From 8d8b31c757a92995bc2db4e6082f2b5a1b87e8d9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= Date: Tue, 25 Feb 2025 09:42:50 +0100 Subject: [PATCH] feat(azure): add PCI DSS 4.0 (#6982) --- README.md | 2 +- dashboard/compliance/pci_4_0_azure.py | 23 + prowler/compliance/azure/pci_4.0_azure.json | 21548 ++++++++++++++++++ 3 files changed, 21572 insertions(+), 1 deletion(-) create mode 100644 dashboard/compliance/pci_4_0_azure.py create mode 100644 prowler/compliance/azure/pci_4.0_azure.json diff --git a/README.md b/README.md index b464742958..5ffa35edee 100644 --- a/README.md +++ b/README.md @@ -73,7 +73,7 @@ It contains hundreds of controls covering CIS, NIST 800, NIST CSF, CISA, RBI, Fe |---|---|---|---|---| | AWS | 564 | 82 | 31 | 10 | | GCP | 77 | 13 | 4 | 3 | -| Azure | 140 | 18 | 5 | 3 | +| Azure | 140 | 18 | 6 | 3 | | Kubernetes | 83 | 7 | 2 | 7 | | Microsoft365 | 5 | 2 | 1 | 0 | diff --git a/dashboard/compliance/pci_4_0_azure.py b/dashboard/compliance/pci_4_0_azure.py new file mode 100644 index 0000000000..c81617efc2 --- /dev/null +++ b/dashboard/compliance/pci_4_0_azure.py @@ -0,0 +1,23 @@ +import warnings + +from dashboard.common_methods import get_section_containers_format3 + +warnings.filterwarnings("ignore") + + +def get_table(data): + aux = data[ + [ + "REQUIREMENTS_ID", + "REQUIREMENTS_ATTRIBUTES_SECTION", + "REQUIREMENTS_DESCRIPTION", + "CHECKID", + "STATUS", + "REGION", + "ACCOUNTID", + "RESOURCEID", + ] + ] + return get_section_containers_format3( + aux, "REQUIREMENTS_ATTRIBUTES_SECTION", "REQUIREMENTS_ID" + ) diff --git a/prowler/compliance/azure/pci_4.0_azure.json b/prowler/compliance/azure/pci_4.0_azure.json new file mode 100644 index 0000000000..5565347b6f --- /dev/null +++ b/prowler/compliance/azure/pci_4.0_azure.json @@ -0,0 +1,21548 @@ +{ + "Framework": "PCI", + "Version": "4.0", + "Provider": "Azure", + "Description": "The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard. It's administered by the PCI Security Standards Council, which was founded by American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa Inc. PCI DSS applies to entities that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD). This includes, but isn't limited to, merchants, processors, acquirers, issuers, and service providers. The PCI DSS is mandated by the card brands and administered by the Payment Card Industry Security Standards Council.", + "Requirements": [ + { + "Id": "1.2.5.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Azure Application Gateway. The rule is NON_COMPLIANT if one or more HTTP listeners of Azure Application Gateway do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP listeners are forwarding traffic to another HTTP listener instead of enforcing redirection.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.5.2", + "Description": "Checks if Azure Front Door or Azure CDN endpoints are using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for an Azure Front Door or CDN profile if any TLS settings include outdated protocols such as TLS 1.0 or TLS 1.1.", + "Name": "Azure CDN", + "Checks": [ + "app_minimum_tls_version_12" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "1.2.5.3", + "Description": "Checks if Azure Front Door and Azure CDN profiles are using a minimum security policy and cipher suite of TLSv1.2 or greater for viewer connections. The rule is NON_COMPLIANT if the minimum TLS version configured is below TLS 1.2.", + "Name": "Azure CDN", + "Checks": [ + "app_minimum_tls_version_12" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "1.2.5.4", + "Description": "Checks if Azure Front Door and Azure CDN profiles are using a custom SSL certificate and are configured to use SNI (Server Name Indication) to serve HTTPS requests. The rule is NON_COMPLIANT if a custom SSL certificate is associated but the SSL support method is using a dedicated IP address instead of SNI.", + "Name": "Azure CDN", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "1.2.5.5", + "Description": "Checks if Azure Front Door and Azure CDN profiles are encrypting traffic to custom origins. The rule is NON_COMPLIANT if OriginProtocolPolicy is set to HTTP only or if OriginProtocolPolicy is set to Match viewer and ViewerProtocolPolicy allows both HTTP and HTTPS traffic.", + "Name": "Azure CDN", + "Checks": [ + "network_http_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "1.2.5.6", + "Description": "Checks if your Azure Front Door and Azure CDN profiles enforce HTTPS (directly or via a redirection). The rule is NON_COMPLIANT if the ViewerProtocolPolicy allows both HTTP and HTTPS traffic for the Default Route Configuration or Custom Route Configurations.", + "Name": "Azure CDN", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "1.2.5.7", + "Description": "Checks if Azure AI Search nodes are encrypted end to end. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the Azure OpenSearch domain.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "1.2.5.8", + "Description": "Checks whether your Azure Load Balancer or Application Gateway SSL listeners are using a custom SSL policy. The rule is applicable only if SSL listeners are configured for the Azure Application Gateway or Azure Front Door. The rule is NON_COMPLIANT if the SSL policy does not follow the organizations security standards.", + "Name": "Azure Load Balancer", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "1.2.5.9", + "Description": "Checks if your Azure Application Gateway or Azure Front Door SSL listeners use a predefined SSL policy. The rule is NON_COMPLIANT if the SSL policy configured for the HTTPS/SSL listener does not match the value of the parameter predefinedPolicyName.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.5.10", + "Description": "Checks if your Azure Application Gateway or Azure Front Door is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured to use HTTPS with a valid SSL certificate.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.5.11", + "Description": "Checks if Azure HDInsight clusters have Enterprise Security Package (ESP) with Kerberos authentication enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not meet the specified rule parameters.", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "1.2.5.12", + "Description": "Checks whether connections to Azure AI Search services are using HTTPS. The rule is NON_COMPLIANT if the EnforceHTTPS setting is not enabled or if the minimum TLS version does not meet the required security policy.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "1.2.5.13", + "Description": "Checks if Azure AI Search services have end-to-end encryption enabled. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the search service.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "1.2.5.14", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) requires TLS/SSL encryption for connections to SQL clients. The rule is NON_COMPLIANT if any Azure Synapse Analytics workspace does not enforce SSL connections.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "1.2.5.15", + "Description": "Checks if Azure Blob Storage accounts enforce secure transfer (HTTPS/TLS) for all requests. The rule is NON_COMPLIANT if any Azure Storage account allows requests over HTTP instead of requiring HTTPS/TLS.", + "Name": "Azure Blob Storage", + "Checks": [ + "storage_secure_transfer_required_is_enabled" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Blob Storage" + } + ] + }, + { + "Id": "1.2.5.16", + "Description": "Checks if an Azure Storage Account with SFTP enabled allows unencrypted FTP connections. The rule is NON_COMPLIANT if the storage account permits FTP instead of requiring SFTP or FTPS for secure endpoint connections.", + "Name": "Azure Storage", + "Checks": [ + "app_function_ftps_deployment_disabled" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.2.5.17", + "Description": "Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.2.5: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.1", + "Description": "Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.2.8.2", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.2.8.3", + "Description": "Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.2.8.4", + "Description": "Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.", + "Name": "Azure Front Door", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "1.2.8.5", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "1.2.8.6", + "Description": "Checks if the Azure DevOps repository URL contains embedded credentials. The rule is NON_COMPLIANT if the repository URL includes any username or password in the connection string and COMPLIANT if it does not.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "1.2.8.7", + "Description": "Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "1.2.8.8", + "Description": "Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "1.2.8.9", + "Description": "Checks if Azure VPN Client Authorization Rules allow connection access for all clients. The rule is NON_COMPLIANT if AccessAll is present and set to true in the Azure Virtual WAN User VPN configuration.", + "Name": "Azure VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure VPN" + } + ] + }, + { + "Id": "1.2.8.10", + "Description": "Checks if the compliance status of Azure Automation State Configuration (DSC) is COMPLIANT or NON_COMPLIANT after applying the configuration on the virtual machine. The rule is COMPLIANT if the compliance status field is set to COMPLIANT in Azure Policy guest configuration or Azure Automation State Configuration.", + "Name": "Azure Automation State Configuration", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Automation State Configuration" + } + ] + }, + { + "Id": "1.2.8.11", + "Description": "Checks if Azure Virtual WAN Hubs have Auto-Accept Shared Connections enabled. The rule is NON_COMPLIANT if the Virtual Hubs setting for automatically accepting shared connections is set to Enabled.", + "Name": "Azure Virtual WAN", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Virtual WAN" + } + ] + }, + { + "Id": "1.2.8.12", + "Description": "Checks if the Azure Kubernetes Service (AKS) API server endpoint is not publicly accessible. The rule is NON_COMPLIANT if the API server endpoint is exposed to the public internet.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_clusters_public_access_disabled" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "1.2.8.13", + "Description": "Checks if Azure Cognitive Search service is deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if the service endpoint is publicly accessible instead of being restricted to a private VNet.", + "Name": "Azure Cognitive Search", + "Checks": [ + "aisearch_service_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "1.2.8.14", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.15", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "1.2.8.16", + "Description": "Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "1.2.8.17", + "Description": "Checks if Azure Network Security Groups (NSGs) restrict inbound SSH (Port 22) access from the public internet. The rule is NON_COMPLIANT if there is an NSG rule allowing unrestricted inbound SSH connections (0.0.0.0/0 or ::/0).", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.18", + "Description": "Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "1.2.8.19", + "Description": "Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.", + "Name": "Azure Functions", + "Checks": [ + "app_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "1.2.8.20", + "Description": "Checks if an Azure Function App is configured to use a Virtual Network (VNet) Integration. The rule is NON_COMPLIANT if the Function App is not connected to a VNet, which may expose it to public access instead of securing it within a private network.", + "Name": "Azure Functions", + "Checks": [ + "app_function_vnet_integration_enabled" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "1.2.8.21", + "Description": "Checks if Azure Network Security Groups (NSGs) allow unrestricted inbound traffic on default ports for SSH (22) or RDP (3389). The rule is NON_COMPLIANT if an NSG inbound rule allows traffic from any source (0.0.0.0/0 or ::/0) on ports 22 (SSH) or 3389 (RDP), which could expose resources to unauthorized access.", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.22", + "Description": "Checks if an Azure Firewall Policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match the user-defined default action, which could lead to inconsistent or insecure traffic handling.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.23", + "Description": "Checks if an Azure Firewall Policy is associated with stateful or stateless rule collections. The rule is NON_COMPLIANT if no stateful or stateless rule collections are associated with the Azure Firewall Policy, ensuring that traffic filtering rules are properly enforced.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.24", + "Description": "Checks if an Azure Firewall Policy Rule Collection Group contains rules. The rule is NON_COMPLIANT if there are no rules in a Rule Collection Group, ensuring that traffic filtering is properly enforced.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.25", + "Description": "Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_http_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "1.2.8.26", + "Description": "Checks if Azure Cognitive Search instances are deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure Cognitive Search service endpoint is publicly accessible instead of being restricted to a private network using Private Endpoints or Service Endpoints.", + "Name": "Azure Cognitive Search", + "Checks": [ + "aisearch_service_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "1.2.8.27", + "Description": "Checks if there are any Azure Database for MySQL, PostgreSQL, or SQL Server firewall rules that are not the default firewall rule. The rule is NON_COMPLIANT if there are any custom firewall rules that allow unrestricted access instead of using the default security configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "1.2.8.28", + "Description": "Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "1.2.8.29", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "1.2.8.30", + "Description": "Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.2.8.31", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.2.8.32", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.2.8.33", + "Description": "Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.2.8.34", + "Description": "Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.2.8.35", + "Description": "Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.2.8.36", + "Description": "Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "1.2.8.37", + "Description": "Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "1.2.8.38", + "Description": "Checks if a Private Endpoint for the service provided in the rule parameter is created for each Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure VNet does not have a Private Endpoint created for the service.", + "Name": "Azure Network", + "Checks": [ + "keyvault_private_endpoints" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.39", + "Description": "Checks if there are unused Network Security Groups (NSGs). The rule is COMPLIANT if each NSG is associated with a subnet or network interface. The rule is NON_COMPLIANT if an NSG is not associated with any subnet or network interface.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.40", + "Description": "Checks if DNS resolution from peered virtual networks (VNets) to private IP is enabled in Azure Virtual Network Peering. The rule is NON_COMPLIANT if DNS resolution from the peered VNet to private IP is not enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.41", + "Description": "Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.42", + "Description": "Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.43", + "Description": "Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.44", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.45", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.46", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.2.8.47", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.2.8: Network security controls (NSCs) are configured and maintained. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.1", + "Description": "Checks if an Azure API Management API stage is using an Azure Web Application Firewall (WAF) web access control list (Web ACL). The rule is NON_COMPLIANT if an Azure WAF Web ACL is not used or if the applied WAF Web ACL does not match the expected configuration in the rule parameter.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.3.1.2", + "Description": "Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.3.1.3", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.3.1.4", + "Description": "Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.3.1.5", + "Description": "Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.", + "Name": "Azure Front Door", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "1.3.1.6", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "1.3.1.7", + "Description": "Checks if the Azure DevOps repository URL contains embedded credentials. The rule is NON_COMPLIANT if the repository URL includes any username or password in the connection string and COMPLIANT if it does not.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "1.3.1.8", + "Description": "Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "1.3.1.9", + "Description": "Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "1.3.1.10", + "Description": "Checks if Azure VPN Client Authorization Rules allow connection access for all clients. The rule is NON_COMPLIANT if AccessAll is present and set to true in the Azure Virtual WAN User VPN configuration.", + "Name": "Azure VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure VPN" + } + ] + }, + { + "Id": "1.3.1.11", + "Description": "Checks if the compliance status of Azure Automation State Configuration (DSC) is COMPLIANT or NON_COMPLIANT after applying the configuration on the virtual machine. The rule is COMPLIANT if the compliance status field is set to COMPLIANT in Azure Policy guest configuration or Azure Automation State Configuration.", + "Name": "Azure Automation State Configuration", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Automation State Configuration" + } + ] + }, + { + "Id": "1.3.1.12", + "Description": "Checks if Azure Virtual WAN Hubs have Auto-Accept Shared Connections enabled. The rule is NON_COMPLIANT if the Virtual Hubs setting for automatically accepting shared connections is set to Enabled.", + "Name": "Azure Virtual WAN", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Virtual WAN" + } + ] + }, + { + "Id": "1.3.1.13", + "Description": "Checks if the Azure Kubernetes Service (AKS) API server endpoint is not publicly accessible. The rule is NON_COMPLIANT if the API server endpoint is exposed to the public internet.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_clusters_public_access_disabled" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "1.3.1.14", + "Description": "Checks if Azure Cache for Redis instances are configured with a custom virtual network (VNet) integration. The rule is NON_COMPLIANT if an Azure Cache for Redis instance is using the default network configuration instead of a custom VNet and subnet.", + "Name": "Azure Cache for Redis", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Cache for Redis" + } + ] + }, + { + "Id": "1.3.1.15", + "Description": "Checks if Azure Cognitive Search service is deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if the service endpoint is publicly accessible instead of being restricted to a private VNet.", + "Name": "Azure Cognitive Search", + "Checks": [ + "aisearch_service_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "1.3.1.16", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.17", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "1.3.1.18", + "Description": "Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "1.3.1.19", + "Description": "Checks if Azure Network Security Groups (NSGs) restrict inbound SSH (Port 22) access from the public internet. The rule is NON_COMPLIANT if there is an NSG rule allowing unrestricted inbound SSH connections (0.0.0.0/0 or ::/0).", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.20", + "Description": "For this rule, the rule identifier (INSTANCES_IN_VNET) and rule name (azure-vm-in-vnet) are different.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.21", + "Description": "Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "1.3.1.22", + "Description": "Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.", + "Name": "Azure Functions", + "Checks": [ + "app_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "1.3.1.23", + "Description": "Checks if an Azure Function App is configured to use a Virtual Network (VNet) Integration. The rule is NON_COMPLIANT if the Function App is not connected to a VNet, which may expose it to public access instead of securing it within a private network.", + "Name": "Azure Functions", + "Checks": [ + "app_function_vnet_integration_enabled" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "1.3.1.24", + "Description": "Checks if Azure Network Security Groups (NSGs) allow unrestricted inbound traffic on default ports for SSH (22) or RDP (3389). The rule is NON_COMPLIANT if an NSG inbound rule allows traffic from any source (0.0.0.0/0 or ::/0) on ports 22 (SSH) or 3389 (RDP), which could expose resources to unauthorized access.", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.25", + "Description": "Checks if an Azure Firewall Policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match the user-defined default action, which could lead to inconsistent or insecure traffic handling.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.26", + "Description": "Checks if an Azure Firewall Policy is associated with stateful or stateless rule collections. The rule is NON_COMPLIANT if no stateful or stateless rule collections are associated with the Azure Firewall Policy, ensuring that traffic filtering rules are properly enforced.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.27", + "Description": "Checks if an Azure Firewall Policy Rule Collection Group contains rules. The rule is NON_COMPLIANT if there are no rules in a Rule Collection Group, ensuring that traffic filtering is properly enforced.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.28", + "Description": "Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_http_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "1.3.1.29", + "Description": "Checks if Azure Cognitive Search instances are deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure Cognitive Search service endpoint is publicly accessible instead of being restricted to a private network using Private Endpoints or Service Endpoints.", + "Name": "Azure Cognitive Search", + "Checks": [ + "aisearch_service_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "1.3.1.30", + "Description": "Checks if there are any Azure Database for MySQL, PostgreSQL, or SQL Server firewall rules that are not the default firewall rule. The rule is NON_COMPLIANT if there are any custom firewall rules that allow unrestricted access instead of using the default security configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "1.3.1.31", + "Description": "Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "1.3.1.32", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "1.3.1.33", + "Description": "Checks if Azure Synapse Analytics dedicated SQL pool has Private Link enabled. The rule is NON_COMPLIANT if Private Link is not enabled or if the configuration field is set to false.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "1.3.1.34", + "Description": "Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.", + "Name": "Azure Blob Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Blob Storage" + } + ] + }, + { + "Id": "1.3.1.35", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.3.1.36", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.3.1.37", + "Description": "Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.3.1.38", + "Description": "Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.3.1.39", + "Description": "Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.3.1.40", + "Description": "Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "1.3.1.41", + "Description": "Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "1.3.1.42", + "Description": "Checks if a Private Endpoint for the service provided in the rule parameter is created for each Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure VNet does not have a Private Endpoint created for the service.", + "Name": "Azure Network", + "Checks": [ + "keyvault_private_endpoints" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.43", + "Description": "Checks if there are unused Network Security Groups (NSGs). The rule is COMPLIANT if each NSG is associated with a subnet or network interface. The rule is NON_COMPLIANT if an NSG is not associated with any subnet or network interface.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.44", + "Description": "Checks if DNS resolution from peered virtual networks (VNets) to private IP is enabled in Azure Virtual Network Peering. The rule is NON_COMPLIANT if DNS resolution from the peered VNet to private IP is not enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.45", + "Description": "Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.46", + "Description": "Checks if both VPN tunnels provided by Azure Site-to-Site VPN are in Connected status. The rule is NON_COMPLIANT if one or both tunnels are in Disconnected status.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.47", + "Description": "Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.48", + "Description": "Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.49", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.50", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.51", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.1.52", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.1: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.1", + "Description": "Checks if an Azure API Management API stage is using an Azure Web Application Firewall (WAF) web access control list (Web ACL). The rule is NON_COMPLIANT if an Azure WAF Web ACL is not used or if the applied WAF Web ACL does not match the expected configuration in the rule parameter.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.3.2.2", + "Description": "Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.3.2.3", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.3.2.4", + "Description": "Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.3.2.5", + "Description": "Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.", + "Name": "Azure Front Door", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "1.3.2.6", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "1.3.2.7", + "Description": "Checks if the Azure DevOps repository URL contains embedded credentials. The rule is NON_COMPLIANT if the repository URL includes any username or password in the connection string and COMPLIANT if it does not.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "1.3.2.8", + "Description": "Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "1.3.2.9", + "Description": "Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "1.3.2.10", + "Description": "Checks if Azure VPN Client Authorization Rules allow connection access for all clients. The rule is NON_COMPLIANT if AccessAll is present and set to true in the Azure Virtual WAN User VPN configuration.", + "Name": "Azure VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure VPN" + } + ] + }, + { + "Id": "1.3.2.11", + "Description": "Checks if the compliance status of Azure Automation State Configuration (DSC) is COMPLIANT or NON_COMPLIANT after applying the configuration on the virtual machine. The rule is COMPLIANT if the compliance status field is set to COMPLIANT in Azure Policy guest configuration or Azure Automation State Configuration.", + "Name": "Azure Automation State Configuration", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Automation State Configuration" + } + ] + }, + { + "Id": "1.3.2.12", + "Description": "Checks if Azure Virtual WAN Hubs have Auto-Accept Shared Connections enabled. The rule is NON_COMPLIANT if the Virtual Hubs setting for automatically accepting shared connections is set to Enabled.", + "Name": "Azure Virtual WAN", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Virtual WAN" + } + ] + }, + { + "Id": "1.3.2.13", + "Description": "Checks if the Azure Kubernetes Service (AKS) API server endpoint is not publicly accessible. The rule is NON_COMPLIANT if the API server endpoint is exposed to the public internet.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_clusters_public_access_disabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "1.3.2.14", + "Description": "Checks if Azure Cache for Redis instances are configured with a custom virtual network (VNet) integration. The rule is NON_COMPLIANT if an Azure Cache for Redis instance is using the default network configuration instead of a custom VNet and subnet.", + "Name": "Azure Cache for Redis", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Cache for Redis" + } + ] + }, + { + "Id": "1.3.2.15", + "Description": "Checks if Azure Cognitive Search service is deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if the service endpoint is publicly accessible instead of being restricted to a private VNet.", + "Name": "Azure Cognitive Search", + "Checks": [ + "aisearch_service_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "1.3.2.16", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.17", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "1.3.2.18", + "Description": "Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).", + "Name": "Azure HDInsight ", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure HDInsight " + } + ] + }, + { + "Id": "1.3.2.19", + "Description": "Checks if Azure Network Security Groups (NSGs) restrict inbound SSH (Port 22) access from the public internet. The rule is NON_COMPLIANT if there is an NSG rule allowing unrestricted inbound SSH connections (0.0.0.0/0 or ::/0).", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.20", + "Description": "For this rule, the rule identifier (INSTANCES_IN_VNET) and rule name (azure-vm-in-vnet) are different.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.21", + "Description": "Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "1.3.2.22", + "Description": "Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.", + "Name": "Azure Functions", + "Checks": [ + "app_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "1.3.2.23", + "Description": "Checks if an Azure Function App is configured to use a Virtual Network (VNet) Integration. The rule is NON_COMPLIANT if the Function App is not connected to a VNet, which may expose it to public access instead of securing it within a private network.", + "Name": "Azure Functions", + "Checks": [ + "app_function_vnet_integration_enabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "1.3.2.24", + "Description": "Checks if Azure Network Security Groups (NSGs) allow unrestricted inbound traffic on default ports for SSH (22) or RDP (3389). The rule is NON_COMPLIANT if an NSG inbound rule allows traffic from any source (0.0.0.0/0 or ::/0) on ports 22 (SSH) or 3389 (RDP), which could expose resources to unauthorized access.", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.25", + "Description": "Checks if an Azure Firewall Policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match the user-defined default action, which could lead to inconsistent or insecure traffic handling.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.26", + "Description": "Checks if an Azure Firewall Policy is associated with stateful or stateless rule collections. The rule is NON_COMPLIANT if no stateful or stateless rule collections are associated with the Azure Firewall Policy, ensuring that traffic filtering rules are properly enforced.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.27", + "Description": "Checks if an Azure Firewall Policy Rule Collection Group contains rules. The rule is NON_COMPLIANT if there are no rules in a Rule Collection Group, ensuring that traffic filtering is properly enforced.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.28", + "Description": "Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_http_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "1.3.2.29", + "Description": "Checks if Azure Cognitive Search instances are deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure Cognitive Search service endpoint is publicly accessible instead of being restricted to a private network using Private Endpoints or Service Endpoints.", + "Name": "Azure Cognitive Search", + "Checks": [ + "aisearch_service_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "1.3.2.30", + "Description": "Checks if there are any Azure Database for MySQL, PostgreSQL, or SQL Server firewall rules that are not the default firewall rule. The rule is NON_COMPLIANT if there are any custom firewall rules that allow unrestricted access instead of using the default security configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "1.3.2.31", + "Description": "Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "1.3.2.32", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "1.3.2.33", + "Description": "Checks if Azure Synapse Analytics dedicated SQL pool has Private Link enabled. The rule is NON_COMPLIANT if Private Link is not enabled or if the configuration field is set to false.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "1.3.2.34", + "Description": "Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.", + "Name": "Azure Blob Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Blob Storage" + } + ] + }, + { + "Id": "1.3.2.35", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.3.2.36", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.3.2.37", + "Description": "Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.3.2.38", + "Description": "Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.3.2.39", + "Description": "Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.3.2.40", + "Description": "Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "1.3.2.41", + "Description": "Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "1.3.2.42", + "Description": "Checks if a Private Endpoint for the service provided in the rule parameter is created for each Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure VNet does not have a Private Endpoint created for the service.", + "Name": "Azure Network", + "Checks": [ + "keyvault_private_endpoints" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.43", + "Description": "Checks if there are unused Network Security Groups (NSGs). The rule is COMPLIANT if each NSG is associated with a subnet or network interface. The rule is NON_COMPLIANT if an NSG is not associated with any subnet or network interface.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.44", + "Description": "Checks if DNS resolution from peered virtual networks (VNets) to private IP is enabled in Azure Virtual Network Peering. The rule is NON_COMPLIANT if DNS resolution from the peered VNet to private IP is not enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.45", + "Description": "Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.46", + "Description": "Checks if both VPN tunnels provided by Azure Site-to-Site VPN are in Connected status. The rule is NON_COMPLIANT if one or both tunnels are in Disconnected status.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.47", + "Description": "Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.48", + "Description": "Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.49", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.50", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.51", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.3.2.52", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.3.2: Network access to and from the cardholder data environment is restricted. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.1.1", + "Description": "Checks if an Azure API Management API stage is using an Azure Web Application Firewall (WAF) web access control list (Web ACL). The rule is NON_COMPLIANT if an Azure WAF Web ACL is not used or if the applied WAF Web ACL does not match the expected configuration in the rule parameter.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.4.1.2", + "Description": "Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.4.1.3", + "Description": "Checks if Azure Cache for Redis instances are configured with a custom virtual network (VNet) integration. The rule is NON_COMPLIANT if an Azure Cache for Redis instance is using the default network configuration instead of a custom VNet and subnet.", + "Name": "Azure Cache for Redis", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Cache for Redis" + } + ] + }, + { + "Id": "1.4.1.4", + "Description": "For this rule, the rule identifier (INSTANCES_IN_VNET) and rule name (azure-vm-in-vnet) are different.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.1.5", + "Description": "Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "1.4.1.6", + "Description": "Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_http_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "1.4.1.7", + "Description": "Checks if Azure Synapse Analytics dedicated SQL pool has Private Link enabled. The rule is NON_COMPLIANT if Private Link is not enabled or if the configuration field is set to false.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "1.4.1.8", + "Description": "Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "1.4.1.9", + "Description": "Checks if DNS resolution from peered virtual networks (VNets) to private IP is enabled in Azure Virtual Network Peering. The rule is NON_COMPLIANT if DNS resolution from the peered VNet to private IP is not enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.1.10", + "Description": "Checks if both VPN tunnels provided by Azure Site-to-Site VPN are in Connected status. The rule is NON_COMPLIANT if one or both tunnels are in Disconnected status.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.1: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.1", + "Description": "Checks if an Azure API Management API stage is using an Azure Web Application Firewall (WAF) web access control list (Web ACL). The rule is NON_COMPLIANT if an Azure WAF Web ACL is not used or if the applied WAF Web ACL does not match the expected configuration in the rule parameter.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.4.2.2", + "Description": "Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.4.2.3", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.4.2.4", + "Description": "Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.4.2.5", + "Description": "Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.", + "Name": "Azure Front Door", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "1.4.2.6", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "1.4.2.7", + "Description": "Checks if the Azure DevOps repository URL contains embedded credentials. The rule is NON_COMPLIANT if the repository URL includes any username or password in the connection string and COMPLIANT if it does not.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "1.4.2.8", + "Description": "Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "1.4.2.9", + "Description": "Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "1.4.2.10", + "Description": "Checks if Azure VPN Client Authorization Rules allow connection access for all clients. The rule is NON_COMPLIANT if AccessAll is present and set to true in the Azure Virtual WAN User VPN configuration.", + "Name": "Azure VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure VPN" + } + ] + }, + { + "Id": "1.4.2.11", + "Description": "Checks if the compliance status of Azure Automation State Configuration (DSC) is COMPLIANT or NON_COMPLIANT after applying the configuration on the virtual machine. The rule is COMPLIANT if the compliance status field is set to COMPLIANT in Azure Policy guest configuration or Azure Automation State Configuration.", + "Name": "Azure Automation State Configuration", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Automation State Configuration" + } + ] + }, + { + "Id": "1.4.2.12", + "Description": "Checks if Azure Virtual WAN Hubs have Auto-Accept Shared Connections enabled. The rule is NON_COMPLIANT if the Virtual Hubs setting for automatically accepting shared connections is set to Enabled.", + "Name": "Azure Virtual WAN", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Virtual WAN" + } + ] + }, + { + "Id": "1.4.2.13", + "Description": "Checks if the Azure Kubernetes Service (AKS) API server endpoint is not publicly accessible. The rule is NON_COMPLIANT if the API server endpoint is exposed to the public internet.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_clusters_public_access_disabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "1.4.2.14", + "Description": "Checks if Azure Cognitive Search service is deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if the service endpoint is publicly accessible instead of being restricted to a private VNet.", + "Name": "Azure Cognitive Search", + "Checks": [ + "aisearch_service_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "1.4.2.15", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.16", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "1.4.2.17", + "Description": "Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "1.4.2.18", + "Description": "Checks if Azure Network Security Groups (NSGs) restrict inbound SSH (Port 22) access from the public internet. The rule is NON_COMPLIANT if there is an NSG rule allowing unrestricted inbound SSH connections (0.0.0.0/0 or ::/0).", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.19", + "Description": "Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "1.4.2.20", + "Description": "Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.", + "Name": "Azure Functions", + "Checks": [ + "app_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "1.4.2.21", + "Description": "Checks if an Azure Function App is configured to use a Virtual Network (VNet) Integration. The rule is NON_COMPLIANT if the Function App is not connected to a VNet, which may expose it to public access instead of securing it within a private network.", + "Name": "Azure Functions", + "Checks": [ + "app_function_vnet_integration_enabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "1.4.2.22", + "Description": "Checks if Azure Network Security Groups (NSGs) allow unrestricted inbound traffic on default ports for SSH (22) or RDP (3389). The rule is NON_COMPLIANT if an NSG inbound rule allows traffic from any source (0.0.0.0/0 or ::/0) on ports 22 (SSH) or 3389 (RDP), which could expose resources to unauthorized access.", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.23", + "Description": "Checks if an Azure Firewall Policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match the user-defined default action, which could lead to inconsistent or insecure traffic handling.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.24", + "Description": "Checks if an Azure Firewall Policy is associated with stateful or stateless rule collections. The rule is NON_COMPLIANT if no stateful or stateless rule collections are associated with the Azure Firewall Policy, ensuring that traffic filtering rules are properly enforced.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.25", + "Description": "Checks if an Azure Firewall Policy Rule Collection Group contains rules. The rule is NON_COMPLIANT if there are no rules in a Rule Collection Group, ensuring that traffic filtering is properly enforced.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.26", + "Description": "Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_http_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "1.4.2.27", + "Description": "Checks if Azure Cognitive Search instances are deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure Cognitive Search service endpoint is publicly accessible instead of being restricted to a private network using Private Endpoints or Service Endpoints.", + "Name": "Azure Cognitive Search", + "Checks": [ + "aisearch_service_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "1.4.2.28", + "Description": "Checks if there are any Azure Database for MySQL, PostgreSQL, or SQL Server firewall rules that are not the default firewall rule. The rule is NON_COMPLIANT if there are any custom firewall rules that allow unrestricted access instead of using the default security configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "1.4.2.29", + "Description": "Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "1.4.2.30", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "1.4.2.31", + "Description": "Checks if Azure Synapse Analytics dedicated SQL pool has Private Link enabled. The rule is NON_COMPLIANT if Private Link is not enabled or if the configuration field is set to false.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "1.4.2.32", + "Description": "Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.", + "Name": "Azure Blob Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Blob Storage" + } + ] + }, + { + "Id": "1.4.2.33", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.4.2.34", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.4.2.35", + "Description": "Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.4.2.36", + "Description": "Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.4.2.37", + "Description": "Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.4.2.38", + "Description": "Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "1.4.2.39", + "Description": "Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "1.4.2.40", + "Description": "Checks if a Private Endpoint for the service provided in the rule parameter is created for each Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure VNet does not have a Private Endpoint created for the service.", + "Name": "Azure Network", + "Checks": [ + "keyvault_private_endpoints" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.41", + "Description": "Checks if there are unused Network Security Groups (NSGs). The rule is COMPLIANT if each NSG is associated with a subnet or network interface. The rule is NON_COMPLIANT if an NSG is not associated with any subnet or network interface.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.42", + "Description": "Checks if DNS resolution from peered virtual networks (VNets) to private IP is enabled in Azure Virtual Network Peering. The rule is NON_COMPLIANT if DNS resolution from the peered VNet to private IP is not enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.43", + "Description": "Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.44", + "Description": "Checks if both VPN tunnels provided by Azure Site-to-Site VPN are in Connected status. The rule is NON_COMPLIANT if one or both tunnels are in Disconnected status.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.45", + "Description": "Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.46", + "Description": "Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.47", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.48", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.49", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.2.50", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.2: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.3.1", + "Description": "Checks if an Azure Firewall Policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match the user-defined default action, which could lead to inconsistent or insecure traffic handling.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.3: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.3.2", + "Description": "Checks if an Azure Firewall policy is configured with a user-defined default stateless action for full packets. This rule is NON_COMPLIANT if the default stateless action for full packets does not match the user-defined default stateless action.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.3: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.3.3", + "Description": "Checks if an Azure Firewall Policy is associated with stateful or stateless rule collections. The rule is NON_COMPLIANT if no stateful or stateless rule collections are associated with the Azure Firewall Policy, ensuring that traffic filtering rules are properly enforced.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.3: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.4.1", + "Description": "Checks if an Azure API Management API stage is using an Azure Web Application Firewall (WAF) web access control list (Web ACL). The rule is NON_COMPLIANT if an Azure WAF Web ACL is not used or if the applied WAF Web ACL does not match the expected configuration in the rule parameter.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.4.4.2", + "Description": "Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.4.4.3", + "Description": "Checks if Azure Cache for Redis instances are configured with a custom virtual network (VNet) integration. The rule is NON_COMPLIANT if an Azure Cache for Redis instance is using the default network configuration instead of a custom VNet and subnet.", + "Name": "Azure Cache for Redis", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Cache for Redis" + } + ] + }, + { + "Id": "1.4.4.4", + "Description": "For this rule, the rule identifier (INSTANCES_IN_VNET) and rule name (azure-vm-in-vnet) are different.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.4.5", + "Description": "Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "1.4.4.6", + "Description": "Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_http_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "1.4.4.7", + "Description": "Checks if Azure Synapse Analytics dedicated SQL pool has Private Link enabled. The rule is NON_COMPLIANT if Private Link is not enabled or if the configuration field is set to false.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "1.4.4.8", + "Description": "Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "1.4.4.9", + "Description": "Checks if DNS resolution from peered virtual networks (VNets) to private IP is enabled in Azure Virtual Network Peering. The rule is NON_COMPLIANT if DNS resolution from the peered VNet to private IP is not enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.4.10", + "Description": "Checks if both VPN tunnels provided by Azure Site-to-Site VPN are in Connected status. The rule is NON_COMPLIANT if one or both tunnels are in Disconnected status.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.4: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.4.5.1", + "Description": "Checks if Azure Virtual Machine Scale Sets (VMSS) and Azure Virtual Machines (VMs) network configurations are set to assign public IP addresses to their network interfaces. The rule is NON_COMPLIANT if the default configuration of a VM or VMSS has at least one network interface with public IP assignment enabled.", + "Name": "Azure Virtual Machine", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.5: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Virtual Machine" + } + ] + }, + { + "Id": "1.4.5.2", + "Description": "Checks if Azure Container Instances (ACI) or Azure Kubernetes Service (AKS) pod definitions are configured to share a hosts process namespace with their containers. The rule is NON_COMPLIANT if the process namespace sharing setting is enabled, allowing containers to access and modify host-level processes.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "1.4.5: Network connections between trusted and untrusted networks are controlled. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "1.5.1.1", + "Description": "Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.5.1.2", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.5.1.3", + "Description": "Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "1.5.1.4", + "Description": "Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.", + "Name": "Azure Front Door", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "1.5.1.5", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "1.5.1.6", + "Description": "Checks if the Azure DevOps repository URL contains embedded credentials. The rule is NON_COMPLIANT if the repository URL includes any username or password in the connection string and COMPLIANT if it does not.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "1.5.1.7", + "Description": "Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "1.5.1.8", + "Description": "Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "1.5.1.9", + "Description": "Checks if Azure VPN Client Authorization Rules allow connection access for all clients. The rule is NON_COMPLIANT if AccessAll is present and set to true in the Azure Virtual WAN User VPN configuration.", + "Name": "Azure VPN", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure VPN" + } + ] + }, + { + "Id": "1.5.1.10", + "Description": "Checks if the compliance status of Azure Automation State Configuration (DSC) is COMPLIANT or NON_COMPLIANT after applying the configuration on the virtual machine. The rule is COMPLIANT if the compliance status field is set to COMPLIANT in Azure Policy guest configuration or Azure Automation State Configuration.", + "Name": "Azure Automation State Configuration", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Automation State Configuration" + } + ] + }, + { + "Id": "1.5.1.11", + "Description": "Checks if Azure Virtual WAN Hubs have Auto-Accept Shared Connections enabled. The rule is NON_COMPLIANT if the Virtual Hubs setting for automatically accepting shared connections is set to Enabled.", + "Name": "Azure Virtual WAN", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Virtual WAN" + } + ] + }, + { + "Id": "1.5.1.12", + "Description": "Checks if the Azure Kubernetes Service (AKS) API server endpoint is not publicly accessible. The rule is NON_COMPLIANT if the API server endpoint is exposed to the public internet.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_clusters_public_access_disabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "1.5.1.13", + "Description": "Checks if Azure Cognitive Search service is deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if the service endpoint is publicly accessible instead of being restricted to a private VNet.", + "Name": "Azure Cognitive Search", + "Checks": [ + "aisearch_service_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "1.5.1.14", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.5.1.15", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "1.5.1.16", + "Description": "Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "1.5.1.17", + "Description": "Checks if Azure Network Security Groups (NSGs) restrict inbound SSH (Port 22) access from the public internet. The rule is NON_COMPLIANT if there is an NSG rule allowing unrestricted inbound SSH connections (0.0.0.0/0 or ::/0).", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.5.1.18", + "Description": "Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "1.5.1.19", + "Description": "Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.", + "Name": "Azure Functions", + "Checks": [ + "app_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "1.5.1.20", + "Description": "Checks if an Azure Function App is configured to use a Virtual Network (VNet) Integration. The rule is NON_COMPLIANT if the Function App is not connected to a VNet, which may expose it to public access instead of securing it within a private network.", + "Name": "Azure Functions", + "Checks": [ + "app_function_vnet_integration_enabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "1.5.1.21", + "Description": "Checks if Azure Network Security Groups (NSGs) allow unrestricted inbound traffic on default ports for SSH (22) or RDP (3389). The rule is NON_COMPLIANT if an NSG inbound rule allows traffic from any source (0.0.0.0/0 or ::/0) on ports 22 (SSH) or 3389 (RDP), which could expose resources to unauthorized access.", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.5.1.22", + "Description": "Checks if an Azure Firewall Policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match the user-defined default action, which could lead to inconsistent or insecure traffic handling.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.5.1.23", + "Description": "Checks if an Azure Firewall Policy is associated with stateful or stateless rule collections. The rule is NON_COMPLIANT if no stateful or stateless rule collections are associated with the Azure Firewall Policy, ensuring that traffic filtering rules are properly enforced.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.5.1.24", + "Description": "Checks if an Azure Firewall Policy Rule Collection Group contains rules. The rule is NON_COMPLIANT if there are no rules in a Rule Collection Group, ensuring that traffic filtering is properly enforced.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.5.1.25", + "Description": "Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_http_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "1.5.1.26", + "Description": "Checks if Azure Cognitive Search instances are deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure Cognitive Search service endpoint is publicly accessible instead of being restricted to a private network using Private Endpoints or Service Endpoints.", + "Name": "Azure Cognitive Search", + "Checks": [ + "aisearch_service_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "1.5.1.27", + "Description": "Checks if there are any Azure Database for MySQL, PostgreSQL, or SQL Server firewall rules that are not the default firewall rule. The rule is NON_COMPLIANT if there are any custom firewall rules that allow unrestricted access instead of using the default security configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "1.5.1.28", + "Description": "Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "1.5.1.29", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "1.5.1.30", + "Description": "Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.", + "Name": "Azure Blob Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Blob Storage" + } + ] + }, + { + "Id": "1.5.1.31", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.5.1.32", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.5.1.33", + "Description": "Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.5.1.34", + "Description": "Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.5.1.35", + "Description": "Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "1.5.1.36", + "Description": "Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "1.5.1.37", + "Description": "Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "1.5.1.38", + "Description": "Checks if a Private Endpoint for the service provided in the rule parameter is created for each Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure VNet does not have a Private Endpoint created for the service.", + "Name": "Azure Network", + "Checks": [ + "keyvault_private_endpoints" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.5.1.39", + "Description": "Checks if there are unused Network Security Groups (NSGs). The rule is COMPLIANT if each NSG is associated with a subnet or network interface. The rule is NON_COMPLIANT if an NSG is not associated with any subnet or network interface.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.5.1.40", + "Description": "Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.5.1.41", + "Description": "Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.5.1.42", + "Description": "Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.5.1.43", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.5.1.44", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.5.1.45", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "1.5.1.46", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.1.1", + "Description": "Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.1.2", + "Description": "Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.1.3", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.1.4", + "Description": "Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.1.5", + "Description": "Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.", + "Name": "Azure Load Balances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balances" + } + ] + }, + { + "Id": "10.2.1.1.6", + "Description": "Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.", + "Name": "Azure Front Door", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "10.2.1.1.7", + "Description": "Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.1.8", + "Description": "Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_nsg" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.1.9", + "Description": "Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.1.10", + "Description": "For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.1.11", + "Description": "Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "10.2.1.1.12", + "Description": "Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.1.13", + "Description": "Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.1.14", + "Description": "Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.", + "Name": "Azure VPN Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure VPN Gateway" + } + ] + }, + { + "Id": "10.2.1.1.15", + "Description": "Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.", + "Name": "Azure Virtual Machines", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "10.2.1.1.16", + "Description": "Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.", + "Name": "Azure Container Instances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Container Instances" + } + ] + }, + { + "Id": "10.2.1.1.17", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "10.2.1.1.18", + "Description": "Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.", + "Name": "Azure App", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure App" + } + ] + }, + { + "Id": "10.2.1.1.19", + "Description": "Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Load Balancer", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "10.2.1.1.20", + "Description": "Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.1.21", + "Description": "Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.1.22", + "Description": "For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.1.23", + "Description": "Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.", + "Name": "Azrure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azrure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.1.24", + "Description": "Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.1.25", + "Description": "Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.", + "Name": "Azure Database", + "Checks": [ + "mysql_flexible_server_audit_log_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "10.2.1.1.26", + "Description": "Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.", + "Name": "Azure SQL Database", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "10.2.1.1.27", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.", + "Name": "Azure Synapse Analytics ", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.1.28", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.1.29", + "Description": "Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.", + "Name": "Azure DNS", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DNS" + } + ] + }, + { + "Id": "10.2.1.1.30", + "Description": "Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.2.1.1.31", + "Description": "Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.", + "Name": "Azure Security Center", + "Checks": [ + "policy_ensure_asc_enforcement_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Security Center" + } + ] + }, + { + "Id": "10.2.1.1.32", + "Description": "Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.1.33", + "Description": "Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.", + "Name": "Azure Logic Apps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Logic Apps" + } + ] + }, + { + "Id": "10.2.1.1.34", + "Description": "Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_flow_log_more_than_90_days" + ], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "10.2.1.1.35", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.1.36", + "Description": "Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.1.37", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.2.1", + "Description": "Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.2.2", + "Description": "Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.2.3", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.2.4", + "Description": "Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.2.5", + "Description": "Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.", + "Name": "Azure Load Balances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balances" + } + ] + }, + { + "Id": "10.2.1.2.6", + "Description": "Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.", + "Name": "Azure Front Door", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "10.2.1.2.7", + "Description": "Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.2.8", + "Description": "For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.2.9", + "Description": "Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "10.2.1.2.10", + "Description": "Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.2.11", + "Description": "Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.2.12", + "Description": "Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.", + "Name": "Azure VPN Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure VPN Gateway" + } + ] + }, + { + "Id": "10.2.1.2.13", + "Description": "Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.", + "Name": "Azure Container Instances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Container Instances" + } + ] + }, + { + "Id": "10.2.1.2.14", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "10.2.1.2.15", + "Description": "Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.", + "Name": "Azure App", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure App" + } + ] + }, + { + "Id": "10.2.1.2.16", + "Description": "Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Load Balancer", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "10.2.1.2.17", + "Description": "Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.2.18", + "Description": "Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.2.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.2.20", + "Description": "Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.", + "Name": "Azrure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azrure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.2.21", + "Description": "Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.2.22", + "Description": "Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.", + "Name": "Azure Database", + "Checks": [ + "mysql_flexible_server_audit_log_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "10.2.1.2.23", + "Description": "Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.", + "Name": "Azure SQL Database", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "10.2.1.2.24", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.", + "Name": "Azure Synapse Analytics ", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.2.25", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.2.26", + "Description": "Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.", + "Name": "Azure DNS", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DNS" + } + ] + }, + { + "Id": "10.2.1.2.27", + "Description": "Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.2.1.2.28", + "Description": "Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.", + "Name": "Azure Logic Apps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Logic Apps" + } + ] + }, + { + "Id": "10.2.1.2.29", + "Description": "Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_flow_log_more_than_90_days" + ], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "10.2.1.2.30", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.2.31", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.3.1", + "Description": "Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.3.2", + "Description": "Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.3.3", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.3.4", + "Description": "Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.3.5", + "Description": "Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.", + "Name": "Azure Load Balances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balances" + } + ] + }, + { + "Id": "10.2.1.3.6", + "Description": "Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.", + "Name": "Azure Front Door", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "10.2.1.3.7", + "Description": "Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.3.8", + "Description": "For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.3.9", + "Description": "Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "10.2.1.3.10", + "Description": "Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.3.11", + "Description": "Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.3.12", + "Description": "Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.", + "Name": "Azure VPN Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure VPN Gateway" + } + ] + }, + { + "Id": "10.2.1.3.13", + "Description": "Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.", + "Name": "Azure Container Instances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Container Instances" + } + ] + }, + { + "Id": "10.2.1.3.14", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "10.2.1.3.15", + "Description": "Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.", + "Name": "Azure App", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure App" + } + ] + }, + { + "Id": "10.2.1.3.16", + "Description": "Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Load Balancer", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "10.2.1.3.17", + "Description": "Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.3.18", + "Description": "Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.3.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.3.20", + "Description": "Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.", + "Name": "Azrure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azrure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.3.21", + "Description": "Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.3.22", + "Description": "Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.", + "Name": "Azure Database", + "Checks": [ + "mysql_flexible_server_audit_log_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "10.2.1.3.23", + "Description": "Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.", + "Name": "Azure SQL Database", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "10.2.1.3.24", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.", + "Name": "Azure Synapse Analytics ", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.3.25", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.3.26", + "Description": "Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.", + "Name": "Azure DNS", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DNS" + } + ] + }, + { + "Id": "10.2.1.3.27", + "Description": "Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.2.1.3.28", + "Description": "Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.", + "Name": "Azure Logic Apps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Logic Apps" + } + ] + }, + { + "Id": "10.2.1.3.29", + "Description": "Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_flow_log_more_than_90_days" + ], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "10.2.1.3.30", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.3.31", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.4.1", + "Description": "Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.4.2", + "Description": "Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.4.3", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.4.4", + "Description": "Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.4.5", + "Description": "Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.", + "Name": "Azure Load Balances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balances" + } + ] + }, + { + "Id": "10.2.1.4.6", + "Description": "Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.", + "Name": "Azure Front Door", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "10.2.1.4.7", + "Description": "Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.4.8", + "Description": "For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.4.9", + "Description": "Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "10.2.1.4.10", + "Description": "Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.4.11", + "Description": "Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.4.12", + "Description": "Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.", + "Name": "Azure VPN Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure VPN Gateway" + } + ] + }, + { + "Id": "10.2.1.4.13", + "Description": "Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.", + "Name": "Azure Container Instances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Container Instances" + } + ] + }, + { + "Id": "10.2.1.4.14", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "10.2.1.4.15", + "Description": "Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.", + "Name": "Azure App", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure App" + } + ] + }, + { + "Id": "10.2.1.4.16", + "Description": "Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Load Balancer", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "10.2.1.4.17", + "Description": "Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.4.18", + "Description": "Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.4.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.4.20", + "Description": "Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.", + "Name": "Azrure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azrure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.4.21", + "Description": "Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.4.22", + "Description": "Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.", + "Name": "Azure Database", + "Checks": [ + "mysql_flexible_server_audit_log_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "10.2.1.4.23", + "Description": "Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.", + "Name": "Azure SQL Database", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "10.2.1.4.24", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.", + "Name": "Azure Synapse Analytics ", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.4.25", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.4.26", + "Description": "Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.", + "Name": "Azure DNS", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DNS" + } + ] + }, + { + "Id": "10.2.1.4.27", + "Description": "Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.2.1.4.28", + "Description": "Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.", + "Name": "Azure Logic Apps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Logic Apps" + } + ] + }, + { + "Id": "10.2.1.4.29", + "Description": "Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_flow_log_more_than_90_days" + ], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "10.2.1.4.30", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.4.31", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.5.1", + "Description": "Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.5.2", + "Description": "Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.5.3", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.5.4", + "Description": "Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.5.5", + "Description": "Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.", + "Name": "Azure Load Balances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balances" + } + ] + }, + { + "Id": "10.2.1.5.6", + "Description": "Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.", + "Name": "Azure Front Door", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "10.2.1.5.7", + "Description": "Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.5.8", + "Description": "For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.5.9", + "Description": "Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "10.2.1.5.10", + "Description": "Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.5.11", + "Description": "Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.5.12", + "Description": "Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.", + "Name": "Azure VPN Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure VPN Gateway" + } + ] + }, + { + "Id": "10.2.1.5.13", + "Description": "Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.", + "Name": "Azure Container Instances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Container Instances" + } + ] + }, + { + "Id": "10.2.1.5.14", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "10.2.1.5.15", + "Description": "Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.", + "Name": "Azure App", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure App" + } + ] + }, + { + "Id": "10.2.1.5.16", + "Description": "Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Load Balancer", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "10.2.1.5.17", + "Description": "Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.5.18", + "Description": "Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.5.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.5.20", + "Description": "Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.", + "Name": "Azrure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azrure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.5.21", + "Description": "Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.5.22", + "Description": "Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.", + "Name": "Azure Database", + "Checks": [ + "mysql_flexible_server_audit_log_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "10.2.1.5.23", + "Description": "Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.", + "Name": "Azure SQL Database", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "10.2.1.5.24", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.", + "Name": "Azure Synapse Analytics ", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.5.25", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.5.26", + "Description": "Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.", + "Name": "Azure DNS", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DNS" + } + ] + }, + { + "Id": "10.2.1.5.27", + "Description": "Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.2.1.5.28", + "Description": "Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.", + "Name": "Azure Logic Apps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Logic Apps" + } + ] + }, + { + "Id": "10.2.1.5.29", + "Description": "Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_flow_log_more_than_90_days" + ], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "10.2.1.5.30", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.5.31", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.6.1", + "Description": "Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.6.2", + "Description": "Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.6.3", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.6.4", + "Description": "Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.6.5", + "Description": "Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.", + "Name": "Azure Load Balances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balances" + } + ] + }, + { + "Id": "10.2.1.6.6", + "Description": "Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.", + "Name": "Azure Front Door", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "10.2.1.6.7", + "Description": "Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.6.8", + "Description": "For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.6.9", + "Description": "Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "10.2.1.6.10", + "Description": "Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.6.11", + "Description": "Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.6.12", + "Description": "Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.", + "Name": "Azure VPN Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure VPN Gateway" + } + ] + }, + { + "Id": "10.2.1.6.13", + "Description": "Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.", + "Name": "Azure Container Instances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Container Instances" + } + ] + }, + { + "Id": "10.2.1.6.14", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "10.2.1.6.15", + "Description": "Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.", + "Name": "Azure App", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure App" + } + ] + }, + { + "Id": "10.2.1.6.16", + "Description": "Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Load Balancer", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "10.2.1.6.17", + "Description": "Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.6.18", + "Description": "Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.6.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.6.20", + "Description": "Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.", + "Name": "Azrure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azrure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.6.21", + "Description": "Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.6.22", + "Description": "Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.", + "Name": "Azure Database", + "Checks": [ + "mysql_flexible_server_audit_log_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "10.2.1.6.23", + "Description": "Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.", + "Name": "Azure SQL Database", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "10.2.1.6.24", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.", + "Name": "Azure Synapse Analytics ", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.6.25", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.6.26", + "Description": "Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.", + "Name": "Azure DNS", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DNS" + } + ] + }, + { + "Id": "10.2.1.6.27", + "Description": "Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.2.1.6.28", + "Description": "Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.", + "Name": "Azure Logic Apps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Logic Apps" + } + ] + }, + { + "Id": "10.2.1.6.29", + "Description": "Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_flow_log_more_than_90_days" + ], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "10.2.1.6.30", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.6.31", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.7.1", + "Description": "Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.7.2", + "Description": "Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.7.3", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.7.4", + "Description": "Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.7.5", + "Description": "Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.", + "Name": "Azure Load Balances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balances" + } + ] + }, + { + "Id": "10.2.1.7.6", + "Description": "Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.", + "Name": "Azure Front Door", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "10.2.1.7.7", + "Description": "Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.7.8", + "Description": "For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.7.9", + "Description": "Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "10.2.1.7.10", + "Description": "Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.7.11", + "Description": "Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.7.12", + "Description": "Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.", + "Name": "Azure VPN Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure VPN Gateway" + } + ] + }, + { + "Id": "10.2.1.7.13", + "Description": "Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.", + "Name": "Azure Container Instances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Container Instances" + } + ] + }, + { + "Id": "10.2.1.7.14", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "10.2.1.7.15", + "Description": "Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.", + "Name": "Azure App", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure App" + } + ] + }, + { + "Id": "10.2.1.7.16", + "Description": "Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Load Balancer", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "10.2.1.7.17", + "Description": "Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.7.18", + "Description": "Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.7.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.7.20", + "Description": "Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.", + "Name": "Azrure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azrure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.7.21", + "Description": "Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.7.22", + "Description": "Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.", + "Name": "Azure Database", + "Checks": [ + "mysql_flexible_server_audit_log_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "10.2.1.7.23", + "Description": "Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.", + "Name": "Azure SQL Database", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "10.2.1.7.24", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.", + "Name": "Azure Synapse Analytics ", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.7.25", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.7.26", + "Description": "Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.", + "Name": "Azure DNS", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DNS" + } + ] + }, + { + "Id": "10.2.1.7.27", + "Description": "Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.2.1.7.28", + "Description": "Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.", + "Name": "Azure Logic Apps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Logic Apps" + } + ] + }, + { + "Id": "10.2.1.7.29", + "Description": "Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_flow_log_more_than_90_days" + ], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "10.2.1.7.30", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.7.31", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.1", + "Description": "Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.2", + "Description": "Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.3", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.4", + "Description": "Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.1.5", + "Description": "Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.", + "Name": "Azure Load Balances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balances" + } + ] + }, + { + "Id": "10.2.1.6", + "Description": "Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.", + "Name": "Azure Front Door", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "10.2.1.7", + "Description": "Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.8", + "Description": "For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.9", + "Description": "Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "10.2.1.10", + "Description": "Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.11", + "Description": "Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.12", + "Description": "Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.", + "Name": "Azure VPN Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure VPN Gateway" + } + ] + }, + { + "Id": "10.2.1.13", + "Description": "Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.", + "Name": "Azure Container Instances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Container Instances" + } + ] + }, + { + "Id": "10.2.1.14", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "10.2.1.15", + "Description": "Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.", + "Name": "Azure App", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure App" + } + ] + }, + { + "Id": "10.2.1.16", + "Description": "Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Load Balancer", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "10.2.1.17", + "Description": "Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.18", + "Description": "Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.1.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.20", + "Description": "Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.", + "Name": "Azrure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azrure Cosmos DB" + } + ] + }, + { + "Id": "10.2.1.21", + "Description": "Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.1.22", + "Description": "Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.", + "Name": "Azure Database", + "Checks": [ + "mysql_flexible_server_audit_log_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "10.2.1.23", + "Description": "Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.", + "Name": "Azure SQL Database", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "10.2.1.24", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.", + "Name": "Azure Synapse Analytics ", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.25", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.1.26", + "Description": "Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.", + "Name": "Azure DNS", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DNS" + } + ] + }, + { + "Id": "10.2.1.27", + "Description": "Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.2.1.28", + "Description": "Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.", + "Name": "Azure Logic Apps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Logic Apps" + } + ] + }, + { + "Id": "10.2.1.29", + "Description": "Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_flow_log_more_than_90_days" + ], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "10.2.1.30", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.1.31", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.2.1", + "Description": "Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.2.2", + "Description": "Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.2.3", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.2.4", + "Description": "Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.2.2.5", + "Description": "Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.", + "Name": "Azure Load Balances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balances" + } + ] + }, + { + "Id": "10.2.2.6", + "Description": "Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.", + "Name": "Azure Front Door", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "10.2.2.7", + "Description": "Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.2.8", + "Description": "For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.2.9", + "Description": "Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "10.2.2.10", + "Description": "Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.2.11", + "Description": "Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.2.2.12", + "Description": "Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.", + "Name": "Azure VPN Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure VPN Gateway" + } + ] + }, + { + "Id": "10.2.2.13", + "Description": "Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.", + "Name": "Azure Container Instances", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Container Instances" + } + ] + }, + { + "Id": "10.2.2.14", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "10.2.2.15", + "Description": "Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.", + "Name": "Azure App", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure App" + } + ] + }, + { + "Id": "10.2.2.16", + "Description": "Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Load Balancer", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "10.2.2.17", + "Description": "Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.2.18", + "Description": "Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.2.2.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.2.20", + "Description": "Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.", + "Name": "Azrure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azrure Cosmos DB" + } + ] + }, + { + "Id": "10.2.2.21", + "Description": "Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.2.2.22", + "Description": "Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.", + "Name": "Azure Database", + "Checks": [ + "mysql_flexible_server_audit_log_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "10.2.2.23", + "Description": "Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.", + "Name": "Azure SQL Database", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "10.2.2.24", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.", + "Name": "Azure Synapse Analytics ", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.2.25", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.2.2.26", + "Description": "Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.", + "Name": "Azure DNS", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure DNS" + } + ] + }, + { + "Id": "10.2.2.27", + "Description": "Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.2.2.28", + "Description": "Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.", + "Name": "Azure Logic Apps", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Logic Apps" + } + ] + }, + { + "Id": "10.2.2.29", + "Description": "Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_flow_log_more_than_90_days" + ], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "10.2.2.30", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.2.2.31", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.3.1.1", + "Description": "Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.3.1.2", + "Description": "Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.3.1.3", + "Description": "Checks if Azure Application Insights tracing is enabled on Azure API Management REST APIs. The rule is COMPLIANT if Application Insights tracing is enabled and NON_COMPLIANT otherwise.", + "Name": "Azure Application Insights", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Application Insights" + } + ] + }, + { + "Id": "10.3.1.4", + "Description": "Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.3.1.5", + "Description": "Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.", + "Name": "Azure Load Balances", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Load Balances" + } + ] + }, + { + "Id": "10.3.1.6", + "Description": "Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.", + "Name": "Azure Front Door", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "10.3.1.7", + "Description": "Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.1.8", + "Description": "For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.1.9", + "Description": "Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "10.3.1.10", + "Description": "Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.1.11", + "Description": "Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.3.1.12", + "Description": "Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.", + "Name": "Azure VPN Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure VPN Gateway" + } + ] + }, + { + "Id": "10.3.1.13", + "Description": "Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.", + "Name": "Azure Container Instances", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Container Instances" + } + ] + }, + { + "Id": "10.3.1.14", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "10.3.1.15", + "Description": "Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.", + "Name": "Azure App", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure App" + } + ] + }, + { + "Id": "10.3.1.16", + "Description": "Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Load Balancer", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "10.3.1.17", + "Description": "Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.3.1.18", + "Description": "Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.3.1.19", + "Description": "For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.1.20", + "Description": "Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.", + "Name": "Azrure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azrure Cosmos DB" + } + ] + }, + { + "Id": "10.3.1.21", + "Description": "Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.3.1.22", + "Description": "Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.", + "Name": "Azure Database", + "Checks": [ + "mysql_flexible_server_audit_log_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "10.3.1.23", + "Description": "Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.", + "Name": "Azure SQL Database", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "10.3.1.24", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.", + "Name": "Azure Synapse Analytics ", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.3.1.25", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.3.1.26", + "Description": "Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.", + "Name": "Azure DNS", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure DNS" + } + ] + }, + { + "Id": "10.3.1.27", + "Description": "Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.3.1.28", + "Description": "Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.", + "Name": "Azure Logic Apps", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Logic Apps" + } + ] + }, + { + "Id": "10.3.1.29", + "Description": "Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_flow_log_more_than_90_days" + ], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "10.3.1.30", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.1.31", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if it does not have logging enabled.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.1: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.3.2.1", + "Description": "Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "10.3.2.2", + "Description": "Checks that there is at least one Azure Monitor diagnostic setting defined with security best practices.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.2.3", + "Description": "Checks if Azure Monitor log analytics workspaces are encrypted with a specified Azure Key Vault encryption key. The rule is NON_COMPLIANT if a Log Analytics workspace is not encrypted with a Key Vault key or is encrypted with a key not supplied in the rule parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.2.4", + "Description": "Checks if Azure Activity Logs are configured to use Azure Key Vault for server-side encryption (SSE). The rule is COMPLIANT if the key vault key ID is defined for encryption.", + "Name": "Azure Monitor", + "Checks": [ + "keyvault_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.2.5", + "Description": "Checks if Azure Monitor logs have file integrity monitoring enabled. The rule is NON_COMPLIANT if log file validation is not enabled for the logs in Azure Monitor.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.2.6", + "Description": "Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "10.3.2.7", + "Description": "Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.3.2.8", + "Description": "Checks if Azure Managed Disks snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots with a similar public access setting are configured, making them accessible to all users.", + "Name": "Azure Managed Disks", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Managed Disks" + } + ] + }, + { + "Id": "10.3.2.9", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "10.3.2.10", + "Description": "Checks if Azure Files access points are configured to enforce a root directory. The rule is NON_COMPLIANT if the value of Path is set to / (default root directory of the file share).", + "Name": "Azure Files", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Files" + } + ] + }, + { + "Id": "10.3.2.11", + "Description": "Checks if Azure Files access points are configured to enforce a user identity. The rule is NON_COMPLIANT if PosixUser is not defined or if parameters are provided and there is no match in the corresponding parameter.", + "Name": "Azure Files", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Files" + } + ] + }, + { + "Id": "10.3.2.12", + "Description": "Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "10.3.2.13", + "Description": "Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.", + "Name": "Azure Functions", + "Checks": [ + "app_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "10.3.2.14", + "Description": "Checks if an Azure Cosmos DB manual database snapshot is public. The rule is NON_COMPLIANT if any existing or new Azure Cosmos DB snapshot is publicly accessible.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.3.2.15", + "Description": "Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "10.3.2.16", + "Description": "Checks if Azure SQL Database backups are public. The rule is NON_COMPLIANT if any existing or new Azure SQL Database backups are publicly accessible.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "10.3.2.17", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "10.3.2.18", + "Description": "Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.", + "Name": "Azure Blob Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Blob Storage" + } + ] + }, + { + "Id": "10.3.2.19", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.3.2.20", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.3.2.21", + "Description": "Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.3.2.22", + "Description": "Checks if Azure Blob Storage has soft delete enabled for blobs in the container. The rule is NON_COMPLIANT if soft delete for blobs is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_soft_delete_is_enabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.3.2.23", + "Description": "Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.3.2.24", + "Description": "Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.3.2.25", + "Description": "Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "10.3.2.26", + "Description": "Checks if Azure Automation runbooks owned by the account are public. The rule is NON_COMPLIANT if Azure Automation runbooks with the owner set to Self are public.", + "Name": "Azure Automations", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.2: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Automations" + } + ] + }, + { + "Id": "10.3.3.1", + "Description": "Checks if Azure SQL Database clusters are protected by an automatic backup policy. The rule is NON_COMPLIANT if the Azure SQL Database cluster is not protected by an automatic backup policy.", + "Name": "Azure Database", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "10.3.3.2", + "Description": "Checks if an Azure Backup policy has a backup rule that satisfies the required frequency and retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "10.3.3.3", + "Description": "Checks if an Azure Backup recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "10.3.3.4", + "Description": "Checks that there is at least one Azure Monitor diagnostic setting defined with security best practices.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.3.5", + "Description": "Checks if Azure Monitor log analytics workspaces are encrypted with a specified Azure Key Vault encryption key. The rule is NON_COMPLIANT if a Log Analytics workspace is not encrypted with a Key Vault key or is encrypted with a key not supplied in the rule parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.3.6", + "Description": "Checks if Azure Activity Logs are configured to use Azure Key Vault for server-side encryption (SSE). The rule is COMPLIANT if the key vault key ID is defined for encryption.", + "Name": "Azure Monitor", + "Checks": [ + "keyvault_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.3.7", + "Description": "Checks if Azure Monitor logs have file integrity monitoring enabled. The rule is NON_COMPLIANT if log file validation is not enabled for the logs in Azure Monitor.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.3.8", + "Description": "Checks if Azure SQL Database instances have backups enabled. Optionally, the rule checks the backup retention period and the backup window.", + "Name": "Azure SQL Database", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "10.3.3.9", + "Description": "Checks whether Azure Cosmos DB tables are present in Azure Backup Plans. The rule is NON_COMPLIANT if Azure Cosmos DB tables are not included in any Azure Backup Plan.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.3.3.10", + "Description": "Checks if point-in-time restore (PITR) is enabled for Azure Cosmos DB tables. The rule is NON_COMPLIANT if PITR is not enabled for Azure Cosmos DB tables.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.3.3.11", + "Description": "Checks if Azure Cosmos DB tables are protected by a backup plan. The rule is NON_COMPLIANT if the Cosmos DB Table is not covered by a backup plan.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.3.3.12", + "Description": "Checks if Azure Managed Disks are included in an Azure Backup policy. The rule is NON_COMPLIANT if Azure Managed Disks are not covered by a backup policy in Azure Backup.", + "Name": "Azure Managed Disks", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Managed Disks" + } + ] + }, + { + "Id": "10.3.3.13", + "Description": "Checks if Azure Managed Disks are protected by a backup policy. The rule is NON_COMPLIANT if the Azure Managed Disk is not covered by a backup policy in Azure Backup.", + "Name": "Azure Managed Disks", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Managed Disks" + } + ] + }, + { + "Id": "10.3.3.14", + "Description": "Checks if Azure Virtual Machines are protected by a backup policy. The rule is NON_COMPLIANT if the Azure Virtual Machine is not covered by a backup policy in Azure Backup.", + "Name": "Azure Virtual Machines", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "10.3.3.15", + "Description": "Checks if Azure Files file shares are included in an Azure Backup policy. The rule is NON_COMPLIANT if Azure Files shares are not covered by an Azure Backup policy.", + "Name": "Azure Files", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Files" + } + ] + }, + { + "Id": "10.3.3.16", + "Description": "Checks if Azure Files file shares are protected by an Azure Backup policy. The rule is NON_COMPLIANT if the Azure Files share is not covered by a backup policy.", + "Name": "Azure Files", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Files" + } + ] + }, + { + "Id": "10.3.3.17", + "Description": "Checks if Azure Cache for Redis has automatic backup enabled. The rule is NON_COMPLIANT if the backup retention period for the Redis cache is less than the required retention period.", + "Name": "Azure Cache", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Cache" + } + ] + }, + { + "Id": "10.3.3.18", + "Description": "Checks if Azure Files or Azure NetApp Files are protected by a backup plan. The rule is NON_COMPLIANT if the Azure File Share or NetApp File System is not covered by a backup plan.", + "Name": "Azure Files", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Files" + } + ] + }, + { + "Id": "10.3.3.19", + "Description": "Checks if Azure Files or Azure NetApp Files are protected by a backup plan. The rule is NON_COMPLIANT if the Azure File Share or NetApp File System is not covered by a backup plan.", + "Name": "Azure Files", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Files" + } + ] + }, + { + "Id": "10.3.3.20", + "Description": "Checks if Azure SQL databases are included in an Azure Backup policy. The rule is NON_COMPLIANT if Azure SQL databases are not part of any Azure Backup plan.", + "Name": "Azure SQL Database", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "10.3.3.21", + "Description": "Checks if Azure SQL Managed Instances are protected by an Azure Backup policy. The rule is NON_COMPLIANT if the Azure SQL Managed Instance is not included in an Azure Backup plan.", + "Name": "Azure SQL Database", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "10.3.3.22", + "Description": "Checks if Azure Synapse Analytics dedicated SQL pools have automated snapshots enabled. The rule is NON_COMPLIANT if the retention period for automated snapshots is greater than the maximum allowed retention period, less than the minimum retention period, or set to 0.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "10.3.3.23", + "Description": "Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.3.3.24", + "Description": "Checks if Azure Blob Storage containers are protected by a backup policy. The rule is NON_COMPLIANT if the Azure Blob Storage container is not covered by a backup policy.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.3: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.3.4.1", + "Description": "Checks if Azure Content Delivery Network (CDN) with Azure Blob Storage origin has managed identity authentication configured. The rule is NON_COMPLIANT if the Azure CDN endpoint is backed by Azure Blob Storage and does not have managed identity authentication configured, or if the origin is not a Blob Storage container.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "10.3.4.2", + "Description": "Checks if an Azure Content Delivery Network (CDN) profile with an Azure Blob Storage origin has managed identity authentication enabled. The rule is NON_COMPLIANT for Azure CDN profiles with Blob Storage origins that do not have managed identity authentication enabled.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "10.3.4.3", + "Description": "Checks that there is at least one Azure Monitor diagnostic setting defined with security best practices.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.4.4", + "Description": "Checks if Azure Monitor log analytics workspaces are encrypted with a specified Azure Key Vault encryption key. The rule is NON_COMPLIANT if a Log Analytics workspace is not encrypted with a Key Vault key or is encrypted with a key not supplied in the rule parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.4.5", + "Description": "Checks if Azure Activity Logs are configured to use Azure Key Vault for server-side encryption (SSE). The rule is COMPLIANT if the key vault key ID is defined for encryption.", + "Name": "Azure Monitor", + "Checks": [ + "keyvault_logging_enabled" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.4.6", + "Description": "Checks if Azure Monitor logs have file integrity monitoring enabled. The rule is NON_COMPLIANT if log file validation is not enabled for the logs in Azure Monitor.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.3.4.7", + "Description": "Checks if the Azure Blob Storage container has immutable blob storage enabled by default. The rule is NON_COMPLIANT if immutable blob storage is not enabled.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.3.4.8", + "Description": "Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.3.4.9", + "Description": "Checks if versioning is enabled for your Azure Blob Storage containers. Optionally, the rule checks if immutable storage with versioning is enabled for your containers. The rule is NON_COMPLIANT if versioning is not enabled.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "10.3.4: Audit logs are protected from destruction and unauthorized modifications. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.4.1.1.1", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.4.1.1.2", + "Description": "Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.4.1.1.3", + "Description": "Checks if Azure Monitor Diagnostic settings are configured to send logs to Log Analytics workspace. The rule is NON_COMPLIANT if no diagnostic settings are configured to send logs to Log Analytics.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.4.1.1.4", + "Description": "Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.", + "Name": "Azure Virtual Machines", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "10.4.1.1.5", + "Description": "Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.", + "Name": "Azure Security Center", + "Checks": [ + "policy_ensure_asc_enforcement_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Security Center" + } + ] + }, + { + "Id": "10.4.1.1.6", + "Description": "Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.4.1.1.7", + "Description": "Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.4.1.1", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.4.1.2", + "Description": "Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.4.1.3", + "Description": "Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.", + "Name": "Azure Virtual Machines", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "10.4.1.4", + "Description": "Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.", + "Name": "Azure Security Center", + "Checks": [ + "policy_ensure_asc_enforcement_enabled" + ], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Security Center" + } + ] + }, + { + "Id": "10.4.1.5", + "Description": "Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.4.1.6", + "Description": "Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.4.2.1", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.4.2.2", + "Description": "Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_nsg" + ], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.4.2.3", + "Description": "Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.4.2.4", + "Description": "Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.", + "Name": "Azure Virtual Machines", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "10.4.2.5", + "Description": "Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.", + "Name": "Azure Security Center", + "Checks": [ + "policy_ensure_asc_enforcement_enabled" + ], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Security Center" + } + ] + }, + { + "Id": "10.4.2.6", + "Description": "Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.4.2.7", + "Description": "Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.4.3.1", + "Description": "Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_nsg" + ], + "Attributes": [ + { + "Section": "10.4.3: Audit logs are reviewed to identify anomalies or suspicious activity. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.5.1.1", + "Description": "Checks if an Azure Backup policy has a backup rule that satisfies the required frequency and retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "10.5.1.2", + "Description": "Checks if an Azure Backup recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "10.5.1.3", + "Description": "Checks that there is at least one Azure Monitor diagnostic setting defined with security best practices.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.5.1.4", + "Description": "Checks if an Azure Monitor Log Analytics Workspace retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.5.1.5", + "Description": "Checks if an Azure Cosmos DB cluster retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.5.1.6", + "Description": "Checks if point-in-time restore (PITR) is enabled for Azure Cosmos DB tables. The rule is NON_COMPLIANT if PITR is not enabled for Azure Cosmos DB tables.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.5.1.7", + "Description": "Checks if Azure Managed Disks are attached to Virtual Machines. Optionally, checks if Managed Disks are configured to be deleted when the Virtual Machine is terminated.", + "Name": "Azure Managed Disks", + "Checks": [ + "vm_ensure_using_managed_disks" + ], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "Azure Managed Disks" + } + ] + }, + { + "Id": "10.5.1.8", + "Description": "Checks if a private Azure Container Registry (ACR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the ACR private repository.", + "Name": "Azure Container Registry", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "Azure Container Registry" + } + ] + }, + { + "Id": "10.5.1.9", + "Description": "Checks if Azure Cognitive Search services are configured to send logs to Azure Monitor Logs. The rule is COMPLIANT if logging is enabled for an Azure Cognitive Search instance. This rule is NON_COMPLIANT if logging is not configured.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "10.5.1.10", + "Description": "Checks if Azure Cognitive Search services have audit logging enabled. The rule is NON_COMPLIANT if an Azure Cognitive Search service does not have audit logging enabled.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "10.5.1.11", + "Description": "Checks if Azure Cognitive Search services are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not configured.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "10.5.1.12", + "Description": "Checks if a lifecycle management policy is configured for an Azure Blob Storage container. The rule is NON_COMPLIANT if there are no active lifecycle management policies or if the configuration does not match the parameter values.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.5.1.13", + "Description": "Checks if Azure Blob Storage containers with versioning enabled have a lifecycle management policy configured. The rule is NON_COMPLIANT if lifecycle management policies are not enabled.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "10.5.1: Audit log history is retained and available for analysis. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.6.3.1", + "Description": "Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.6.3.2", + "Description": "Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.6.3.3", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.6.3.4", + "Description": "Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.6.3.5", + "Description": "Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.", + "Name": "Azure Load Balances", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Load Balances" + } + ] + }, + { + "Id": "10.6.3.6", + "Description": "Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.", + "Name": "Azure Front Door", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "10.6.3.7", + "Description": "Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.6.3.8", + "Description": "Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_nsg" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.6.3.9", + "Description": "Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.6.3.10", + "Description": "For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.6.3.11", + "Description": "Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "10.6.3.12", + "Description": "Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.6.3.13", + "Description": "Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "10.6.3.14", + "Description": "Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.", + "Name": "Azure VPN Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure VPN Gateway" + } + ] + }, + { + "Id": "10.6.3.15", + "Description": "Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.", + "Name": "Azure Virtual Machines", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "10.6.3.16", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Backup", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "10.6.3.17", + "Description": "Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.", + "Name": "Azure Container Instances", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Container Instances" + } + ] + }, + { + "Id": "10.6.3.18", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "10.6.3.19", + "Description": "Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.", + "Name": "Azure App", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure App" + } + ] + }, + { + "Id": "10.6.3.20", + "Description": "Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Load Balancer", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "10.6.3.21", + "Description": "Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "10.6.3.22", + "Description": "Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.6.3.23", + "Description": "Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.6.3.24", + "Description": "For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.6.3.25", + "Description": "Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.", + "Name": "Azrure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azrure Cosmos DB" + } + ] + }, + { + "Id": "10.6.3.26", + "Description": "Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.6.3.27", + "Description": "Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "10.6.3.28", + "Description": "Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.", + "Name": "Azure Database", + "Checks": [ + "mysql_flexible_server_audit_log_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "10.6.3.29", + "Description": "Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.", + "Name": "Azure SQL Database", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "10.6.3.30", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.", + "Name": "Azure Synapse Analytics ", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.6.3.31", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "10.6.3.32", + "Description": "Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.", + "Name": "Azure DNS", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure DNS" + } + ] + }, + { + "Id": "10.6.3.33", + "Description": "Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.6.3.34", + "Description": "Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.6.3.35", + "Description": "Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "10.6.3.36", + "Description": "Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.", + "Name": "Azure Security Center", + "Checks": [ + "policy_ensure_asc_enforcement_enabled" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Security Center" + } + ] + }, + { + "Id": "10.6.3.37", + "Description": "Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.6.3.38", + "Description": "Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.", + "Name": "Azure Logic Apps", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Logic Apps" + } + ] + }, + { + "Id": "10.6.3.39", + "Description": "Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_flow_log_more_than_90_days" + ], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "10.6.3.40", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.6.3.41", + "Description": "Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.6.3.42", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if logging is not enabled.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "10.6.3: Time-synchronization mechanisms support consistent time settings across all systems. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.7.1.1", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.7.1.2", + "Description": "Checks if your Azure Resource Manager (ARM) templates send event notifications to an Azure Event Grid topic or Azure Service Bus. Optionally checks if specified Event Grid topics or Service Bus namespaces are used. The rule is NON_COMPLIANT if ARM templates do not send notifications.", + "Name": "Azure Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure Resource Manager" + } + ] + }, + { + "Id": "10.7.1.3", + "Description": "Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_nsg" + ], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.7.1.4", + "Description": "Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.7.1.5", + "Description": "Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.", + "Name": "Azure Virtual Machines", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "10.7.1.6", + "Description": "Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.", + "Name": "Azure Security Center", + "Checks": [ + "policy_ensure_asc_enforcement_enabled" + ], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure Security Center" + } + ] + }, + { + "Id": "10.7.1.7", + "Description": "Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.7.1.8", + "Description": "Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "10.7.2.1", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "10.7.2.2", + "Description": "Checks if your Azure Resource Manager (ARM) templates send event notifications to an Azure Event Grid topic or Azure Service Bus. Optionally checks if specified Event Grid topics or Service Bus namespaces are used. The rule is NON_COMPLIANT if ARM templates do not send notifications.", + "Name": "Azure Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure Resource Manager" + } + ] + }, + { + "Id": "10.7.2.3", + "Description": "Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_nsg" + ], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.7.2.4", + "Description": "Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "10.7.2.5", + "Description": "Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.", + "Name": "Azure Virtual Machines", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "10.7.2.6", + "Description": "Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.", + "Name": "Azure Security Center", + "Checks": [ + "policy_ensure_asc_enforcement_enabled" + ], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure Security Center" + } + ] + }, + { + "Id": "10.7.2.7", + "Description": "Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "10.7.2.8", + "Description": "Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "11.3.1.1.1", + "Description": "Checks if all the specified applications are installed on the Azure Virtual Machine (VM). Optionally, specify the minimum acceptable version. You can also specify the platform to apply the rule only to VMs running that platform.", + "Name": "Azure Virtual Machine", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "Azure Virtual Machine" + } + ] + }, + { + "Id": "11.3.1.1.2", + "Description": "Checks if the compliance status of the Azure Update Management patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the virtual machine (VM). The rule is compliant if the field status is COMPLIANT.", + "Name": "Azure Update Management", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "Azure Update Management" + } + ] + }, + { + "Id": "11.3.1.2.1", + "Description": "Checks if a private Azure Container Registry (ACR) repository has image scanning enabled. The rule is NON_COMPLIANT if the private Azure ACR repositorys scan frequency is not set to “scan on push” or “continuous scan.”", + "Name": "Azure Container Registry", + "Checks": [ + "defender_container_images_scan_enabled" + ], + "Attributes": [ + { + "Section": "11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "Azure Container Registry" + } + ] + }, + { + "Id": "11.3.1.3.1", + "Description": "Checks if all the specified applications are installed on the Azure Virtual Machine (VM). Optionally, specify the minimum acceptable version. You can also specify the platform to apply the rule only to VMs running that platform.", + "Name": "Azure Virtual Machine", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "Azure Virtual Machine" + } + ] + }, + { + "Id": "11.3.1.3.2", + "Description": "Checks if the compliance status of the Azure Update Management patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the virtual machine (VM). The rule is compliant if the field status is COMPLIANT.", + "Name": "Azure Update Management", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "Azure Update Management" + } + ] + }, + { + "Id": "11.3.1.3.3", + "Description": "Checks if a private Azure Container Registry (ACR) repository has image scanning enabled. The rule is NON_COMPLIANT if the private Azure ACR repositorys scan frequency is not set to “scan on push” or “continuous scan.”", + "Name": "Azure Container Registry", + "Checks": [ + "defender_container_images_scan_enabled" + ], + "Attributes": [ + { + "Section": "11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "Azure Container Registry" + } + ] + }, + { + "Id": "11.3.1.1", + "Description": "Checks if all the specified applications are installed on the Azure Virtual Machine (VM). Optionally, specify the minimum acceptable version. You can also specify the platform to apply the rule only to VMs running that platform.", + "Name": "Azure Virtual Machine", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "Azure Virtual Machine" + } + ] + }, + { + "Id": "11.3.1.2", + "Description": "Checks if the compliance status of the Azure Update Management patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the virtual machine (VM). The rule is compliant if the field status is COMPLIANT.", + "Name": "Azure Update Management", + "Checks": [], + "Attributes": [ + { + "Section": "11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "Azure Update Management" + } + ] + }, + { + "Id": "11.3.1.3", + "Description": "Checks if a private Azure Container Registry (ACR) repository has image scanning enabled. The rule is NON_COMPLIANT if the private Azure ACR repositorys scan frequency is not set to “scan on push” or “continuous scan.”", + "Name": "Azure Container Registry", + "Checks": [ + "defender_container_images_scan_enabled" + ], + "Attributes": [ + { + "Section": "11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed. ", + "Service": "Azure Container Registry" + } + ] + }, + { + "Id": "11.5.1.1.1", + "Description": "Checks whether an Azure Application Gateway, Azure Front Door, Azure Load Balancer, or Azure Public IP has Azure DDoS Protection enabled. It also checks if they have a Web Application Firewall (WAF) policy associated for Azure Application Gateway and Azure Front Door.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.1.1: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "11.5.1.1.2", + "Description": "Checks if Microsoft Defender for Cloud is enabled in your Azure subscription and region. If you provide a central security management account, the rule evaluates the Defender for Cloud settings in the centralized account. The rule is COMPLIANT when Defender for Cloud is enabled.", + "Name": "Microsoft Defender", + "Checks": [ + "defender_ensure_mcas_is_enabled" + ], + "Attributes": [ + { + "Section": "11.5.1.1: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "Microsoft Defender" + } + ] + }, + { + "Id": "11.5.1.1", + "Description": "Checks whether an Azure Application Gateway, Azure Front Door, Azure Load Balancer, or Azure Public IP has Azure DDoS Protection enabled. It also checks if they have a Web Application Firewall (WAF) policy associated for Azure Application Gateway and Azure Front Door.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.1: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "11.5.1.2", + "Description": "Checks if Microsoft Defender for Cloud is enabled in your Azure subscription and region. If you provide a central security management account, the rule evaluates the Defender for Cloud settings in the centralized account. The rule is COMPLIANT when Defender for Cloud is enabled.", + "Name": "Microsoft Defender", + "Checks": [ + "defender_ensure_mcas_is_enabled" + ], + "Attributes": [ + { + "Section": "11.5.1: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "Microsoft Defender" + } + ] + }, + { + "Id": "11.5.2.1", + "Description": "Checks if your Azure Resource Manager (ARM) templates send event notifications to an Azure Event Grid topic or Azure Service Bus. Optionally checks if specified Event Grid topics or Service Bus namespaces are used. The rule is NON_COMPLIANT if ARM templates do not send notifications.", + "Name": "Azure Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "Azure Resource Manager" + } + ] + }, + { + "Id": "11.5.2.2", + "Description": "Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_nsg" + ], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "11.5.2.3", + "Description": "Checks whether Azure Monitor alerts with the given metric name have the specified settings.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "11.5.2.4", + "Description": "Checks if Azure Monitor Diagnostic settings are configured to send logs to Log Analytics workspace. The rule is NON_COMPLIANT if no diagnostic settings are configured to send logs to Log Analytics.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "11.5.2.5", + "Description": "Checks if Azure Storage Event Grid notifications are enabled on an Azure Storage account. The rule is NON_COMPLIANT if Event Grid notifications are not set on a storage account, or if the event type or destination do not match the specified parameters.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "11.5.2.6", + "Description": "Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "11.5.2: Network intrusions and unexpected file changes are detected and responded to. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "11.6.1.1", + "Description": "Checks if your Azure Resource Manager (ARM) templates send event notifications to an Azure Event Grid topic or Azure Service Bus. Optionally checks if specified Event Grid topics or Service Bus namespaces are used. The rule is NON_COMPLIANT if ARM templates do not send notifications.", + "Name": "Azure Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to. ", + "Service": "Azure Resource Manager" + } + ] + }, + { + "Id": "11.6.1.2", + "Description": "Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_nsg" + ], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "11.6.1.3", + "Description": "Checks whether Azure Monitor alerts with the given metric name have the specified settings.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "11.6.1.4", + "Description": "Checks if Azure Monitor Diagnostic settings are configured to send logs to Log Analytics workspace. The rule is NON_COMPLIANT if no diagnostic settings are configured to send logs to Log Analytics.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "11.6.1.5", + "Description": "Checks if Azure Storage Event Grid notifications are enabled on an Azure Storage account. The rule is NON_COMPLIANT if Event Grid notifications are not set on a storage account, or if the event type or destination do not match the specified parameters.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "11.6.1.6", + "Description": "Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "11.6.1: Unauthorized changes on payment pages are detected and responded to. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "12.10.5.1", + "Description": "Checks if your Azure Resource Manager (ARM) templates send event notifications to an Azure Event Grid topic or Azure Service Bus. Optionally checks if specified Event Grid topics or Service Bus namespaces are used. The rule is NON_COMPLIANT if ARM templates do not send notifications.", + "Name": "Azure Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. ", + "Service": "Azure Resource Manager" + } + ] + }, + { + "Id": "12.10.5.2", + "Description": "Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_nsg" + ], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "12.10.5.3", + "Description": "Checks whether Azure Monitor alerts with the given metric name have the specified settings.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "12.10.5.4", + "Description": "Checks if Azure Monitor Diagnostic settings are configured to send logs to Log Analytics workspace. The rule is NON_COMPLIANT if no diagnostic settings are configured to send logs to Log Analytics.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "12.10.5.5", + "Description": "Checks if Azure Storage Event Grid notifications are enabled on an Azure Storage account. The rule is NON_COMPLIANT if Event Grid notifications are not set on a storage account, or if the event type or destination do not match the specified parameters.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "12.10.5.6", + "Description": "Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "12.4.2.1.1", + "Description": "Checks if Azure Service Catalog shares portfolios with an Azure Management Group when integration is enabled with Azure Management Groups. The rule is NON_COMPLIANT if the Type value of a share is Subscription.", + "Name": "Azure Service Catalog", + "Checks": [], + "Attributes": [ + { + "Section": "12.4.2.1: PCI DSS compliance is managed. ", + "Service": "Azure Service Catalog" + } + ] + }, + { + "Id": "2.2.5.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Azure Application Gateway. The rule is NON_COMPLIANT if one or more HTTP listeners of Azure Application Gateway do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP listeners are forwarding traffic to another HTTP listener instead of enforcing redirection.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "2.2.5.2", + "Description": "Checks if Azure Front Door or Azure CDN endpoints are using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for an Azure Front Door or CDN profile if any TLS settings include outdated protocols such as TLS 1.0 or TLS 1.1.", + "Name": "Azure CDN", + "Checks": [ + "app_minimum_tls_version_12" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "2.2.5.3", + "Description": "Checks if Azure Front Door and Azure CDN profiles are using a minimum security policy and cipher suite of TLSv1.2 or greater for viewer connections. The rule is NON_COMPLIANT if the minimum TLS version configured is below TLS 1.2.", + "Name": "Azure CDN", + "Checks": [ + "app_minimum_tls_version_12" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "2.2.5.4", + "Description": "Checks if Azure Front Door and Azure CDN profiles are using a custom SSL certificate and are configured to use SNI (Server Name Indication) to serve HTTPS requests. The rule is NON_COMPLIANT if a custom SSL certificate is associated but the SSL support method is using a dedicated IP address instead of SNI.", + "Name": "Azure CDN", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "2.2.5.5", + "Description": "Checks if Azure Front Door and Azure CDN profiles are encrypting traffic to custom origins. The rule is NON_COMPLIANT if OriginProtocolPolicy is set to HTTP only or if OriginProtocolPolicy is set to Match viewer and ViewerProtocolPolicy allows both HTTP and HTTPS traffic.", + "Name": "Azure CDN", + "Checks": [ + "network_http_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "2.2.5.6", + "Description": "Checks if your Azure Front Door and Azure CDN profiles enforce HTTPS (directly or via a redirection). The rule is NON_COMPLIANT if the ViewerProtocolPolicy allows both HTTP and HTTPS traffic for the Default Route Configuration or Custom Route Configurations.", + "Name": "Azure CDN", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "2.2.5.7", + "Description": "Checks if Azure AI Search nodes are encrypted end to end. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the Azure OpenSearch domain.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "2.2.5.8", + "Description": "Checks whether your Azure Load Balancer or Application Gateway SSL listeners are using a custom SSL policy. The rule is applicable only if SSL listeners are configured for the Azure Application Gateway or Azure Front Door. The rule is NON_COMPLIANT if the SSL policy does not follow the organizations security standards.", + "Name": "Azure Load Balancer", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "2.2.5.9", + "Description": "Checks if your Azure Application Gateway or Azure Front Door SSL listeners use a predefined SSL policy. The rule is NON_COMPLIANT if the SSL policy configured for the HTTPS/SSL listener does not match the value of the parameter predefinedPolicyName.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "2.2.5.10", + "Description": "Checks if your Azure Application Gateway or Azure Front Door is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured to use HTTPS with a valid SSL certificate.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "2.2.5.11", + "Description": "Checks if Azure HDInsight clusters have Enterprise Security Package (ESP) with Kerberos authentication enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not meet the specified rule parameters.", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "2.2.5.12", + "Description": "Checks whether connections to Azure AI Search services are using HTTPS. The rule is NON_COMPLIANT if the EnforceHTTPS setting is not enabled or if the minimum TLS version does not meet the required security policy.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "2.2.5.13", + "Description": "Checks if Azure AI Search services have end-to-end encryption enabled. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the search service.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "2.2.5.14", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) requires TLS/SSL encryption for connections to SQL clients. The rule is NON_COMPLIANT if any Azure Synapse Analytics workspace does not enforce SSL connections.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "2.2.5.15", + "Description": "Checks if Azure Blob Storage accounts enforce secure transfer (HTTPS/TLS) for all requests. The rule is NON_COMPLIANT if any Azure Storage account allows requests over HTTP instead of requiring HTTPS/TLS.", + "Name": "Azure Blob Storage", + "Checks": [ + "storage_secure_transfer_required_is_enabled" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure Blob Storage" + } + ] + }, + { + "Id": "2.2.5.16", + "Description": "Checks if an Azure Storage Account with SFTP enabled allows unencrypted FTP connections. The rule is NON_COMPLIANT if the storage account permits FTP instead of requiring SFTP or FTPS for secure endpoint connections.", + "Name": "Azure Storage", + "Checks": [ + "app_function_ftps_deployment_disabled" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "2.2.5.17", + "Description": "Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "2.2.5: System components are configured and managed securely. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "2.2.7.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Azure Application Gateway. The rule is NON_COMPLIANT if one or more HTTP listeners of Azure Application Gateway do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP listeners are forwarding traffic to another HTTP listener instead of enforcing redirection.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "2.2.7.2", + "Description": "Checks if Azure Front Door or Azure CDN endpoints are using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for an Azure Front Door or CDN profile if any TLS settings include outdated protocols such as TLS 1.0 or TLS 1.1.", + "Name": "Azure CDN", + "Checks": [ + "app_minimum_tls_version_12" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "2.2.7.3", + "Description": "Checks if Azure Front Door and Azure CDN profiles are encrypting traffic to custom origins. The rule is NON_COMPLIANT if OriginProtocolPolicy is set to HTTP only or if OriginProtocolPolicy is set to Match viewer and ViewerProtocolPolicy allows both HTTP and HTTPS traffic.", + "Name": "Azure CDN", + "Checks": [ + "network_http_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "2.2.7.4", + "Description": "Checks if your Azure Front Door and Azure CDN profiles enforce HTTPS (directly or via a redirection). The rule is NON_COMPLIANT if the ViewerProtocolPolicy allows both HTTP and HTTPS traffic for the Default Route Configuration or Custom Route Configurations.", + "Name": "Azure CDN", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "2.2.7.5", + "Description": "Checks if your Azure Cosmos DB Accelerator (DAX equivalent) cluster has ClusterEndpointEncryptionType set to TLS. The rule is NON_COMPLIANT if a Cosmos DB Accelerator cluster is not encrypted using Transport Layer Security (TLS).", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "2.2.7.6", + "Description": "Checks if Azure Database Migration Service (Azure DMS) endpoints are configured with an SSL connection. The rule is NON_COMPLIANT if Azure DMS does not have an SSL connection configured.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "2.2.7.7", + "Description": "Checks if Azure Database Migration Service (Azure DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints. The rule is NON_COMPLIANT if TLS/SSL encryption is not enabled.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "2.2.7.8", + "Description": "Checks if Azure Cache for Redis replication groups have encryption-in-transit enabled. The rule is NON_COMPLIANT for an Azure Cache for Redis replication group if enableNonSslPort is set to true.", + "Name": "Azure Cache", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure Cache" + } + ] + }, + { + "Id": "2.2.7.9", + "Description": "Checks if Azure AI Search nodes are encrypted end to end. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the Azure OpenSearch domain.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "2.2.7.10", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "2.2.7.11", + "Description": "Checks whether your Azure Load Balancer or Application Gateway SSL listeners are using a custom SSL policy. The rule is applicable only if SSL listeners are configured for the Azure Application Gateway or Azure Front Door. The rule is NON_COMPLIANT if the SSL policy does not follow the organizations security standards.", + "Name": "Azure Load Balancer", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "2.2.7.12", + "Description": "Checks if your Azure Application Gateway or Azure Front Door SSL listeners use a predefined SSL policy. The rule is NON_COMPLIANT if the SSL policy configured for the HTTPS/SSL listener does not match the value of the parameter predefinedPolicyName.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "2.2.7.13", + "Description": "Checks if your Azure Application Gateway or Azure Front Door is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured to use HTTPS with a valid SSL certificate.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "2.2.7.14", + "Description": "Checks if Azure HDInsight clusters have Enterprise Security Package (ESP) with Kerberos authentication enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not meet the specified rule parameters.", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "2.2.7.15", + "Description": "Checks if an Azure Event Hubs or Azure Service Bus namespace enforces encryption in transit using HTTPS (TLS) for communication between nodes. The rule is NON_COMPLIANT if plain text communication is enabled for in-cluster node connections.", + "Name": "Azure Events Hub", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure Events Hub" + } + ] + }, + { + "Id": "2.2.7.16", + "Description": "Checks whether connections to Azure AI Search services are using HTTPS. The rule is NON_COMPLIANT if the EnforceHTTPS setting is not enabled or if the minimum TLS version does not meet the required security policy.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "2.2.7.17", + "Description": "Checks if Azure AI Search services have end-to-end encryption enabled. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the search service.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "2.2.7.18", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) requires TLS/SSL encryption for connections to SQL clients. The rule is NON_COMPLIANT if any Azure Synapse Analytics workspace does not enforce SSL connections.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "2.2.7.19", + "Description": "Checks if Azure Blob Storage accounts enforce secure transfer (HTTPS/TLS) for all requests. The rule is NON_COMPLIANT if any Azure Storage account allows requests over HTTP instead of requiring HTTPS/TLS.", + "Name": "Azure Blob Storage", + "Checks": [ + "storage_secure_transfer_required_is_enabled" + ], + "Attributes": [ + { + "Section": "2.2.7: System components are configured and managed securely. ", + "Service": "Azure Blob Storage" + } + ] + }, + { + "Id": "3.2.1.1", + "Description": "Checks if an Azure Backup policy has a backup rule that satisfies the required frequency and retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "3.2.1.2", + "Description": "Checks if an Azure Backup recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "3.2.1.3", + "Description": "Checks if an Azure Monitor Log Analytics Workspace retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "3.2.1.4", + "Description": "Checks if an Azure Cosmos DB cluster retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.2.1.5", + "Description": "Checks if point-in-time restore (PITR) is enabled for Azure Cosmos DB tables. The rule is NON_COMPLIANT if PITR is not enabled for Azure Cosmos DB tables.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.2.1.6", + "Description": "Checks if Azure Managed Disks are attached to Virtual Machines. Optionally, checks if Managed Disks are configured to be deleted when the Virtual Machine is terminated.", + "Name": "Azure Managed Disks", + "Checks": [ + "vm_ensure_using_managed_disks" + ], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "Azure Managed Disks" + } + ] + }, + { + "Id": "3.2.1.7", + "Description": "Checks if a private Azure Container Registry (ACR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the ACR private repository.", + "Name": "Azure Container Registry", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "Azure Container Registry" + } + ] + }, + { + "Id": "3.2.1.8", + "Description": "Checks if a lifecycle management policy is configured for an Azure Blob Storage container. The rule is NON_COMPLIANT if there are no active lifecycle management policies or if the configuration does not match the parameter values.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.2.1.9", + "Description": "Checks if Azure Blob Storage containers with versioning enabled have a lifecycle management policy configured. The rule is NON_COMPLIANT if lifecycle management policies are not enabled.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.2.1: Storage of account data is kept to a minimum. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.3.1.1.1", + "Description": "Checks if an Azure Backup policy has a backup rule that satisfies the required frequency and retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "3.3.1.1.2", + "Description": "Checks if an Azure Backup recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "3.3.1.1.3", + "Description": "Checks if an Azure Monitor Log Analytics Workspace retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "3.3.1.1.4", + "Description": "Checks if an Azure Cosmos DB cluster retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.3.1.1.5", + "Description": "Checks if point-in-time restore (PITR) is enabled for Azure Cosmos DB tables. The rule is NON_COMPLIANT if PITR is not enabled for Azure Cosmos DB tables.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.3.1.1.6", + "Description": "Checks if Azure Managed Disks are attached to Virtual Machines. Optionally, checks if Managed Disks are configured to be deleted when the Virtual Machine is terminated.", + "Name": "Azure Managed Disks", + "Checks": [ + "vm_ensure_using_managed_disks" + ], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Managed Disks" + } + ] + }, + { + "Id": "3.3.1.1.7", + "Description": "Checks if a private Azure Container Registry (ACR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the ACR private repository.", + "Name": "Azure Container Registry", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Container Registry" + } + ] + }, + { + "Id": "3.3.1.1.8", + "Description": "Checks if a lifecycle management policy is configured for an Azure Blob Storage container. The rule is NON_COMPLIANT if there are no active lifecycle management policies or if the configuration does not match the parameter values.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.3.1.1.9", + "Description": "Checks if Azure Blob Storage containers with versioning enabled have a lifecycle management policy configured. The rule is NON_COMPLIANT if lifecycle management policies are not enabled.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.1: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.3.1.3.1", + "Description": "Checks if an Azure Backup policy has a backup rule that satisfies the required frequency and retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "3.3.1.3.2", + "Description": "Checks if an Azure Backup recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "3.3.1.3.3", + "Description": "Checks if an Azure Monitor Log Analytics Workspace retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "3.3.1.3.4", + "Description": "Checks if an Azure Cosmos DB cluster retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.3.1.3.5", + "Description": "Checks if point-in-time restore (PITR) is enabled for Azure Cosmos DB tables. The rule is NON_COMPLIANT if PITR is not enabled for Azure Cosmos DB tables.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.3.1.3.6", + "Description": "Checks if Azure Managed Disks are attached to Virtual Machines. Optionally, checks if Managed Disks are configured to be deleted when the Virtual Machine is terminated.", + "Name": "Azure Managed Disks", + "Checks": [ + "vm_ensure_using_managed_disks" + ], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Managed Disks" + } + ] + }, + { + "Id": "3.3.1.3.7", + "Description": "Checks if a private Azure Container Registry (ACR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the ACR private repository.", + "Name": "Azure Container Registry", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Container Registry" + } + ] + }, + { + "Id": "3.3.1.3.8", + "Description": "Checks if a lifecycle management policy is configured for an Azure Blob Storage container. The rule is NON_COMPLIANT if there are no active lifecycle management policies or if the configuration does not match the parameter values.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.3.1.3.9", + "Description": "Checks if Azure Blob Storage containers with versioning enabled have a lifecycle management policy configured. The rule is NON_COMPLIANT if lifecycle management policies are not enabled.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.1.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.3.2.1", + "Description": "Checks if an Azure Backup policy has a backup rule that satisfies the required frequency and retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "3.3.2.2", + "Description": "Checks if an Azure Backup recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "3.3.2.3", + "Description": "Checks if an Azure Monitor Log Analytics Workspace retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "3.3.2.4", + "Description": "Checks if an Azure Cosmos DB cluster retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.3.2.5", + "Description": "Checks if point-in-time restore (PITR) is enabled for Azure Cosmos DB tables. The rule is NON_COMPLIANT if PITR is not enabled for Azure Cosmos DB tables.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.3.2.6", + "Description": "Checks if Azure Managed Disks are attached to Virtual Machines. Optionally, checks if Managed Disks are configured to be deleted when the Virtual Machine is terminated.", + "Name": "Azure Managed Disks", + "Checks": [ + "vm_ensure_using_managed_disks" + ], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Managed Disks" + } + ] + }, + { + "Id": "3.3.2.7", + "Description": "Checks if a private Azure Container Registry (ACR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the ACR private repository.", + "Name": "Azure Container Registry", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Container Registry" + } + ] + }, + { + "Id": "3.3.2.8", + "Description": "Checks if a lifecycle management policy is configured for an Azure Blob Storage container. The rule is NON_COMPLIANT if there are no active lifecycle management policies or if the configuration does not match the parameter values.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.3.2.9", + "Description": "Checks if Azure Blob Storage containers with versioning enabled have a lifecycle management policy configured. The rule is NON_COMPLIANT if lifecycle management policies are not enabled.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.2: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.3.3.1", + "Description": "Checks if an Azure Backup policy has a backup rule that satisfies the required frequency and retention period. The rule is NON_COMPLIANT if recovery points are not created at least as often as the specified frequency or expire before the specified period.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "3.3.3.2", + "Description": "Checks if an Azure Backup recovery point expires no earlier than after the specified period. The rule is NON_COMPLIANT if the recovery point has a retention point that is less than the required retention period.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "3.3.3.3", + "Description": "Checks if an Azure Monitor Log Analytics Workspace retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "3.3.3.4", + "Description": "Checks if an Azure Cosmos DB cluster retention period is set to a specific number of days. The rule is NON_COMPLIANT if the retention period is less than the value specified by the parameter.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.3.3.5", + "Description": "Checks if point-in-time restore (PITR) is enabled for Azure Cosmos DB tables. The rule is NON_COMPLIANT if PITR is not enabled for Azure Cosmos DB tables.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.3.3.6", + "Description": "Checks if Azure Managed Disks are attached to Virtual Machines. Optionally, checks if Managed Disks are configured to be deleted when the Virtual Machine is terminated.", + "Name": "Azure Managed Disks", + "Checks": [ + "vm_ensure_using_managed_disks" + ], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Managed Disks" + } + ] + }, + { + "Id": "3.3.3.7", + "Description": "Checks if a private Azure Container Registry (ACR) repository has at least one lifecycle policy configured. The rule is NON_COMPLIANT if no lifecycle policy is configured for the ACR private repository.", + "Name": "Azure Container Registry", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Container Registry" + } + ] + }, + { + "Id": "3.3.3.8", + "Description": "Checks if a lifecycle management policy is configured for an Azure Blob Storage container. The rule is NON_COMPLIANT if there are no active lifecycle management policies or if the configuration does not match the parameter values.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.3.3.9", + "Description": "Checks if Azure Blob Storage containers with versioning enabled have a lifecycle management policy configured. The rule is NON_COMPLIANT if lifecycle management policies are not enabled.", + "Name": "Azure Storage", + "Checks": [], + "Attributes": [ + { + "Section": "3.3.3: Sensitive authentication data (SAD) is not stored after authorization. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.5.1.1.1", + "Description": "Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.5.1.1.2", + "Description": "Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.5.1.1.3", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "3.5.1.1.4", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "3.5.1.1.5", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "3.5.1.1.6", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "3.5.1.1.7", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.5.1.1.8", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.5.1.1.9", + "Description": "Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.5.1.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.5.1.3.1", + "Description": "Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.5.1.3.2", + "Description": "Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.5.1.3.3", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "3.5.1.3.4", + "Description": "Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "3.5.1.3.5", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "3.5.1.3.6", + "Description": "Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "3.5.1.3.7", + "Description": "Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.5.1.3.8", + "Description": "Checks if Azure Managed Disks snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots with a similar public access setting are configured, making them accessible to all users.", + "Name": "Azure Managed Disks", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Managed Disks" + } + ] + }, + { + "Id": "3.5.1.3.9", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "3.5.1.3.10", + "Description": "Checks if Azure Files access points are configured to enforce a root directory. The rule is NON_COMPLIANT if the value of Path is set to / (default root directory of the file share).", + "Name": "Azure Files", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Files" + } + ] + }, + { + "Id": "3.5.1.3.11", + "Description": "Checks if Azure Files access points are configured to enforce a user identity. The rule is NON_COMPLIANT if PosixUser is not defined or if parameters are provided and there is no match in the corresponding parameter.", + "Name": "Azure Files", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Files" + } + ] + }, + { + "Id": "3.5.1.3.12", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "3.5.1.3.13", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "3.5.1.3.14", + "Description": "Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "3.5.1.3.15", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.5.1.3.16", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.5.1.3.17", + "Description": "Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.5.1.3.18", + "Description": "Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.", + "Name": "Azure Functions", + "Checks": [ + "app_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "3.5.1.3.19", + "Description": "Checks if an Azure Cosmos DB manual database snapshot is public. The rule is NON_COMPLIANT if any existing or new Azure Cosmos DB snapshot is publicly accessible.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.5.1.3.20", + "Description": "Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "3.5.1.3.21", + "Description": "Checks if Azure SQL Database backups are public. The rule is NON_COMPLIANT if any existing or new Azure SQL Database backups are publicly accessible.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "3.5.1.3.22", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "3.5.1.3.23", + "Description": "Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.", + "Name": "Azure Blob Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Blob Storage" + } + ] + }, + { + "Id": "3.5.1.3.24", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.5.1.3.25", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.5.1.3.26", + "Description": "Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.5.1.3.27", + "Description": "Checks if Azure Blob Storage has soft delete enabled for blobs in the container. The rule is NON_COMPLIANT if soft delete for blobs is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_soft_delete_is_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.5.1.3.28", + "Description": "Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.5.1.3.29", + "Description": "Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.5.1.3.30", + "Description": "Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "3.5.1.3.31", + "Description": "Checks if Azure Automation runbooks owned by the account are public. The rule is NON_COMPLIANT if Azure Automation runbooks with the owner set to Self are public.", + "Name": "Azure Automations", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1.3: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Automations" + } + ] + }, + { + "Id": "3.5.1.1", + "Description": "Checks if all methods in Azure API Management API operations have caching enabled and encryption applied. The rule is NON_COMPLIANT if any API operation in an Azure API Management instance is not configured with caching or the cache is not encrypted.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "3.5.1.2", + "Description": "Checks if an Azure Synapse Analytics workspace is encrypted at rest. The rule is NON_COMPLIANT if encryption of data at rest is not enabled for an Azure Synapse workspace.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "3.5.1.3", + "Description": "Checks if an Azure Backup recovery point is encrypted. The rule is NON_COMPLIANT if the recovery point is not encrypted.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "3.5.1.4", + "Description": "Checks if Azure Monitor log analytics workspaces are encrypted with a specified Azure Key Vault encryption key. The rule is NON_COMPLIANT if a Log Analytics workspace is not encrypted with a Key Vault key or is encrypted with a key not supplied in the rule parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "3.5.1.5", + "Description": "Checks if Azure Activity Logs are configured to use Azure Key Vault for server-side encryption (SSE). The rule is COMPLIANT if the key vault key ID is defined for encryption.", + "Name": "Azure Monitor", + "Checks": [ + "keyvault_logging_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "3.5.1.6", + "Description": "Checks if an Azure DevOps Pipeline project has encryption enabled for all of its artifacts. The rule is NON_COMPLIANT if encryption is disabled for any primary or secondary artifact configurations", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "3.5.1.7", + "Description": "Checks if the Azure DevOps project contains environment variables AZURE_CLIENT_ID and AZURE_CLIENT_SECRET. The rule is NON_COMPLIANT if the project environment variables contain plaintext credentials.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "3.5.1.8", + "Description": "Checks if an Azure DevOps Pipeline configured with Azure Blob Storage Logs has encryption enabled for its logs. The rule is NON_COMPLIANT if encryption is disabled in the logging configuration of an Azure DevOps Pipeline.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "3.5.1.9", + "Description": "Checks if Azure Cache for Redis clusters have encryption enabled. The rule is NON_COMPLIANT if an Azure Cache for Redis cluster is not encrypted.", + "Name": "Azure Cache", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Cache" + } + ] + }, + { + "Id": "3.5.1.10", + "Description": "Checks if storage encryption is enabled for your Azure Cosmos DB for MongoDB API clusters. The rule is NON_COMPLIANT if storage encryption is not enabled.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.5.1.11", + "Description": "Checks if Azure Cosmos DB tables are encrypted with Azure Key Vault Managed HSM. The rule is NON_COMPLIANT if an Azure Cosmos DB table is not encrypted with Azure Key Vault. The rule is also NON_COMPLIANT if the encrypted Azure Key Vault key is not present in the specified key input parameter.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.5.1.12", + "Description": "Checks if Azure Cosmos DB tables are encrypted and verifies their status. The rule is COMPLIANT if the status is enabled or enabling.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.5.1.13", + "Description": "Checks if Azure Managed Disks encryption is enabled by default. The rule is NON_COMPLIANT if the encryption is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "vm_ensure_using_managed_disks" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.5.1.14", + "Description": "Checks if secrets are passed as container environment variables in Azure Container Instances or Azure Kubernetes Service (AKS). The rule is NON_COMPLIANT if one or more environment variable keys match a key listed in the secretKeys parameter, excluding secrets stored in Azure Key Vault or other secure locations.", + "Name": "Azure Container", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Container" + } + ] + }, + { + "Id": "3.5.1.15", + "Description": "Checks if Azure Files is configured to encrypt the file data using Azure Key Vault Managed Keys. The rule is NON_COMPLIANT if encryption is not enabled or if the encryption key does not match the specified Key Vault Key.", + "Name": "Azure Files", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Files" + } + ] + }, + { + "Id": "3.5.1.16", + "Description": "Checks if Azure Kubernetes Service (AKS) clusters are configured to have Kubernetes secrets encrypted using Azure Key Vault or Customer-Managed Keys (CMK). The rule is NON_COMPLIANT if an AKS cluster does not have encryption-at-rest enabled or if secrets encryption is not configured using Azure Key Vault keys.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "3.5.1.17", + "Description": "Checks if Azure Kubernetes Service (AKS) clusters are configured to have Kubernetes secrets encrypted using Azure Key Vault or Customer-Managed Keys (CMK). The rule is NON_COMPLIANT if an AKS cluster does not have encryption-at-rest enabled or if secrets encryption is not configured using Azure Key Vault keys.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "3.5.1.18", + "Description": "Checks if Azure Cache for Redis replication groups have encryption-at-rest enabled. The rule is NON_COMPLIANT for an Azure Cache for Redis replication group if encryption-at-rest is not enabled or if the Key Vault key does not match the approved Key Vault key specified.", + "Name": "Azure Cache", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Cache" + } + ] + }, + { + "Id": "3.5.1.19", + "Description": "Checks if Azure Cognitive Search (previously called Azure Search) services have encryption at rest enabled. The rule is NON_COMPLIANT if the encryptionWithCustomerManagedKey field is not enabled.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "3.5.1.20", + "Description": "Checks if attached Azure Managed Disks are encrypted and optionally encrypted with a specified customer-managed key (CMK). The rule is NON_COMPLIANT if attached Managed Disks are unencrypted or are encrypted with a key not in the supplied parameters.", + "Name": "Azure Storage", + "Checks": [ + "vm_ensure_unattached_disks_encrypted_with_cmk" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.5.1.21", + "Description": "Checks if Azure Event Hubs or Azure Stream Analytics streams are encrypted at rest with server-side encryption. The rule is NON_COMPLIANT if encryption is not enabled for the stream.", + "Name": "Azure Stream Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Stream Analytics" + } + ] + }, + { + "Id": "3.5.1.22", + "Description": "Checks if storage encryption is enabled for your Azure Cosmos DB or Azure SQL Database instances. The rule is NON_COMPLIANT if storage encryption is not enabled.", + "Name": "Azure Cosmos DB", + "Checks": [ + "storage_infrastructure_encryption_is_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.5.1.23", + "Description": "Checks if an Azure Cosmos DB cluster has automatic backups encrypted. The rule is NON_COMPLIANT if the Azure Cosmos DB cluster does not have automatic backups encrypted.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "3.5.1.24", + "Description": "Checks if Azure Cognitive Search service has encryption at rest configuration enabled. The rule is NON_COMPLIANT if the encryption at rest option is not enabled for the Azure Cognitive Search domain.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "3.5.1.25", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance is encrypted at rest. The rule is NON_COMPLIANT if the SQL database or SQL Managed Instance is not encrypted at rest.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_tde_encryption_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "3.5.1.26", + "Description": "Checks if Azure SQL Database or Azure SQL Managed Instance backups are encrypted. The rule is NON_COMPLIANT if the SQL database or SQL Managed Instance backups are not encrypted.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_tde_encryption_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "3.5.1.27", + "Description": "Checks if storage encryption is enabled for your Azure SQL Database or Azure SQL Managed Instance. The rule is NON_COMPLIANT if storage encryption is not enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_tde_encryption_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "3.5.1.28", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "3.5.1.29", + "Description": "Checks if Azure Synapse Analytics (formerly Azure SQL Data Warehouse) clusters are using a specified Azure Key Vault key for encryption. The rule is COMPLIANT if encryption is enabled and the cluster is encrypted with the key provided in the keyVaultKeyId parameter. The rule is NON_COMPLIANT if the cluster is not encrypted or encrypted with another key.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "3.5.1.30", + "Description": "Checks if your Azure Blob Storage container either has Azure Storage Service Encryption (SSE) enabled by default or that the container policy explicitly denies put-object requests without server-side encryption that uses AES-256 or Azure Key Vault. The rule is NON_COMPLIANT if your Azure Blob Storage container is not encrypted by default.", + "Name": "Azure Storage", + "Checks": [ + "storage_secure_transfer_required_is_enabled" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.5.1.31", + "Description": "Checks if the Azure Blob Storage containers are encrypted with Azure Key Vault. The rule is NON_COMPLIANT if the Azure Blob Storage container is not encrypted with an Azure Key Vault key.", + "Name": "Azure Storage", + "Checks": [ + "defender_ensure_defender_for_keyvault_is_on" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "3.5.1.32", + "Description": "Checks if an Azure Key Vault key is configured for an Azure Machine Learning endpoint configuration. The rule is NON_COMPLIANT if KeyVaultKeyId is not specified for the Azure Machine Learning endpoint configuration.", + "Name": "Azure Key Vault", + "Checks": [ + "defender_ensure_defender_for_keyvault_is_on" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.5.1.33", + "Description": "Checks if an Azure Key Vault key is configured for an Azure Machine Learning notebook instance. The rule is NON_COMPLIANT if KeyVaultKeyId is not specified for the Azure Machine Learning notebook instance.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.5.1.34", + "Description": "Checks if all secrets in Azure Key Vault are encrypted using the Azure managed key or a customer-managed key that was created in Azure Key Vault. The rule is COMPLIANT if a secret is encrypted using a customer-managed key. This rule is NON_COMPLIANT if a secret is encrypted using the Azure managed key.", + "Name": "Azure Key Vault", + "Checks": [ + "storage_ensure_encryption_with_customer_managed_keys" + ], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.5.1.35", + "Description": "Checks if Azure Service Bus topics are encrypted with Azure Key Vault. The rule is NON_COMPLIANT if a Service Bus topic is not encrypted with Azure Key Vault. Optionally, specify the key Azure Key Vault references or the key names for the rule to check.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "3.5.1: Primary account number (PAN) is secured wherever it is stored. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "3.6.1.2.1", + "Description": "Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.6.1.2.2", + "Description": "Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.6.1.2.3", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "3.6.1.2.4", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "3.6.1.2.5", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "3.6.1.2.6", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "3.6.1.2.7", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.6.1.2.8", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.6.1.2.9", + "Description": "Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.6.1.2: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.6.1.3.1", + "Description": "Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.6.1.3.2", + "Description": "Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.6.1.3.3", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "3.6.1.3.4", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "3.6.1.3.5", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "3.6.1.3.6", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "3.6.1.3.7", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.6.1.3.8", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.6.1.3.9", + "Description": "Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.6.1.3: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.6.1.4.1", + "Description": "Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.6.1.4.2", + "Description": "Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.6.1.4.3", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "3.6.1.4.4", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "3.6.1.4.5", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "3.6.1.4.6", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "3.6.1.4.7", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.6.1.4.8", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.6.1.4.9", + "Description": "Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.6.1.4: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.6.1.1", + "Description": "Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.6.1.2", + "Description": "Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.6.1.3", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "3.6.1.4", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "3.6.1.5", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "3.6.1.6", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "3.6.1.7", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.6.1.8", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.6.1.9", + "Description": "Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.6.1: Cryptographic keys used to protect stored account data are secured. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.1.1", + "Description": "Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.1.2", + "Description": "Checks if RSA certificates managed by Azure Key Vault have a key length of at least 2048 bits. The rule is NON_COMPLIANT if the minimum key length is less than 2048 bits.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.1.3", + "Description": "Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.1.4", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "3.7.1.5", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "3.7.1.6", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "3.7.1.7", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "3.7.1.8", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.7.1.9", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.7.1.10", + "Description": "Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.2.1", + "Description": "Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.2.2", + "Description": "Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.2.3", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "3.7.2.4", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "3.7.2.5", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "3.7.2.6", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "3.7.2.7", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.7.2.8", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.7.2.9", + "Description": "Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.4.1", + "Description": "Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.4.2", + "Description": "Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.4.3", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "3.7.4.4", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "3.7.4.5", + "Description": "Checks if automatic key rotation is enabled for each key and matches the key ID of the customer-managed key in Azure Key Vault. The rule is NON_COMPLIANT if the Azure Policy assignment does not enforce key rotation or if the necessary permissions to manage the key rotation settings are missing.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.4.6", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "3.7.4.7", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "3.7.4.8", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.7.4.9", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.7.4.10", + "Description": "Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.5.1", + "Description": "Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.5.2", + "Description": "Checks if automatic key rotation is enabled for each key and matches the key ID of the customer-managed key in Azure Key Vault. The rule is NON_COMPLIANT if the Azure Policy assignment does not enforce key rotation or if the necessary permissions to manage the key rotation settings are missing.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.6.1", + "Description": "Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.6.2", + "Description": "Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.6.3", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "3.7.6.4", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "3.7.6.5", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "3.7.6.6", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "3.7.6.7", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.7.6.8", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.7.6.9", + "Description": "Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.7.1", + "Description": "Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.7.2", + "Description": "Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "3.7.7.3", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "3.7.7.4", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "3.7.7.5", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "3.7.7.6", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "3.7.7.7", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.7.7.8", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "3.7.7.9", + "Description": "Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "4.2.1.1.1", + "Description": "Checks if Azure Key Vault certificates in your account are marked for expiration within the specified number of days. Certificates managed by Azure Key Vault can be configured for automatic renewal. However, manually imported certificates do not renew automatically. The rule is NON_COMPLIANT if your certificates are about to expire.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "4.2.1.1.2", + "Description": "Checks if Azure Key Vault Managed Certificate Authority (Azure Managed CA) has a root CA that is disabled. The rule is NON_COMPLIANT for root CAs with a status that is not DISABLED.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "4.2.1.1.3", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Azure Application Gateway. The rule is NON_COMPLIANT if one or more HTTP listeners of Azure Application Gateway do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP listeners are forwarding traffic to another HTTP listener instead of enforcing redirection.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "4.2.1.1.4", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "4.2.1.1.5", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "4.2.1.1.6", + "Description": "Checks if Azure Front Door or Azure CDN endpoints are using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for an Azure Front Door or CDN profile if any TLS settings include outdated protocols such as TLS 1.0 or TLS 1.1.", + "Name": "Azure CDN", + "Checks": [ + "app_minimum_tls_version_12" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "4.2.1.1.7", + "Description": "Checks if Azure Front Door and Azure CDN profiles are encrypting traffic to custom origins. The rule is NON_COMPLIANT if OriginProtocolPolicy is set to HTTP only or if OriginProtocolPolicy is set to Match viewer and ViewerProtocolPolicy allows both HTTP and HTTPS traffic.", + "Name": "Azure CDN", + "Checks": [ + "network_http_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "4.2.1.1.8", + "Description": "Checks if your Azure Front Door and Azure CDN profiles enforce HTTPS (directly or via a redirection). The rule is NON_COMPLIANT if the ViewerProtocolPolicy allows both HTTP and HTTPS traffic for the Default Route Configuration or Custom Route Configurations.", + "Name": "Azure CDN", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "4.2.1.1.9", + "Description": "Checks if your Azure Cosmos DB Accelerator (DAX equivalent) cluster has ClusterEndpointEncryptionType set to TLS. The rule is NON_COMPLIANT if a Cosmos DB Accelerator cluster is not encrypted using Transport Layer Security (TLS).", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "4.2.1.1.10", + "Description": "Checks if Azure Database Migration Service (Azure DMS) endpoints are configured with an SSL connection. The rule is NON_COMPLIANT if Azure DMS does not have an SSL connection configured.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "4.2.1.1.11", + "Description": "Checks if Azure Database Migration Service (Azure DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints. The rule is NON_COMPLIANT if TLS/SSL encryption is not enabled.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "4.2.1.1.12", + "Description": "Checks if Azure Cache for Redis replication groups have encryption-in-transit enabled. The rule is NON_COMPLIANT for an Azure Cache for Redis replication group if enableNonSslPort is set to true.", + "Name": "Azure Cache", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Cache" + } + ] + }, + { + "Id": "4.2.1.1.13", + "Description": "Checks if Azure AI Search nodes are encrypted end to end. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the Azure OpenSearch domain.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "4.2.1.1.14", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "4.2.1.1.15", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "4.2.1.1.16", + "Description": "Checks whether your Azure Load Balancer or Application Gateway SSL listeners are using a custom SSL policy. The rule is applicable only if SSL listeners are configured for the Azure Application Gateway or Azure Front Door. The rule is NON_COMPLIANT if the SSL policy does not follow the organizations security standards.", + "Name": "Azure Load Balancer", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "4.2.1.1.17", + "Description": "Checks if your Azure Application Gateway or Azure Front Door SSL listeners use a predefined SSL policy. The rule is NON_COMPLIANT if the SSL policy configured for the HTTPS/SSL listener does not match the value of the parameter predefinedPolicyName.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "4.2.1.1.18", + "Description": "Checks if your Azure Application Gateway or Azure Front Door is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured to use HTTPS with a valid SSL certificate.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "4.2.1.1.19", + "Description": "Checks if Azure HDInsight clusters have Enterprise Security Package (ESP) with Kerberos authentication enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not meet the specified rule parameters.", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "4.2.1.1.20", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "4.2.1.1.21", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "4.2.1.1.22", + "Description": "Checks if Azure Key Vault keys are not scheduled for deletion in Azure Key Vault. The rule is NON_COMPLIANT if Key Vault keys are scheduled for deletion.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "4.2.1.1.23", + "Description": "Checks if an Azure Event Hubs or Azure Service Bus namespace enforces encryption in transit using HTTPS (TLS) for communication between nodes. The rule is NON_COMPLIANT if plain text communication is enabled for in-cluster node connections.", + "Name": "Azure Events Hub", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Events Hub" + } + ] + }, + { + "Id": "4.2.1.1.24", + "Description": "Checks whether connections to Azure AI Search services are using HTTPS. The rule is NON_COMPLIANT if the EnforceHTTPS setting is not enabled or if the minimum TLS version does not meet the required security policy.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "4.2.1.1.25", + "Description": "Checks if Azure AI Search services have end-to-end encryption enabled. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the search service.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "4.2.1.1.26", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) requires TLS/SSL encryption for connections to SQL clients. The rule is NON_COMPLIANT if any Azure Synapse Analytics workspace does not enforce SSL connections.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "4.2.1.1.27", + "Description": "Checks if Azure Blob Storage accounts enforce secure transfer (HTTPS/TLS) for all requests. The rule is NON_COMPLIANT if any Azure Storage account allows requests over HTTP instead of requiring HTTPS/TLS.", + "Name": "Azure Blob Storage", + "Checks": [ + "storage_secure_transfer_required_is_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Blob Storage" + } + ] + }, + { + "Id": "4.2.1.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Azure Application Gateway. The rule is NON_COMPLIANT if one or more HTTP listeners of Azure Application Gateway do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP listeners are forwarding traffic to another HTTP listener instead of enforcing redirection.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "4.2.1.2", + "Description": "Checks if Azure Front Door or Azure CDN endpoints are using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for an Azure Front Door or CDN profile if any TLS settings include outdated protocols such as TLS 1.0 or TLS 1.1.", + "Name": "Azure CDN", + "Checks": [ + "app_minimum_tls_version_12" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "4.2.1.3", + "Description": "Checks if Azure Front Door and Azure CDN profiles are encrypting traffic to custom origins. The rule is NON_COMPLIANT if OriginProtocolPolicy is set to HTTP only or if OriginProtocolPolicy is set to Match viewer and ViewerProtocolPolicy allows both HTTP and HTTPS traffic.", + "Name": "Azure CDN", + "Checks": [ + "network_http_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "4.2.1.4", + "Description": "Checks if your Azure Front Door and Azure CDN profiles enforce HTTPS (directly or via a redirection). The rule is NON_COMPLIANT if the ViewerProtocolPolicy allows both HTTP and HTTPS traffic for the Default Route Configuration or Custom Route Configurations.", + "Name": "Azure CDN", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "4.2.1.5", + "Description": "Checks if your Azure Cosmos DB Accelerator (DAX equivalent) cluster has ClusterEndpointEncryptionType set to TLS. The rule is NON_COMPLIANT if a Cosmos DB Accelerator cluster is not encrypted using Transport Layer Security (TLS).", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "4.2.1.6", + "Description": "Checks if Azure Database Migration Service (Azure DMS) endpoints are configured with an SSL connection. The rule is NON_COMPLIANT if Azure DMS does not have an SSL connection configured.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "4.2.1.7", + "Description": "Checks if Azure Database Migration Service (Azure DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints. The rule is NON_COMPLIANT if TLS/SSL encryption is not enabled.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "4.2.1.8", + "Description": "Checks if Azure Cache for Redis replication groups have encryption-in-transit enabled. The rule is NON_COMPLIANT for an Azure Cache for Redis replication group if enableNonSslPort is set to true.", + "Name": "Azure Cache", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Cache" + } + ] + }, + { + "Id": "4.2.1.9", + "Description": "Checks if Azure AI Search nodes are encrypted end to end. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the Azure OpenSearch domain.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "4.2.1.10", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "4.2.1.11", + "Description": "Checks whether your Azure Load Balancer or Application Gateway SSL listeners are using a custom SSL policy. The rule is applicable only if SSL listeners are configured for the Azure Application Gateway or Azure Front Door. The rule is NON_COMPLIANT if the SSL policy does not follow the organizations security standards.", + "Name": "Azure Load Balancer", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "4.2.1.12", + "Description": "Checks if your Azure Application Gateway or Azure Front Door SSL listeners use a predefined SSL policy. The rule is NON_COMPLIANT if the SSL policy configured for the HTTPS/SSL listener does not match the value of the parameter predefinedPolicyName.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "4.2.1.13", + "Description": "Checks if your Azure Application Gateway or Azure Front Door is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured to use HTTPS with a valid SSL certificate.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "4.2.1.14", + "Description": "Checks if Azure HDInsight clusters have Enterprise Security Package (ESP) with Kerberos authentication enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not meet the specified rule parameters.", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "4.2.1.15", + "Description": "Checks if an Azure Event Hubs or Azure Service Bus namespace enforces encryption in transit using HTTPS (TLS) for communication between nodes. The rule is NON_COMPLIANT if plain text communication is enabled for in-cluster node connections.", + "Name": "Azure Events Hub", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Events Hub" + } + ] + }, + { + "Id": "4.2.1.16", + "Description": "Checks whether connections to Azure AI Search services are using HTTPS. The rule is NON_COMPLIANT if the EnforceHTTPS setting is not enabled or if the minimum TLS version does not meet the required security policy.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "4.2.1.17", + "Description": "Checks if Azure AI Search services have end-to-end encryption enabled. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the search service.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "4.2.1.18", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) requires TLS/SSL encryption for connections to SQL clients. The rule is NON_COMPLIANT if any Azure Synapse Analytics workspace does not enforce SSL connections.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "4.2.1.19", + "Description": "Checks if Azure Blob Storage accounts enforce secure transfer (HTTPS/TLS) for all requests. The rule is NON_COMPLIANT if any Azure Storage account allows requests over HTTP instead of requiring HTTPS/TLS.", + "Name": "Azure Blob Storage", + "Checks": [ + "storage_secure_transfer_required_is_enabled" + ], + "Attributes": [ + { + "Section": "4.2.1: PAN is protected with strong cryptography during transmission. ", + "Service": "Azure Blob Storage" + } + ] + }, + { + "Id": "5.3.4.1", + "Description": "Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "5.3.4.2", + "Description": "Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "5.3.4.3", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "5.3.4.4", + "Description": "Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "5.3.4.5", + "Description": "Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.", + "Name": "Azure Load Balances", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Load Balances" + } + ] + }, + { + "Id": "5.3.4.6", + "Description": "Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.", + "Name": "Azure Front Door", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "5.3.4.7", + "Description": "Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "5.3.4.8", + "Description": "Checks that there is at least one Azure Monitor diagnostic setting defined with security best practices.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "5.3.4.9", + "Description": "For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "5.3.4.10", + "Description": "Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "5.3.4.11", + "Description": "Checks if an Azure Monitor Log Analytics Workspace retention period is set to greater than 365 days or a specified retention period. The rule is NON_COMPLIANT if the retention period is less than MinRetentionTime, if specified, or else 365 days.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "5.3.4.12", + "Description": "Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "5.3.4.13", + "Description": "Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "5.3.4.14", + "Description": "Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.", + "Name": "Azure VPN Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure VPN Gateway" + } + ] + }, + { + "Id": "5.3.4.15", + "Description": "Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.", + "Name": "Azure Container Instances", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Container Instances" + } + ] + }, + { + "Id": "5.3.4.16", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "5.3.4.17", + "Description": "Checks if Azure Cognitive Search services are configured to send logs to Azure Monitor Logs. The rule is COMPLIANT if logging is enabled for an Azure Cognitive Search instance. This rule is NON_COMPLIANT if logging is not configured.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "5.3.4.18", + "Description": "Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.", + "Name": "Azure App", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure App" + } + ] + }, + { + "Id": "5.3.4.19", + "Description": "Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Load Balancer", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "5.3.4.20", + "Description": "Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "5.3.4.21", + "Description": "Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "5.3.4.22", + "Description": "For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "5.3.4.23", + "Description": "Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.", + "Name": "Azrure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azrure Cosmos DB" + } + ] + }, + { + "Id": "5.3.4.24", + "Description": "Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "5.3.4.25", + "Description": "Checks if Azure Cognitive Search services have audit logging enabled. The rule is NON_COMPLIANT if an Azure Cognitive Search service does not have audit logging enabled.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "5.3.4.26", + "Description": "Checks if Azure Cognitive Search services are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not configured.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "5.3.4.27", + "Description": "Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.", + "Name": "Azure Database", + "Checks": [ + "mysql_flexible_server_audit_log_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "5.3.4.28", + "Description": "Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.", + "Name": "Azure SQL Database", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "5.3.4.29", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.", + "Name": "Azure Synapse Analytics ", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "5.3.4.30", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "5.3.4.31", + "Description": "Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.", + "Name": "Azure DNS", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure DNS" + } + ] + }, + { + "Id": "5.3.4.32", + "Description": "Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "5.3.4.33", + "Description": "Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.", + "Name": "Azure Logic Apps", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Logic Apps" + } + ] + }, + { + "Id": "5.3.4.34", + "Description": "Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_flow_log_more_than_90_days" + ], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "5.3.4.35", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "5.3.4.36", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if logging is not enabled.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "6.3.3.1", + "Description": "Checks if all the specified applications are installed on the Azure Virtual Machine (VM). Optionally, specify the minimum acceptable version. You can also specify the platform to apply the rule only to VMs running that platform.", + "Name": "Azure Virtual Machine", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "Azure Virtual Machine" + } + ] + }, + { + "Id": "6.3.3.2", + "Description": "Checks if the compliance status of the Azure Update Management patch compliance is COMPLIANT or NON_COMPLIANT after the patch installation on the virtual machine (VM). The rule is compliant if the field status is COMPLIANT.", + "Name": "Azure Update Management", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "Azure Update Management" + } + ] + }, + { + "Id": "6.3.3.3", + "Description": "Checks if Azure Container Instances (ACI) are set to the latest platform version. The rule is NON_COMPLIANT if the platform version for the container instance is not set to the latest available version.", + "Name": "Azure Container Instances", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "Azure Container Instances" + } + ] + }, + { + "Id": "6.3.3.4", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is running the oldest supported version. The rule is NON_COMPLIANT if an AKS cluster is running an outdated version that is no longer supported (equal to the parameter oldestVersionSupported).", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "6.3.3.5", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is running a supported Kubernetes version. This rule is NON_COMPLIANT if an AKS cluster is running an unsupported version (less than the parameter oldestVersionSupported).", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_network_policy_enabled" + ], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "6.3.3.6", + "Description": "Checks if Azure Cache for Redis clusters have auto minor version upgrades enabled. The rule is NON_COMPLIANT for an Azure Cache for Redis cluster if AutoMinorVersionUpgrade is not set to true.", + "Name": "Azure Cache", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "Azure Cache" + } + ] + }, + { + "Id": "6.3.3.7", + "Description": "Checks if managed platform updates in an Azure App Service environment are enabled. The rule is COMPLIANT if the value for ManagedActionsEnabled is set to true. The rule is NON_COMPLIANT if the value for ManagedActionsEnabled is set to false, or if a parameter is provided and its value does not match the existing configurations.", + "Name": "Azure App", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "Azure App" + } + ] + }, + { + "Id": "6.3.3.8", + "Description": "Checks if the Azure Function App settings for runtime, role, timeout, and memory size match the expected values. The rule ignores functions with the Container package type and functions with runtime set to OS-only Runtime. The rule is NON_COMPLIANT if the Function App settings do not match the expected values.", + "Name": "Azure Function", + "Checks": [ + "app_function_latest_runtime_version" + ], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "Azure Function" + } + ] + }, + { + "Id": "6.3.3.9", + "Description": "Checks if Azure Cognitive Search service version updates are available but not installed. The rule is NON_COMPLIANT for an Azure Cognitive Search instance if the latest software updates are not installed.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "6.3.3.10", + "Description": "Checks if Azure SQL Database instances are configured for automatic minor version upgrades. The rule is NON_COMPLIANT if the value of autoMinorVersionUpgrade is false.", + "Name": "Azure Database", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "6.3.3.11", + "Description": "Checks if Azure Synapse Analytics (formerly Azure SQL Data Warehouse) clusters have the specified maintenance settings. The rule is NON_COMPLIANT if automatic upgrades to the major version are disabled.", + "Name": "Azure Synapse", + "Checks": [], + "Attributes": [ + { + "Section": "6.3.3: Security vulnerabilities are identified and addressed. ", + "Service": "Azure Synapse" + } + ] + }, + { + "Id": "6.4.1.1", + "Description": "Checks if Azure Web Application Firewall (WAF) is enabled on Azure Application Gateways. The rule is NON_COMPLIANT if waf.enabled is set to false.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.1.2", + "Description": "Checks if an Azure API Management API stage is using an Azure Web Application Firewall (WAF) web access control list (Web ACL). The rule is NON_COMPLIANT if an Azure WAF Web ACL is not used or if the applied WAF Web ACL does not match the expected configuration in the rule parameter.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "6.4.1.3", + "Description": "Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "6.4.1.4", + "Description": "Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.", + "Name": "Azure Front Door", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "6.4.1.5", + "Description": "Checks if the Web Application Firewall (WAF) policy is associated with an Azure Application Gateway, Azure API Management, or Azure Front Door. The rule is NON_COMPLIANT if the specified WAF policy is not associated with the relevant resource.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.1.6", + "Description": "Checks if the rule groups are associated with the Web Application Firewall (WAF) policy in the correct priority order. The correct priority is determined by the rank of the rule groups specified in the ruleGroups parameter. When Azure Firewall Manager creates this rule, it assigns the highest priority as 0, followed by 1, 2, and so on. The Firewall Manager policy owner specifies the ruleGroups rank in the policy and can optionally enable remediation.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.1.7", + "Description": "Checks if Azure Web Application Firewall (WAF) v2 rule groups contain rules. The rule is NON_COMPLIANT if there are no rules present in a WAF v2 rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.1.8", + "Description": "Checks if an Azure Web Application Firewall (WAF) v2 Web ACL contains any WAF rules or WAF rule groups. The rule is NON_COMPLIANT if a Web ACL does not contain any WAF rules or WAF rule groups.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.1.9", + "Description": "Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.1.10", + "Description": "Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.1.11", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.1.12", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.1.13", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.1.14", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.1: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.2.1", + "Description": "Checks if Azure Web Application Firewall (WAF) is enabled on Azure Application Gateways. The rule is NON_COMPLIANT if waf.enabled is set to false.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.2.2", + "Description": "Checks if an Azure API Management API stage is using an Azure Web Application Firewall (WAF) web access control list (Web ACL). The rule is NON_COMPLIANT if an Azure WAF Web ACL is not used or if the applied WAF Web ACL does not match the expected configuration in the rule parameter.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "6.4.2.3", + "Description": "Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "6.4.2.4", + "Description": "Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.", + "Name": "Azure Front Door", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "6.4.2.5", + "Description": "Checks if the Web Application Firewall (WAF) policy is associated with an Azure Application Gateway, Azure API Management, or Azure Front Door. The rule is NON_COMPLIANT if the specified WAF policy is not associated with the relevant resource.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.2.6", + "Description": "Checks if the rule groups are associated with the Web Application Firewall (WAF) policy in the correct priority order. The correct priority is determined by the rank of the rule groups specified in the ruleGroups parameter. When Azure Firewall Manager creates this rule, it assigns the highest priority as 0, followed by 1, 2, and so on. The Firewall Manager policy owner specifies the ruleGroups rank in the policy and can optionally enable remediation.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.2.7", + "Description": "Checks if Azure Web Application Firewall (WAF) v2 rule groups contain rules. The rule is NON_COMPLIANT if there are no rules present in a WAF v2 rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.2.8", + "Description": "Checks if an Azure Web Application Firewall (WAF) v2 Web ACL contains any WAF rules or WAF rule groups. The rule is NON_COMPLIANT if a Web ACL does not contain any WAF rules or WAF rule groups.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.2.9", + "Description": "Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.2.10", + "Description": "Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.2.11", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.2.12", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.2.13", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.4.2.14", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "6.4.2: Public-facing web applications are protected against attacks. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "6.5.5.1", + "Description": "Checks if the deployment group for Azure Functions Compute Platform is not using the default deployment configuration. The rule is NON_COMPLIANT if the deployment group is using the deployment configuration CodeDeployDefault.LambdaAllAtOnce.", + "Name": "Azure Functions", + "Checks": [], + "Attributes": [ + { + "Section": "6.5.5: Changes to all system components are managed securely. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "6.5.5.2", + "Description": "Checks if the first deployment stage of Azure DevOps Pipelines performs more than one deployment. Optionally checks if each of the subsequent remaining stages deploy to more than the specified number of deployments (deploymentLimit).", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "6.5.5: Changes to all system components are managed securely. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "6.5.6.1", + "Description": "Checks if the deployment group for Azure Functions Compute Platform is not using the default deployment configuration. The rule is NON_COMPLIANT if the deployment group is using the deployment configuration CodeDeployDefault.LambdaAllAtOnce.", + "Name": "Azure Functions", + "Checks": [], + "Attributes": [ + { + "Section": "6.5.6: Changes to all system components are managed securely. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "6.5.6.2", + "Description": "Checks if the first deployment stage of Azure DevOps Pipelines performs more than one deployment. Optionally checks if each of the subsequent remaining stages deploy to more than the specified number of deployments (deploymentLimit).", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "6.5.6: Changes to all system components are managed securely. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "7.2.1.1", + "Description": "Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.1.2", + "Description": "Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "7.2.1.3", + "Description": "Checks if an Azure DevOps pipeline environment has privileged mode enabled. The rule is NON_COMPLIANT for a pipeline if privilegedMode is set to true.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "7.2.1.4", + "Description": "Checks if custom Azure Event Grid schema registries have a resource policy attached. The rule is NON_COMPLIANT for custom schema registries without a resource policy attached.", + "Name": "Azure Event Grid", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Event Grid" + } + ] + }, + { + "Id": "7.2.1.5", + "Description": "Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.", + "Name": "Azure VIrtual Machine", + "Checks": [ + "app_function_identity_is_configured" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure VIrtual Machine" + } + ] + }, + { + "Id": "7.2.1.6", + "Description": "Checks if the privileged mode in the container definition of Azure Kubernetes Service (AKS) pod specifications is set to true. The rule is NON_COMPLIANT if the privileged parameter is true.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "7.2.1.7", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "7.2.1.8", + "Description": "Checks if Azure Kubernetes Service (AKS) pods specify a user for container execution. The rule is NON_COMPLIANT if the user parameter is not present or set to root.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "7.2.1.9", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.1.10", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.1.11", + "Description": "Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.1.12", + "Description": "Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.1.13", + "Description": "Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.1.14", + "Description": "Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes \"Actions\": [\"*\"] over \"AssignableScopes\": [\"/\"].", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.1.15", + "Description": "Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.1.16", + "Description": "Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.1.17", + "Description": "Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.1.18", + "Description": "Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "7.2.1.19", + "Description": "Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "7.2.1.20", + "Description": "Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.2.1.21", + "Description": "Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "7.2.1.22", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.2.1.23", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.2.1.24", + "Description": "Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.2.1.25", + "Description": "Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.2.1.26", + "Description": "Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.2.1.27", + "Description": "Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.2.1.28", + "Description": "Checks if the Azure Machine Learning Compute Instance has administrator access enabled. The rule is NON_COMPLIANT if the administrator access setting is set to Enabled for an Azure Machine Learning Compute Instance.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "7.2.1.29", + "Description": "Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.2.1", + "Description": "Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.2.2", + "Description": "Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "7.2.2.3", + "Description": "Checks if an Azure DevOps pipeline environment has privileged mode enabled. The rule is NON_COMPLIANT for a pipeline if privilegedMode is set to true.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "7.2.2.4", + "Description": "Checks if custom Azure Event Grid schema registries have a resource policy attached. The rule is NON_COMPLIANT for custom schema registries without a resource policy attached.", + "Name": "Azure Event Grid", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Event Grid" + } + ] + }, + { + "Id": "7.2.2.5", + "Description": "Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.", + "Name": "Azure VIrtual Machine", + "Checks": [ + "app_function_identity_is_configured" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure VIrtual Machine" + } + ] + }, + { + "Id": "7.2.2.6", + "Description": "Checks if the privileged mode in the container definition of Azure Kubernetes Service (AKS) pod specifications is set to true. The rule is NON_COMPLIANT if the privileged parameter is true.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "7.2.2.7", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "7.2.2.8", + "Description": "Checks if Azure Kubernetes Service (AKS) pods specify a user for container execution. The rule is NON_COMPLIANT if the user parameter is not present or set to root.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "7.2.2.9", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.2.10", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.2.11", + "Description": "Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.2.12", + "Description": "Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.2.13", + "Description": "Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.2.14", + "Description": "Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes \"Actions\": [\"*\"] over \"AssignableScopes\": [\"/\"].", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.2.15", + "Description": "Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.2.16", + "Description": "Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.2.17", + "Description": "Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.2.18", + "Description": "Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "7.2.2.19", + "Description": "Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "7.2.2.20", + "Description": "Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.2.2.21", + "Description": "Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "7.2.2.22", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.2.2.23", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.2.2.24", + "Description": "Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.2.2.25", + "Description": "Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.2.2.26", + "Description": "Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.2.2.27", + "Description": "Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.2.2.28", + "Description": "Checks if the Azure Machine Learning Compute Instance has administrator access enabled. The rule is NON_COMPLIANT if the administrator access setting is set to Enabled for an Azure Machine Learning Compute Instance.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "7.2.2.29", + "Description": "Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.2: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.3.1", + "Description": "Checks if an Azure DevOps pipeline environment has privileged mode enabled. The rule is NON_COMPLIANT for a pipeline if privilegedMode is set to true.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "7.2.3.2", + "Description": "Checks if custom Azure Event Grid schema registries have a resource policy attached. The rule is NON_COMPLIANT for custom schema registries without a resource policy attached.", + "Name": "Azure Event Grid", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Event Grid" + } + ] + }, + { + "Id": "7.2.3.3", + "Description": "Checks if the privileged mode in the container definition of Azure Kubernetes Service (AKS) pod specifications is set to true. The rule is NON_COMPLIANT if the privileged parameter is true.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "7.2.3.4", + "Description": "Checks if Azure Kubernetes Service (AKS) pods specify a user for container execution. The rule is NON_COMPLIANT if the user parameter is not present or set to root.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "7.2.3.5", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.3.6", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.3.7", + "Description": "Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes \"Actions\": [\"*\"] over \"AssignableScopes\": [\"/\"].", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.3.8", + "Description": "Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.3.9", + "Description": "Checks if the Azure Machine Learning Compute Instance has administrator access enabled. The rule is NON_COMPLIANT if the administrator access setting is set to Enabled for an Azure Machine Learning Compute Instance.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.3: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "7.2.4.1", + "Description": "Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.4: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.4.2", + "Description": "Checks if your Azure Active Directory (Azure AD) users have passwords or active access credentials that have not been used within the specified number of days provided. The rule is NON_COMPLIANT if there are inactive accounts that have not been used recently.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.4: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.4.3", + "Description": "Checks if Azure Key Vault secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in unusedForDays number of days. The default value is 90 days.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_non_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "7.2.4: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "7.2.5.1.1", + "Description": "Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.5.1.2", + "Description": "Checks if your Azure Active Directory (Azure AD) users have passwords or active access credentials that have not been used within the specified number of days provided. The rule is NON_COMPLIANT if there are inactive accounts that have not been used recently.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.5.1.3", + "Description": "Checks if Azure Key Vault secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in unusedForDays number of days. The default value is 90 days.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_non_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "7.2.5.1: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "7.2.5.1", + "Description": "Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.5.2", + "Description": "Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "7.2.5.3", + "Description": "Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.", + "Name": "Azure VIrtual Machine", + "Checks": [ + "app_function_identity_is_configured" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure VIrtual Machine" + } + ] + }, + { + "Id": "7.2.5.4", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Backup", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "7.2.5.5", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.5.6", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.5.7", + "Description": "Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.5.8", + "Description": "Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.5.9", + "Description": "Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.5.10", + "Description": "Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes \"Actions\": [\"*\"] over \"AssignableScopes\": [\"/\"].", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.5.11", + "Description": "Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.5.12", + "Description": "Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.5.13", + "Description": "Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "7.2.5.14", + "Description": "Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.2.5.15", + "Description": "Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "7.2.5.16", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.2.5.17", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.2.5.18", + "Description": "Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.2.5.19", + "Description": "Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.2.5.20", + "Description": "Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.2.5.21", + "Description": "Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.2.5.22", + "Description": "Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.5: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.2.6.1", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Backup", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "7.2.6.2", + "Description": "Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "7.2.6.3", + "Description": "Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "7.2.6.4", + "Description": "Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.2.6.5", + "Description": "Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "7.2.6: Access to system components and data is appropriately defined and assigned. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.3.1.1", + "Description": "Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.1.2", + "Description": "Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "7.3.1.3", + "Description": "Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.", + "Name": "Azure VIrtual Machine", + "Checks": [ + "app_function_identity_is_configured" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure VIrtual Machine" + } + ] + }, + { + "Id": "7.3.1.4", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Backup", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "7.3.1.5", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.1.6", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.1.7", + "Description": "Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.1.8", + "Description": "Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.1.9", + "Description": "Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.1.10", + "Description": "Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes \"Actions\": [\"*\"] over \"AssignableScopes\": [\"/\"].", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.1.11", + "Description": "Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.1.12", + "Description": "Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.1.13", + "Description": "Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "7.3.1.14", + "Description": "Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.3.1.15", + "Description": "Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "7.3.1.16", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.3.1.17", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.3.1.18", + "Description": "Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.3.1.19", + "Description": "Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.3.1.20", + "Description": "Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.3.1.21", + "Description": "Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.3.1.22", + "Description": "Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.1: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.2.1", + "Description": "Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.2.2", + "Description": "Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "7.3.2.3", + "Description": "Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.", + "Name": "Azure VIrtual Machine", + "Checks": [ + "app_function_identity_is_configured" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure VIrtual Machine" + } + ] + }, + { + "Id": "7.3.2.4", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Backup", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "7.3.2.5", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.2.6", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.2.7", + "Description": "Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.2.8", + "Description": "Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.2.9", + "Description": "Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.2.10", + "Description": "Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes \"Actions\": [\"*\"] over \"AssignableScopes\": [\"/\"].", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.2.11", + "Description": "Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.2.12", + "Description": "Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.2.13", + "Description": "Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "7.3.2.14", + "Description": "Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.3.2.15", + "Description": "Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "7.3.2.16", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.3.2.17", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.3.2.18", + "Description": "Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.3.2.19", + "Description": "Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.3.2.20", + "Description": "Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.3.2.21", + "Description": "Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.3.2.22", + "Description": "Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.2: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.3.1", + "Description": "Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.3.2", + "Description": "Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "7.3.3.3", + "Description": "Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.", + "Name": "Azure VIrtual Machine", + "Checks": [ + "app_function_identity_is_configured" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure VIrtual Machine" + } + ] + }, + { + "Id": "7.3.3.4", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Backup", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "7.3.3.5", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.3.6", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.3.7", + "Description": "Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.3.8", + "Description": "Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.3.9", + "Description": "Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.3.10", + "Description": "Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes \"Actions\": [\"*\"] over \"AssignableScopes\": [\"/\"].", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.3.11", + "Description": "Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.3.12", + "Description": "Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.3.13", + "Description": "Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "7.3.3.14", + "Description": "Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.3.3.15", + "Description": "Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "7.3.3.16", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.3.3.17", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "7.3.3.18", + "Description": "Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.3.3.19", + "Description": "Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.3.3.20", + "Description": "Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.3.3.21", + "Description": "Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "7.3.3.22", + "Description": "Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "7.3.3: Access to system components and data is managed via an access control system(s). ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.1.1", + "Description": "Checks if running Azure Virtual Machines (VMs) are launched using Azure SSH public keys. The rule is NON_COMPLIANT if a running VM instance is launched with a public SSH key.", + "Name": "Azure Virtual Machines", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "8.2.1.2", + "Description": "Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.1.3", + "Description": "Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.1.4", + "Description": "Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.1.5", + "Description": "Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.1: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "8.2.2.1", + "Description": "Checks if the Azure DevOps project contains environment variables AZURE_CLIENT_ID and AZURE_CLIENT_SECRET. The rule is NON_COMPLIANT if the project environment variables contain plaintext credentials.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "8.2.2.2", + "Description": "Checks if running Azure Virtual Machines (VMs) are launched using Azure SSH public keys. The rule is NON_COMPLIANT if a running VM instance is launched with a public SSH key.", + "Name": "Azure Virtual Machines", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "8.2.2.3", + "Description": "Checks if secrets are passed as container environment variables in Azure Container Instances or Azure Kubernetes Service (AKS). The rule is NON_COMPLIANT if one or more environment variable keys match a key listed in the secretKeys parameter, excluding secrets stored in Azure Key Vault or other secure locations.", + "Name": "Azure Container", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Container" + } + ] + }, + { + "Id": "8.2.2.4", + "Description": "Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.2.5", + "Description": "Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.2.6", + "Description": "Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.2.7", + "Description": "Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "8.2.2.8", + "Description": "Checks if Azure Key Vault secrets have rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the number specified in the maximumAllowedRotationFrequency parameter.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.2.2.9", + "Description": "Checks if Azure Key Vault secrets are rotated successfully according to the configured rotation schedule. Azure Key Vault calculates the date the rotation should occur. The rule is NON_COMPLIANT if the scheduled rotation date passes and the secret is not rotated.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.2.2.10", + "Description": "Checks if Azure Key Vault secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_non_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.2.2.11", + "Description": "Checks if Azure Key Vault secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in unusedForDays number of days. The default value is 90 days.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_non_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.2.4.1", + "Description": "Checks if running Azure Virtual Machines (VMs) are launched using Azure SSH public keys. The rule is NON_COMPLIANT if a running VM instance is launched with a public SSH key.", + "Name": "Azure Virtual Machines", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "8.2.4.2", + "Description": "Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.4.3", + "Description": "Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.4.4", + "Description": "Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.4.5", + "Description": "Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.4: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "8.2.5.1", + "Description": "Checks if running Azure Virtual Machines (VMs) are launched using Azure SSH public keys. The rule is NON_COMPLIANT if a running VM instance is launched with a public SSH key.", + "Name": "Azure Virtual Machines", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "8.2.5.2", + "Description": "Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.5.3", + "Description": "Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.5.4", + "Description": "Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.5.5", + "Description": "Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.5: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "8.2.6.1", + "Description": "Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.6.2", + "Description": "Checks if your Azure Active Directory (Azure AD) users have passwords or active access credentials that have not been used within the specified number of days provided. The rule is NON_COMPLIANT if there are inactive accounts that have not been used recently.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.6.3", + "Description": "Checks if Azure Key Vault secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in unusedForDays number of days. The default value is 90 days.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_non_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.2.7.1", + "Description": "Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.7.2", + "Description": "Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "8.2.7.3", + "Description": "Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.", + "Name": "Azure VIrtual Machine", + "Checks": [ + "app_function_identity_is_configured" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure VIrtual Machine" + } + ] + }, + { + "Id": "8.2.7.4", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "8.2.7.5", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.7.6", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.7.7", + "Description": "Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.7.8", + "Description": "Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.7.9", + "Description": "Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.7.10", + "Description": "Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes \"Actions\": [\"*\"] over \"AssignableScopes\": [\"/\"].", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.7.11", + "Description": "Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.7.12", + "Description": "Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.7.13", + "Description": "Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "8.2.7.14", + "Description": "Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "8.2.7.15", + "Description": "Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "8.2.7.16", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "8.2.7.17", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "8.2.7.18", + "Description": "Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.2.7.19", + "Description": "Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.2.7.20", + "Description": "Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.2.7.21", + "Description": "Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.2.7.22", + "Description": "Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.8.1", + "Description": "Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.8.2", + "Description": "Checks whether only Azure Instance Metadata Service (IMDS) v2 is enabled. The rule is NON_COMPLIANT if the Metadata version is not included in the launch configuration or if both IMDS v1 and v2 are enabled.", + "Name": "Azure Instance Metadata Service", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Instance Metadata Service" + } + ] + }, + { + "Id": "8.2.8.3", + "Description": "Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "8.2.8.4", + "Description": "Checks if your Azure Virtual Machines metadata service is configured with Instance Metadata Service Version 2 (IMDSv2). The rule is NON_COMPLIANT if the HttpTokens setting is set to optional.", + "Name": "Azure VIrtual Machine", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure VIrtual Machine" + } + ] + }, + { + "Id": "8.2.8.5", + "Description": "Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.", + "Name": "Azure VIrtual Machine", + "Checks": [ + "app_function_identity_is_configured" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure VIrtual Machine" + } + ] + }, + { + "Id": "8.2.8.6", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "8.2.8.7", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.8.8", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.8.9", + "Description": "Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.8.10", + "Description": "Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.8.11", + "Description": "Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.8.12", + "Description": "Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes \"Actions\": [\"*\"] over \"AssignableScopes\": [\"/\"].", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.8.13", + "Description": "Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.8.14", + "Description": "Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.2.8.15", + "Description": "Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "8.2.8.16", + "Description": "Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "8.2.8.17", + "Description": "Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "8.2.8.18", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "8.2.8.19", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "8.2.8.20", + "Description": "Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.2.8.21", + "Description": "Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.2.8.22", + "Description": "Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.2.8.23", + "Description": "Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.2.8.24", + "Description": "Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.10.1.1", + "Description": "Checks if active Azure AD service principal credentials (client secrets or certificates) are rotated within the number of days specified in maxCredentialAge. The rule is NON_COMPLIANT if credentials are not rotated within the specified time period. The default value is 90 days.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "8.3.10.1: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.10.1.2", + "Description": "Checks if Azure Key Vault secrets have rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the number specified in the maximumAllowedRotationFrequency parameter.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.10.1: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.3.10.1.3", + "Description": "Checks if Azure Key Vault secrets are rotated successfully according to the configured rotation schedule. Azure Key Vault calculates the date the rotation should occur. The rule is NON_COMPLIANT if the scheduled rotation date passes and the secret is not rotated.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.10.1: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.3.10.1.4", + "Description": "Checks if Azure Key Vault secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_non_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "8.3.10.1: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.3.11.1", + "Description": "Checks if running Azure Virtual Machines (VMs) are launched using Azure SSH public keys. The rule is NON_COMPLIANT if a running VM instance is launched with a public SSH key.", + "Name": "Azure Virtual Machines", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "8.3.11.2", + "Description": "Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.11.3", + "Description": "Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.11.4", + "Description": "Checks if the Azure subscription root user has an active access key. The rule is COMPLIANT if no access key exists for the root user. Otherwise, it is NON_COMPLIANT.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.11.5", + "Description": "Checks whether Azure Active Directory (AAD) users are members of at least one Azure AD group. The rule is NON_COMPLIANT if an AAD user is not a member of any AD group.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.11: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "8.3.2.1", + "Description": "Checks if HTTP to HTTPS redirection is configured on all HTTP listeners of Azure Application Gateway. The rule is NON_COMPLIANT if one or more HTTP listeners of Azure Application Gateway do not have HTTP to HTTPS redirection configured. The rule is also NON_COMPLIANT if one or more HTTP listeners are forwarding traffic to another HTTP listener instead of enforcing redirection.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "8.3.2.2", + "Description": "Checks if all methods in Azure API Management API operations have caching enabled and encryption applied. The rule is NON_COMPLIANT if any API operation in an Azure API Management instance is not configured with caching or the cache is not encrypted.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "8.3.2.3", + "Description": "Checks if an Azure Synapse Analytics workspace is encrypted at rest. The rule is NON_COMPLIANT if encryption of data at rest is not enabled for an Azure Synapse workspace.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "8.3.2.4", + "Description": "Checks if a Azure Backup recovery point is encrypted. The rule is NON_COMPLIANT if the recovery point is not encrypted using Azure Storage Service Encryption (SSE) or Customer-Managed Keys (CMK) in Azure Key Vault.", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "8.3.2.5", + "Description": "Checks if Azure Front Door or Azure CDN endpoints are using deprecated SSL protocols for HTTPS communication between edge locations and custom origins. This rule is NON_COMPLIANT for an Azure Front Door or CDN profile if any TLS settings include outdated protocols such as TLS 1.0 or TLS 1.1.", + "Name": "Azure CDN", + "Checks": [ + "app_minimum_tls_version_12" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "8.3.2.6", + "Description": "Checks if Azure Front Door and Azure CDN profiles are encrypting traffic to custom origins. The rule is NON_COMPLIANT if OriginProtocolPolicy is set to HTTP only or if OriginProtocolPolicy is set to Match viewer and ViewerProtocolPolicy allows both HTTP and HTTPS traffic.", + "Name": "Azure CDN", + "Checks": [ + "network_http_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "8.3.2.7", + "Description": "Checks if your Azure Front Door and Azure CDN profiles enforce HTTPS (directly or via a redirection). The rule is NON_COMPLIANT if the ViewerProtocolPolicy allows both HTTP and HTTPS traffic for the Default Route Configuration or Custom Route Configurations.", + "Name": "Azure CDN", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure CDN" + } + ] + }, + { + "Id": "8.3.2.8", + "Description": "Checks if Azure Monitor log analytics workspaces are encrypted with a specified Azure Key Vault encryption key. The rule is NON_COMPLIANT if a Log Analytics workspace is not encrypted with a Key Vault key or is encrypted with a key not supplied in the rule parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "8.3.2.9", + "Description": "Checks if Azure Activity Logs are configured to use Azure Key Vault for server-side encryption (SSE). The rule is COMPLIANT if the key vault key ID is defined for encryption.", + "Name": "Azure Monitor", + "Checks": [ + "keyvault_logging_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "8.3.2.10", + "Description": "Checks if an Azure DevOps Pipeline project has encryption enabled for all of its artifacts. The rule is NON_COMPLIANT if encryption is disabled for any primary or secondary artifact configurations", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "8.3.2.11", + "Description": "Checks if the Azure DevOps project contains environment variables AZURE_CLIENT_ID and AZURE_CLIENT_SECRET. The rule is NON_COMPLIANT if the project environment variables contain plaintext credentials.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "8.3.2.12", + "Description": "Checks if an Azure DevOps Pipeline configured with Azure Blob Storage Logs has encryption enabled for its logs. The rule is NON_COMPLIANT if encryption is disabled in the logging configuration of an Azure DevOps Pipeline.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "8.3.2.13", + "Description": "Checks if Azure Cache for Redis clusters have encryption enabled. The rule is NON_COMPLIANT if an Azure Cache for Redis cluster is not encrypted.", + "Name": "Azure Cache", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Cache" + } + ] + }, + { + "Id": "8.3.2.14", + "Description": "Checks if your Azure Cosmos DB Accelerator (DAX equivalent) cluster has ClusterEndpointEncryptionType set to TLS. The rule is NON_COMPLIANT if a Cosmos DB Accelerator cluster is not encrypted using Transport Layer Security (TLS).", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "8.3.2.15", + "Description": "Checks if Azure Database Migration Service (Azure DMS) endpoints are configured with an SSL connection. The rule is NON_COMPLIANT if Azure DMS does not have an SSL connection configured.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "8.3.2.16", + "Description": "Checks if Azure Database Migration Service (Azure DMS) endpoints for Redis data stores are enabled for TLS/SSL encryption of data communicated with other endpoints. The rule is NON_COMPLIANT if TLS/SSL encryption is not enabled.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "8.3.2.17", + "Description": "Checks if storage encryption is enabled for your Azure Cosmos DB for MongoDB API clusters. The rule is NON_COMPLIANT if storage encryption is not enabled.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "8.3.2.18", + "Description": "Checks if Azure Cosmos DB tables are encrypted with Azure Key Vault Managed HSM. The rule is NON_COMPLIANT if an Azure Cosmos DB table is not encrypted with Azure Key Vault. The rule is also NON_COMPLIANT if the encrypted Azure Key Vault key is not present in the specified key input parameter.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "8.3.2.19", + "Description": "Checks if Azure Cosmos DB tables are encrypted and verifies their status. The rule is COMPLIANT if the status is enabled or enabling.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "8.3.2.20", + "Description": "Checks if Azure Managed Disks encryption is enabled by default. The rule is NON_COMPLIANT if the encryption is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "vm_ensure_using_managed_disks" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.3.2.21", + "Description": "Checks if secrets are passed as container environment variables in Azure Container Instances or Azure Kubernetes Service (AKS). The rule is NON_COMPLIANT if one or more environment variable keys match a key listed in the secretKeys parameter, excluding secrets stored in Azure Key Vault or other secure locations.", + "Name": "Azure Container", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Container" + } + ] + }, + { + "Id": "8.3.2.22", + "Description": "Checks if Azure Files is configured to encrypt the file data using Azure Key Vault Managed Keys. The rule is NON_COMPLIANT if encryption is not enabled or if the encryption key does not match the specified Key Vault Key.", + "Name": "Azure Files", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Files" + } + ] + }, + { + "Id": "8.3.2.23", + "Description": "Checks if Azure Kubernetes Service (AKS) clusters are configured to have Kubernetes secrets encrypted using Azure Key Vault or Customer-Managed Keys (CMK). The rule is NON_COMPLIANT if an AKS cluster does not have encryption-at-rest enabled or if secrets encryption is not configured using Azure Key Vault keys.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "8.3.2.24", + "Description": "Checks if Azure Kubernetes Service (AKS) clusters are configured to have Kubernetes secrets encrypted using Azure Key Vault or Customer-Managed Keys (CMK). The rule is NON_COMPLIANT if an AKS cluster does not have encryption-at-rest enabled or if secrets encryption is not configured using Azure Key Vault keys.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "8.3.2.25", + "Description": "Checks if Azure Cache for Redis replication groups have encryption-at-rest enabled. The rule is NON_COMPLIANT for an Azure Cache for Redis replication group if encryption-at-rest is not enabled or if the Key Vault key does not match the approved Key Vault key specified.", + "Name": "Azure Cache", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Cache" + } + ] + }, + { + "Id": "8.3.2.26", + "Description": "Checks if Azure Cache for Redis replication groups have encryption-in-transit enabled. The rule is NON_COMPLIANT for an Azure Cache for Redis replication group if enableNonSslPort is set to true.", + "Name": "Azure Cache", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Cache" + } + ] + }, + { + "Id": "8.3.2.27", + "Description": "Checks if Azure Cognitive Search (previously called Azure Search) services have encryption at rest enabled. The rule is NON_COMPLIANT if the encryptionWithCustomerManagedKey field is not enabled.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "8.3.2.28", + "Description": "Checks if Azure AI Search nodes are encrypted end to end. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the Azure OpenSearch domain.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "8.3.2.29", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "8.3.2.30", + "Description": "Checks whether your Azure Load Balancer or Application Gateway SSL listeners are using a custom SSL policy. The rule is applicable only if SSL listeners are configured for the Azure Application Gateway or Azure Front Door. The rule is NON_COMPLIANT if the SSL policy does not follow the organizations security standards.", + "Name": "Azure Load Balancer", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "8.3.2.31", + "Description": "Checks if your Azure Application Gateway or Azure Front Door SSL listeners use a predefined SSL policy. The rule is NON_COMPLIANT if the SSL policy configured for the HTTPS/SSL listener does not match the value of the parameter predefinedPolicyName.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "8.3.2.32", + "Description": "Checks if your Azure Application Gateway or Azure Front Door is configured with SSL or HTTPS listeners. The rule is NON_COMPLIANT if a listener is not configured to use HTTPS with a valid SSL certificate.", + "Name": "Azure Network", + "Checks": [ + "app_ensure_http_is_redirected_to_https" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "8.3.2.33", + "Description": "Checks if Azure HDInsight clusters have Enterprise Security Package (ESP) with Kerberos authentication enabled. The rule is NON_COMPLIANT if a security configuration is not attached to the cluster or if the security configuration does not meet the specified rule parameters.", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "8.3.2.34", + "Description": "Checks if attached Azure Managed Disks are encrypted and optionally encrypted with a specified customer-managed key (CMK). The rule is NON_COMPLIANT if attached Managed Disks are unencrypted or are encrypted with a key not in the supplied parameters.", + "Name": "Azure Storage", + "Checks": [ + "vm_ensure_unattached_disks_encrypted_with_cmk" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.3.2.35", + "Description": "Checks if Azure Event Hubs or Azure Stream Analytics streams are encrypted at rest with server-side encryption. The rule is NON_COMPLIANT if encryption is not enabled for the stream.", + "Name": "Azure Stream Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Stream Analytics" + } + ] + }, + { + "Id": "8.3.2.36", + "Description": "Checks if an Azure Event Hubs or Azure Service Bus namespace enforces encryption in transit using HTTPS (TLS) for communication between nodes. The rule is NON_COMPLIANT if plain text communication is enabled for in-cluster node connections.", + "Name": "Azure Events Hub", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Events Hub" + } + ] + }, + { + "Id": "8.3.2.37", + "Description": "Checks if storage encryption is enabled for your Azure Cosmos DB or Azure SQL Database instances. The rule is NON_COMPLIANT if storage encryption is not enabled.", + "Name": "Azure Cosmos DB", + "Checks": [ + "storage_infrastructure_encryption_is_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "8.3.2.38", + "Description": "Checks if an Azure Cosmos DB cluster has automatic backups encrypted. The rule is NON_COMPLIANT if the Azure Cosmos DB cluster does not have automatic backups encrypted.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "8.3.2.39", + "Description": "Checks if Azure Cognitive Search service has encryption at rest configuration enabled. The rule is NON_COMPLIANT if the encryption at rest option is not enabled for the Azure Cognitive Search domain.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "8.3.2.40", + "Description": "Checks whether connections to Azure AI Search services are using HTTPS. The rule is NON_COMPLIANT if the EnforceHTTPS setting is not enabled or if the minimum TLS version does not meet the required security policy.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "8.3.2.41", + "Description": "Checks if Azure AI Search services have end-to-end encryption enabled. The rule is NON_COMPLIANT if node-to-node encryption is not enabled for the search service.", + "Name": "Azure AI Search", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AI Search" + } + ] + }, + { + "Id": "8.3.2.42", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance is encrypted at rest. The rule is NON_COMPLIANT if the SQL database or SQL Managed Instance is not encrypted at rest.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_tde_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "8.3.2.43", + "Description": "Checks if Azure SQL Database or Azure SQL Managed Instance backups are encrypted. The rule is NON_COMPLIANT if the SQL database or SQL Managed Instance backups are not encrypted.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_tde_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "8.3.2.44", + "Description": "Checks if storage encryption is enabled for your Azure SQL Database or Azure SQL Managed Instance. The rule is NON_COMPLIANT if storage encryption is not enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_tde_encryption_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "8.3.2.45", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "8.3.2.46", + "Description": "Checks if Azure Synapse Analytics (formerly Azure SQL Data Warehouse) clusters are using a specified Azure Key Vault key for encryption. The rule is COMPLIANT if encryption is enabled and the cluster is encrypted with the key provided in the keyVaultKeyId parameter. The rule is NON_COMPLIANT if the cluster is not encrypted or encrypted with another key.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "8.3.2.47", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) requires TLS/SSL encryption for connections to SQL clients. The rule is NON_COMPLIANT if any Azure Synapse Analytics workspace does not enforce SSL connections.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "8.3.2.48", + "Description": "Checks if your Azure Blob Storage container either has Azure Storage Service Encryption (SSE) enabled by default or that the container policy explicitly denies put-object requests without server-side encryption that uses AES-256 or Azure Key Vault. The rule is NON_COMPLIANT if your Azure Blob Storage container is not encrypted by default.", + "Name": "Azure Storage", + "Checks": [ + "storage_secure_transfer_required_is_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.3.2.49", + "Description": "Checks if Azure Blob Storage accounts enforce secure transfer (HTTPS/TLS) for all requests. The rule is NON_COMPLIANT if any Azure Storage account allows requests over HTTP instead of requiring HTTPS/TLS.", + "Name": "Azure Storage", + "Checks": [ + "storage_secure_transfer_required_is_enabled" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.3.2.50", + "Description": "Checks if the Azure Blob Storage containers are encrypted with Azure Key Vault. The rule is NON_COMPLIANT if the Azure Blob Storage container is not encrypted with an Azure Key Vault key.", + "Name": "Azure Storage", + "Checks": [ + "defender_ensure_defender_for_keyvault_is_on" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.3.2.51", + "Description": "Checks if an Azure Key Vault key is configured for an Azure Machine Learning endpoint configuration. The rule is NON_COMPLIANT if KeyVaultKeyId is not specified for the Azure Machine Learning endpoint configuration.", + "Name": "Azure Key Vault", + "Checks": [ + "defender_ensure_defender_for_keyvault_is_on" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.3.2.52", + "Description": "Checks if an Azure Key Vault key is configured for an Azure Machine Learning notebook instance. The rule is NON_COMPLIANT if KeyVaultKeyId is not specified for the Azure Machine Learning notebook instance.", + "Name": "Azure Key Vault", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.3.2.53", + "Description": "Checks if all secrets in Azure Key Vault are encrypted using the Azure managed key or a customer-managed key that was created in Azure Key Vault. The rule is COMPLIANT if a secret is encrypted using a customer-managed key. This rule is NON_COMPLIANT if a secret is encrypted using the Azure managed key.", + "Name": "Azure Key Vault", + "Checks": [ + "storage_ensure_encryption_with_customer_managed_keys" + ], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.3.2.54", + "Description": "Checks if Azure Service Bus topics are encrypted with Azure Key Vault. The rule is NON_COMPLIANT if a Service Bus topic is not encrypted with Azure Key Vault. Optionally, specify the key Azure Key Vault references or the key names for the rule to check.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.2: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "8.3.4.1", + "Description": "Checks if an Azure subscription is part of an Azure Management Group. The rule is NON_COMPLIANT if the Azure subscription is not part of an Azure Management Group or the Management Group ID does not match the rule parameter MasterManagementGroupId.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.4.2", + "Description": "Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "8.3.4.3", + "Description": "Checks if an Azure Virtual Machine (VM) has a managed identity attached to it. The rule is NON_COMPLIANT if no managed identity is attached to the Azure VM.", + "Name": "Azure VIrtual Machine", + "Checks": [ + "app_function_identity_is_configured" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure VIrtual Machine" + } + ] + }, + { + "Id": "8.3.4.4", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "8.3.4.5", + "Description": "Checks if the managed Azure Role-Based Access Control (RBAC) policies that you create do not allow blocked actions on Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on Key Vault keys by the managed RBAC policy.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_enabled" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.4.6", + "Description": "Checks if the inline policies attached to your Azure AD users, roles, and groups do not allow blocked actions on all Azure Key Vault keys. The rule is NON_COMPLIANT if any blocked action is allowed on all Key Vault keys in an inline policy.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.4.7", + "Description": "Checks if the inline policy feature is not in use. The rule is NON_COMPLIANT if an Azure role assignment for a user, role, or group contains custom role definitions with inline permissions, instead of using Azure built-in roles or properly managed custom roles through Azure Role-Based Access Control (RBAC).", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.4.8", + "Description": "Checks if an Azure Role-Based Access Control (RBAC) assignment contains a specific role definition listed in the input parameter. The rule is NON_COMPLIANT if the specified role definition is assigned to a user, group, or service principal within the Azure subscription or management group.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.4.9", + "Description": "Checks whether an Azure Role-Based Access Control (RBAC) policy is assigned to a user, group, or service principal within the Azure subscription or management group. The rule is NON_COMPLIANT if the specified role assignment is applied to an unauthorized entity.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.4.10", + "Description": "Checks if Azure Role-Based Access Control (RBAC) policies have role assignments that grant unrestricted permissions to all actions on all resources. The rule is NON_COMPLIANT if any custom role definition includes \"Actions\": [\"*\"] over \"AssignableScopes\": [\"/\"].", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.4.11", + "Description": "Checks if Azure Role-Based Access Control (RBAC) custom roles grant permissions to all actions on individual Azure resources. The rule is NON_COMPLIANT if any custom RBAC role allows full access to at least one Azure service.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.4.12", + "Description": "Checks if all Azure Role-Based Access Control (RBAC) custom roles specified in the list of custom roles are assigned to the Azure Active Directory (Azure AD) role. The rule is NON_COMPLIANT if a required custom role is not assigned to the Azure AD role.", + "Name": "Azure AD", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.4.13", + "Description": "Checks if none of your Azure Active Directory (AAD) users have direct roles or permissions assigned. Azure AD users should inherit permissions from AAD groups or roles. The rule is NON_COMPLIANT if there is at least one direct role or permission assigned to an AAD user.", + "Name": "Azure Active Directory", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Active Directory" + } + ] + }, + { + "Id": "8.3.4.14", + "Description": "Checks if an Azure Database for PostgreSQL or Azure Database for MySQL instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the database does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "8.3.4.15", + "Description": "Checks if Azure Cognitive Search domains have fine-grained access control enabled. The rule is NON_COMPLIANT if Azure Cognitive Search advanced security features, such as role-based access control (RBAC), are not enabled for the search service.", + "Name": "Azure Cognitive Search", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "8.3.4.16", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "8.3.4.17", + "Description": "Checks if an Azure SQL Database or Azure SQL Managed Instance has Azure Active Directory (AAD) authentication enabled. The rule is NON_COMPLIANT if the Azure SQL Database or Azure SQL Managed Instance does not have AAD authentication enabled.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_azuread_administrator_enabled" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "8.3.4.18", + "Description": "Checks if Azure Storage account containers allow user permissions through access control lists (ACLs). The rule is NON_COMPLIANT if ACLs are configured for user access in Azure Storage account containers.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.3.4.19", + "Description": "Checks if an Azure Blob Storage container policy does not allow blocklisted container-level and object-level actions on resources in the container for principals from other Azure subscriptions. For example, the rule checks that the Azure Blob Storage container policy does not allow another Azure subscription to perform any GetBlob actions or DeleteBlob on any blob in the container. The rule is NON_COMPLIANT if any blocklisted actions are allowed by the Azure Blob Storage container policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.3.4.20", + "Description": "Checks that the access granted by the Azure Storage account container is restricted by any of the Azure principals, federated users, managed identities, IP addresses, or virtual networks that you provide. The rule is COMPLIANT if a container policy is not present.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.3.4.21", + "Description": "Checks if your Azure Storage account container policies do not allow cross-tenant permissions other than the specified Azure Storage account policy.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.3.4.22", + "Description": "Checks if the Azure DDoS Protection Response Team (DRT) can access your Azure account. The rule is NON_COMPLIANT if Azure DDoS Protection is enabled but the role for DRT access is not configured.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.4: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.5.1", + "Description": "Checks if active Azure AD service principal credentials (client secrets or certificates) are rotated within the number of days specified in maxCredentialAge. The rule is NON_COMPLIANT if credentials are not rotated within the specified time period. The default value is 90 days.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "8.3.5: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.5.2", + "Description": "Checks if Azure Key Vault secrets have rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the number specified in the maximumAllowedRotationFrequency parameter.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.5: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.3.5.3", + "Description": "Checks if Azure Key Vault secrets are rotated successfully according to the configured rotation schedule. Azure Key Vault calculates the date the rotation should occur. The rule is NON_COMPLIANT if the scheduled rotation date passes and the secret is not rotated.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.5: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.3.5.4", + "Description": "Checks if Azure Key Vault secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_non_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "8.3.5: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.3.6.1", + "Description": "Checks if the Azure Active Directory (Azure AD) password policy for users meets the specified requirements indicated in the parameters. The rule is NON_COMPLIANT if the account password policy does not meet the specified requirements.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.3.6: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.7.1", + "Description": "Checks if active Azure AD service principal credentials (client secrets or certificates) are rotated within the number of days specified in maxCredentialAge. The rule is NON_COMPLIANT if credentials are not rotated within the specified time period. The default value is 90 days.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "8.3.7: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.7.2", + "Description": "Checks if Azure Key Vault secrets have rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the number specified in the maximumAllowedRotationFrequency parameter.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.7: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.3.7.3", + "Description": "Checks if Azure Key Vault secrets are rotated successfully according to the configured rotation schedule. Azure Key Vault calculates the date the rotation should occur. The rule is NON_COMPLIANT if the scheduled rotation date passes and the secret is not rotated.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.7: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.3.7.4", + "Description": "Checks if Azure Key Vault secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_non_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "8.3.7: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.3.9.1", + "Description": "Checks if active Azure AD service principal credentials (client secrets or certificates) are rotated within the number of days specified in maxCredentialAge. The rule is NON_COMPLIANT if credentials are not rotated within the specified time period. The default value is 90 days.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "8.3.9: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.3.9.2", + "Description": "Checks if Azure Key Vault secrets have rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the number specified in the maximumAllowedRotationFrequency parameter.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.9: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.3.9.3", + "Description": "Checks if Azure Key Vault secrets are rotated successfully according to the configured rotation schedule. Azure Key Vault calculates the date the rotation should occur. The rule is NON_COMPLIANT if the scheduled rotation date passes and the secret is not rotated.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.3.9: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.3.9.4", + "Description": "Checks if Azure Key Vault secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_non_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "8.3.9: Strong authentication for users and administrators is established and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.4.1.1", + "Description": "Checks if Azure Active Directory (Azure AD) users have multi-factor authentication (MFA) enabled. The rule is NON_COMPLIANT if MFA is not enabled for at least one Azure AD user.", + "Name": "Azure AD", + "Checks": [ + "entra_non_privileged_user_has_mfa" + ], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.4.1.2", + "Description": "Checks if Azure multi-factor authentication (MFA) is enabled for all Azure Active Directory (Azure AD) users that use a console password. The rule is COMPLIANT if MFA is enabled.", + "Name": "Azure AD", + "Checks": [ + "entra_privileged_user_has_mfa" + ], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.4.1.3", + "Description": "Checks if your Azure account is enabled to use multi-factor authentication (MFA) hardware device to sign in with global administrator credentials. The rule is NON_COMPLIANT if any virtual MFA devices are permitted for signing in with global administrator credentials.", + "Name": "Azure AD", + "Checks": [ + "entra_privileged_user_has_mfa" + ], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.4.1.4", + "Description": "Checks if the global administrator account of your Azure Active Directory (AAD) requires multi-factor authentication for console sign-in. The rule is NON_COMPLIANT if the global administrator account does not have multi-factor authentication (MFA) enabled.", + "Name": "Azure AD", + "Checks": [ + "entra_privileged_user_has_mfa" + ], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.4.1.5", + "Description": "Checks if Azure Blob Storage has soft delete enabled for blobs in the container. The rule is NON_COMPLIANT if soft delete for blobs is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_soft_delete_is_enabled" + ], + "Attributes": [ + { + "Section": "8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.4.2.1", + "Description": "Checks if Azure Active Directory (Azure AD) users have multi-factor authentication (MFA) enabled. The rule is NON_COMPLIANT if MFA is not enabled for at least one Azure AD user.", + "Name": "Azure AD", + "Checks": [ + "entra_non_privileged_user_has_mfa" + ], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.4.2.2", + "Description": "Checks if Azure multi-factor authentication (MFA) is enabled for all Azure Active Directory (Azure AD) users that use a console password. The rule is COMPLIANT if MFA is enabled.", + "Name": "Azure AD", + "Checks": [ + "entra_privileged_user_has_mfa" + ], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.4.2.3", + "Description": "Checks if your Azure account is enabled to use multi-factor authentication (MFA) hardware device to sign in with global administrator credentials. The rule is NON_COMPLIANT if any virtual MFA devices are permitted for signing in with global administrator credentials.", + "Name": "Azure AD", + "Checks": [ + "entra_privileged_user_has_mfa" + ], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.4.2.4", + "Description": "Checks if the global administrator account of your Azure Active Directory (AAD) requires multi-factor authentication for console sign-in. The rule is NON_COMPLIANT if the global administrator account does not have multi-factor authentication (MFA) enabled.", + "Name": "Azure AD", + "Checks": [ + "entra_privileged_user_has_mfa" + ], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.4.2.5", + "Description": "Checks if Azure Blob Storage has soft delete enabled for blobs in the container. The rule is NON_COMPLIANT if soft delete for blobs is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_soft_delete_is_enabled" + ], + "Attributes": [ + { + "Section": "8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.4.3.1", + "Description": "Checks if Azure Active Directory (Azure AD) users have multi-factor authentication (MFA) enabled. The rule is NON_COMPLIANT if MFA is not enabled for at least one Azure AD user.", + "Name": "Azure AD", + "Checks": [ + "entra_non_privileged_user_has_mfa" + ], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.4.3.2", + "Description": "Checks if Azure multi-factor authentication (MFA) is enabled for all Azure Active Directory (Azure AD) users that use a console password. The rule is COMPLIANT if MFA is enabled.", + "Name": "Azure AD", + "Checks": [ + "entra_privileged_user_has_mfa" + ], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.4.3.3", + "Description": "Checks if your Azure account is enabled to use multi-factor authentication (MFA) hardware device to sign in with global administrator credentials. The rule is NON_COMPLIANT if any virtual MFA devices are permitted for signing in with global administrator credentials.", + "Name": "Azure AD", + "Checks": [ + "entra_privileged_user_has_mfa" + ], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.4.3.4", + "Description": "Checks if the global administrator account of your Azure Active Directory (AAD) requires multi-factor authentication for console sign-in. The rule is NON_COMPLIANT if the global administrator account does not have multi-factor authentication (MFA) enabled.", + "Name": "Azure AD", + "Checks": [ + "entra_privileged_user_has_mfa" + ], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.4.3.5", + "Description": "Checks if Azure Blob Storage has soft delete enabled for blobs in the container. The rule is NON_COMPLIANT if soft delete for blobs is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_soft_delete_is_enabled" + ], + "Attributes": [ + { + "Section": "8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "8.6.3.1", + "Description": "Checks if active Azure AD service principal credentials (client secrets or certificates) are rotated within the number of days specified in maxCredentialAge. The rule is NON_COMPLIANT if credentials are not rotated within the specified time period. The default value is 90 days.", + "Name": "Azure AD", + "Checks": [ + "keyvault_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.6.3.2", + "Description": "Checks if the Azure Active Directory (Azure AD) password policy for users meets the specified requirements indicated in the parameters. The rule is NON_COMPLIANT if the account password policy does not meet the specified requirements.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "8.6.3.3", + "Description": "Checks if Azure Key Vault secrets have rotation enabled. The rule also checks an optional maximumAllowedRotationFrequency parameter. If the parameter is specified, the rotation frequency of the secret is compared with the maximum allowed frequency. The rule is NON_COMPLIANT if the secret is not scheduled for rotation. The rule is also NON_COMPLIANT if the rotation frequency is higher than the number specified in the maximumAllowedRotationFrequency parameter.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.6.3.4", + "Description": "Checks if Azure Key Vault secrets are rotated successfully according to the configured rotation schedule. Azure Key Vault calculates the date the rotation should occur. The rule is NON_COMPLIANT if the scheduled rotation date passes and the secret is not rotated.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_key_rotation_enabled" + ], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "8.6.3.5", + "Description": "Checks if Azure Key Vault secrets have been rotated in the past specified number of days. The rule is NON_COMPLIANT if a secret has not been rotated for more than maxDaysSinceRotation number of days. The default value is 90 days.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_non_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "8.6.3: Use of application and system accounts and associated authentication factors is strictly managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "A1.1.2.1", + "Description": "Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "A1.1.2.2", + "Description": "Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "A1.1.2.3", + "Description": "Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "A1.1.2.4", + "Description": "Checks if Azure Managed Disks snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots with a similar public access setting are configured, making them accessible to all users.", + "Name": "Azure Managed Disks", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Managed Disks" + } + ] + }, + { + "Id": "A1.1.2.5", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Backup", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "A1.1.2.6", + "Description": "Checks if Azure Files access points are configured to enforce a root directory. The rule is NON_COMPLIANT if the value of Path is set to / (default root directory of the file share).", + "Name": "Azure Files", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Files" + } + ] + }, + { + "Id": "A1.1.2.7", + "Description": "Checks if Azure Files access points are configured to enforce a user identity. The rule is NON_COMPLIANT if PosixUser is not defined or if parameters are provided and there is no match in the corresponding parameter.", + "Name": "Azure Files", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Files" + } + ] + }, + { + "Id": "A1.1.2.8", + "Description": "Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "A1.1.2.9", + "Description": "Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.", + "Name": "Azure Functions", + "Checks": [ + "app_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "A1.1.2.10", + "Description": "Checks if an Azure Cosmos DB manual database snapshot is public. The rule is NON_COMPLIANT if any existing or new Azure Cosmos DB snapshot is publicly accessible.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "A1.1.2.11", + "Description": "Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "A1.1.2.12", + "Description": "Checks if Azure SQL Database backups are public. The rule is NON_COMPLIANT if any existing or new Azure SQL Database backups are publicly accessible.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "A1.1.2.13", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "A1.1.2.14", + "Description": "Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.", + "Name": "Azure Blob Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Blob Storage" + } + ] + }, + { + "Id": "A1.1.2.15", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A1.1.2.16", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A1.1.2.17", + "Description": "Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A1.1.2.18", + "Description": "Checks if Azure Blob Storage has soft delete enabled for blobs in the container. The rule is NON_COMPLIANT if soft delete for blobs is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_soft_delete_is_enabled" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A1.1.2.19", + "Description": "Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A1.1.2.20", + "Description": "Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A1.1.2.21", + "Description": "Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "A1.1.2.22", + "Description": "Checks if Azure Automation runbooks owned by the account are public. The rule is NON_COMPLIANT if Azure Automation runbooks with the owner set to Self are public.", + "Name": "Azure Automations", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.2: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Automations" + } + ] + }, + { + "Id": "A1.1.3.1", + "Description": "Checks if Azure API Management (APIM) APIs are configured with the specified endpoint type as defined in the rule parameter. The rule is NON_COMPLIANT if the API does not match the expected endpoint configuration type.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "A1.1.3.2", + "Description": "Checks if an Azure API Management (APIM) API stage is configured with an SSL certificate. The rule is NON_COMPLIANT if the API stage does not have an associated SSL certificate for secure communication.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "A1.1.3.3", + "Description": "Checks if Azure API Management (APIM) APIs are associated with Azure Web Application Firewall (WAF) policies. The rule is NON_COMPLIANT if an APIM API is not associated with a WAF policy to protect against web threats and vulnerabilities.", + "Name": "Azure API Management", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "A1.1.3.4", + "Description": "Checks if Azure Front Door profiles are associated with an Azure Web Application Firewall (WAF) policy. The rule is NON_COMPLIANT if an Azure Front Door profile is not linked to a WAF policy, which helps protect against web threats and vulnerabilities.", + "Name": "Azure Front Door", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "A1.1.3.5", + "Description": "Checks if the certificate associated with an Azure Content Delivery Network (CDN) endpoint is the default SSL certificate. The rule is NON_COMPLIANT if an Azure CDN endpoint is using the default SSL certificate instead of a custom-managed certificate.", + "Name": "Azure Content Delivery Network", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Content Delivery Network" + } + ] + }, + { + "Id": "A1.1.3.6", + "Description": "Checks if the Azure DevOps repository URL contains embedded credentials. The rule is NON_COMPLIANT if the repository URL includes any username or password in the connection string and COMPLIANT if it does not.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "A1.1.3.7", + "Description": "Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "A1.1.3.8", + "Description": "Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "A1.1.3.9", + "Description": "Checks if Azure VPN Client Authorization Rules allow connection access for all clients. The rule is NON_COMPLIANT if AccessAll is present and set to true in the Azure Virtual WAN User VPN configuration.", + "Name": "Azure VPN", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure VPN" + } + ] + }, + { + "Id": "A1.1.3.10", + "Description": "Checks if the compliance status of Azure Automation State Configuration (DSC) is COMPLIANT or NON_COMPLIANT after applying the configuration on the virtual machine. The rule is COMPLIANT if the compliance status field is set to COMPLIANT in Azure Policy guest configuration or Azure Automation State Configuration.", + "Name": "Azure Automation State Configuration", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Automation State Configuration" + } + ] + }, + { + "Id": "A1.1.3.11", + "Description": "Checks if Azure Virtual WAN Hubs have Auto-Accept Shared Connections enabled. The rule is NON_COMPLIANT if the Virtual Hubs setting for automatically accepting shared connections is set to Enabled.", + "Name": "Azure Virtual WAN", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Virtual WAN" + } + ] + }, + { + "Id": "A1.1.3.12", + "Description": "Checks if the Azure Kubernetes Service (AKS) API server endpoint is not publicly accessible. The rule is NON_COMPLIANT if the API server endpoint is exposed to the public internet.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_clusters_public_access_disabled" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "A1.1.3.13", + "Description": "Checks if Azure Cognitive Search service is deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if the service endpoint is publicly accessible instead of being restricted to a private VNet.", + "Name": "Azure Cognitive Search", + "Checks": [ + "aisearch_service_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "A1.1.3.14", + "Description": "Checks if Azure Application Gateway and Azure Load Balancer listeners are configured to use SSL/TLS certificates from Azure Key Vault. This rule is NON_COMPLIANT if at least one load balancer has at least one listener that is not configured with a certificate from Azure Key Vault or is using a certificate from an untrusted source.", + "Name": "Azure Network", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.1.3.15", + "Description": "Checks if Azure Application Gateway uses SSL certificates provided by Azure Key Vault. To use this rule, an SSL or HTTPS listener must be configured with Azure Application Gateway. This rule is NON_COMPLIANT if the Application Gateway is using a self-signed or untrusted SSL certificate instead of a certificate from Azure Key Vault. This rule does not apply to Azure Load Balancer.", + "Name": "Azure Aplication Gateway", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Aplication Gateway" + } + ] + }, + { + "Id": "A1.1.3.16", + "Description": "Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "A1.1.3.17", + "Description": "Checks if Azure Network Security Groups (NSGs) restrict inbound SSH (Port 22) access from the public internet. The rule is NON_COMPLIANT if there is an NSG rule allowing unrestricted inbound SSH connections (0.0.0.0/0 or ::/0).", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.1.3.18", + "Description": "Checks if Azure Virtual Network (VNet) gateways are attached only to authorized virtual networks. The rule is NON_COMPLIANT if an Azure VPN Gateway or Azure Virtual Network Gateway is attached to an unauthorized VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "A1.1.3.19", + "Description": "Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.", + "Name": "Azure Functions", + "Checks": [ + "app_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "A1.1.3.20", + "Description": "Checks if an Azure Function App is configured to use a Virtual Network (VNet) Integration. The rule is NON_COMPLIANT if the Function App is not connected to a VNet, which may expose it to public access instead of securing it within a private network.", + "Name": "Azure Functions", + "Checks": [ + "app_function_vnet_integration_enabled" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "A1.1.3.21", + "Description": "Checks if Azure Network Security Groups (NSGs) allow unrestricted inbound traffic on default ports for SSH (22) or RDP (3389). The rule is NON_COMPLIANT if an NSG inbound rule allows traffic from any source (0.0.0.0/0 or ::/0) on ports 22 (SSH) or 3389 (RDP), which could expose resources to unauthorized access.", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.1.3.22", + "Description": "Checks if an Azure Firewall Policy is configured with a user-defined stateless default action for fragmented packets. The rule is NON_COMPLIANT if the stateless default action for fragmented packets does not match the user-defined default action, which could lead to inconsistent or insecure traffic handling.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.1.3.23", + "Description": "Checks if an Azure Firewall Policy is associated with stateful or stateless rule collections. The rule is NON_COMPLIANT if no stateful or stateless rule collections are associated with the Azure Firewall Policy, ensuring that traffic filtering rules are properly enforced.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.1.3.24", + "Description": "Checks if an Azure Firewall Policy Rule Collection Group contains rules. The rule is NON_COMPLIANT if there are no rules in a Rule Collection Group, ensuring that traffic filtering is properly enforced.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.1.3.25", + "Description": "Checks if there are public routes in the Azure Route Table pointing to an Internet gateway (IGW) equivalent, such as Azure Virtual Network NAT or a user-defined route (UDR) directing traffic to the internet. The rule is NON_COMPLIANT if a route has a destination CIDR block of 0.0.0.0/0 or ::/0, or if the destination CIDR block does not align with the rule parameters, ensuring that traffic is not unintentionally exposed to the internet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_http_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "A1.1.3.26", + "Description": "Checks if Azure Cognitive Search instances are deployed within an Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure Cognitive Search service endpoint is publicly accessible instead of being restricted to a private network using Private Endpoints or Service Endpoints.", + "Name": "Azure Cognitive Search", + "Checks": [ + "aisearch_service_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Cognitive Search" + } + ] + }, + { + "Id": "A1.1.3.27", + "Description": "Checks if there are any Azure Database for MySQL, PostgreSQL, or SQL Server firewall rules that are not the default firewall rule. The rule is NON_COMPLIANT if there are any custom firewall rules that allow unrestricted access instead of using the default security configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "A1.1.3.28", + "Description": "Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "A1.1.3.29", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "A1.1.3.30", + "Description": "Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.", + "Name": "Azure Blob Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Blob Storage" + } + ] + }, + { + "Id": "A1.1.3.31", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A1.1.3.32", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A1.1.3.33", + "Description": "Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A1.1.3.34", + "Description": "Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A1.1.3.35", + "Description": "Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A1.1.3.36", + "Description": "Checks if an Azure Machine Learning workspace notebook instance is deployed within a Virtual Network (VNet) or within a list of approved subnets. The rule is NON_COMPLIANT if a notebook instance is not deployed within a VNet or if its subnet ID is not included in the parameter list.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "A1.1.3.37", + "Description": "Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "A1.1.3.38", + "Description": "Checks if a Private Endpoint for the service provided in the rule parameter is created for each Azure Virtual Network (VNet). The rule is NON_COMPLIANT if an Azure VNet does not have a Private Endpoint created for the service.", + "Name": "Azure Network", + "Checks": [ + "keyvault_private_endpoints" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.1.3.39", + "Description": "Checks if there are unused Network Security Groups (NSGs). The rule is COMPLIANT if each NSG is associated with a subnet or network interface. The rule is NON_COMPLIANT if an NSG is not associated with any subnet or network interface.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.1.3.40", + "Description": "Checks if Azure Network Security Groups (NSGs) allowing unrestricted inbound traffic (0.0.0.0/0 or ::/0) only permit TCP or UDP connections on authorized ports. The rule is NON_COMPLIANT if NSG rules allow inbound traffic on ports not specified in the rule parameters.", + "Name": "Azure Network", + "Checks": [ + "network_ssh_internet_access_restricted" + ], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.1.3.41", + "Description": "Checks if an Azure Web Application Firewall (WAF) policy contains any rules. The rule is NON_COMPLIANT if there are no rules defined within the WAF policy rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.1.3.42", + "Description": "Checks if an Azure Web Application Firewall (WAF) global rule contains any conditions. The rule is NON_COMPLIANT if no conditions are defined within the WAF global rule set.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.1.3.43", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Global Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if a Web ACL does not include any WAF rule or rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.1.3.44", + "Description": "Checks whether an Azure Web Application Firewall (WAF) Regional rule group contains any rules. The rule is NON_COMPLIANT if there are no rules present within a WAF Regional rule group.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.1.3.45", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional rule contains any conditions. This rule is COMPLIANT if the regional rule contains at least one condition and NON_COMPLIANT otherwise.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.1.3.46", + "Description": "Checks whether an Azure Web Application Firewall (WAF) regional Web ACL contains any WAF rules or rule groups. The rule is NON_COMPLIANT if there are no WAF rules or rule groups present within the Web ACL.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "A1.1.3: Multi-tenant service providers protect and separate all customer environments and data. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.2.1.1", + "Description": "Checks if Azure API Management (APIM) services have access logging enabled for API stages. The rule is NON_COMPLIANT if log settings are not configured in the API Management diagnostics settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "A1.2.1.2", + "Description": "Checks if all methods in Azure API Management (APIM) services have logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the logging level is not set to Error or Information in the diagnostic settings.", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "A1.2.1.3", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "A1.2.1.4", + "Description": "Checks if an Azure API Management (APIM) service has diagnostic logging enabled. The rule is NON_COMPLIANT if logging is not enabled, or if the log level is neither Error nor Verbose (All logs).", + "Name": "Azure API Management", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "A1.2.1.5", + "Description": "Checks if Azure Load Balancers (ALB/CLB) are configured with a user-defined desynchronization mitigation mode. The rule is NON_COMPLIANT if the Load Balancer desync mitigation mode does not match the user-defined desync mitigation mode.", + "Name": "Azure Load Balances", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Load Balances" + } + ] + }, + { + "Id": "A1.2.1.6", + "Description": "Checks if Azure Front Door or Azure CDN profiles are configured to deliver access logs to an Azure Storage Account or Log Analytics Workspace. The rule is NON_COMPLIANT if an Azure Front Door or Azure CDN profile does not have logging configured.", + "Name": "Azure Front Door", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Front Door" + } + ] + }, + { + "Id": "A1.2.1.7", + "Description": "Checks if at least one Azure Monitor Diagnostic Setting is logging Azure Blob Storage data events for all Storage Accounts. The rule is NON_COMPLIANT if there are no Diagnostic Settings configured or if no settings record Blob Storage data events.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A1.2.1.8", + "Description": "Checks that there is at least one Azure Monitor diagnostic setting defined with security best practices.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A1.2.1.9", + "Description": "Checks if Azure Monitor log analytics workspaces are encrypted with a specified Azure Key Vault encryption key. The rule is NON_COMPLIANT if a Log Analytics workspace is not encrypted with a Key Vault key or is encrypted with a key not supplied in the rule parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A1.2.1.10", + "Description": "For this rule, the rule identifier (AZURE_ACTIVITY_LOG_ENABLED) and rule name (azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A1.2.1.11", + "Description": "Checks if Azure Activity Logs are configured to use Azure Key Vault for server-side encryption (SSE). The rule is COMPLIANT if the key vault key ID is defined for encryption.", + "Name": "Azure Monitor", + "Checks": [ + "keyvault_logging_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A1.2.1.12", + "Description": "Checks if Azure Monitor logs have file integrity monitoring enabled. The rule is NON_COMPLIANT if log file validation is not enabled for the logs in Azure Monitor.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A1.2.1.13", + "Description": "Checks if an Azure DevOps Pipeline project environment has at least one log option enabled. The rule is NON_COMPLIANT if the status of all present log configurations is set to DISABLED.", + "Name": "Azure DevOps", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure DevOps" + } + ] + }, + { + "Id": "A1.2.1.14", + "Description": "Checks if logging is enabled with a valid severity level for Azure Database Migration Service (DMS) replication task events of a target database. The rule is NON_COMPLIANT if logging is not enabled or replication task logging of a target database has a severity level that is not valid.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A1.2.1.15", + "Description": "Checks if an Azure Cosmos DB for MongoDB instance cluster has Azure Monitor Diagnostic Settings enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB for MongoDB instance cluster does not have Diagnostic Settings configured to export audit logs.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "A1.2.1.16", + "Description": "Checks if Azure VPN Gateway has diagnostic logging enabled for client connections. The rule is NON_COMPLIANT if diagnostic settings are not configured to capture connection logs.", + "Name": "Azure VPN Gateway", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure VPN Gateway" + } + ] + }, + { + "Id": "A1.2.1.17", + "Description": "Checks if Azure Container Instances have log analytics integration enabled. The rule is NON_COMPLIANT if an active Azure Container Instance does not have log analytics workspace configured or if logging is not enabled in at least one container definition.", + "Name": "Azure Container Instances", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Container Instances" + } + ] + }, + { + "Id": "A1.2.1.18", + "Description": "Checks if an Azure Kubernetes Service (AKS) cluster is configured with logging enabled. The rule is NON_COMPLIANT if logging for AKS clusters is not enabled for all log types.", + "Name": "Azure Kubernetes Service", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "A1.2.1.19", + "Description": "Checks if Azure App Service Environments are configured to send logs to Azure Monitor Logs. The rule is NON_COMPLIANT if logging is not enabled or if logs are not being sent to Azure Monitor Logs.", + "Name": "Azure App", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure App" + } + ] + }, + { + "Id": "A1.2.1.20", + "Description": "Checks if Azure Load Balancer and Azure Application Gateway have logging enabled. The rule is NON_COMPLIANT if diagnostic logs are not enabled or if logs are not being sent to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Load Balancer", + "Checks": [ + "app_http_logs_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Load Balancer" + } + ] + }, + { + "Id": "A1.2.1.21", + "Description": "Checks if Azure Service Bus namespaces have Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if a Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "A1.2.1.22", + "Description": "Checks if an Azure Service Bus namespace has Azure Monitor diagnostic logging enabled. The rule is NON_COMPLIANT if the Service Bus namespace does not have audit logging enabled and configured to send logs to Azure Monitor Logs or Azure Storage Account.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "A1.2.1.23", + "Description": "For this rule, the rule identifier (MULTI_REGION_AZURE_ACTIVITY_LOG_ENABLED) and rule name (multi-region-azure-activity-log-enabled) are different.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A1.2.1.24", + "Description": "Checks if an Azure Cosmos DB cluster has Azure Monitor Log export enabled for audit logs. The rule is NON_COMPLIANT if an Azure Cosmos DB cluster does not have Azure Monitor Log export enabled for audit logs.", + "Name": "Azrure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azrure Cosmos DB" + } + ] + }, + { + "Id": "A1.2.1.25", + "Description": "Checks if Azure Firewall has logging enabled. The rule is NON_COMPLIANT if a logging type is not configured. You can specify which logging type you want the rule to check.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A1.2.1.26", + "Description": "Checks if Azure Database for MySQL Flexible Server is configured to publish audit logs to Azure Monitor Logs. The rule is NON_COMPLIANT if MySQL Flexible Server does not have audit log publishing configured.", + "Name": "Azure Database", + "Checks": [ + "mysql_flexible_server_audit_log_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "A1.2.1.27", + "Description": "Checks if Azure SQL Database has respective logs enabled in Azure Monitor Logs. The rule is NON_COMPLIANT if any required log types are not enabled.", + "Name": "Azure SQL Database", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure SQL Database" + } + ] + }, + { + "Id": "A1.2.1.28", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) is logging audits to a specific Azure Storage Account. The rule is NON_COMPLIANT if audit logging is not enabled for a Synapse Analytics instance or if the specified storage account does not match the configured audit logging destination.", + "Name": "Azure Synapse Analytics ", + "Checks": [ + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "A1.2.1.29", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) has the specified security settings. The rule is NON_COMPLIANT if the Synapse Analytics instance is not encrypted, is encrypted with a different key, or does not have audit logging enabled.", + "Name": "Azure Synapse Analytics ", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Synapse Analytics " + } + ] + }, + { + "Id": "A1.2.1.30", + "Description": "Checks if DNS query logging is enabled for your Azure DNS public zones. The rule is NON_COMPLIANT if DNS query logging is not enabled for your Azure DNS public zones.", + "Name": "Azure DNS", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure DNS" + } + ] + }, + { + "Id": "A1.2.1.31", + "Description": "Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A1.2.1.32", + "Description": "Checks if logging is enabled for your Azure Storage accounts. The rule is NON_COMPLIANT if logging is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A1.2.1.33", + "Description": "Checks if Azure Logic Apps has logging enabled for the workflow executions. The rule is NON_COMPLIANT if the Logic App does not have logging enabled or the logging configuration does not meet the required minimum level.", + "Name": "Azure Logic Apps", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Logic Apps" + } + ] + }, + { + "Id": "A1.2.1.34", + "Description": "Checks if Azure Virtual Network (VNet) flow logs are enabled for all VNets. The rule is NON_COMPLIANT if flow logs are not enabled for at least one Azure VNet.", + "Name": "Azure Virtual Network", + "Checks": [ + "network_flow_log_more_than_90_days" + ], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Virtual Network" + } + ] + }, + { + "Id": "A1.2.1.35", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) regional and global web access control lists (Web ACLs). The rule is NON_COMPLIANT if logging is enabled but the logging destination does not match the value of the parameter.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A1.2.1.36", + "Description": "Checks if logging is enabled on Azure Web Application Firewall (WAF) global web access control lists (web ACLs). The rule is NON_COMPLIANT for a global web ACL if logging is not enabled.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A1.2.3.1", + "Description": "Checks if you have provided security contact information for your Azure account. The rule is NON_COMPLIANT if security contact information within the account is not provided.", + "Name": "Azure AD", + "Checks": [ + "defender_additional_email_configured_with_a_security_contact" + ], + "Attributes": [ + { + "Section": "A1.2.3: Multi-tenant service providers facilitate logging and incident response for all customers. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "A3.2.5.1.1", + "Description": "Checks if automated sensitive data discovery is enabled for Azure Purview. The rule is NON_COMPLIANT if automated sensitive data discovery is disabled. The rule is APPLICABLE for administrator accounts and NOT_APPLICABLE for member accounts.", + "Name": "Azure Purview", + "Checks": [], + "Attributes": [ + { + "Section": "A3.2.5.1: PCI DSS scope is documented and validated. ", + "Service": "Azure Purview" + } + ] + }, + { + "Id": "A3.2.5.1.2", + "Description": "Checks if Azure Purview is enabled in your account per region. The rule is NON_COMPLIANT if the status attribute is not set to ENABLED.", + "Name": "Azure Purview", + "Checks": [], + "Attributes": [ + { + "Section": "A3.2.5.1: PCI DSS scope is documented and validated. ", + "Service": "Azure Purview" + } + ] + }, + { + "Id": "A3.2.5.1.3", + "Description": "Checks if automated sensitive data discovery is enabled for Azure Purview. The rule is NON_COMPLIANT if automated sensitive data discovery is disabled. The rule is APPLICABLE for administrator accounts and NOT_APPLICABLE for member accounts.", + "Name": "Azure Purview", + "Checks": [], + "Attributes": [ + { + "Section": "A3.2.5.2: PCI DSS scope is documented and validated. ", + "Service": "Azure Purview" + } + ] + }, + { + "Id": "A3.2.5.1.4", + "Description": "Checks if Azure Purview is enabled in your account per region. The rule is NON_COMPLIANT if the status attribute is not set to ENABLED.", + "Name": "Azure Purview", + "Checks": [], + "Attributes": [ + { + "Section": "A3.2.5.2: PCI DSS scope is documented and validated. ", + "Service": "Azure Purview" + } + ] + }, + { + "Id": "A3.3.1.1", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "A3.3.1.2", + "Description": "Checks if your Azure Resource Manager (ARM) templates send event notifications to an Azure Event Grid topic or Azure Service Bus. Optionally checks if specified Event Grid topics or Service Bus namespaces are used. The rule is NON_COMPLIANT if ARM templates do not send notifications.", + "Name": "Azure Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "Azure Resource Manager" + } + ] + }, + { + "Id": "A3.3.1.3", + "Description": "Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_nsg" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A3.3.1.4", + "Description": "Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A3.3.1.5", + "Description": "Checks whether Azure Monitor alerts with the given metric name have the specified settings.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A3.3.1.6", + "Description": "Checks if Azure Monitor Diagnostic settings are configured to send logs to Log Analytics workspace. The rule is NON_COMPLIANT if no diagnostic settings are configured to send logs to Log Analytics.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A3.3.1.7", + "Description": "Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.", + "Name": "Azure Virtual Machines", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "A3.3.1.8", + "Description": "Checks if Azure Storage Event Grid notifications are enabled on an Azure Storage account. The rule is NON_COMPLIANT if Event Grid notifications are not set on a storage account, or if the event type or destination do not match the specified parameters.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A3.3.1.9", + "Description": "Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.", + "Name": "Azure Security Center", + "Checks": [ + "policy_ensure_asc_enforcement_enabled" + ], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "Azure Security Center" + } + ] + }, + { + "Id": "A3.3.1.10", + "Description": "Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "A3.3.1.11", + "Description": "Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities. ", + "Service": "Azure Network" + } + ] + }, + { + "Id": "A3.4.1.1", + "Description": "Checks if an Azure Backup Recovery Services vault has an attached resource-based policy that prevents the deletion of recovery points. The rule is NON_COMPLIANT if the Recovery Services vault does not have resource-based policies or has policies without a suitable Deny statement (statement with backup:DeleteRecoveryPoint, backup:UpdateRecoveryPointLifecycle, and backup:PutBackupVaultAccessPolicy permissions).", + "Name": "Azure Backup", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Backup" + } + ] + }, + { + "Id": "A3.4.1.2", + "Description": "Checks if Azure Database Migration Service (DMS) instances are publicly accessible. The rule is NON_COMPLIANT if the public access setting is enabled.", + "Name": "Azure Database Migration Service", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Database Migration Service" + } + ] + }, + { + "Id": "A3.4.1.3", + "Description": "Checks if Azure Cosmos DB manual backups are publicly accessible. The rule is NON_COMPLIANT if any manual backup snapshots are publicly available.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "A3.4.1.4", + "Description": "Checks if Azure Managed Disks snapshots are not publicly accessible. The rule is NON_COMPLIANT if one or more snapshots with a similar public access setting are configured, making them accessible to all users.", + "Name": "Azure Managed Disks", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Managed Disks" + } + ] + }, + { + "Id": "A3.4.1.5", + "Description": "Checks if Azure Kubernetes Service (AKS) containers only have read-only access to their root filesystems. The rule is NON_COMPLIANT if the readOnlyRootFilesystem parameter in the container definition of AKS deployment is set to false.", + "Name": "Azure Kubernetes Service", + "Checks": [ + "aks_cluster_rbac_enabled" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Kubernetes Service" + } + ] + }, + { + "Id": "A3.4.1.6", + "Description": "Checks if Azure Files access points are configured to enforce a root directory. The rule is NON_COMPLIANT if the value of Path is set to / (default root directory of the file share).", + "Name": "Azure Files", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Files" + } + ] + }, + { + "Id": "A3.4.1.7", + "Description": "Checks if Azure Files access points are configured to enforce a user identity. The rule is NON_COMPLIANT if PosixUser is not defined or if parameters are provided and there is no match in the corresponding parameter.", + "Name": "Azure Files", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Files" + } + ] + }, + { + "Id": "A3.4.1.8", + "Description": "Checks if an Azure HDInsight cluster has public network access disabled. The rule is NON_COMPLIANT if public network access is enabled or if the NSG (Network Security Group) rules allow inbound traffic on ports other than the required management port (e.g., SSH on Port 22).", + "Name": "Azure HDInsight", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure HDInsight" + } + ] + }, + { + "Id": "A3.4.1.9", + "Description": "Checks whether Azure Active Directory (Azure AD) groups have at least one assigned user. The rule is NON_COMPLIANT if an Azure AD group does not have any members assigned.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "A3.4.1.10", + "Description": "Checks if your Azure Active Directory (Azure AD) users have passwords or active access credentials that have not been used within the specified number of days provided. The rule is NON_COMPLIANT if there are inactive accounts that have not been used recently.", + "Name": "Azure AD", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure AD" + } + ] + }, + { + "Id": "A3.4.1.11", + "Description": "Checks if the Azure Function App policy attached to the function resource prohibits public access. The rule is NON_COMPLIANT if the Azure Function App policy allows public access. Additionally, it ensures that Azure Private Endpoints or Access Restrictions are properly configured to limit exposure.", + "Name": "Azure Functions", + "Checks": [ + "app_function_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Functions" + } + ] + }, + { + "Id": "A3.4.1.12", + "Description": "Checks if an Azure Cosmos DB manual database snapshot is public. The rule is NON_COMPLIANT if any existing or new Azure Cosmos DB snapshot is publicly accessible.", + "Name": "Azure Cosmos DB", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Cosmos DB" + } + ] + }, + { + "Id": "A3.4.1.13", + "Description": "Checks if Azure Database for MySQL, PostgreSQL, or SQL Server instances are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the instance configuration.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "A3.4.1.14", + "Description": "Checks if Azure SQL Database backups are public. The rule is NON_COMPLIANT if any existing or new Azure SQL Database backups are publicly accessible.", + "Name": "Azure Database", + "Checks": [ + "sqlserver_unrestricted_inbound_access" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Database" + } + ] + }, + { + "Id": "A3.4.1.15", + "Description": "Checks if Azure Synapse Analytics (formerly SQL Data Warehouse) dedicated SQL pools are not publicly accessible. The rule is NON_COMPLIANT if the publicNetworkAccess field is set to Enabled in the workspace or dedicated SQL pool configuration.", + "Name": "Azure Synapse Analytics", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Synapse Analytics" + } + ] + }, + { + "Id": "A3.4.1.16", + "Description": "Checks if Azure Blob Storage access points have public access blocked. The rule is NON_COMPLIANT if public access settings are not disabled for Azure Storage accounts.", + "Name": "Azure Blob Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Blob Storage" + } + ] + }, + { + "Id": "A3.4.1.17", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the specified settings do not match the corresponding configuration fields in the Azure Storage account.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A3.4.1.18", + "Description": "Checks if the required public access block settings are configured at the Azure Storage account level. The rule is NON_COMPLIANT if the configuration settings do not match one or more specified parameters (or default values).", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A3.4.1.19", + "Description": "Checks if Azure Blob Storage containers are publicly accessible. The rule is NON_COMPLIANT if a storage container is not listed in the excludedPublicContainers parameter and its access level is set to public.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A3.4.1.20", + "Description": "Checks if Azure Blob Storage has soft delete enabled for blobs in the container. The rule is NON_COMPLIANT if soft delete for blobs is not enabled.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_soft_delete_is_enabled" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A3.4.1.21", + "Description": "Checks if your Azure Blob Storage containers do not allow public read access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A3.4.1.22", + "Description": "Checks if your Azure Blob Storage containers do not allow public write access. The rule checks the Public Access Level settings, the container access policies, and the container-level role assignments.", + "Name": "Azure Storage", + "Checks": [ + "storage_blob_public_access_level_is_disabled" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A3.4.1.23", + "Description": "Checks if direct internet access is disabled for an Azure Machine Learning workspace notebook instance. The rule is NON_COMPLIANT if an Azure Machine Learning notebook instance is internet-enabled.", + "Name": "Azure Machine Learning", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Machine Learning" + } + ] + }, + { + "Id": "A3.4.1.24", + "Description": "Checks if Azure Key Vault secrets have been accessed within a specified number of days. The rule is NON_COMPLIANT if a secret has not been accessed in unusedForDays number of days. The default value is 90 days.", + "Name": "Azure Key Vault", + "Checks": [ + "keyvault_non_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Key Vault" + } + ] + }, + { + "Id": "A3.4.1.25", + "Description": "Checks if Azure Automation runbooks owned by the account are public. The rule is NON_COMPLIANT if Azure Automation runbooks with the owner set to Self are public.", + "Name": "Azure Automations", + "Checks": [], + "Attributes": [ + { + "Section": "A3.4.1: Logical access to the cardholder data environment is controlled and managed. ", + "Service": "Azure Automations" + } + ] + }, + { + "Id": "A3.5.1.1", + "Description": "Checks if Azure API Management (APIM) services have Azure Monitor Application Insights (AI) tracing enabled. The rule is COMPLIANT if Application Insights integration is enabled for API requests, and NON_COMPLIANT otherwise.", + "Name": "Azure API Management", + "Checks": [ + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "Azure API Management" + } + ] + }, + { + "Id": "A3.5.1.2", + "Description": "Checks if your Azure Resource Manager (ARM) templates send event notifications to an Azure Event Grid topic or Azure Service Bus. Optionally checks if specified Event Grid topics or Service Bus namespaces are used. The rule is NON_COMPLIANT if ARM templates do not send notifications.", + "Name": "Azure Resource Manager", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "Azure Resource Manager" + } + ] + }, + { + "Id": "A3.5.1.3", + "Description": "Checks if Azure Monitor Alerts have an action group configured for the Activated, Resolved, or No Data state. Optionally checks if any actions match a specified Azure Resource Manager (ARM) ID. The rule is NON_COMPLIANT if no action group is specified for the alert or optional parameter.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_nsg" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A3.5.1.4", + "Description": "Checks if a resource type has an Azure Monitor metric alert configured for the specified metric. For resource type, you can specify Azure Managed Disks, Virtual Machines, Azure SQL Databases, or Storage Accounts. The rule is COMPLIANT if the specified metric has an associated resource ID and an active Azure Monitor alert.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_alert_create_update_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A3.5.1.5", + "Description": "Checks whether Azure Monitor alerts with the given metric name have the specified settings.", + "Name": "Azure Monitor", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A3.5.1.6", + "Description": "Checks if Azure Monitor Diagnostic settings are configured to send logs to Log Analytics workspace. The rule is NON_COMPLIANT if no diagnostic settings are configured to send logs to Log Analytics.", + "Name": "Azure Monitor", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "Azure Monitor" + } + ] + }, + { + "Id": "A3.5.1.7", + "Description": "Checks if Azure Virtual Machines have diagnostic settings configured to enable detailed monitoring. The rule is NON_COMPLIANT if diagnostic settings are not enabled to capture detailed performance metrics.", + "Name": "Azure Virtual Machines", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "Azure Virtual Machines" + } + ] + }, + { + "Id": "A3.5.1.8", + "Description": "Checks if Azure Storage Event Grid notifications are enabled on an Azure Storage account. The rule is NON_COMPLIANT if Event Grid notifications are not set on a storage account, or if the event type or destination do not match the specified parameters.", + "Name": "Azure Storage", + "Checks": [ + "storage_ensure_azure_services_are_trusted_to_access_is_enabled" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "Azure Storage" + } + ] + }, + { + "Id": "A3.5.1.9", + "Description": "Checks if Azure Security Center is enabled for an Azure subscription. The rule is NON_COMPLIANT if Azure Security Center is not enabled.", + "Name": "Azure Security Center", + "Checks": [ + "policy_ensure_asc_enforcement_enabled" + ], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "Azure Security Center" + } + ] + }, + { + "Id": "A3.5.1.10", + "Description": "Checks if Azure Service Bus logging is enabled for the delivery status of messages sent to a queue or topic for the endpoints. The rule is NON_COMPLIANT if the delivery status notification for messages is not enabled.", + "Name": "Azure Service Bus", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "Azure Service Bus" + } + ] + }, + { + "Id": "A3.5.1.11", + "Description": "Checks if Azure Web Application Firewall (WAF) security metrics collection on rule groups is enabled. The rule is NON_COMPLIANT if the VisibilityConfig.CloudWatchMetricsEnabled equivalent field is set to false.", + "Name": "Azure Network", + "Checks": [], + "Attributes": [ + { + "Section": "A3.5.1: Suspicious events are identified and responded to. ", + "Service": "Azure Network" + } + ] + } + ] +}