ben.carrasco/prowler
1
0 Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-11-08 12:24:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(defender): extract Defender resource metadata in automated way (#6538)

Browse Source
This commit is contained in:
Rubén De la Torre Vico authored and GitHub committed 2025-01-15 12:14:24 -05:00
1 parent 6b3b6ca45e
commit 9e7104fb7f
32 files changed
+317 -229
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/providers/azure/services/defender/defender_additional_email_configured_with_a_security_contact/defender_additional_email_configured_with_a_security_contact_test.py
+12 -6
View File
@@ -33,8 +33,9 @@ class Test_defender_additional_email_configured_with_a_security_contact:
defender_client = mock.MagicMock
defender_client.security_contacts = {
AZURE_SUBSCRIPTION_ID: {
"default": SecurityContacts(
resource_id: SecurityContacts(
resource_id=resource_id,
name="default",
emails="",
phone="",
alert_notifications_minimal_severity="High",
@@ -73,8 +74,9 @@ class Test_defender_additional_email_configured_with_a_security_contact:
defender_client = mock.MagicMock
defender_client.security_contacts = {
AZURE_SUBSCRIPTION_ID: {
"default": SecurityContacts(
resource_id: SecurityContacts(
resource_id=resource_id,
name="default",
emails="bad_email",
phone="",
alert_notifications_minimal_severity="High",
@@ -113,8 +115,9 @@ class Test_defender_additional_email_configured_with_a_security_contact:
defender_client = mock.MagicMock
defender_client.security_contacts = {
AZURE_SUBSCRIPTION_ID: {
"default": SecurityContacts(
resource_id: SecurityContacts(
resource_id=resource_id,
name="default",
emails="test@test.es, test@test.email.com",
phone="",
alert_notifications_minimal_severity="High",
@@ -153,8 +156,9 @@ class Test_defender_additional_email_configured_with_a_security_contact:
defender_client = mock.MagicMock
defender_client.security_contacts = {
AZURE_SUBSCRIPTION_ID: {
"default": SecurityContacts(
resource_id: SecurityContacts(
resource_id=resource_id,
name="default",
emails="test@test.com",
phone="",
alert_notifications_minimal_severity="High",
@@ -193,8 +197,9 @@ class Test_defender_additional_email_configured_with_a_security_contact:
defender_client = mock.MagicMock
defender_client.security_contacts = {
AZURE_SUBSCRIPTION_ID: {
"default": SecurityContacts(
resource_id: SecurityContacts(
resource_id=resource_id,
name="default",
emails="test@test.mail.es; bad_mail",
phone="",
alert_notifications_minimal_severity="High",
@@ -232,8 +237,9 @@ class Test_defender_additional_email_configured_with_a_security_contact:
defender_client = mock.MagicMock
defender_client.security_contacts = {
AZURE_SUBSCRIPTION_ID: {
"default": SecurityContacts(
f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Security/securityContacts/default": SecurityContacts(
resource_id=f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Security/securityContacts/default",
name="default",
emails="",
phone="",
alert_notifications_minimal_severity="",
tests/providers/azure/services/defender/defender_ensure_iot_hub_defender_is_on/defender_ensure_iot_hub_defender_is_on_test.py
+57 -38
View File
@@ -15,12 +15,15 @@ class Test_defender_ensure_iot_hub_defender_is_on:
defender_client = mock.MagicMock
defender_client.iot_security_solutions = {}
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
), mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on.defender_client",
new=defender_client,
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on.defender_client",
new=defender_client,
),
):
from prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on import (
defender_ensure_iot_hub_defender_is_on,
@@ -34,12 +37,15 @@ class Test_defender_ensure_iot_hub_defender_is_on:
defender_client = mock.MagicMock
defender_client.iot_security_solutions = {AZURE_SUBSCRIPTION_ID: {}}
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
), mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on.defender_client",
new=defender_client,
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on.defender_client",
new=defender_client,
),
):
from prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on import (
defender_ensure_iot_hub_defender_is_on,
@@ -61,18 +67,21 @@ class Test_defender_ensure_iot_hub_defender_is_on:
defender_client = mock.MagicMock
defender_client.iot_security_solutions = {
AZURE_SUBSCRIPTION_ID: {
"iot_sec_solution": IoTSecuritySolution(
resource_id=resource_id, status="Disabled"
resource_id: IoTSecuritySolution(
resource_id=resource_id, name="iot_sec_solution", status="Disabled"
)
}
}
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
), mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on.defender_client",
new=defender_client,
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on.defender_client",
new=defender_client,
),
):
from prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on import (
defender_ensure_iot_hub_defender_is_on,
@@ -94,18 +103,21 @@ class Test_defender_ensure_iot_hub_defender_is_on:
defender_client = mock.MagicMock
defender_client.iot_security_solutions = {
AZURE_SUBSCRIPTION_ID: {
"iot_sec_solution": IoTSecuritySolution(
resource_id=resource_id, status="Enabled"
resource_id: IoTSecuritySolution(
resource_id=resource_id, name="iot_sec_solution", status="Enabled"
)
}
}
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
), mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on.defender_client",
new=defender_client,
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on.defender_client",
new=defender_client,
),
):
from prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on import (
defender_ensure_iot_hub_defender_is_on,
@@ -129,21 +141,28 @@ class Test_defender_ensure_iot_hub_defender_is_on:
defender_client = mock.MagicMock
defender_client.iot_security_solutions = {
AZURE_SUBSCRIPTION_ID: {
"iot_sec_solution_enabled": IoTSecuritySolution(
resource_id=resource_id_enabled, status="Enabled"
resource_id_enabled: IoTSecuritySolution(
resource_id=resource_id_enabled,
name="iot_sec_solution_enabled",
status="Enabled",
),
"iot_sec_solution_disabled": IoTSecuritySolution(
resource_id=resource_id_disabled, status="Disabled"
resource_id_disabled: IoTSecuritySolution(
resource_id=resource_id_disabled,
name="iot_sec_solution_disabled",
status="Disabled",
),
}
}
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
), mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on.defender_client",
new=defender_client,
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on.defender_client",
new=defender_client,
),
):
from prowler.providers.azure.services.defender.defender_ensure_iot_hub_defender_is_on.defender_ensure_iot_hub_defender_is_on import (
defender_ensure_iot_hub_defender_is_on,
tests/providers/azure/services/defender/defender_ensure_mcas_is_enabled/defender_ensure_mcas_is_enabled_test.py
+1 -1
View File
@@ -59,7 +59,7 @@ class Test_defender_ensure_mcas_is_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Microsoft Defender for Cloud Apps is disabeld for subscription {AZURE_SUBSCRIPTION_ID}."
== f"Microsoft Defender for Cloud Apps is disabled for subscription {AZURE_SUBSCRIPTION_ID}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "MCAS"
tests/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high_test.py
+42 -27
View File
@@ -13,12 +13,15 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
defender_client = mock.MagicMock
defender_client.security_contacts = {}
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
), mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_notify_alerts_severity_is_high.defender_ensure_notify_alerts_severity_is_high.defender_client",
new=defender_client,
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_notify_alerts_severity_is_high.defender_ensure_notify_alerts_severity_is_high.defender_client",
new=defender_client,
),
):
from prowler.providers.azure.services.defender.defender_ensure_notify_alerts_severity_is_high.defender_ensure_notify_alerts_severity_is_high import (
defender_ensure_notify_alerts_severity_is_high,
@@ -33,8 +36,9 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
defender_client = mock.MagicMock
defender_client.security_contacts = {
AZURE_SUBSCRIPTION_ID: {
"default": SecurityContacts(
resource_id: SecurityContacts(
resource_id=resource_id,
name="default",
emails="",
phone="",
alert_notifications_minimal_severity="Low",
@@ -45,12 +49,15 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
}
}
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
), mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_notify_alerts_severity_is_high.defender_ensure_notify_alerts_severity_is_high.defender_client",
new=defender_client,
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_notify_alerts_severity_is_high.defender_ensure_notify_alerts_severity_is_high.defender_client",
new=defender_client,
),
):
from prowler.providers.azure.services.defender.defender_ensure_notify_alerts_severity_is_high.defender_ensure_notify_alerts_severity_is_high import (
defender_ensure_notify_alerts_severity_is_high,
@@ -73,8 +80,9 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
defender_client = mock.MagicMock
defender_client.security_contacts = {
AZURE_SUBSCRIPTION_ID: {
"default": SecurityContacts(
resource_id: SecurityContacts(
resource_id=resource_id,
name="default",
emails="",
phone="",
alert_notifications_minimal_severity="High",
@@ -85,12 +93,15 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
}
}
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
), mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_notify_alerts_severity_is_high.defender_ensure_notify_alerts_severity_is_high.defender_client",
new=defender_client,
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_notify_alerts_severity_is_high.defender_ensure_notify_alerts_severity_is_high.defender_client",
new=defender_client,
),
):
from prowler.providers.azure.services.defender.defender_ensure_notify_alerts_severity_is_high.defender_ensure_notify_alerts_severity_is_high import (
defender_ensure_notify_alerts_severity_is_high,
@@ -112,8 +123,9 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
defender_client = mock.MagicMock
defender_client.security_contacts = {
AZURE_SUBSCRIPTION_ID: {
"default": SecurityContacts(
f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Security/securityContacts/default": SecurityContacts(
resource_id=f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Security/securityContacts/default",
name="default",
emails="",
phone="",
alert_notifications_minimal_severity="",
@@ -124,12 +136,15 @@ class Test_defender_ensure_notify_alerts_severity_is_high:
}
}
with mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
), mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_notify_alerts_severity_is_high.defender_ensure_notify_alerts_severity_is_high.defender_client",
new=defender_client,
with (
mock.patch(
"prowler.providers.common.provider.Provider.get_global_provider",
return_value=set_mocked_azure_provider(),
),
mock.patch(
"prowler.providers.azure.services.defender.defender_ensure_notify_alerts_severity_is_high.defender_ensure_notify_alerts_severity_is_high.defender_client",
new=defender_client,
),
):
from prowler.providers.azure.services.defender.defender_ensure_notify_alerts_severity_is_high.defender_ensure_notify_alerts_severity_is_high import (
defender_ensure_notify_alerts_severity_is_high,
tests/providers/azure/services/defender/defender_ensure_notify_emails_to_owners/defender_ensure_notify_emails_to_owners_test.py
+8 -4
View File
@@ -33,8 +33,9 @@ class Test_defender_ensure_notify_emails_to_owners:
defender_client = mock.MagicMock
defender_client.security_contacts = {
AZURE_SUBSCRIPTION_ID: {
"default": SecurityContacts(
resource_id: SecurityContacts(
resource_id=resource_id,
name="default",
emails="",
phone="",
alert_notifications_minimal_severity="High",
@@ -73,8 +74,9 @@ class Test_defender_ensure_notify_emails_to_owners:
defender_client = mock.MagicMock
defender_client.security_contacts = {
AZURE_SUBSCRIPTION_ID: {
"default": SecurityContacts(
resource_id: SecurityContacts(
resource_id=resource_id,
name="default",
emails="",
phone="",
alert_notifications_minimal_severity="High",
@@ -113,8 +115,9 @@ class Test_defender_ensure_notify_emails_to_owners:
defender_client = mock.MagicMock
defender_client.security_contacts = {
AZURE_SUBSCRIPTION_ID: {
"default": SecurityContacts(
resource_id: SecurityContacts(
resource_id=resource_id,
name="default",
emails="test@test.es",
phone="",
alert_notifications_minimal_severity="High",
@@ -152,8 +155,9 @@ class Test_defender_ensure_notify_emails_to_owners:
defender_client = mock.MagicMock
defender_client.security_contacts = {
AZURE_SUBSCRIPTION_ID: {
"default": SecurityContacts(
f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Security/securityContacts/default": SecurityContacts(
resource_id=f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/providers/Microsoft.Security/securityContacts/default",
name="default",
emails="",
phone="",
alert_notifications_minimal_severity="",
tests/providers/azure/services/defender/defender_ensure_wdatp_is_enabled/defender_ensure_wdatp_is_enabled_test.py
+1 -1
View File
@@ -59,7 +59,7 @@ class Test_defender_ensure_wdatp_is_enabled:
assert result[0].status == "FAIL"
assert (
result[0].status_extended
== f"Microsoft Defender for Endpoint integration is disabeld for subscription {AZURE_SUBSCRIPTION_ID}."
== f"Microsoft Defender for Endpoint integration is disabled for subscription {AZURE_SUBSCRIPTION_ID}."
)
assert result[0].subscription == AZURE_SUBSCRIPTION_ID
assert result[0].resource_name == "WDATP"
tests/providers/azure/services/defender/defender_service_test.py
+31 -11
View File
@@ -57,8 +57,9 @@ def mock_defender_get_assessments(_):
def mock_defender_get_security_contacts(_):
return {
AZURE_SUBSCRIPTION_ID: {
"default": SecurityContacts(
"/subscriptions/resource_id": SecurityContacts(
resource_id="/subscriptions/resource_id",
name="default",
emails="user@user.com, test@test.es",
phone="666666666",
alert_notifications_minimal_severity="High",
@@ -86,8 +87,9 @@ def mock_defender_get_settings(_):
def mock_defender_get_iot_security_solutions(_):
return {
AZURE_SUBSCRIPTION_ID: {
"iot_sec_solution": IoTSecuritySolution(
"/subscriptions/resource_id": IoTSecuritySolution(
resource_id="/subscriptions/resource_id",
name="iot_sec_solution",
status="Enabled",
)
}
@@ -211,35 +213,47 @@ class Test_Defender_Service:
defender = Defender(set_mocked_azure_provider())
assert len(defender.security_contacts) == 1
assert (
defender.security_contacts[AZURE_SUBSCRIPTION_ID]["default"].resource_id
defender.security_contacts[AZURE_SUBSCRIPTION_ID][
"/subscriptions/resource_id"
].resource_id
== "/subscriptions/resource_id"
)
assert (
defender.security_contacts[AZURE_SUBSCRIPTION_ID]["default"].emails
defender.security_contacts[AZURE_SUBSCRIPTION_ID][
"/subscriptions/resource_id"
].name
== "default"
)
assert (
defender.security_contacts[AZURE_SUBSCRIPTION_ID][
"/subscriptions/resource_id"
].emails
== "user@user.com, test@test.es"
)
assert (
defender.security_contacts[AZURE_SUBSCRIPTION_ID]["default"].phone
defender.security_contacts[AZURE_SUBSCRIPTION_ID][
"/subscriptions/resource_id"
].phone
== "666666666"
)
assert (
defender.security_contacts[AZURE_SUBSCRIPTION_ID][
"default"
"/subscriptions/resource_id"
].alert_notifications_minimal_severity
== "High"
)
assert (
defender.security_contacts[AZURE_SUBSCRIPTION_ID][
"default"
"/subscriptions/resource_id"
].alert_notifications_state
== "On"
)
assert defender.security_contacts[AZURE_SUBSCRIPTION_ID][
"default"
"/subscriptions/resource_id"
].notified_roles == ["Owner", "Contributor"]
assert (
defender.security_contacts[AZURE_SUBSCRIPTION_ID][
"default"
"/subscriptions/resource_id"
].notified_roles_state
== "On"
)
@@ -249,13 +263,19 @@ class Test_Defender_Service:
assert len(defender.iot_security_solutions) == 1
assert (
defender.iot_security_solutions[AZURE_SUBSCRIPTION_ID][
"iot_sec_solution"
"/subscriptions/resource_id"
].resource_id
== "/subscriptions/resource_id"
)
assert (
defender.iot_security_solutions[AZURE_SUBSCRIPTION_ID][
"iot_sec_solution"
"/subscriptions/resource_id"
].name
== "iot_sec_solution"
)
assert (
defender.iot_security_solutions[AZURE_SUBSCRIPTION_ID][
"/subscriptions/resource_id"
].status
== "Enabled"
)