diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 9b01c2b8a7..f73657a018 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -23,6 +23,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Ensure `is_service_role` only returns `True` for service roles [(#8274)](https://github.com/prowler-cloud/prowler/pull/8274) - Update DynamoDB check metadata to fix broken link [(#8273)](https://github.com/prowler-cloud/prowler/pull/8273) - Show correct count of findings in Dashboard Security Posture page [(#8270)](https://github.com/prowler-cloud/prowler/pull/8270) +- Use subscription ID in Azure mutelist [(#8290)](https://github.com/prowler-cloud/prowler/pull/8290) - `ServiceName` field in Network Firewall checks metadata [(#8280)](https://github.com/prowler-cloud/prowler/pull/8280) - Update `entra_users_mfa_capable` check to use the correct resource name and ID [(#8288)](https://github.com/prowler-cloud/prowler/pull/8288) diff --git a/prowler/lib/check/check.py b/prowler/lib/check/check.py index bce9db8378..088df6af51 100644 --- a/prowler/lib/check/check.py +++ b/prowler/lib/check/check.py @@ -636,6 +636,10 @@ def execute( global_provider.identity.account_name ) for finding in check_findings: + if global_provider.type == "azure": + is_finding_muted_args["subscription_id"] = ( + global_provider.identity.subscriptions.get(finding.subscription) + ) is_finding_muted_args["finding"] = finding finding.muted = global_provider.mutelist.is_finding_muted( **is_finding_muted_args diff --git a/prowler/providers/azure/lib/mutelist/mutelist.py b/prowler/providers/azure/lib/mutelist/mutelist.py index 159a3cbb77..90ad609a1a 100644 --- a/prowler/providers/azure/lib/mutelist/mutelist.py +++ b/prowler/providers/azure/lib/mutelist/mutelist.py @@ -7,9 +7,16 @@ class AzureMutelist(Mutelist): def is_finding_muted( self, finding: Check_Report_Azure, + subscription_id: str, ) -> bool: return self.is_muted( - finding.subscription, + subscription_id, # support Azure Subscription ID in mutelist + finding.check_metadata.CheckID, + finding.location, + finding.resource_name, + unroll_dict(unroll_tags(finding.resource_tags)), + ) or self.is_muted( + finding.subscription, # support Azure Subscription Name in mutelist finding.check_metadata.CheckID, finding.location, finding.resource_name, diff --git a/tests/providers/azure/lib/mutelist/azure_mutelist_test.py b/tests/providers/azure/lib/mutelist/azure_mutelist_test.py index 83a981cbd2..257f20e2ab 100644 --- a/tests/providers/azure/lib/mutelist/azure_mutelist_test.py +++ b/tests/providers/azure/lib/mutelist/azure_mutelist_test.py @@ -40,7 +40,7 @@ class TestAzureMutelist: assert mutelist.mutelist == {} assert mutelist.mutelist_file_path is None - def test_is_finding_muted(self): + def test_is_finding_muted_subscription_name(self): # Mutelist mutelist_content = { "Accounts": { @@ -66,7 +66,39 @@ class TestAzureMutelist: finding.resource_tags = {} finding.subscription = "subscription_1" - assert mutelist.is_finding_muted(finding) + assert mutelist.is_finding_muted( + finding, "12345678-1234-1234-1234-123456789012" + ) + + def test_is_finding_muted_subscription_id(self): + # Mutelist + mutelist_content = { + "Accounts": { + "12345678-1234-1234-1234-123456789012": { + "Checks": { + "check_test": { + "Regions": ["*"], + "Resources": ["test_resource"], + } + } + } + } + } + + mutelist = AzureMutelist(mutelist_content=mutelist_content) + + finding = MagicMock + finding.check_metadata = MagicMock + finding.check_metadata.CheckID = "check_test" + finding.location = "West Europe" + finding.status = "FAIL" + finding.resource_name = "test_resource" + finding.resource_tags = {} + finding.subscription = "subscription_1" + + assert mutelist.is_finding_muted( + finding, "12345678-1234-1234-1234-123456789012" + ) def test_mute_finding(self): # Mutelist