.Authorization/policyAssignments/write" + ): + report.status = "PASS" + report.resource_name = alert_rule.name + report.resource_id = alert_rule.id + report.subscription = subscription_name + report.status_extended = f"There is an alert configured for creating Policy Assignments in subscription {subscription_name}." + break + + findings.append(report) + + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/__init__.py b/prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg.metadata.json b/prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg.metadata.json new file mode 100644 index 0000000000..b36be1ee1a --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "azure", + "CheckID": "monitor_alert_create_update_policy_assignment", + "CheckTitle": "Ensure that Activity Log Alert exists for Create or Update Network Security Group", + "CheckType": [], + "ServiceName": "monitor", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Monitor", + "Description": "Create an Activity Log Alert for the Create or Update Network Security Group event.", + "Risk": "Monitoring for Create or Update Network Security Group events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.", + "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log", + "Remediation": { + "Code": { + "CLI": "az monitor activity-log alert create --resource-group '' --condition category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/write and level=verbose --scope '/subscriptions/' --name '' --subscription --action-group --location global", + "NativeIaC": "", + "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/create-update-network-security-group-rule-alert-in-use.html#trendmicro", + "Terraform": "" + }, + "Recommendation": { + "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Network security groups. 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Create or Update Network Security Group (Microsoft.Network/networkSecurityGroups). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.", + "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "By default, no monitoring alerts are created." +} diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg.py b/prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg.py new file mode 100644 index 0000000000..34890c2b3f --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg.py @@ -0,0 +1,32 @@ +from prowler.lib.check.models import Check, Check_Report_Azure +from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule +from prowler.providers.azure.services.monitor.monitor_client import monitor_client + + +class monitor_alert_create_update_nsg(Check): + def execute(self) -> Check_Report_Azure: + findings = [] + + for ( + subscription_name, + activity_log_alerts, + ) in monitor_client.alert_rules.items(): + report = Check_Report_Azure(self.metadata()) + report.status = "FAIL" + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status_extended = f"There is not an alert for creating/updating Network Security Groups in subscription {subscription_name}." + for alert_rule in activity_log_alerts: + if check_alert_rule( + alert_rule, "Microsoft.Network/networkSecurityGroups/write" + ): + report.status = "PASS" + report.resource_name = alert_rule.name + report.resource_id = alert_rule.id + report.subscription = subscription_name + report.status_extended = f"There is an alert configured for creating/updating Network Security Groups in subscription {subscription_name}." + break + + findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule.metadata.json b/prowler/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule.metadata.json new file mode 100644 index 0000000000..667ba826e5 --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "azure", + "CheckID": "monitor_alert_create_update_public_ip_address_rule", + "CheckTitle": "Ensure that Activity Log Alert exists for Create or Update Public IP Address rule", + "CheckType": [], + "ServiceName": "monitor", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Monitor", + "Description": "Create an activity log alert for the Create or Update Public IP Addresses rule.", + "Risk": "Monitoring for Create or Update Public IP Address events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.", + "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log", + "Remediation": { + "Code": { + "CLI": "az monitor activity-log alert create --resource-group '' --condition category=Administrative and operationName=Microsoft.Network/publicIPAddresses/write and level=--scope '/subscriptions/' --name '' -- subscription --action-group --location global", + "NativeIaC": "", + "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/create-or-update-public-ip-alert.html#trendmicro", + "Terraform": "" + }, + "Recommendation": { + "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Public IP addresses. 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Create or Update Public Ip Address (Microsoft.Network/publicIPAddresses). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.", + "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "By default, no monitoring alerts are created." +} diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule.py b/prowler/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule.py new file mode 100644 index 0000000000..c616f7c69c --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule.py @@ -0,0 +1,33 @@ +from prowler.lib.check.models import Check, Check_Report_Azure +from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule +from prowler.providers.azure.services.monitor.monitor_client import monitor_client + + +class monitor_alert_create_update_public_ip_address_rule(Check): + def execute(self) -> Check_Report_Azure: + findings = [] + + for ( + subscription_name, + activity_log_alerts, + ) in monitor_client.alert_rules.items(): + report = Check_Report_Azure(self.metadata()) + report.status = "FAIL" + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status_extended = f"There is not an alert for creating/updating Public IP address rule in subscription {subscription_name}." + for alert_rule in activity_log_alerts: + if check_alert_rule( + alert_rule, "Microsoft.Network/publicIPAddresses/write" + ): + report.status = "PASS" + report.resource_name = alert_rule.name + report.resource_id = alert_rule.id + report.subscription = subscription_name + report.status_extended = f"There is an alert configured for creating/updating Public IP address rule in subscription {subscription_name}." + break + + findings.append(report) + + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/__init__.py b/prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution.metadata.json b/prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution.metadata.json new file mode 100644 index 0000000000..f660216f28 --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "azure", + "CheckID": "monitor_alert_create_update_security_solution", + "CheckTitle": "Ensure that Activity Log Alert exists for Create or Update Security Solution", + "CheckType": [], + "ServiceName": "monitor", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Monitor", + "Description": "Create an activity log alert for the Create or Update Security Solution event.", + "Risk": "Monitoring for Create or Update Security Solution events gives insight into changes to the active security solutions and may reduce the time it takes to detect suspicious activity.", + "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log", + "Remediation": { + "Code": { + "CLI": "az monitor activity-log alert create --resource-group '' --condition category=Administrative and operationName=Microsoft.Security/securitySolutions/write and level=--scope '/subscriptions/' --name '' -- subscription --action-group --location global", + "NativeIaC": "", + "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/create-or-update-security-solution-alert.html#trendmicro", + "Terraform": "" + }, + "Recommendation": { + "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Security Solutions (securitySolutions). 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Create or Update Security Solutions (Microsoft.Security/securitySolutions). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.", + "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "By default, no monitoring alerts are created." +} diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution.py b/prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution.py new file mode 100644 index 0000000000..90aab29b33 --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution.py @@ -0,0 +1,32 @@ +from prowler.lib.check.models import Check, Check_Report_Azure +from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule +from prowler.providers.azure.services.monitor.monitor_client import monitor_client + + +class monitor_alert_create_update_security_solution(Check): + def execute(self) -> Check_Report_Azure: + findings = [] + + for ( + subscription_name, + activity_log_alerts, + ) in monitor_client.alert_rules.items(): + report = Check_Report_Azure(self.metadata()) + report.status = "FAIL" + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status_extended = f"There is not an alert for creating/updating Security Solution in subscription {subscription_name}." + for alert_rule in activity_log_alerts: + if check_alert_rule( + alert_rule, "Microsoft.Security/securitySolutions/write" + ): + report.status = "PASS" + report.resource_name = alert_rule.name + report.resource_id = alert_rule.id + report.subscription = subscription_name + report.status_extended = f"There is an alert configured for creating/updating Security Solution in subscription {subscription_name}." + break + + findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/__init__.py b/prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr.metadata.json b/prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr.metadata.json new file mode 100644 index 0000000000..eecacc7705 --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "azure", + "CheckID": "monitor_alert_create_update_sqlserver_fr", + "CheckTitle": "Ensure that Activity Log Alert exists for Create or Update SQL Server Firewall Rule", + "CheckType": [], + "ServiceName": "monitor", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Monitor", + "Description": "Create an activity log alert for the Create or Update SQL Server Firewall Rule event.", + "Risk": "Monitoring for Create or Update SQL Server Firewall Rule events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.", + "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log", + "Remediation": { + "Code": { + "CLI": "az monitor activity-log alert create --resource-group '' --condition category=Administrative and operationName=Microsoft.Sql/servers/firewallRules/write and level=--scope '/subscriptions/' --name '' -- subscription --action-group --location global", + "NativeIaC": "", + "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/create-or-update-or-delete-sql-server-firewall-rule-alert.html#trendmicro", + "Terraform": "" + }, + "Recommendation": { + "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Server Firewall Rule (servers/firewallRules). 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Create/Update server firewall rule (Microsoft.Sql/servers/firewallRules). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.", + "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "By default, no monitoring alerts are created." +} diff --git a/prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr.py b/prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr.py new file mode 100644 index 0000000000..4c468486b4 --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr.py @@ -0,0 +1,32 @@ +from prowler.lib.check.models import Check, Check_Report_Azure +from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule +from prowler.providers.azure.services.monitor.monitor_client import monitor_client + + +class monitor_alert_create_update_sqlserver_fr(Check): + def execute(self) -> Check_Report_Azure: + findings = [] + + for ( + subscription_name, + activity_log_alerts, + ) in monitor_client.alert_rules.items(): + report = Check_Report_Azure(self.metadata()) + report.status = "FAIL" + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status_extended = f"There is not an alert for creating/updating SQL Server firewall rule in subscription {subscription_name}." + for alert_rule in activity_log_alerts: + if check_alert_rule( + alert_rule, "Microsoft.Sql/servers/firewallRules/write" + ): + report.status = "PASS" + report.resource_name = alert_rule.name + report.resource_id = alert_rule.id + report.subscription = subscription_name + report.status_extended = f"There is an alert configured for creating/updating SQL Server firewall rule in subscription {subscription_name}." + break + + findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/__init__.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg.metadata.json b/prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg.metadata.json new file mode 100644 index 0000000000..c5ab182c44 --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "azure", + "CheckID": "monitor_alert_delete_nsg", + "CheckTitle": "Ensure that Activity Log Alert exists for Delete Network Security Group", + "CheckType": [], + "ServiceName": "monitor", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Monitor", + "Description": "Create an activity log alert for the Delete Network Security Group event.", + "Risk": "Monitoring for 'Delete Network Security Group' events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.", + "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log", + "Remediation": { + "Code": { + "CLI": "az monitor activity-log alert create --resource-group '' --condition category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/delete and level=--scope '/subscriptions/' --name '' -- subscription --action-group --location global", + "NativeIaC": "", + "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/delete-network-security-group-rule-alert-in-use.html#trendmicro", + "Terraform": "" + }, + "Recommendation": { + "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Network security groups. 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Delete Network Security Group (Microsoft.Network/networkSecurityGroups). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.", + "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "By default, no monitoring alerts are created." +} diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg.py new file mode 100644 index 0000000000..7de7a9c7dd --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg.py @@ -0,0 +1,35 @@ +from prowler.lib.check.models import Check, Check_Report_Azure +from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule +from prowler.providers.azure.services.monitor.monitor_client import monitor_client + + +class monitor_alert_delete_nsg(Check): + def execute(self) -> Check_Report_Azure: + findings = [] + + for ( + subscription_name, + activity_log_alerts, + ) in monitor_client.alert_rules.items(): + report = Check_Report_Azure(self.metadata()) + report.status = "FAIL" + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status_extended = f"There is not an alert for deleting Network Security Groups in subscription {subscription_name}." + for alert_rule in activity_log_alerts: + if check_alert_rule( + alert_rule, "Microsoft.Network/networkSecurityGroups/delete" + ) or check_alert_rule( + alert_rule, "Microsoft.ClassicNetwork/networkSecurityGroups/delete" + ): + report.status = "PASS" + report.resource_name = alert_rule.name + report.resource_id = alert_rule.id + report.subscription = subscription_name + report.status_extended = f"There is an alert configured for deleting Network Security Groups in subscription {subscription_name}." + break + + findings.append(report) + + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/__init__.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment.metadata.json b/prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment.metadata.json new file mode 100644 index 0000000000..f655257c8a --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "azure", + "CheckID": "monitor_alert_delete_policy_assignment", + "CheckTitle": "Ensure that Activity Log Alert exists for Delete Policy Assignment", + "CheckType": [], + "ServiceName": "monitor", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Monitor", + "Description": "Create an activity log alert for the Delete Policy Assignment event.", + "Risk": "Monitoring for delete policy assignment events gives insight into changes done in 'azure policy - assignments' and can reduce the time it takes to detect unsolicited changes.", + "RelatedUrl": "https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate", + "Remediation": { + "Code": { + "CLI": "az monitor activity-log alert create --resource-group '' --condition category=Administrative and operationName=Microsoft.Authorization/policyAssignments/delete and level= --scope '/subscriptions/' --name '' -- subscription --action-group --location global", + "NativeIaC": "", + "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/delete-policy-assignment-alert-in-use.html#trendmicro", + "Terraform": "" + }, + "Recommendation": { + "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Policy assignment (policyAssignments). 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Delete policy assignment (Microsoft.Authorization/policyAssignments). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.", + "Url": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "By default, no monitoring alerts are created." +} diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment.py new file mode 100644 index 0000000000..0898aaf9ab --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment.py @@ -0,0 +1,32 @@ +from prowler.lib.check.models import Check, Check_Report_Azure +from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule +from prowler.providers.azure.services.monitor.monitor_client import monitor_client + + +class monitor_alert_delete_policy_assignment(Check): + def execute(self) -> Check_Report_Azure: + findings = [] + + for ( + subscription_name, + activity_log_alerts, + ) in monitor_client.alert_rules.items(): + report = Check_Report_Azure(self.metadata()) + report.status = "FAIL" + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status_extended = f"There is not an alert for deleting policy assignment in subscription {subscription_name}." + for alert_rule in activity_log_alerts: + if check_alert_rule( + alert_rule, "Microsoft.Authorization/policyAssignments/delete" + ): + report.status = "PASS" + report.resource_name = alert_rule.name + report.resource_id = alert_rule.id + report.subscription = subscription_name + report.status_extended = f"There is an alert configured for deleting policy assignment in subscription {subscription_name}." + break + + findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/__init__.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule.metadata.json b/prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule.metadata.json new file mode 100644 index 0000000000..e23e2b237f --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "azure", + "CheckID": "monitor_alert_delete_public_ip_address_rule", + "CheckTitle": "Ensure that Activity Log Alert exists for Delete Public IP Address rule", + "CheckType": [], + "ServiceName": "monitor", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Monitor", + "Description": "Create an activity log alert for the Delete Public IP Address rule.", + "Risk": "Monitoring for Delete Public IP Address events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.", + "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log", + "Remediation": { + "Code": { + "CLI": "az monitor activity-log alert create --resource-group '' --condition category=Administrative and operationName=Microsoft.Network/publicIPAddresses/delete and level=--scope '/subscriptions/' --name '' -- subscription --action-group --location global", + "NativeIaC": "", + "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/delete-public-ip-alert.html#trendmicro", + "Terraform": "" + }, + "Recommendation": { + "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Public IP addresses. 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Delete Public Ip Address (Microsoft.Network/publicIPAddresses). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.", + "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "By default, no monitoring alerts are created." +} diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule.py new file mode 100644 index 0000000000..845c5527d0 --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule.py @@ -0,0 +1,32 @@ +from prowler.lib.check.models import Check, Check_Report_Azure +from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule +from prowler.providers.azure.services.monitor.monitor_client import monitor_client + + +class monitor_alert_delete_public_ip_address_rule(Check): + def execute(self) -> Check_Report_Azure: + findings = [] + + for ( + subscription_name, + activity_log_alerts, + ) in monitor_client.alert_rules.items(): + report = Check_Report_Azure(self.metadata()) + report.status = "FAIL" + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status_extended = f"There is not an alert for deleting public IP address rule in subscription {subscription_name}." + for alert_rule in activity_log_alerts: + if check_alert_rule( + alert_rule, "Microsoft.Network/publicIPAddresses/delete" + ): + report.status = "PASS" + report.resource_name = alert_rule.name + report.resource_id = alert_rule.id + report.subscription = subscription_name + report.status_extended = f"There is an alert configured for deleting public IP address rule in subscription {subscription_name}." + break + + findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/__init__.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution.metadata.json b/prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution.metadata.json new file mode 100644 index 0000000000..780c454ad8 --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "azure", + "CheckID": "monitor_alert_delete_security_solution", + "CheckTitle": "Ensure that Activity Log Alert exists for Delete Security Solution", + "CheckType": [], + "ServiceName": "monitor", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Monitor", + "Description": "Create an activity log alert for the Delete Security Solution event.", + "Risk": "Monitoring for Delete Security Solution events gives insight into changes to the active security solutions and may reduce the time it takes to detect suspicious activity.", + "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log", + "Remediation": { + "Code": { + "CLI": "az monitor activity-log alert create --resource-group '' --condition category=Administrative and operationName=Microsoft.Security/securitySolutions/delete and level=--scope '/subscriptions/' --name '' -- subscription --action-group --location global", + "NativeIaC": "", + "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/delete-security-solution-alert.html#trendmicro", + "Terraform": "" + }, + "Recommendation": { + "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Security Solutions (securitySolutions). 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Delete Security Solutions (Microsoft.Security/securitySolutions). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.curitySolutions). 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Create or Update Security Solutions (Microsoft.Security/securitySolutions). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.", + "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "By default, no monitoring alerts are created." +} diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution.py new file mode 100644 index 0000000000..5aa1883b9f --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution.py @@ -0,0 +1,32 @@ +from prowler.lib.check.models import Check, Check_Report_Azure +from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule +from prowler.providers.azure.services.monitor.monitor_client import monitor_client + + +class monitor_alert_delete_security_solution(Check): + def execute(self) -> Check_Report_Azure: + findings = [] + + for ( + subscription_name, + activity_log_alerts, + ) in monitor_client.alert_rules.items(): + report = Check_Report_Azure(self.metadata()) + report.status = "FAIL" + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status_extended = f"There is not an alert for deleting Security Solution in subscription {subscription_name}." + for alert_rule in activity_log_alerts: + if check_alert_rule( + alert_rule, "Microsoft.Security/securitySolutions/delete" + ): + report.status = "PASS" + report.resource_name = alert_rule.name + report.resource_id = alert_rule.id + report.subscription = subscription_name + report.status_extended = f"There is an alert configured for deleting Security Solution in subscription {subscription_name}." + break + + findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/__init__.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr.metadata.json b/prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr.metadata.json new file mode 100644 index 0000000000..bb709a12e9 --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr.metadata.json @@ -0,0 +1,30 @@ +{ + "Provider": "azure", + "CheckID": "monitor_alert_delete_sqlserver_fr", + "CheckTitle": "Ensure that Activity Log Alert exists for Delete SQL Server Firewall Rule", + "CheckType": [], + "ServiceName": "monitor", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "Monitor", + "Description": "Create an activity log alert for the 'Delete SQL Server Firewall Rule.'", + "Risk": "Monitoring for Delete SQL Server Firewall Rule events gives insight into SQL network access changes and may reduce the time it takes to detect suspicious activity.", + "RelatedUrl": "https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log", + "Remediation": { + "Code": { + "CLI": "az monitor activity-log alert create --resource-group '' --condition category=Administrative and operationName=Microsoft.Sql/servers/firewallRules/delete and level=--scope '/subscriptions/' --name '' -- subscription --action-group --location global", + "NativeIaC": "", + "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/azure/ActivityLog/create-or-update-or-delete-sql-server-firewall-rule-alert.html#trendmicro", + "Terraform": "" + }, + "Recommendation": { + "Text": "1. Navigate to the Monitor blade. 2. Select Alerts. 3. Select Create. 4. Select Alert rule. 5. Under Filter by subscription, choose a subscription. 6. Under Filter by resource type, select Server Firewall Rule (servers/firewallRules). 7. Under Filter by location, select All. 8. From the results, select the subscription. 9. Select Done. 10. Select the Condition tab. 11. Under Signal name, click Delete server firewall rule (Microsoft.Sql/servers/firewallRules). 12. Select the Actions tab. 13. To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection. 14. Select the Details tab. 15. Select a Resource group, provide an Alert rule name and an optional Alert rule description. 16. Click Review + create. 17. Click Create.", + "Url": "https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement" + } + }, + "Categories": [], + "DependsOn": [], + "RelatedTo": [], + "Notes": "By default, no monitoring alerts are created." +} diff --git a/prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr.py b/prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr.py new file mode 100644 index 0000000000..aeff8a6d02 --- /dev/null +++ b/prowler/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr.py @@ -0,0 +1,32 @@ +from prowler.lib.check.models import Check, Check_Report_Azure +from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule +from prowler.providers.azure.services.monitor.monitor_client import monitor_client + + +class monitor_alert_delete_sqlserver_fr(Check): + def execute(self) -> Check_Report_Azure: + findings = [] + + for ( + subscription_name, + activity_log_alerts, + ) in monitor_client.alert_rules.items(): + report = Check_Report_Azure(self.metadata()) + report.status = "FAIL" + report.subscription = subscription_name + report.resource_name = "Monitor" + report.resource_id = "Monitor" + report.status_extended = f"There is not an alert for deleting SQL Server firewall rule in subscription {subscription_name}." + for alert_rule in activity_log_alerts: + if check_alert_rule( + alert_rule, "Microsoft.Sql/servers/firewallRules/delete" + ): + report.status = "PASS" + report.resource_name = alert_rule.name + report.resource_id = alert_rule.id + report.subscription = subscription_name + report.status_extended = f"There is an alert configured for deleting SQL Server firewall rule in subscription {subscription_name}." + break + + findings.append(report) + return findings diff --git a/prowler/providers/azure/services/monitor/monitor_service.py b/prowler/providers/azure/services/monitor/monitor_service.py index 7570cd5aa8..b7d644f260 100644 --- a/prowler/providers/azure/services/monitor/monitor_service.py +++ b/prowler/providers/azure/services/monitor/monitor_service.py @@ -1,7 +1,7 @@ from dataclasses import dataclass from azure.mgmt.monitor import MonitorManagementClient -from azure.mgmt.monitor.models import LogSettings +from azure.mgmt.monitor.models import AlertRuleAllOfCondition, LogSettings from prowler.lib.logger import logger from prowler.providers.azure.lib.service.service import AzureService @@ -13,6 +13,7 @@ class Monitor(AzureService): super().__init__(MonitorManagementClient, audit_info) self.diagnostics_settings = self.__get_diagnostics_settings__() + self.alert_rules = self.get_alert_rules() def __get_diagnostics_settings__(self): logger.info("Monitor - Getting diagnostics settings...") @@ -41,6 +42,29 @@ class Monitor(AzureService): ) return diagnostics_settings + def get_alert_rules(self): + logger.info("Monitor - Getting alert rules...") + alert_rules = {} + for subscription, client in self.clients.items(): + try: + alert_rules.update({subscription: []}) + rules = client.activity_log_alerts.list_by_subscription_id() + for rule in rules: + alert_rules[subscription].append( + AlertRule( + id=rule.id, + name=rule.name, + condition=rule.condition, + enabled=rule.enabled, + description=rule.description, + ) + ) + except Exception as error: + logger.error( + f"Subscription name: {subscription} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}" + ) + return alert_rules + @dataclass class DiagnosticSetting: @@ -48,3 +72,12 @@ class DiagnosticSetting: storage_account_id: str storage_account_name: str logs: LogSettings + + +@dataclass +class AlertRule: + id: str + name: str + condition: AlertRuleAllOfCondition + enabled: bool + description: str diff --git a/tests/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment_test.py b/tests/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment_test.py new file mode 100644 index 0000000000..e5cca139f8 --- /dev/null +++ b/tests/providers/azure/services/monitor/monitor_alert_create_policy_assignment/monitor_alert_create_policy_assignment_test.py @@ -0,0 +1,106 @@ +from unittest import mock + +from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition + +from prowler.providers.azure.services.monitor.monitor_service import ( + AlertRule, + AlertRuleAllOfCondition, +) +from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION + + +class Test_monitor_alert_create_policy_assignment: + def test_monitor_alert_create_policy_assignment_no_subscriptions(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = {} + + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_policy_assignment.monitor_alert_create_policy_assignment.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_policy_assignment.monitor_alert_create_policy_assignment import ( + monitor_alert_create_policy_assignment, + ) + + check = monitor_alert_create_policy_assignment() + result = check.execute() + assert len(result) == 0 + + def test_no_alert_rules(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_policy_assignment.monitor_alert_create_policy_assignment.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_policy_assignment.monitor_alert_create_policy_assignment import ( + monitor_alert_create_policy_assignment, + ) + + check = monitor_alert_create_policy_assignment() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "Monitor" + assert result[0].resource_id == "Monitor" + assert ( + result[0].status_extended + == f"There is not an alert for creating Policy Assignments in subscription {AZURE_SUBSCRIPTION}." + ) + + def test_alert_rules_configured(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = { + AZURE_SUBSCRIPTION: [ + AlertRule( + id="id", + name="name", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Authorization/policyAssignments/write", + field="operationName", + ), + ] + ), + enabled=False, + description="description", + ), + AlertRule( + id="id2", + name="name2", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Authorization/policyAssignments/write", + field="operationName", + ), + ] + ), + enabled=True, + description="description2", + ), + ] + } + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_policy_assignment.monitor_alert_create_policy_assignment.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_policy_assignment.monitor_alert_create_policy_assignment import ( + monitor_alert_create_policy_assignment, + ) + + check = monitor_alert_create_policy_assignment() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "name2" + assert result[0].resource_id == "id2" + assert ( + result[0].status_extended + == f"There is an alert configured for creating Policy Assignments in subscription {AZURE_SUBSCRIPTION}." + ) diff --git a/tests/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg_test.py b/tests/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg_test.py new file mode 100644 index 0000000000..272e9397c3 --- /dev/null +++ b/tests/providers/azure/services/monitor/monitor_alert_create_update_nsg/monitor_alert_create_update_nsg_test.py @@ -0,0 +1,105 @@ +from unittest import mock + +from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition + +from prowler.providers.azure.services.monitor.monitor_service import ( + AlertRule, + AlertRuleAllOfCondition, +) +from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION + + +class Test_monitor_alert_create_update_nsg: + def test_monitor_alert_create_update_nsg_no_subscriptions(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = {} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_update_nsg.monitor_alert_create_update_nsg.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_update_nsg.monitor_alert_create_update_nsg import ( + monitor_alert_create_update_nsg, + ) + + check = monitor_alert_create_update_nsg() + result = check.execute() + assert len(result) == 0 + + def test_no_alert_rules(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_update_nsg.monitor_alert_create_update_nsg.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_update_nsg.monitor_alert_create_update_nsg import ( + monitor_alert_create_update_nsg, + ) + + check = monitor_alert_create_update_nsg() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "Monitor" + assert result[0].resource_id == "Monitor" + assert ( + result[0].status_extended + == f"There is not an alert for creating/updating Network Security Groups in subscription {AZURE_SUBSCRIPTION}." + ) + + def test_alert_rules_configured(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = { + AZURE_SUBSCRIPTION: [ + AlertRule( + id="id", + name="name", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Network/networkSecurityGroups/write", + field="operationName", + ), + ] + ), + enabled=False, + description="description", + ), + AlertRule( + id="id2", + name="name2", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Network/networkSecurityGroups/write", + field="operationName", + ), + ] + ), + enabled=True, + description="description2", + ), + ] + } + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_update_nsg.monitor_alert_create_update_nsg.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_update_nsg.monitor_alert_create_update_nsg import ( + monitor_alert_create_update_nsg, + ) + + check = monitor_alert_create_update_nsg() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "name2" + assert result[0].resource_id == "id2" + assert ( + result[0].status_extended + == f"There is an alert configured for creating/updating Network Security Groups in subscription {AZURE_SUBSCRIPTION}." + ) diff --git a/tests/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule_test.py b/tests/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule_test.py new file mode 100644 index 0000000000..002986fb41 --- /dev/null +++ b/tests/providers/azure/services/monitor/monitor_alert_create_update_public_ip_address_rule/monitor_alert_create_update_public_ip_address_rule_test.py @@ -0,0 +1,105 @@ +from unittest import mock + +from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition + +from prowler.providers.azure.services.monitor.monitor_service import ( + AlertRule, + AlertRuleAllOfCondition, +) +from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION + + +class Test_monitor_alert_create_update_security_solution: + def test_monitor_alert_create_update_public_ip_address_rule_no_subscriptions(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_update_public_ip_address_rule.monitor_alert_create_update_public_ip_address_rule.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_update_public_ip_address_rule.monitor_alert_create_update_public_ip_address_rule import ( + monitor_alert_create_update_public_ip_address_rule, + ) + + check = monitor_alert_create_update_public_ip_address_rule() + result = check.execute() + assert len(result) == 0 + + def test_no_alert_rules(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_update_public_ip_address_rule.monitor_alert_create_update_public_ip_address_rule.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_update_public_ip_address_rule.monitor_alert_create_update_public_ip_address_rule import ( + monitor_alert_create_update_public_ip_address_rule, + ) + + check = monitor_alert_create_update_public_ip_address_rule() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "Monitor" + assert result[0].resource_id == "Monitor" + assert ( + result[0].status_extended + == f"There is not an alert for creating/updating Public IP address rule in subscription {AZURE_SUBSCRIPTION}." + ) + + def test_alert_rules_configured(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = { + AZURE_SUBSCRIPTION: [ + AlertRule( + id="id", + name="name", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Network/publicIPAddresses/write", + field="operationName", + ), + ] + ), + enabled=False, + description="description", + ), + AlertRule( + id="id2", + name="name2", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Network/publicIPAddresses/write", + field="operationName", + ), + ] + ), + enabled=True, + description="description2", + ), + ] + } + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_update_public_ip_address_rule.monitor_alert_create_update_public_ip_address_rule.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_update_public_ip_address_rule.monitor_alert_create_update_public_ip_address_rule import ( + monitor_alert_create_update_public_ip_address_rule, + ) + + check = monitor_alert_create_update_public_ip_address_rule() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "name2" + assert result[0].resource_id == "id2" + assert ( + result[0].status_extended + == f"There is an alert configured for creating/updating Public IP address rule in subscription {AZURE_SUBSCRIPTION}." + ) diff --git a/tests/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution_test.py b/tests/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution_test.py new file mode 100644 index 0000000000..5f53315131 --- /dev/null +++ b/tests/providers/azure/services/monitor/monitor_alert_create_update_security_solution/monitor_alert_create_update_security_solution_test.py @@ -0,0 +1,105 @@ +from unittest import mock + +from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition + +from prowler.providers.azure.services.monitor.monitor_service import ( + AlertRule, + AlertRuleAllOfCondition, +) +from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION + + +class Test_monitor_alert_create_update_security_solution: + def test_monitor_alert_create_update_security_solution_no_subscriptions(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_update_security_solution.monitor_alert_create_update_security_solution.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_update_security_solution.monitor_alert_create_update_security_solution import ( + monitor_alert_create_update_security_solution, + ) + + check = monitor_alert_create_update_security_solution() + result = check.execute() + assert len(result) == 0 + + def test_no_alert_rules(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_update_security_solution.monitor_alert_create_update_security_solution.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_update_security_solution.monitor_alert_create_update_security_solution import ( + monitor_alert_create_update_security_solution, + ) + + check = monitor_alert_create_update_security_solution() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "Monitor" + assert result[0].resource_id == "Monitor" + assert ( + result[0].status_extended + == f"There is not an alert for creating/updating Security Solution in subscription {AZURE_SUBSCRIPTION}." + ) + + def test_alert_rules_configured(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = { + AZURE_SUBSCRIPTION: [ + AlertRule( + id="id", + name="name", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Security/securitySolutions/write", + field="operationName", + ), + ] + ), + enabled=False, + description="description", + ), + AlertRule( + id="id2", + name="name2", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Security/securitySolutions/write", + field="operationName", + ), + ] + ), + enabled=True, + description="description2", + ), + ] + } + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_update_security_solution.monitor_alert_create_update_security_solution.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_update_security_solution.monitor_alert_create_update_security_solution import ( + monitor_alert_create_update_security_solution, + ) + + check = monitor_alert_create_update_security_solution() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "name2" + assert result[0].resource_id == "id2" + assert ( + result[0].status_extended + == f"There is an alert configured for creating/updating Security Solution in subscription {AZURE_SUBSCRIPTION}." + ) diff --git a/tests/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr_test.py b/tests/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr_test.py new file mode 100644 index 0000000000..73c42ca708 --- /dev/null +++ b/tests/providers/azure/services/monitor/monitor_alert_create_update_sqlserver_fr/monitor_alert_create_update_sqlserver_fr_test.py @@ -0,0 +1,105 @@ +from unittest import mock + +from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition + +from prowler.providers.azure.services.monitor.monitor_service import ( + AlertRule, + AlertRuleAllOfCondition, +) +from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION + + +class Test_monitor_alert_create_update_sqlserver_fr: + def test_monitor_alert_create_update_sqlserver_fr_no_subscriptions(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_update_sqlserver_fr.monitor_alert_create_update_sqlserver_fr.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_update_sqlserver_fr.monitor_alert_create_update_sqlserver_fr import ( + monitor_alert_create_update_sqlserver_fr, + ) + + check = monitor_alert_create_update_sqlserver_fr() + result = check.execute() + assert len(result) == 0 + + def test_no_alert_rules(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_update_sqlserver_fr.monitor_alert_create_update_sqlserver_fr.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_update_sqlserver_fr.monitor_alert_create_update_sqlserver_fr import ( + monitor_alert_create_update_sqlserver_fr, + ) + + check = monitor_alert_create_update_sqlserver_fr() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "Monitor" + assert result[0].resource_id == "Monitor" + assert ( + result[0].status_extended + == f"There is not an alert for creating/updating SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION}." + ) + + def test_alert_rules_configured(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = { + AZURE_SUBSCRIPTION: [ + AlertRule( + id="id", + name="name", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Sql/servers/firewallRules/write", + field="operationName", + ), + ] + ), + enabled=False, + description="description", + ), + AlertRule( + id="id2", + name="name2", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Sql/servers/firewallRules/write", + field="operationName", + ), + ] + ), + enabled=True, + description="description2", + ), + ] + } + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_create_update_sqlserver_fr.monitor_alert_create_update_sqlserver_fr.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_create_update_sqlserver_fr.monitor_alert_create_update_sqlserver_fr import ( + monitor_alert_create_update_sqlserver_fr, + ) + + check = monitor_alert_create_update_sqlserver_fr() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "name2" + assert result[0].resource_id == "id2" + assert ( + result[0].status_extended + == f"There is an alert configured for creating/updating SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION}." + ) diff --git a/tests/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg_test.py b/tests/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg_test.py new file mode 100644 index 0000000000..da21369d0a --- /dev/null +++ b/tests/providers/azure/services/monitor/monitor_alert_delete_nsg/monitor_alert_delete_nsg_test.py @@ -0,0 +1,105 @@ +from unittest import mock + +from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition + +from prowler.providers.azure.services.monitor.monitor_service import ( + AlertRule, + AlertRuleAllOfCondition, +) +from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION + + +class Test_monitor_alert_delete_nsg: + def test_monitor_alert_delete_nsg_no_subscriptions(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_nsg.monitor_alert_delete_nsg.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_nsg.monitor_alert_delete_nsg import ( + monitor_alert_delete_nsg, + ) + + check = monitor_alert_delete_nsg() + result = check.execute() + assert len(result) == 0 + + def test_no_alert_rules(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_nsg.monitor_alert_delete_nsg.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_nsg.monitor_alert_delete_nsg import ( + monitor_alert_delete_nsg, + ) + + check = monitor_alert_delete_nsg() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "Monitor" + assert result[0].resource_id == "Monitor" + assert ( + result[0].status_extended + == f"There is not an alert for deleting Network Security Groups in subscription {AZURE_SUBSCRIPTION}." + ) + + def test_alert_rules_configured(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = { + AZURE_SUBSCRIPTION: [ + AlertRule( + id="id", + name="name", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Network/networkSecurityGroups/delete", + field="operationName", + ), + ] + ), + enabled=False, + description="description", + ), + AlertRule( + id="id2", + name="name2", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Network/networkSecurityGroups/delete", + field="operationName", + ), + ] + ), + enabled=True, + description="description2", + ), + ] + } + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_nsg.monitor_alert_delete_nsg.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_nsg.monitor_alert_delete_nsg import ( + monitor_alert_delete_nsg, + ) + + check = monitor_alert_delete_nsg() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "name2" + assert result[0].resource_id == "id2" + assert ( + result[0].status_extended + == f"There is an alert configured for deleting Network Security Groups in subscription {AZURE_SUBSCRIPTION}." + ) diff --git a/tests/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment_test.py b/tests/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment_test.py new file mode 100644 index 0000000000..feec4dfc82 --- /dev/null +++ b/tests/providers/azure/services/monitor/monitor_alert_delete_policy_assignment/monitor_alert_delete_policy_assignment_test.py @@ -0,0 +1,106 @@ +from unittest import mock + +from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition + +from prowler.providers.azure.services.monitor.monitor_service import ( + AlertRule, + AlertRuleAllOfCondition, +) +from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION + + +class Test_monitor_alert_delete_policy_assignment: + def test_monitor_alert_delete_policy_assignment_no_subscriptions(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = {} + + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_policy_assignment.monitor_alert_delete_policy_assignment.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_policy_assignment.monitor_alert_delete_policy_assignment import ( + monitor_alert_delete_policy_assignment, + ) + + check = monitor_alert_delete_policy_assignment() + result = check.execute() + assert len(result) == 0 + + def test_no_alert_rules(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_policy_assignment.monitor_alert_delete_policy_assignment.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_policy_assignment.monitor_alert_delete_policy_assignment import ( + monitor_alert_delete_policy_assignment, + ) + + check = monitor_alert_delete_policy_assignment() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "Monitor" + assert result[0].resource_id == "Monitor" + assert ( + result[0].status_extended + == f"There is not an alert for deleting policy assignment in subscription {AZURE_SUBSCRIPTION}." + ) + + def test_alert_rules_configured(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = { + AZURE_SUBSCRIPTION: [ + AlertRule( + id="id", + name="name", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Authorization/policyAssignments/delete", + field="operationName", + ), + ] + ), + enabled=False, + description="description", + ), + AlertRule( + id="id2", + name="name2", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Authorization/policyAssignments/delete", + field="operationName", + ), + ] + ), + enabled=True, + description="description2", + ), + ] + } + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_policy_assignment.monitor_alert_delete_policy_assignment.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_policy_assignment.monitor_alert_delete_policy_assignment import ( + monitor_alert_delete_policy_assignment, + ) + + check = monitor_alert_delete_policy_assignment() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "name2" + assert result[0].resource_id == "id2" + assert ( + result[0].status_extended + == f"There is an alert configured for deleting policy assignment in subscription {AZURE_SUBSCRIPTION}." + ) diff --git a/tests/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule_test.py b/tests/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule_test.py new file mode 100644 index 0000000000..d4da9dc1b4 --- /dev/null +++ b/tests/providers/azure/services/monitor/monitor_alert_delete_public_ip_address_rule/monitor_alert_delete_public_ip_address_rule_test.py @@ -0,0 +1,105 @@ +from unittest import mock + +from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition + +from prowler.providers.azure.services.monitor.monitor_service import ( + AlertRule, + AlertRuleAllOfCondition, +) +from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION + + +class Test_monitor_alert_create_update_security_solution: + def test_monitor_alert_delete_public_ip_address_rule_no_subscriptions(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_public_ip_address_rule.monitor_alert_delete_public_ip_address_rule.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_public_ip_address_rule.monitor_alert_delete_public_ip_address_rule import ( + monitor_alert_delete_public_ip_address_rule, + ) + + check = monitor_alert_delete_public_ip_address_rule() + result = check.execute() + assert len(result) == 0 + + def test_no_alert_rules(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_public_ip_address_rule.monitor_alert_delete_public_ip_address_rule.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_public_ip_address_rule.monitor_alert_delete_public_ip_address_rule import ( + monitor_alert_delete_public_ip_address_rule, + ) + + check = monitor_alert_delete_public_ip_address_rule() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "Monitor" + assert result[0].resource_id == "Monitor" + assert ( + result[0].status_extended + == f"There is not an alert for deleting public IP address rule in subscription {AZURE_SUBSCRIPTION}." + ) + + def test_alert_rules_configured(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = { + AZURE_SUBSCRIPTION: [ + AlertRule( + id="id", + name="name", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Network/publicIPAddresses/delete", + field="operationName", + ), + ] + ), + enabled=False, + description="description", + ), + AlertRule( + id="id2", + name="name2", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Network/publicIPAddresses/delete", + field="operationName", + ), + ] + ), + enabled=True, + description="description2", + ), + ] + } + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_public_ip_address_rule.monitor_alert_delete_public_ip_address_rule.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_public_ip_address_rule.monitor_alert_delete_public_ip_address_rule import ( + monitor_alert_delete_public_ip_address_rule, + ) + + check = monitor_alert_delete_public_ip_address_rule() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "name2" + assert result[0].resource_id == "id2" + assert ( + result[0].status_extended + == f"There is an alert configured for deleting public IP address rule in subscription {AZURE_SUBSCRIPTION}." + ) diff --git a/tests/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution_test.py b/tests/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution_test.py new file mode 100644 index 0000000000..8a2e7aabbb --- /dev/null +++ b/tests/providers/azure/services/monitor/monitor_alert_delete_security_solution/monitor_alert_delete_security_solution_test.py @@ -0,0 +1,105 @@ +from unittest import mock + +from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition + +from prowler.providers.azure.services.monitor.monitor_service import ( + AlertRule, + AlertRuleAllOfCondition, +) +from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION + + +class Test_monitor_alert_create_update_security_solution: + def test_monitor_alert_delete_security_solution_no_subscriptions(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_security_solution.monitor_alert_delete_security_solution.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_security_solution.monitor_alert_delete_security_solution import ( + monitor_alert_delete_security_solution, + ) + + check = monitor_alert_delete_security_solution() + result = check.execute() + assert len(result) == 0 + + def test_no_alert_rules(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_security_solution.monitor_alert_delete_security_solution.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_security_solution.monitor_alert_delete_security_solution import ( + monitor_alert_delete_security_solution, + ) + + check = monitor_alert_delete_security_solution() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "Monitor" + assert result[0].resource_id == "Monitor" + assert ( + result[0].status_extended + == f"There is not an alert for deleting Security Solution in subscription {AZURE_SUBSCRIPTION}." + ) + + def test_alert_rules_configured(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = { + AZURE_SUBSCRIPTION: [ + AlertRule( + id="id", + name="name", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Security/securitySolutions/delete", + field="operationName", + ), + ] + ), + enabled=False, + description="description", + ), + AlertRule( + id="id2", + name="name2", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Security/securitySolutions/delete", + field="operationName", + ), + ] + ), + enabled=True, + description="description2", + ), + ] + } + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_security_solution.monitor_alert_delete_security_solution.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_security_solution.monitor_alert_delete_security_solution import ( + monitor_alert_delete_security_solution, + ) + + check = monitor_alert_delete_security_solution() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "name2" + assert result[0].resource_id == "id2" + assert ( + result[0].status_extended + == f"There is an alert configured for deleting Security Solution in subscription {AZURE_SUBSCRIPTION}." + ) diff --git a/tests/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr_test.py b/tests/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr_test.py new file mode 100644 index 0000000000..4fe5316743 --- /dev/null +++ b/tests/providers/azure/services/monitor/monitor_alert_delete_sqlserver_fr/monitor_alert_delete_sqlserver_fr_test.py @@ -0,0 +1,105 @@ +from unittest import mock + +from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition + +from prowler.providers.azure.services.monitor.monitor_service import ( + AlertRule, + AlertRuleAllOfCondition, +) +from tests.providers.azure.azure_fixtures import AZURE_SUBSCRIPTION + + +class Test_monitor_alert_delete_sqlserver_fr: + def test_monitor_alert_delete_sqlserver_fr_no_subscriptions(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_sqlserver_fr.monitor_alert_delete_sqlserver_fr.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_sqlserver_fr.monitor_alert_delete_sqlserver_fr import ( + monitor_alert_delete_sqlserver_fr, + ) + + check = monitor_alert_delete_sqlserver_fr() + result = check.execute() + assert len(result) == 0 + + def test_no_alert_rules(self): + monitor_client = mock.MagicMock() + monitor_client.alert_rules = {AZURE_SUBSCRIPTION: []} + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_sqlserver_fr.monitor_alert_delete_sqlserver_fr.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_sqlserver_fr.monitor_alert_delete_sqlserver_fr import ( + monitor_alert_delete_sqlserver_fr, + ) + + check = monitor_alert_delete_sqlserver_fr() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "Monitor" + assert result[0].resource_id == "Monitor" + assert ( + result[0].status_extended + == f"There is not an alert for deleting SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION}." + ) + + def test_alert_rules_configured(self): + monitor_client = mock.MagicMock + monitor_client.alert_rules = { + AZURE_SUBSCRIPTION: [ + AlertRule( + id="id", + name="name", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Sql/servers/firewallRules/delete", + field="operationName", + ), + ] + ), + enabled=False, + description="description", + ), + AlertRule( + id="id2", + name="name2", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Sql/servers/firewallRules/delete", + field="operationName", + ), + ] + ), + enabled=True, + description="description2", + ), + ] + } + with mock.patch( + "prowler.providers.azure.services.monitor.monitor_alert_delete_sqlserver_fr.monitor_alert_delete_sqlserver_fr.monitor_client", + new=monitor_client, + ): + from prowler.providers.azure.services.monitor.monitor_alert_delete_sqlserver_fr.monitor_alert_delete_sqlserver_fr import ( + monitor_alert_delete_sqlserver_fr, + ) + + check = monitor_alert_delete_sqlserver_fr() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].subscription == AZURE_SUBSCRIPTION + assert result[0].resource_name == "name2" + assert result[0].resource_id == "id2" + assert ( + result[0].status_extended + == f"There is an alert configured for deleting SQL Server firewall rule in subscription {AZURE_SUBSCRIPTION}." + ) diff --git a/tests/providers/azure/services/monitor/monitor_service_test.py b/tests/providers/azure/services/monitor/monitor_service_test.py index 6339a8a58a..a357112fd3 100644 --- a/tests/providers/azure/services/monitor/monitor_service_test.py +++ b/tests/providers/azure/services/monitor/monitor_service_test.py @@ -1,7 +1,12 @@ from unittest import mock from unittest.mock import patch +from azure.mgmt.monitor.models import AlertRuleAnyOfOrLeafCondition + +from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule from prowler.providers.azure.services.monitor.monitor_service import ( + AlertRule, + AlertRuleAllOfCondition, DiagnosticSetting, Monitor, ) @@ -101,3 +106,66 @@ class Test_Monitor_Service: monitor.diagnostics_settings[AZURE_SUBSCRIPTION][0].storage_account_id == "/subscriptions/1234a5-123a-123a-123a-1234567890ab/resourceGroups/rg/providers/Microsoft.Storage/storageAccounts/storageaccountname" ) + + def test__monitor_alerts_false__(self): + alert_rule = AlertRule( + id="id", + name="name", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Authorization/policyAssignments/write", + field="operationName", + ), + ] + ), + enabled=False, + description="description", + ) + + assert not check_alert_rule( + alert_rule, "Microsoft.Authorization/policyAssignments/write" + ) + + def test__monitor_alerts_true__(self): + alert_rule = AlertRule( + id="id", + name="name", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Authorization/policyAssignments/write", + field="operationName", + ), + ] + ), + enabled=True, + description="description", + ) + + assert check_alert_rule( + alert_rule, "Microsoft.Authorization/policyAssignments/write" + ) + + def test__monitor_alerts_false_equal__(self): + alert_rule = AlertRule( + id="id", + name="name", + condition=AlertRuleAllOfCondition( + all_of=[ + AlertRuleAnyOfOrLeafCondition(), + AlertRuleAnyOfOrLeafCondition( + equals="Microsoft.Authorization/policyAssingments/write", + field="operationName", + ), + ] + ), + enabled=True, + description="description", + ) + + assert not check_alert_rule( + alert_rule, "Microsoft.Authorization/policyAssignments/write" + )