diff --git a/ui/lib/lighthouse/helperChecks.ts b/ui/lib/lighthouse/helperChecks.ts index b7c7720869..fd2a7db5d6 100644 --- a/ui/lib/lighthouse/helperChecks.ts +++ b/ui/lib/lighthouse/helperChecks.ts @@ -6,6 +6,7 @@ const checksByProvider = async (provider_type: string) => { "accessanalyzer_enabled", "accessanalyzer_enabled_without_findings", "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", "account_security_contact_information_is_registered", "account_security_questions_are_registered_in_the_aws_account", "acm_certificates_expiration_check", @@ -98,6 +99,8 @@ const checksByProvider = async (provider_type: string) => { "cloudwatch_log_group_no_secrets_in_logs", "cloudwatch_log_group_not_publicly_accessible", "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", "cloudwatch_log_metric_filter_authentication_failures", "cloudwatch_log_metric_filter_aws_organizations_changes", "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", @@ -221,12 +224,15 @@ const checksByProvider = async (provider_type: string) => { "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", "ec2_securitygroup_allow_wide_open_public_ipv4", "ec2_securitygroup_default_restrict_traffic", @@ -635,11 +641,14 @@ const checksByProvider = async (provider_type: string) => { "iam_sa_no_administrative_privileges", "iam_sa_no_user_managed_keys", "iam_sa_user_managed_key_rotate_90_days", + "iam_sa_user_managed_key_unused", "kms_key_not_publicly_accessible", "kms_key_rotation_enabled", + "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled", "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled", "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled", "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled", + "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled", "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled", "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled", "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled", @@ -879,7 +888,29 @@ const checksByProvider = async (provider_type: string) => { "admincenter_settings_password_never_expire", "admincenter_users_admins_reduced_license_footprint", "admincenter_users_between_two_and_four_global_admins", + "entra_admin_consent_workflow_enabled", + "entra_admin_portals_access_restriction", + "entra_admin_users_cloud_only", + "entra_admin_users_mfa_enabled", + "entra_admin_users_phishing_resistant_mfa_enabled", + "entra_admin_users_sign_in_frequency_enabled", + "entra_dynamic_group_for_guests_created", + "entra_identity_protection_sign_in_risk_enabled", + "entra_identity_protection_user_risk_enabled", + "entra_legacy_authentication_blocked", + "entra_managed_device_required_for_authentication", + "entra_managed_device_required_for_mfa_registration", + "entra_password_hash_sync_enabled", + "entra_policy_ensure_default_user_cannot_create_tenants", + "entra_policy_guest_invite_only_for_admin_roles", + "entra_policy_guest_users_access_restrictions", + "entra_policy_restricts_user_consent_for_apps", "entra_thirdparty_integrated_apps_not_allowed", + "entra_users_mfa_enabled", + "sharepoint_external_sharing_managed", + "sharepoint_external_sharing_restricted", + "sharepoint_guest_sharing_restricted", + "sharepoint_modern_authentication_required", ], }; diff --git a/ui/lib/lighthouse/helperComplianceFrameworks.ts b/ui/lib/lighthouse/helperComplianceFrameworks.ts index 3d4658eddd..26b8c1f09a 100644 --- a/ui/lib/lighthouse/helperComplianceFrameworks.ts +++ b/ui/lib/lighthouse/helperComplianceFrameworks.ts @@ -10,19 +10,21 @@ export const complianceFrameworksByProvider = async (provider_type: string) => { "aws_well_architected_framework_reliability_pillar_aws", "aws_well_architected_framework_security_pillar_aws", "cis_1.4_aws", - "cis_3.0_aws", "cis_1.5_aws", "cis_2.0_aws", + "cis_3.0_aws", + "cis_4.0_aws", "cisa_aws", "ens_rd2022_aws", - "ffiec_aws", "fedramp_low_revision_4_aws", "fedramp_moderate_revision_4_aws", + "ffiec_aws", "gdpr_aws", "gxp_21_cfr_part_11_aws", "gxp_eu_annex_11_aws", "hipaa_aws", "iso27001_2013_aws", + "iso27001_2022_aws", "kisa_isms_p_2023_aws", "kisa_isms_p_2023_korean_aws", "mitre_attack_aws", @@ -31,6 +33,7 @@ export const complianceFrameworksByProvider = async (provider_type: string) => { "nist_800_53_revision_5_aws", "nist_csf_1.1_aws", "pci_3.2.1_aws", + "pci_4.0_aws", "rbi_cyber_security_framework_aws", "soc2_aws", ], @@ -39,11 +42,27 @@ export const complianceFrameworksByProvider = async (provider_type: string) => { "cis_2.1_azure", "cis_3.0_azure", "ens_rd2022_azure", + "iso27001_2022_azure", "mitre_attack_azure", + "pci_4.0_azure", + "soc2_azure", ], - gcp: ["cis_2.0_gcp", "cis_3.0_gcp", "ens_rd2022_gcp", "mitre_attack_gcp"], - kubernetes: ["cis_1.10_kubernetes", "cis_1.8_kubernetes"], - microsoft365: [], + gcp: [ + "cis_2.0_gcp", + "cis_3.0_gcp", + "ens_rd2022_gcp", + "iso27001_2022_gcp", + "mitre_attack_gcp", + "pci_4.0_gcp", + "soc2_gcp", + ], + kubernetes: [ + "cis_1.10_kubernetes", + "cis_1.8_kubernetes", + "iso27001_2022_kubernetes", + "pci_4.0_kubernetes", + ], + microsoft365: ["cis_4.0_microsoft365"], }; return complianceFrameworks[provider_type as ProviderType] || []; };