diff --git a/README.md b/README.md index 0fbf555e26..8702e8f675 100644 --- a/README.md +++ b/README.md @@ -86,12 +86,12 @@ prowler dashboard | Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/compliance/) | [Categories](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/misc/#categories) | |---|---|---|---|---| -| AWS | 564 | 82 | 35 | 10 | +| AWS | 567 | 82 | 36 | 10 | | GCP | 79 | 13 | 9 | 3 | -| Azure | 140 | 18 | 8 | 3 | +| Azure | 142 | 18 | 10 | 3 | | Kubernetes | 83 | 7 | 5 | 7 | -| GitHub | 3 | 2 | 1 | 0 | -| M365 | 44 | 2 | 2 | 0 | +| GitHub | 16 | 2 | 1 | 0 | +| M365 | 69 | 7 | 2 | 2 | | NHN (Unofficial) | 6 | 2 | 1 | 0 | > [!Note] diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index f49253fb45..6459e17086 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -16,6 +16,7 @@ All notable changes to the **Prowler API** are documented in this file. ### Fixed - Fixed task lookup to use task_kwargs instead of task_args for scan report resolution. [(#7830)](https://github.com/prowler-cloud/prowler/pull/7830) +- Fixed Kubernetes UID validation to allow valid context names [(#7871)](https://github.com/prowler-cloud/prowler/pull/7871) --- diff --git a/api/src/backend/api/models.py b/api/src/backend/api/models.py index 28b0845a3a..2b4fec00cf 100644 --- a/api/src/backend/api/models.py +++ b/api/src/backend/api/models.py @@ -242,7 +242,7 @@ class Provider(RowLevelSecurityProtectedModel): @staticmethod def validate_kubernetes_uid(value): if not re.match( - r"^[a-z0-9][A-Za-z0-9_.:\/-]{1,250}$", + r"^[a-zA-Z0-9][a-zA-Z0-9._@:\/-]{1,250}$", value, ): raise ModelValidationError( diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py index f6c2c56c38..ac6c6b51a6 100644 --- a/api/src/backend/api/tests/test_views.py +++ b/api/src/backend/api/tests/test_views.py @@ -914,6 +914,16 @@ class TestProviderViewSet: "uid": "gke_aaaa-dev_europe-test1_dev-aaaa-test-cluster-long-name-123456789", "alias": "GKE", }, + { + "provider": "kubernetes", + "uid": "gke_project/cluster-name", + "alias": "GKE", + }, + { + "provider": "kubernetes", + "uid": "admin@k8s-demo", + "alias": "test", + }, { "provider": "azure", "uid": "8851db6b-42e5-4533-aa9e-30a32d67e875", @@ -921,7 +931,7 @@ class TestProviderViewSet: }, { "provider": "m365", - "uid": "TestingPro.onMirosoft.com", + "uid": "TestingPro.onmicrosoft.com", "alias": "test", }, { diff --git a/dashboard/compliance/nis2_azure.py b/dashboard/compliance/nis2_azure.py new file mode 100644 index 0000000000..8baac9a9a5 --- /dev/null +++ b/dashboard/compliance/nis2_azure.py @@ -0,0 +1,43 @@ +import warnings + +from dashboard.common_methods import get_section_containers_3_levels + +warnings.filterwarnings("ignore") + + +def get_table(data): + data["REQUIREMENTS_DESCRIPTION"] = ( + data["REQUIREMENTS_ID"] + " - " + data["REQUIREMENTS_DESCRIPTION"] + ) + + data["REQUIREMENTS_DESCRIPTION"] = data["REQUIREMENTS_DESCRIPTION"].apply( + lambda x: x[:150] + "..." if len(str(x)) > 150 else x + ) + + data["REQUIREMENTS_ATTRIBUTES_SECTION"] = data[ + "REQUIREMENTS_ATTRIBUTES_SECTION" + ].apply(lambda x: x[:80] + "..." if len(str(x)) > 80 else x) + + data["REQUIREMENTS_ATTRIBUTES_SUBSECTION"] = data[ + "REQUIREMENTS_ATTRIBUTES_SUBSECTION" + ].apply(lambda x: x[:150] + "..." if len(str(x)) > 150 else x) + + aux = data[ + [ + "REQUIREMENTS_DESCRIPTION", + "REQUIREMENTS_ATTRIBUTES_SECTION", + "REQUIREMENTS_ATTRIBUTES_SUBSECTION", + "CHECKID", + "STATUS", + "REGION", + "ACCOUNTID", + "RESOURCEID", + ] + ] + + return get_section_containers_3_levels( + aux, + "REQUIREMENTS_ATTRIBUTES_SECTION", + "REQUIREMENTS_ATTRIBUTES_SUBSECTION", + "REQUIREMENTS_DESCRIPTION", + ) diff --git a/dashboard/lib/layouts.py b/dashboard/lib/layouts.py index f1b4408c38..144036f183 100644 --- a/dashboard/lib/layouts.py +++ b/dashboard/lib/layouts.py @@ -90,12 +90,28 @@ def create_layout_overview( ), html.Div( [ - ( - html.Label( - "Table Rows:", - className="text-prowler-stone-900 font-bold text-sm", - style={"margin-right": "10px"}, - ) + html.Label( + "Search:", + className="text-prowler-stone-900 font-bold text-sm", + style={"margin-right": "10px"}, + ), + dcc.Input( + id="search-input", + type="text", + placeholder="Search by check title, service, region...", + debounce=True, + style={ + "padding": "4px 8px", + "border": "1px solid #ccc", + "borderRadius": "4px", + "marginRight": "20px", + "width": "250px", + }, + ), + html.Label( + "Table Rows:", + className="text-prowler-stone-900 font-bold text-sm", + style={"margin-right": "10px"}, ), table_row_dropdown, download_button_csv, diff --git a/dashboard/pages/overview.py b/dashboard/pages/overview.py index 2688281af2..0901604ad9 100644 --- a/dashboard/pages/overview.py +++ b/dashboard/pages/overview.py @@ -518,6 +518,7 @@ else: Input("service-filter", "value"), Input("table-rows", "value"), Input("status-filter", "value"), + Input("search-input", "value"), Input("aws_card", "n_clicks"), Input("azure_card", "n_clicks"), Input("gcp_card", "n_clicks"), @@ -540,6 +541,7 @@ def filter_data( service_values, table_row_values, status_values, + search_value, aws_clicks, azure_clicks, gcp_clicks, @@ -1144,6 +1146,15 @@ def filter_data( } index_count = 0 + if search_value: + search_value = search_value.lower() + filtered_data = filtered_data[ + filtered_data["CHECK_TITLE"].str.lower().str.contains(search_value) + | filtered_data["SERVICE_NAME"].str.lower().str.contains(search_value) + | filtered_data["REGION"].str.lower().str.contains(search_value) + | filtered_data["STATUS"].str.lower().str.contains(search_value) + ] + full_filtered_data = filtered_data.copy() filtered_data = filtered_data.head(table_row_values) # Sort the filtered_data diff --git a/docs/getting-started/requirements.md b/docs/getting-started/requirements.md index ff506506e6..6e79f86bba 100644 --- a/docs/getting-started/requirements.md +++ b/docs/getting-started/requirements.md @@ -163,70 +163,24 @@ export AZURE_CLIENT_ID="XXXXXXXXX" export AZURE_CLIENT_SECRET="XXXXXXXXX" export AZURE_TENANT_ID="XXXXXXXXX" export M365_USER="your_email@example.com" -export M365_PASSWORD="6500780061006d0070006c006500700061007300730077006f0072006400" # replace this to yours +export M365_PASSWORD="examplepassword" ``` These two new environment variables are **required** to execute the PowerShell modules needed to retrieve information from M365 services. Prowler uses Service Principal authentication to access Microsoft Graph and user credentials to authenticate to Microsoft PowerShell modules. -- `M365_USER` should be your Microsoft account email using the default domain. This means it must look like `example@YourCompany.onmicrosoft.com`. +- `M365_USER` should be your Microsoft account email using the **assigned domain in the tenant**. This means it must look like `example@YourCompany.onmicrosoft.com` or `example@YourCompany.com`, but it must be the exact domain assigned to that user in the tenant. - To ensure that you are using the default domain you can see how to verify it [here](../tutorials/microsoft365/getting-started-m365.md#step-1-obtain-your-domain). + ???+ warning + Using a tenant domain other than the one assigned — even if it belongs to the same tenant — will cause Prowler to fail, as Microsoft authentication will not succeed. - If you don't have a user created with that domain, Prowler will not work as it will not be able to ensure both app an user belong to the same tenant. To proceed, you can either create a new user with that domain or modify the domain of an existing user. + Ensure you are using the right domain for the user you are trying to authenticate with. ![User Domains](../tutorials/microsoft365/img/user-domains.png) -- `M365_PASSWORD` must be an encrypted SecureString. To convert your password into a valid encrypted string, you need to use PowerShell. - - ???+ warning - Passwords encrypted using ConvertTo-SecureString can only be decrypted on the same OS/user context. If you generate an encrypted password on macOS or Linux (both UNIX), it should fail on Windows and vice versa. As Prowler Cloud runs on UNIX if you generate your password using Windows it won't work so you'll need to generate a new password using any UNIX distro (example above) - - If you are working from Windows and you will use your encrypted password in a different system (like for example executing Prowler in macOS or adding your password to Prowler Cloud), you will need to generate a "UNIX compatible" version of your encrypted password. This can be done using WSL which is so easy to install on Windows. - - === "UNIX" - - Open a PowerShell cmd with a [supported version](requirements.md#supported-powershell-versions) and then run the following command: - - ```console - $securePassword = ConvertTo-SecureString "examplepassword" -AsPlainText -Force - $encryptedPassword = $securePassword | ConvertFrom-SecureString - Write-Output $encryptedPassword - 6500780061006d0070006c006500700061007300730077006f0072006400 - ``` - - If everything is done correctly, you will see the encrypted string that you need to set as the `M365_PASSWORD` environment variable. - - === "Windows" - - - How to install WSL and PowerShell on it to generate that password (you can use a different distro but this one will work for sure): - - ```console - wsl --install -d Ubuntu-22.04 - ``` - - Then, open the Ubuntu terminal and run the following commands: - - ```console - sudo apt update && sudo apt install -y wget apt-transport-https software-properties-common - wget -q "https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/packages-microsoft-prod.deb" - sudo dpkg -i packages-microsoft-prod.deb - sudo apt update - sudo apt install -y powershell - pwsh - ``` - - With this done you will see now that a prompt running PowerShell with the latest version is open so here you will be able to generate your encrypted password: - - ```console - $securePassword = ConvertTo-SecureString "examplepassword" -AsPlainText -Force - $encryptedPassword = $securePassword | ConvertFrom-SecureString - Write-Output $encryptedPassword - 6500780061006d0070006c006500700061007300730077006f0072006400 - ``` - - If everything is done correctly, you will see the encrypted string that you need to set as the `M365_PASSWORD` environment variable. +- `M365_PASSWORD` must be the user password. + ???+ note + Before we asked for a encrypted password, but now we ask for the user password directly. Prowler will now handle the password encryption for you. ### Interactive Browser authentication @@ -248,7 +202,6 @@ Prowler for M365 requires two types of permission scopes to be set (if you want - `Directory.Read.All`: Required for all services. - `Policy.Read.All`: Required for all services. - `User.Read` (IMPORTANT: this must be set as **delegated**): Required for the sign-in. - - `Sites.Read.All`: Required for SharePoint service. - `SharePointTenantSettings.Read.All`: Required for SharePoint service. - `AuditLog.Read.All`: Required for Entra service. diff --git a/docs/img/m365-credentials.png b/docs/img/m365-credentials.png index 9c06343ce2..87191751a8 100644 Binary files a/docs/img/m365-credentials.png and b/docs/img/m365-credentials.png differ diff --git a/docs/tutorials/microsoft365/getting-started-m365.md b/docs/tutorials/microsoft365/getting-started-m365.md index bf9d6b0664..f94707d86b 100644 --- a/docs/tutorials/microsoft365/getting-started-m365.md +++ b/docs/tutorials/microsoft365/getting-started-m365.md @@ -4,9 +4,9 @@ Set up your M365 account to enable security scanning using Prowler Cloud/App. ## Requirements -To configure your M365 account, you’ll need: +To configure your M365 account, you'll need: -1. Obtain your `Default Domain` from the Entra ID portal. +1. Obtain a domain from the Entra ID portal. 2. Access Prowler Cloud/App and add a new cloud provider `Microsoft 365`. @@ -18,8 +18,6 @@ To configure your M365 account, you’ll need: 3.3 Assign the required roles to your user. - 3.4 Retrieve your encrypted password. - 4. Add the credentials to Prowler Cloud/App. ## Step 1: Obtain your Domain @@ -32,9 +30,7 @@ Go to the Entra ID portal, then you can search for `Domain` or go to Identity > ![Custom Domain Names](./img/custom-domain-names.png) -Once you are there just look for the `Default Domain` this should be something similar to `YourCompany.onmicrosoft.com`. To ensure that you are picking the correct domain just click on it and verify that the type is `Initial` and you can't delete it. - -![Search Default Domain](./img/search-default-domain.png) +Once you are there just select the domain you want to use. --- @@ -78,11 +74,11 @@ A Service Principal is required to grant Prowler the necessary privileges. ![New Registration](./img/new-registration.png) -4. Go to `Certificates & secrets` > `+ New client secret` +4. Go to `Certificates & secrets` > `Client secrets` > `+ New client secret` ![Certificate & Secrets nav](./img/certificates-and-secrets.png) -5. Fill in the required fields and click `Add`, then copy the generated value (that value will be `AZURE_CLIENT_SECRET`) +5. Fill in the required fields and click `Add`, then copy the generated `value` (that value will be `AZURE_CLIENT_SECRET`) ![New Client Secret](./img/new-client-secret.png) @@ -102,9 +98,9 @@ Assign the following Microsoft Graph permissions: - `Directory.Read.All`: Required for all services. - `Policy.Read.All`: Required for all services. -- `User.Read` (IMPORTANT: this is set as **delegated**): Required for the sign-in. -- `Sites.Read.All`: Required for SharePoint service. - `SharePointTenantSettings.Read.All`: Required for SharePoint service. +- `AuditLog.Read.All`: Required for Entra service. +- `User.Read` (IMPORTANT: this is set as **delegated**): Required for the sign-in. Follow these steps to assign the permissions: @@ -120,8 +116,8 @@ Follow these steps to assign the permissions: - `Directory.Read.All` - `Policy.Read.All` - - `Sites.Read.All` - `SharePointTenantSettings.Read.All` + - `AuditLog.Read.All`: Required for Entra service. ![Permission Screenshots](./img/directory-permission.png) @@ -174,25 +170,34 @@ Follow these steps to assign the role: --- -### Get your encrypted password - -For this step you will need to use PowerShell, here you will have to create your Encrypted Password based on the password of the User that you are going to use. For more information about how to generate this Password go [here](../../getting-started/requirements.md#service-principal-and-user-credentials-authentication-recommended) and follow the steps needed to obtain `M365_PASSWORD`. - ---- - ## Step 4: Add credentials to Prowler Cloud/App 1. Go to your App Registration overview and copy the `Client ID` and `Tenant ID` ![App Overview](./img/app-overview.png) +???+ warning + For Prowler Cloud encrypted password is still needed (when we update Prowler Cloud and regular password is accepted this warning will be deleted), so the password that you paste in the next step should be generated following this steps: + + - UNIX: Open a PowerShell cmd with a [supported version](../../getting-started/requirements.md#supported-powershell-versions) and then run the following command: + + ```console + $securePassword = ConvertTo-SecureString "examplepassword" -AsPlainText -Force + $encryptedPassword = $securePassword | ConvertFrom-SecureString + Write-Output $encryptedPassword + 6500780061006d0070006c006500700061007300730077006f0072006400 + ``` + + - Windows: Install WSL using `wsl --install -d Ubuntu-22.04`, then open the Ubuntu terminal, install powershell and run the same command above. + + 2. Go to Prowler Cloud/App and paste: - `Client ID` - `Tenant ID` - `AZURE_CLIENT_SECRET` from earlier - - `M365_USER` your user using the default domain, more info [here](../../getting-started/requirements.md#service-principal-and-user-credentials-authentication-recommended) - - `M365_PASSWORD` generated before + - `M365_USER` the user using the correct assigned domain, more info [here](../../getting-started/requirements.md#service-principal-and-user-credentials-authentication-recommended) + - `M365_PASSWORD` the password of the user ![Prowler Cloud M365 Credentials](./img/m365-credentials.png) diff --git a/docs/tutorials/microsoft365/img/m365-credentials.png b/docs/tutorials/microsoft365/img/m365-credentials.png index 9c06343ce2..87191751a8 100644 Binary files a/docs/tutorials/microsoft365/img/m365-credentials.png and b/docs/tutorials/microsoft365/img/m365-credentials.png differ diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 741a89f2aa..2f6de1ce04 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -20,11 +20,14 @@ All notable changes to the **Prowler SDK** are documented in this file. - Add `repository_secret_scanning_enabled` check for GitHub provider. [(#7759)](https://github.com/prowler-cloud/prowler/pull/7759) - Add `repository_default_branch_requires_codeowners_review` check for GitHub provider. [(#7753)](https://github.com/prowler-cloud/prowler/pull/7753) - Add NIS 2 compliance framework for AWS. [(7839)](https://github.com/prowler-cloud/prowler/pull/7839) +- Add NIS 2 compliance framework for Azure. [(7857)](https://github.com/prowler-cloud/prowler/pull/7857) +- Add search bar in Dashboard Overview page. [(#7804)](https://github.com/prowler-cloud/prowler/pull/7804) ### Fixed - Fix `m365_powershell test_credentials` to use sanitized credentials. [(#7761)](https://github.com/prowler-cloud/prowler/pull/7761) - Fix `admincenter_users_admins_reduced_license_footprint` check logic to pass when admin user has no license. [(#7779)](https://github.com/prowler-cloud/prowler/pull/7779) - Fix `m365_powershell` to close the PowerShell sessions in msgraph services. [(#7816)](https://github.com/prowler-cloud/prowler/pull/7816) +- Fix `defender_ensure_notify_alerts_severity_is_high`check to accept high or lower severity. [(#7862)](https://github.com/prowler-cloud/prowler/pull/7862) --- diff --git a/prowler/compliance/azure/nis2_azure.json b/prowler/compliance/azure/nis2_azure.json new file mode 100644 index 0000000000..d3a350bfc7 --- /dev/null +++ b/prowler/compliance/azure/nis2_azure.json @@ -0,0 +1,1898 @@ +{ + "Framework": "NIS2", + "Version": "", + "Provider": "Azure", + "Description": "ANNEX to the Commission Implementing Regulation laying down rules for the application of Directive (EU) 2022/2555 as regards technical and methodological requirements of cybersecurity risk-management measures and further specification of the cases in which an incident is considered to be significant with regard to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers", + "Requirements": [ + { + "Id": "1.1.1.a", + "Description": "set out the relevant entities approach to managing the security of their network and information systems;", + "Checks": [ + "storage_ensure_private_endpoints_in_storage_accounts" + ], + "Attributes": [ + { + "Section": "1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "1.1 Policy on the security of network and information systems", + "Service": "generic" + } + ] + }, + { + "Id": "1.1.1.c", + "Description": "set out network and information security objectives;", + "Checks": [ + "network_flow_log_more_than_90_days", + "network_http_internet_access_restricted", + "storage_ensure_private_endpoints_in_storage_accounts" + ], + "Attributes": [ + { + "Section": "1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "1.1 Policy on the security of network and information systems", + "Service": "generic" + } + ] + }, + { + "Id": "1.2.1", + "Description": "As part of their policy on the security of network and information systems referred to in point 1.1., the relevant entities shall lay down responsibilities and authorities for network and information system security and assign them to roles, allocate them according to the relevant entities needs, and communicate them to the management bodies.", + "Checks": [ + "aks_network_policy_enabled", + "network_http_internet_access_restricted", + "storage_default_network_access_rule_is_denied" + ], + "Attributes": [ + { + "Section": "1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "1.2 Roles, responsibilities and authorities", + "Service": "generic" + } + ] + }, + { + "Id": "1.2.4", + "Description": "Depending on the size of the relevant entities, network and information system security shall be covered by dedicated roles or duties carried out in addition to existing roles.", + "Checks": [ + "sqlserver_azuread_administrator_enabled", + "sqlserver_va_emails_notifications_admins_enabled" + ], + "Attributes": [ + { + "Section": "1 POLICY ON THE SECURITY OF NETWORK AND INFORMATION SYSTEMS (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "1.2 Roles, responsibilities and authorities", + "Service": "sqlserver" + } + ] + }, + { + "Id": "2.1.2.f", + "Description": "evaluate the identified risks based on the risk criteria;", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac", + "keyvault_rbac_key_expiration_set" + ], + "Attributes": [ + { + "Section": "2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "2.1 Risk management framework", + "Service": "keyvault" + } + ] + }, + { + "Id": "2.1.2.g", + "Description": "identify and prioritise appropriate risk treatment options and measures;", + "Checks": [ + "aisearch_service_not_publicly_accessible", + "aks_cluster_rbac_enabled", + "aks_clusters_created_with_private_nodes", + "aks_clusters_public_access_disabled", + "aks_network_policy_enabled", + "app_ensure_auth_is_set_up", + "app_ensure_http_is_redirected_to_https", + "app_function_access_keys_configured", + "app_function_application_insights_enabled", + "app_function_identity_is_configured", + "app_function_identity_without_admin_privileges", + "app_function_latest_runtime_version", + "app_function_not_publicly_accessible", + "app_function_vnet_integration_enabled", + "app_http_logs_enabled", + "app_minimum_tls_version_12", + "app_register_with_identity", + "containerregistry_admin_user_disabled", + "containerregistry_not_publicly_accessible", + "cosmosdb_account_firewall_use_selected_networks", + "cosmosdb_account_use_aad_and_rbac", + "cosmosdb_account_use_private_endpoints" + ], + "Attributes": [ + { + "Section": "2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "2.1 Risk management framework", + "Service": "generic" + } + ] + }, + { + "Id": "2.1.2.h", + "Description": "continuously monitor the implementation of the risk treatment measures;", + "Checks": [ + "app_http_logs_enabled", + "defender_auto_provisioning_log_analytics_agent_vms_on", + "keyvault_logging_enabled", + "monitor_storage_account_with_activity_logs_cmk_encrypted", + "monitor_storage_account_with_activity_logs_is_private", + "mysql_flexible_server_audit_log_connection_activated", + "mysql_flexible_server_audit_log_enabled", + "network_flow_log_captured_sent", + "network_flow_log_more_than_90_days", + "postgresql_flexible_server_log_checkpoints_on", + "postgresql_flexible_server_log_connections_on", + "postgresql_flexible_server_log_disconnections_on", + "postgresql_flexible_server_log_retention_days_greater_3" + ], + "Attributes": [ + { + "Section": "2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "2.1 Risk management framework", + "Service": "generic" + } + ] + }, + { + "Id": "2.1.2.i", + "Description": "identify who is responsible for implementing the risk treatment measures and when they should be implemented;", + "Checks": [ + "app_function_identity_is_configured", + "app_function_identity_without_admin_privileges", + "app_register_with_identity" + ], + "Attributes": [ + { + "Section": "2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "2.1 Risk management framework", + "Service": "app" + } + ] + }, + { + "Id": "2.2.1", + "Description": "The relevant entities shall regularly review the compliance with their policies on network and information system security, topic-specific policies, rules, and standards. The management bodies shall be informed of the status of network and information security on the basis of the compliance reviews by means of regular reporting.", + "Checks": [ + "sqlserver_va_scan_reports_configured", + "defender_container_images_scan_enabled", + "sqlserver_va_periodic_recurring_scans_enabled" + ], + "Attributes": [ + { + "Section": "2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "2.2 Compliance monitoring", + "Service": "generic" + } + ] + }, + { + "Id": "2.2.3", + "Description": "The relevant entities shall perform the compliance monitoring at planned intervals and when significant incidents or significant changes to operations or risks occur.", + "Checks": [ + "monitor_alert_create_policy_assignment", + "monitor_alert_create_update_nsg", + "monitor_alert_create_update_public_ip_address_rule", + "monitor_alert_create_update_security_solution", + "monitor_alert_create_update_sqlserver_fr", + "monitor_alert_delete_nsg", + "monitor_alert_delete_policy_assignment", + "monitor_alert_delete_public_ip_address_rule", + "monitor_alert_delete_security_solution", + "monitor_alert_delete_sqlserver_fr", + "monitor_diagnostic_setting_with_appropriate_categories", + "monitor_diagnostic_settings_exists" + ], + "Attributes": [ + { + "Section": "2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "2.2 Compliance monitoring", + "Service": "monitor" + } + ] + }, + { + "Id": "2.3.1", + "Description": "The relevant entities shall review independently their approach to managing network and information system security and its implementation including people, processes and technologies.", + "Checks": [ + "entra_global_admin_in_less_than_five_users", + "entra_policy_default_users_cannot_create_security_groups", + "entra_policy_ensure_default_user_cannot_create_apps", + "entra_policy_ensure_default_user_cannot_create_tenants", + "entra_policy_guest_invite_only_for_admin_roles", + "entra_policy_guest_users_access_restrictions", + "entra_policy_restricts_user_consent_for_apps", + "entra_policy_user_consent_for_verified_apps", + "entra_privileged_user_has_mfa", + "entra_security_defaults_enabled", + "entra_trusted_named_locations_exists", + "entra_user_with_vm_access_has_mfa", + "entra_users_cannot_create_microsoft_365_groups", + "aks_network_policy_enabled", + "network_bastion_host_exists", + "network_flow_log_captured_sent", + "network_flow_log_more_than_90_days", + "network_http_internet_access_restricted", + "network_public_ip_shodan", + "network_rdp_internet_access_restricted", + "network_ssh_internet_access_restricted", + "network_udp_internet_access_restricted", + "network_watcher_enabled", + "storage_default_network_access_rule_is_denied" + ], + "Attributes": [ + { + "Section": "2 RISK MANAGEMENT POLICY (ARTICLE 21(2), POINT (A) OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "2.3 Independent review of information and network security", + "Service": "generic" + } + ] + }, + { + "Id": "3.1.1", + "Description": "For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant entities shall establish and implement an incident handling policy laying down the roles, responsibilities, and procedures for detecting, analysing, containing or responding to, recovering from, documenting and reporting of incidents in a timely manner.", + "Checks": [ + "sqlserver_va_scan_reports_configured" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.1 Incident handling policy", + "Service": "sqlserver" + } + ] + }, + { + "Id": "3.1.2.c", + "Description": "assignment of roles to detect and appropriately respond to incidents to competent employees;", + "Checks": [ + "defender_ensure_notify_emails_to_owners", + "defender_additional_email_configured_with_a_security_contact", + "defender_ensure_notify_alerts_severity_is_high" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.1 Incident handling policy", + "Service": "defender" + } + ] + }, + { + "Id": "3.1.2.d", + "Description": "documents to be used in the course of incident detection and response such as incident response manuals, escalation charts, contact lists and templates.", + "Checks": [ + "defender_auto_provisioning_log_analytics_agent_vms_on", + "defender_auto_provisioning_vulnerabilty_assessments_machines_on", + "defender_container_images_resolved_vulnerabilities", + "defender_container_images_scan_enabled" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.1 Incident handling policy", + "Service": "defender" + } + ] + }, + { + "Id": "3.1.3", + "Description": "The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant changes to operations or risks.", + "Checks": [ + "defender_ensure_notify_emails_to_owners", + "defender_ensure_notify_alerts_severity_is_high", + "entra_global_admin_in_less_than_five_users", + "entra_policy_default_users_cannot_create_security_groups", + "entra_policy_ensure_default_user_cannot_create_apps", + "entra_policy_ensure_default_user_cannot_create_tenants", + "entra_policy_guest_invite_only_for_admin_roles", + "entra_policy_guest_users_access_restrictions", + "entra_policy_restricts_user_consent_for_apps", + "entra_policy_user_consent_for_verified_apps", + "entra_privileged_user_has_mfa", + "entra_security_defaults_enabled", + "entra_trusted_named_locations_exists", + "entra_user_with_vm_access_has_mfa", + "entra_users_cannot_create_microsoft_365_groups" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.1 Incident handling policy", + "Service": "generic" + } + ] + }, + { + "Id": "3.2.1", + "Description": "The relevant entities shall lay down procedures and use tools to monitor and log activities on their network and information systems to detect events that could be considered as incidents and respond accordingly to mitigate the impact.", + "Checks": [ + "app_http_logs_enabled", + "keyvault_logging_enabled", + "monitor_alert_create_policy_assignment", + "monitor_alert_create_update_nsg", + "monitor_alert_create_update_public_ip_address_rule", + "monitor_alert_create_update_security_solution", + "monitor_alert_create_update_sqlserver_fr", + "monitor_alert_delete_nsg", + "monitor_alert_delete_policy_assignment", + "monitor_alert_delete_public_ip_address_rule", + "monitor_alert_delete_security_solution", + "monitor_alert_delete_sqlserver_fr", + "monitor_diagnostic_setting_with_appropriate_categories", + "monitor_diagnostic_settings_exists", + "monitor_storage_account_with_activity_logs_cmk_encrypted", + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.2 Monitoring and logging", + "Service": "generic" + } + ] + }, + { + "Id": "3.2.2", + "Description": "To the extent feasible, monitoring shall be automated and carried out either continuously or in periodic intervals, subject to business capabilities. The relevant entities shall implement their monitoring activities in a way which minimises false positives and false negatives.", + "Checks": [ + "monitor_alert_create_policy_assignment", + "monitor_alert_create_update_nsg", + "monitor_alert_create_update_public_ip_address_rule", + "monitor_alert_create_update_security_solution", + "monitor_alert_create_update_sqlserver_fr", + "monitor_alert_delete_nsg", + "monitor_alert_delete_policy_assignment", + "monitor_alert_delete_public_ip_address_rule", + "monitor_alert_delete_security_solution", + "monitor_alert_delete_sqlserver_fr", + "monitor_diagnostic_setting_with_appropriate_categories", + "monitor_diagnostic_settings_exists", + "monitor_storage_account_with_activity_logs_cmk_encrypted", + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.2 Monitoring and logging", + "Service": "monitor" + } + ] + }, + { + "Id": "3.2.3.a", + "Description": "relevant outbound and inbound network traffic;", + "Checks": [ + "network_flow_log_captured_sent", + "network_flow_log_more_than_90_days", + "monitor_alert_delete_public_ip_address_rule", + "monitor_alert_create_update_nsg", + "monitor_alert_create_update_public_ip_address_rule", + "monitor_alert_create_update_sqlserver_fr", + "monitor_alert_delete_nsg" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.2 Monitoring and logging", + "Service": "generic" + } + ] + }, + { + "Id": "3.2.3.b", + "Description": "creation, modification or deletion of users of the relevant entities network and information systems and extension of the permissions;", + "Checks": [ + "entra_global_admin_in_less_than_five_users", + "monitor_alert_create_policy_assignment", + "monitor_alert_delete_policy_assignment", + "monitor_storage_account_with_activity_logs_cmk_encrypted", + "monitor_storage_account_with_activity_logs_is_private", + "monitor_diagnostic_settings_exists" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.2 Monitoring and logging", + "Service": "generic" + } + ] + }, + { + "Id": "3.2.3.c", + "Description": "access to systems and applications;", + "Checks": [ + "app_http_logs_enabled", + "keyvault_logging_enabled", + "monitor_diagnostic_settings_exists", + "monitor_diagnostic_setting_with_appropriate_categories", + "defender_auto_provisioning_log_analytics_agent_vms_on", + "mysql_flexible_server_audit_log_connection_activated", + "mysql_flexible_server_audit_log_enabled", + "postgresql_flexible_server_log_connections_on", + "postgresql_flexible_server_log_disconnections_on" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.2 Monitoring and logging", + "Service": "generic" + } + ] + }, + { + "Id": "3.2.3.d", + "Description": "authentication-related events;", + "Checks": [ + "network_flow_log_captured_sent", + "mysql_flexible_server_audit_log_connection_activated", + "keyvault_logging_enabled" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.2 Monitoring and logging", + "Service": "generic" + } + ] + }, + { + "Id": "3.2.3.e", + "Description": "all privileged access to systems and applications, and activities performed by administrative accounts;", + "Checks": [ + "app_http_logs_enabled", + "defender_auto_provisioning_log_analytics_agent_vms_on", + "keyvault_logging_enabled", + "postgresql_flexible_server_log_connections_on", + "postgresql_flexible_server_log_disconnections_on" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.2 Monitoring and logging", + "Service": "generic" + } + ] + }, + { + "Id": "3.2.3.f", + "Description": "access or changes to critical configuration and backup files;", + "Checks": [ + "monitor_alert_create_policy_assignment", + "monitor_alert_create_update_nsg", + "monitor_alert_create_update_public_ip_address_rule", + "monitor_alert_create_update_security_solution", + "monitor_alert_create_update_sqlserver_fr", + "monitor_alert_delete_nsg", + "monitor_alert_delete_policy_assignment", + "monitor_alert_delete_public_ip_address_rule", + "monitor_alert_delete_security_solution", + "monitor_alert_delete_sqlserver_fr", + "monitor_diagnostic_setting_with_appropriate_categories", + "monitor_diagnostic_settings_exists", + "monitor_storage_account_with_activity_logs_cmk_encrypted", + "monitor_storage_account_with_activity_logs_is_private" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.2 Monitoring and logging", + "Service": "monitor" + } + ] + }, + { + "Id": "3.2.3.g", + "Description": "event logs and logs from security tools, such as antivirus, intrusion detection systems or firewalls;", + "Checks": [ + "app_http_logs_enabled", + "defender_auto_provisioning_log_analytics_agent_vms_on", + "keyvault_logging_enabled", + "monitor_storage_account_with_activity_logs_cmk_encrypted", + "monitor_storage_account_with_activity_logs_is_private", + "mysql_flexible_server_audit_log_connection_activated", + "mysql_flexible_server_audit_log_enabled", + "network_flow_log_captured_sent", + "network_flow_log_more_than_90_days", + "postgresql_flexible_server_log_checkpoints_on", + "postgresql_flexible_server_log_connections_on", + "postgresql_flexible_server_log_disconnections_on", + "postgresql_flexible_server_log_retention_days_greater_3" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.2 Monitoring and logging", + "Service": "generic" + } + ] + }, + { + "Id": "3.2.3.h", + "Description": "use of system resources, as well as their performance;", + "Checks": [ + "appinsights_ensure_is_configured", + "monitor_diagnostic_settings_exists" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.2 Monitoring and logging", + "Service": "generic" + } + ] + }, + { + "Id": "3.2.4", + "Description": "The logs shall be regularly reviewed for any unusual or unwanted trends. Where appropriate, the relevant entities shall lay down appropriate values for alarm thresholds. If the laid down values for alarm threshold are exceeded, an alarm shall be triggered, where appropriate, automatically. The relevant entities shall ensure that, in case of an alarm, a qualified and appropriate response is initiated in a timely manner.", + "Checks": [ + "monitor_alert_create_policy_assignment", + "monitor_alert_create_update_nsg", + "monitor_alert_create_update_public_ip_address_rule", + "monitor_alert_create_update_security_solution", + "monitor_alert_create_update_sqlserver_fr", + "monitor_alert_delete_nsg", + "monitor_alert_delete_policy_assignment", + "monitor_alert_delete_public_ip_address_rule", + "monitor_alert_delete_security_solution", + "monitor_alert_delete_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.2 Monitoring and logging", + "Service": "monitor" + } + ] + }, + { + "Id": "3.2.5", + "Description": "The relevant entities shall maintain and back up logs for a predefined period and shall protect them from unauthorised access or changes.", + "Checks": [ + "network_flow_log_more_than_90_days", + "postgresql_flexible_server_log_retention_days_greater_3", + "sqlserver_auditing_retention_90_days" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.2 Monitoring and logging", + "Service": "generic" + } + ] + }, + { + "Id": "3.4.1", + "Description": "The relevant entities shall assess suspicious events to determine whether they constitute incidents and, if so, determine their nature and severity.", + "Checks": [ + "monitor_diagnostic_setting_with_appropriate_categories", + "monitor_diagnostic_settings_exists", + "monitor_alert_create_policy_assignment", + "monitor_alert_create_update_nsg", + "monitor_alert_create_update_public_ip_address_rule", + "monitor_alert_create_update_security_solution", + "monitor_alert_create_update_sqlserver_fr", + "monitor_alert_delete_nsg", + "monitor_alert_delete_policy_assignment", + "monitor_alert_delete_public_ip_address_rule", + "monitor_alert_delete_security_solution", + "monitor_alert_delete_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.4 Event assessment and classification", + "Service": "monitor" + } + ] + }, + { + "Id": "3.5.1", + "Description": "The relevant entities shall respond to incidents in accordance with documented procedures and in a timely manner.", + "Checks": [ + "defender_additional_email_configured_with_a_security_contact", + "defender_ensure_notify_emails_to_owners", + "sqlserver_va_emails_notifications_admins_enabled" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.5 Incident response", + "Service": "generic" + } + ] + }, + { + "Id": "3.5.3.a", + "Description": "with the Computer Security Incident Response Teams (CSIRTs) or, where applicable, the competent authorities, related to incident notification;", + "Checks": [ + "defender_additional_email_configured_with_a_security_contact", + "defender_ensure_notify_emails_to_owners", + "sqlserver_va_emails_notifications_admins_enabled" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.5 Incident response", + "Service": "generic" + } + ] + }, + { + "Id": "3.5.4", + "Description": "The relevant entities shall log incident response activities in accordance with the procedures referred to in point 3.2.1., and record evidence.", + "Checks": [ + "monitor_alert_create_policy_assignment", + "monitor_alert_create_update_nsg", + "monitor_alert_create_update_public_ip_address_rule", + "monitor_alert_create_update_security_solution", + "monitor_alert_create_update_sqlserver_fr", + "monitor_alert_delete_nsg", + "monitor_alert_delete_policy_assignment", + "monitor_alert_delete_public_ip_address_rule", + "monitor_alert_delete_security_solution", + "monitor_alert_delete_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.5 Incident response", + "Service": "monitor" + } + ] + }, + { + "Id": "3.6.2", + "Description": "The relevant entities shall ensure that post-incident reviews contribute to improving their approach to network and information security, to risk treatment measures, and to incident handling, detection and response procedures.", + "Checks": [ + "defender_additional_email_configured_with_a_security_contact", + "defender_assessments_vm_endpoint_protection_installed", + "defender_auto_provisioning_log_analytics_agent_vms_on", + "defender_auto_provisioning_vulnerabilty_assessments_machines_on", + "defender_container_images_resolved_vulnerabilities", + "defender_container_images_scan_enabled", + "defender_ensure_defender_for_app_services_is_on", + "defender_ensure_defender_for_arm_is_on", + "defender_ensure_defender_for_azure_sql_databases_is_on", + "defender_ensure_defender_for_containers_is_on", + "defender_ensure_defender_for_cosmosdb_is_on", + "defender_ensure_defender_for_databases_is_on", + "defender_ensure_defender_for_dns_is_on", + "defender_ensure_defender_for_keyvault_is_on", + "defender_ensure_defender_for_os_relational_databases_is_on", + "defender_ensure_defender_for_server_is_on", + "defender_ensure_defender_for_sql_servers_is_on", + "defender_ensure_defender_for_storage_is_on", + "defender_ensure_iot_hub_defender_is_on", + "defender_ensure_mcas_is_enabled", + "defender_ensure_notify_alerts_severity_is_high", + "defender_ensure_notify_emails_to_owners", + "defender_ensure_system_updates_are_applied", + "defender_ensure_wdatp_is_enabled", + "sqlserver_microsoft_defender_enabled" + ], + "Attributes": [ + { + "Section": "3 INCIDENT HANDLING (ARTICLE 21(2), POINT (B), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "3.6 Post-incident reviews", + "Service": "defender" + } + ] + }, + { + "Id": "4.1.1", + "Description": "For the purpose of Article 21(2), point (c) of Directive (EU) 2022/2555, the relevant entities shall lay down and maintain a business continuity and disaster recovery plan to apply in the case of incidents.", + "Checks": [ + "keyvault_recoverable" + ], + "Attributes": [ + { + "Section": "4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "4.1 Business continuity and disaster recovery plan", + "Service": "keyvault" + } + ] + }, + { + "Id": "4.1.2.f", + "Description": "recovery plans for specific operations, including recovery objectives;", + "Checks": [ + "keyvault_recoverable" + ], + "Attributes": [ + { + "Section": "4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "4.1 Business continuity and disaster recovery plan", + "Service": "keyvault" + } + ] + }, + { + "Id": "4.1.2.g", + "Description": "required resources, including backups and redundancies;", + "Checks": [ + "keyvault_recoverable", + "network_flow_log_more_than_90_days", + "postgresql_flexible_server_log_retention_days_greater_3", + "sqlserver_auditing_retention_90_days" + ], + "Attributes": [ + { + "Section": "4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "4.1 Business continuity and disaster recovery plan", + "Service": "generic" + } + ] + }, + { + "Id": "4.1.4", + "Description": "The business continuity plan and disaster recovery plan shall be tested, reviewed and, where appropriate, updated at planned intervals and following significant incidents or significant changes to operations or risks. The relevant entities shall ensure that the plans incorporate lessons learnt from such tests.", + "Checks": [ + "keyvault_recoverable", + "network_flow_log_more_than_90_days", + "postgresql_flexible_server_log_retention_days_greater_3", + "sqlserver_auditing_retention_90_days" + ], + "Attributes": [ + { + "Section": "4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "4.1 Business continuity and disaster recovery plan", + "Service": "generic" + } + ] + }, + { + "Id": "4.2.2.b", + "Description": "assurance that backup copies are complete and accurate, including configuration data and data stored in cloud computing service environment;", + "Checks": [ + "keyvault_recoverable" + ], + "Attributes": [ + { + "Section": "4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "4.2 Backup and redundancy management", + "Service": "keyvault" + } + ] + }, + { + "Id": "4.2.2.e", + "Description": "restoring data from backup copies;", + "Checks": [ + "keyvault_recoverable" + ], + "Attributes": [ + { + "Section": "4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "4.2 Backup and redundancy management", + "Service": "generic" + } + ] + }, + { + "Id": "4.2.2.f", + "Description": "retention periods based on business and regulatory requirements.", + "Checks": [ + "sqlserver_auditing_retention_90_days", + "storage_ensure_soft_delete_is_enabled", + "network_flow_log_more_than_90_days" + ], + "Attributes": [ + { + "Section": "4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "4.2 Backup and redundancy management", + "Service": "generic" + } + ] + }, + { + "Id": "4.3.2.a", + "Description": "roles and responsibilities for personnel and, where appropriate, suppliers and service providers, specifying the allocation of roles in crisis situations, including specific steps to follow;", + "Checks": [ + "defender_additional_email_configured_with_a_security_contact", + "defender_ensure_notify_emails_to_owners", + "sqlserver_va_emails_notifications_admins_enabled" + ], + "Attributes": [ + { + "Section": "4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "4.3 Crisis management", + "Service": "generic" + } + ] + }, + { + "Id": "4.3.2.c", + "Description": "application of appropriate measures to ensure the maintenance of network and information system security in crisis situations.", + "Checks": [ + "monitor_alert_create_policy_assignment", + "monitor_alert_create_update_nsg", + "monitor_alert_create_update_public_ip_address_rule", + "monitor_alert_create_update_security_solution", + "monitor_alert_create_update_sqlserver_fr", + "monitor_alert_delete_nsg", + "monitor_alert_delete_policy_assignment", + "monitor_alert_delete_public_ip_address_rule", + "monitor_alert_delete_security_solution", + "monitor_alert_delete_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "4 BUSINESS CONTINUITY AND CRISIS MANAGEMENT (ARTICLE 21(2), POINT (C), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "4.3 Crisis management", + "Service": "monitor" + } + ] + }, + { + "Id": "5.1.2.a", + "Description": "the cybersecurity practices of the suppliers and service providers, including their secure development procedures;", + "Checks": [ + "aks_network_policy_enabled", + "app_client_certificates_on", + "app_ensure_auth_is_set_up", + "app_ensure_http_is_redirected_to_https", + "app_ensure_java_version_is_latest", + "app_ensure_php_version_is_latest", + "app_ensure_python_version_is_latest", + "app_ensure_using_http20", + "app_ftp_deployment_disabled", + "app_function_access_keys_configured", + "app_function_application_insights_enabled", + "app_function_ftps_deployment_disabled", + "app_function_identity_is_configured", + "app_function_identity_without_admin_privileges", + "app_function_latest_runtime_version", + "app_function_not_publicly_accessible", + "app_function_vnet_integration_enabled", + "app_http_logs_enabled", + "app_minimum_tls_version_12", + "app_register_with_identity", + "appinsights_ensure_is_configured" + ], + "Attributes": [ + { + "Section": "5 SUPPLY CHAIN SECURITY (ARTICLE 21(2), POINT (D), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "5.1 Supply chain security policy", + "Service": "app" + } + ] + }, + { + "Id": "5.1.4.f", + "Description": "an obligation on suppliers and service providers to handle vulnerabilities that present a risk to the security of the network and information systems of the relevant entities;", + "Checks": [ + "defender_container_images_resolved_vulnerabilities", + "defender_container_images_scan_enabled", + "defender_auto_provisioning_vulnerabilty_assessments_machines_on", + "sqlserver_vulnerability_assessment_enabled" + ], + "Attributes": [ + { + "Section": "5 SUPPLY CHAIN SECURITY (ARTICLE 21(2), POINT (D), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "5.1 Supply chain security policy", + "Service": "generic" + } + ] + }, + { + "Id": "5.1.7.b", + "Description": "review incidents related to ICT products and ICT services from suppliers and service providers;", + "Checks": [ + "defender_additional_email_configured_with_a_security_contact", + "defender_ensure_notify_emails_to_owners", + "sqlserver_va_emails_notifications_admins_enabled" + ], + "Attributes": [ + { + "Section": "5 SUPPLY CHAIN SECURITY (ARTICLE 21(2), POINT (D), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "5.1 Supply chain security policy", + "Service": "generic" + } + ] + }, + { + "Id": "6.1.2.b", + "Description": "requirements regarding security updates throughout the entire lifetime of the ICT services or ICT products, or replacement after the end of the support period;", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac", + "keyvault_non_rbac_secret_expiration_set", + "postgresql_flexible_server_log_retention_days_greater_3", + "network_flow_log_more_than_90_days", + "sqlserver_auditing_retention_90_days" + ], + "Attributes": [ + { + "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "6.1 Security in acquisition of ICT services or ICT products", + "Service": "generic" + } + ] + }, + { + "Id": "6.2.1", + "Description": "Before developing a network and information system, including software, the relevant entities shall lay down rules for the secure development of network and information systems and apply them when developing network and information systems in-house, or when outsourcing the development of network and information systems. The rules shall cover all development phases, including specification, design, development, implementation and testing.", + "Checks": [ + "defender_ensure_system_updates_are_applied", + "app_client_certificates_on", + "app_ensure_auth_is_set_up", + "app_ensure_http_is_redirected_to_https", + "app_ensure_java_version_is_latest", + "app_ensure_php_version_is_latest", + "app_ensure_python_version_is_latest", + "app_ensure_using_http20", + "app_ftp_deployment_disabled", + "app_function_access_keys_configured", + "app_function_application_insights_enabled", + "app_function_ftps_deployment_disabled", + "app_function_identity_is_configured", + "app_function_identity_without_admin_privileges", + "app_function_latest_runtime_version", + "app_function_not_publicly_accessible", + "app_function_vnet_integration_enabled", + "app_http_logs_enabled", + "app_minimum_tls_version_12", + "app_register_with_identity" + ], + "Attributes": [ + { + "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "6.2 Secure development life cycle", + "Service": "app" + } + ] + }, + { + "Id": "6.2.2.b", + "Description": "apply principles for engineering secure systems and secure coding principles to any information system development activities such as promoting cybersecurity-by-design, zero-trust architectures;", + "Checks": [ + "app_client_certificates_on", + "app_ensure_auth_is_set_up", + "app_ensure_http_is_redirected_to_https", + "app_ensure_java_version_is_latest", + "app_ensure_php_version_is_latest", + "app_ensure_python_version_is_latest", + "app_ensure_using_http20", + "app_ftp_deployment_disabled", + "app_function_access_keys_configured", + "app_function_application_insights_enabled", + "app_function_ftps_deployment_disabled", + "app_function_identity_is_configured", + "app_function_identity_without_admin_privileges", + "app_function_latest_runtime_version", + "app_function_not_publicly_accessible", + "app_function_vnet_integration_enabled", + "app_http_logs_enabled", + "app_minimum_tls_version_12", + "app_register_with_identity" + ], + "Attributes": [ + { + "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "6.2 Secure development life cycle", + "Service": "app" + } + ] + }, + { + "Id": "6.2.2.c", + "Description": "lay down security requirements regarding development environments;", + "Checks": [ + "app_client_certificates_on", + "app_ensure_auth_is_set_up", + "app_ensure_http_is_redirected_to_https", + "app_ensure_java_version_is_latest", + "app_ensure_php_version_is_latest", + "app_ensure_python_version_is_latest", + "app_ensure_using_http20", + "app_ftp_deployment_disabled", + "app_function_access_keys_configured", + "app_function_application_insights_enabled", + "app_function_ftps_deployment_disabled", + "app_function_identity_is_configured", + "app_function_identity_without_admin_privileges", + "app_function_latest_runtime_version", + "app_function_not_publicly_accessible", + "app_function_vnet_integration_enabled", + "app_http_logs_enabled", + "app_minimum_tls_version_12", + "app_register_with_identity" + ], + "Attributes": [ + { + "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "6.2 Secure development life cycle", + "Service": "app" + } + ] + }, + { + "Id": "6.4.1", + "Description": "The relevant entities shall apply change management procedures to control changes of network and information systems. Where applicable, the procedures shall be consistent with the relevant entities general policies concerning change management.", + "Checks": [ + "monitor_alert_create_policy_assignment", + "monitor_alert_create_update_nsg", + "monitor_alert_create_update_public_ip_address_rule", + "monitor_alert_create_update_security_solution", + "monitor_alert_create_update_sqlserver_fr", + "monitor_alert_delete_nsg", + "monitor_alert_delete_policy_assignment", + "monitor_alert_delete_public_ip_address_rule", + "monitor_alert_delete_security_solution", + "monitor_alert_delete_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "6.4 Change management, repairs and maintenance", + "Service": "monitor" + } + ] + }, + { + "Id": "6.6.1.a", + "Description": "security patches are applied within a reasonable time after they become available;", + "Checks": [ + "defender_auto_provisioning_vulnerabilty_assessments_machines_on", + "defender_container_images_resolved_vulnerabilities", + "sqlserver_vulnerability_assessment_enabled" + ], + "Attributes": [ + { + "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "6.6 Security patch management", + "Service": "generic" + } + ] + }, + { + "Id": "6.7.2.b", + "Description": "determine and apply controls to protect the relevant entities internal network domains from unauthorised access;", + "Checks": [ + "aisearch_service_not_publicly_accessible", + "aks_network_policy_enabled", + "containerregistry_not_publicly_accessible", + "cosmosdb_account_firewall_use_selected_networks", + "network_bastion_host_exists", + "network_flow_log_captured_sent", + "network_flow_log_more_than_90_days", + "network_http_internet_access_restricted", + "network_public_ip_shodan", + "network_rdp_internet_access_restricted", + "network_ssh_internet_access_restricted", + "network_udp_internet_access_restricted", + "network_watcher_enabled", + "storage_default_network_access_rule_is_denied" + ], + "Attributes": [ + { + "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "6.7 Network security", + "Service": "generic" + } + ] + }, + { + "Id": "6.7.2.e", + "Description": "not use systems used for administration of the security policy implementation for other purposes;", + "Checks": [ + "app_function_identity_without_admin_privileges", + "containerregistry_admin_user_disabled", + "entra_global_admin_in_less_than_five_users", + "entra_policy_ensure_default_user_cannot_create_tenants", + "entra_policy_guest_invite_only_for_admin_roles", + "iam_custom_role_has_permissions_to_administer_resource_locks", + "sqlserver_azuread_administrator_enabled", + "sqlserver_va_emails_notifications_admins_enabled" + ], + "Attributes": [ + { + "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "6.7 Network security", + "Service": "generic" + } + ] + }, + { + "Id": "6.7.2.g", + "Description": "where appropriate, exclusively allow access to the relevant entities network and information systems by devices authorised by those entities;", + "Checks": [ + "entra_policy_restricts_user_consent_for_apps", + "entra_policy_ensure_default_user_cannot_create_tenants", + "app_function_ftps_deployment_disabled", + "app_ensure_auth_is_set_up", + "app_function_identity_is_configured" + ], + "Attributes": [ + { + "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "6.7 Network security", + "Service": "generic" + } + ] + }, + { + "Id": "6.7.2.i", + "Description": "establish communication between distinct systems only through trusted channels that are isolated using logical, cryptographic or physical separation from other communication channels and provide assured identification of their end points and protection of the channel data from modification or disclosure;", + "Checks": [ + "storage_ensure_private_endpoints_in_storage_accounts", + "storage_secure_transfer_required_is_enabled", + "app_minimum_tls_version_12", + "mysql_flexible_server_minimum_tls_version_12", + "sqlserver_recommended_minimal_tls_version", + "storage_ensure_minimum_tls_version_12", + "app_ensure_http_is_redirected_to_https", + "defender_ensure_defender_for_dns_is_on", + "sqlserver_tde_encryption_enabled" + ], + "Attributes": [ + { + "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "6.7 Network security", + "Service": "generic" + } + ] + }, + { + "Id": "6.7.2.l", + "Description": "apply best practices for the security of the DNS, and for Internet routing security and routing hygiene of traffic originating from and destined to the network.", + "Checks": [ + "storage_ensure_private_endpoints_in_storage_accounts", + "storage_secure_transfer_required_is_enabled", + "app_minimum_tls_version_12", + "mysql_flexible_server_minimum_tls_version_12", + "sqlserver_recommended_minimal_tls_version", + "storage_ensure_minimum_tls_version_12", + "app_ensure_http_is_redirected_to_https", + "defender_ensure_defender_for_dns_is_on", + "sqlserver_tde_encryption_enabled", + "network_bastion_host_exists", + "network_flow_log_captured_sent", + "network_flow_log_more_than_90_days", + "network_http_internet_access_restricted", + "network_public_ip_shodan", + "network_rdp_internet_access_restricted", + "network_ssh_internet_access_restricted", + "network_udp_internet_access_restricted", + "network_watcher_enabled" + ], + "Attributes": [ + { + "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "6.7 Network security", + "Service": "generic" + } + ] + }, + { + "Id": "6.8.2.a", + "Description": "consider the functional, logical and physical relationship, including location, between trustworthy systems and services;", + "Checks": [ + "entra_trusted_named_locations_exists", + "network_watcher_enabled" + ], + "Attributes": [ + { + "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "6.8 Network segmentation", + "Service": "generic" + } + ] + }, + { + "Id": "6.9.2", + "Description": "For that purpose, the relevant entities shall in particular implement measures that detect or prevent the use of malicious or unauthorised software. The relevant entities shall, where appropriate, ensure that their network and information systems are equipped with detection and response software, which is updated regularly in accordance with the risk assessment carried out pursuant to point 2.1 and the contractual agreements with the providers.", + "Checks": [ + "defender_additional_email_configured_with_a_security_contact", + "defender_assessments_vm_endpoint_protection_installed", + "defender_auto_provisioning_log_analytics_agent_vms_on", + "defender_auto_provisioning_vulnerabilty_assessments_machines_on", + "defender_container_images_resolved_vulnerabilities", + "defender_container_images_scan_enabled", + "defender_ensure_defender_for_app_services_is_on", + "defender_ensure_defender_for_arm_is_on", + "defender_ensure_defender_for_azure_sql_databases_is_on", + "defender_ensure_defender_for_containers_is_on", + "defender_ensure_defender_for_cosmosdb_is_on", + "defender_ensure_defender_for_databases_is_on", + "defender_ensure_defender_for_dns_is_on", + "defender_ensure_defender_for_keyvault_is_on", + "defender_ensure_defender_for_os_relational_databases_is_on", + "defender_ensure_defender_for_server_is_on", + "defender_ensure_defender_for_sql_servers_is_on", + "defender_ensure_defender_for_storage_is_on", + "defender_ensure_iot_hub_defender_is_on", + "defender_ensure_mcas_is_enabled", + "defender_ensure_notify_alerts_severity_is_high", + "defender_ensure_notify_emails_to_owners", + "defender_ensure_system_updates_are_applied", + "defender_ensure_wdatp_is_enabled", + "sqlserver_microsoft_defender_enabled" + ], + "Attributes": [ + { + "Section": "6 SECURITY IN NETWORK AND INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE (ARTICLE 21(2), POINT (E), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "6.9 Protection against malicious and unauthorised software", + "Service": "generic" + } + ] + }, + { + "Id": "7.2.b", + "Description": "the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results;", + "Checks": [ + "defender_ensure_notify_alerts_severity_is_high", + "monitor_alert_create_policy_assignment", + "monitor_alert_create_update_nsg", + "monitor_alert_create_update_public_ip_address_rule", + "monitor_alert_create_update_security_solution", + "monitor_alert_create_update_sqlserver_fr", + "monitor_alert_delete_nsg", + "monitor_alert_delete_policy_assignment", + "monitor_alert_delete_public_ip_address_rule", + "monitor_alert_delete_security_solution", + "monitor_alert_delete_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "7 POLICIES AND PROCEDURES TO ASSESS THE EFFECTIVENESS OF CYBERSECURITY RISK-MANAGEMENT MEASURES (ARTICLE 21(2), POINT (F), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "7.2 The policy and procedures referred to in point 7.1. shall take into account results of the risk assessment pursuant to point 2.1. and past significant incidents. The relevant entities shall determine:", + "Service": "generic" + } + ] + }, + { + "Id": "9.2.a", + "Description": "in accordance with the relevant entities classification of assets, the type, strength and quality of the cryptographic measures required to protect the relevant entities assets, including data at rest and data in transit;", + "Checks": [ + "app_minimum_tls_version_12", + "monitor_storage_account_with_activity_logs_cmk_encrypted", + "sqlserver_tde_encrypted_with_cmk", + "sqlserver_tde_encryption_enabled", + "storage_ensure_encryption_with_customer_managed_keys", + "storage_infrastructure_encryption_is_enabled", + "storage_secure_transfer_required_is_enabled", + "vm_ensure_attached_disks_encrypted_with_cmk", + "vm_ensure_unattached_disks_encrypted_with_cmk" + ], + "Attributes": [ + { + "Section": "9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "9.2 Cryptography", + "Service": "generic" + } + ] + }, + { + "Id": "9.2.c", + "Description": "the relevant entities approach to key management, including, where appropriate, methods for the following:", + "Checks": [ + "defender_ensure_defender_for_keyvault_is_on", + "keyvault_key_expiration_set_in_non_rbac", + "keyvault_key_rotation_enabled", + "keyvault_logging_enabled", + "keyvault_non_rbac_secret_expiration_set", + "keyvault_private_endpoints", + "keyvault_rbac_enabled", + "keyvault_rbac_key_expiration_set", + "keyvault_rbac_secret_expiration_set", + "keyvault_recoverable", + "monitor_storage_account_with_activity_logs_cmk_encrypted", + "sqlserver_tde_encrypted_with_cmk", + "vm_ensure_attached_disks_encrypted_with_cmk", + "vm_ensure_unattached_disks_encrypted_with_cmk" + ], + "Attributes": [ + { + "Section": "9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "9.2 Cryptography", + "Service": "generic" + } + ] + }, + { + "Id": "9.2.c.i", + "Description": "generating different keys for cryptographic systems and applications;", + "Checks": [ + "keyvault_rbac_key_expiration_set", + "keyvault_rbac_secret_expiration_set", + "monitor_storage_account_with_activity_logs_cmk_encrypted", + "sqlserver_tde_encrypted_with_cmk", + "vm_ensure_attached_disks_encrypted_with_cmk", + "vm_ensure_unattached_disks_encrypted_with_cmk" + ], + "Attributes": [ + { + "Section": "9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "9.2 Cryptography", + "Service": "generic" + } + ] + }, + { + "Id": "9.2.c.ii", + "Description": "issuing and obtaining public key certificates;", + "Checks": [ + "app_client_certificates_on" + ], + "Attributes": [ + { + "Section": "9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "9.2 Cryptography", + "Service": "app" + } + ] + }, + { + "Id": "9.2.c.iii", + "Description": "distributing keys to intended entities, including how to activate keys when received;", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac", + "keyvault_rbac_key_expiration_set", + "storage_key_rotation_90_days" + ], + "Attributes": [ + { + "Section": "9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "9.2 Cryptography", + "Service": "generic" + } + ] + }, + { + "Id": "9.2.c.iv", + "Description": "storing keys, including how authorised users obtain access to keys;", + "Checks": [ + "app_function_access_keys_configured", + "defender_ensure_defender_for_keyvault_is_on", + "keyvault_key_expiration_set_in_non_rbac", + "keyvault_key_rotation_enabled", + "keyvault_logging_enabled", + "keyvault_non_rbac_secret_expiration_set", + "keyvault_private_endpoints", + "keyvault_rbac_enabled", + "keyvault_rbac_key_expiration_set", + "keyvault_rbac_secret_expiration_set", + "keyvault_recoverable", + "sqlserver_tde_encrypted_with_cmk", + "storage_ensure_encryption_with_customer_managed_keys", + "storage_key_rotation_90_days" + ], + "Attributes": [ + { + "Section": "9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "9.2 Cryptography", + "Service": "generic" + } + ] + }, + { + "Id": "9.2.c.v", + "Description": "changing or updating keys, including rules on when and how to change keys;", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac", + "keyvault_key_rotation_enabled", + "keyvault_logging_enabled", + "keyvault_non_rbac_secret_expiration_set", + "keyvault_private_endpoints", + "keyvault_rbac_enabled", + "keyvault_rbac_key_expiration_set", + "keyvault_rbac_secret_expiration_set", + "keyvault_recoverable" + ], + "Attributes": [ + { + "Section": "9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "9.2 Cryptography", + "Service": "keyvault" + } + ] + }, + { + "Id": "9.2.c.vi", + "Description": "backing up or archiving keys;", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac", + "keyvault_recoverable", + "keyvault_rbac_key_expiration_set" + ], + "Attributes": [ + { + "Section": "9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "9.2 Cryptography", + "Service": "keyvault" + } + ] + }, + { + "Id": "9.2.c.vii", + "Description": "logging and auditing of key management-related activities;", + "Checks": [ + "monitor_storage_account_with_activity_logs_cmk_encrypted", + "keyvault_logging_enabled", + "sqlserver_auditing_enabled" + ], + "Attributes": [ + { + "Section": "9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "9.2 Cryptography", + "Service": "generic" + } + ] + }, + { + "Id": "9.2.c.xii", + "Description": "setting activation and deactivation dates for keys ensuring that the keys can only be used for the specified period of time according to the organization's rules on key management.", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac", + "keyvault_rbac_key_expiration_set", + "keyvault_rbac_secret_expiration_set", + "keyvault_non_rbac_secret_expiration_set" + ], + "Attributes": [ + { + "Section": "9 CRYPTOGRAPHY (ARTICLE 21(2), POINT (H), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "9.2 Cryptography", + "Service": "keyvault" + } + ] + }, + { + "Id": "11.1.1", + "Description": "For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish, document and implement logical and physical access control policies for the access to their network and information systems, based on business requirements as well as network and information system security requirements.", + "Checks": [ + "app_ensure_auth_is_set_up", + "app_function_ftps_deployment_disabled", + "aisearch_service_not_publicly_accessible", + "aks_network_policy_enabled", + "containerregistry_not_publicly_accessible", + "cosmosdb_account_firewall_use_selected_networks", + "network_bastion_host_exists", + "network_flow_log_captured_sent", + "network_flow_log_more_than_90_days", + "network_http_internet_access_restricted", + "network_public_ip_shodan", + "network_rdp_internet_access_restricted", + "network_ssh_internet_access_restricted", + "network_udp_internet_access_restricted", + "network_watcher_enabled", + "storage_default_network_access_rule_is_denied" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.1 Access control policy", + "Service": "generic" + } + ] + }, + { + "Id": "11.1.2.c", + "Description": "ensure that access is only granted to users that have been adequately authenticated.", + "Checks": [ + "app_ensure_auth_is_set_up", + "app_function_ftps_deployment_disabled" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.1 Access control policy", + "Service": "app" + } + ] + }, + { + "Id": "11.2.1", + "Description": "The relevant entities shall provide, modify, remove and document access rights to network and information systems in accordance with the access control policy referred to in point 11.1.", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private", + "storage_default_network_access_rule_is_denied" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.2 Management of access rights", + "Service": "generic" + } + ] + }, + { + "Id": "11.2.2.a", + "Description": "assign and revoke access rights based on the principles of need-to-know, least privilege and separation of duties;", + "Checks": [ + "entra_global_admin_in_less_than_five_users", + "entra_policy_default_users_cannot_create_security_groups", + "entra_policy_ensure_default_user_cannot_create_apps", + "entra_policy_ensure_default_user_cannot_create_tenants", + "entra_policy_guest_invite_only_for_admin_roles", + "entra_policy_guest_users_access_restrictions", + "entra_policy_restricts_user_consent_for_apps", + "entra_policy_user_consent_for_verified_apps", + "entra_users_cannot_create_microsoft_365_groups" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.2 Management of access rights", + "Service": "entra" + } + ] + }, + { + "Id": "11.2.2.d", + "Description": "ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers, in particular by limiting access rights in scope and in duration;", + "Checks": [ + "monitor_storage_account_with_activity_logs_is_private", + "entra_policy_default_users_cannot_create_security_groups", + "entra_policy_ensure_default_user_cannot_create_apps", + "entra_policy_ensure_default_user_cannot_create_tenants", + "entra_policy_guest_invite_only_for_admin_roles", + "entra_policy_guest_users_access_restrictions", + "entra_policy_restricts_user_consent_for_apps", + "entra_policy_user_consent_for_verified_apps", + "entra_users_cannot_create_microsoft_365_groups", + "aks_clusters_created_with_private_nodes", + "containerregistry_uses_private_link", + "cosmosdb_account_use_private_endpoints", + "keyvault_private_endpoints", + "monitor_storage_account_with_activity_logs_is_private", + "storage_ensure_private_endpoints_in_storage_accounts" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.2 Management of access rights", + "Service": "generic" + } + ] + }, + { + "Id": "11.2.2.f", + "Description": "apply logging to the management of access rights.", + "Checks": [ + "app_http_logs_enabled", + "defender_auto_provisioning_log_analytics_agent_vms_on", + "keyvault_logging_enabled", + "monitor_storage_account_with_activity_logs_cmk_encrypted", + "monitor_storage_account_with_activity_logs_is_private", + "mysql_flexible_server_audit_log_connection_activated", + "mysql_flexible_server_audit_log_enabled", + "network_flow_log_captured_sent", + "network_flow_log_more_than_90_days", + "postgresql_flexible_server_log_checkpoints_on", + "postgresql_flexible_server_log_connections_on", + "postgresql_flexible_server_log_disconnections_on", + "postgresql_flexible_server_log_retention_days_greater_3" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.2 Management of access rights", + "Service": "generic" + } + ] + }, + { + "Id": "11.3.1", + "Description": "The relevant entities shall maintain policies for management of privileged accounts and system administration accounts as part of the access control policy referred to in point 11.1.", + "Checks": [ + "monitor_alert_create_policy_assignment", + "monitor_alert_create_update_nsg", + "monitor_alert_create_update_sqlserver_fr", + "monitor_alert_delete_nsg", + "monitor_alert_delete_policy_assignment", + "monitor_alert_delete_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.3 Privileged accounts and system administration accounts", + "Service": "monitor" + } + ] + }, + { + "Id": "11.3.2.a", + "Description": "establish strong identification, authentication such as multi-factor authentication, and authorisation procedures for privileged accounts and system administration accounts;", + "Checks": [ + "entra_conditional_access_policy_require_mfa_for_management_api", + "entra_non_privileged_user_has_mfa", + "entra_privileged_user_has_mfa", + "entra_user_with_vm_access_has_mfa" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.3 Privileged accounts and system administration accounts", + "Service": "entra" + } + ] + }, + { + "Id": "11.3.2.b", + "Description": "set up specific accounts to be used for system administration operations exclusively, such as installation, configuration, management or maintenance;", + "Checks": [ + "entra_global_admin_in_less_than_five_users" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.3 Privileged accounts and system administration accounts", + "Service": "entra" + } + ] + }, + { + "Id": "11.3.2.c", + "Description": "individualise and restrict system administration privileges to the highest extent possible,", + "Checks": [ + "entra_global_admin_in_less_than_five_users", + "entra_policy_default_users_cannot_create_security_groups", + "entra_policy_ensure_default_user_cannot_create_apps", + "entra_policy_ensure_default_user_cannot_create_tenants", + "entra_policy_guest_invite_only_for_admin_roles", + "entra_policy_guest_users_access_restrictions", + "entra_policy_restricts_user_consent_for_apps", + "entra_policy_user_consent_for_verified_apps", + "entra_users_cannot_create_microsoft_365_groups" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.3 Privileged accounts and system administration accounts", + "Service": "entra" + } + ] + }, + { + "Id": "11.3.2.d", + "Description": "provide that system administration accounts are only used to connect to system administration systems.", + "Checks": [ + "entra_global_admin_in_less_than_five_users", + "entra_policy_default_users_cannot_create_security_groups", + "entra_policy_ensure_default_user_cannot_create_apps", + "entra_policy_ensure_default_user_cannot_create_tenants" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.3 Privileged accounts and system administration accounts", + "Service": "entra" + } + ] + }, + { + "Id": "11.4.2.b", + "Description": "separate logically such systems from application software not used for system administrative purposes,", + "Checks": [ + "entra_global_admin_in_less_than_five_users", + "entra_policy_default_users_cannot_create_security_groups", + "entra_policy_ensure_default_user_cannot_create_apps", + "entra_policy_ensure_default_user_cannot_create_tenants" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.4 Administration systems", + "Service": "entra" + } + ] + }, + { + "Id": "11.4.2.c", + "Description": "protect access to system administration systems through authentication and encryption.", + "Checks": [ + "entra_trusted_named_locations_exists", + "entra_user_with_vm_access_has_mfa", + "entra_conditional_access_policy_require_mfa_for_management_api", + "entra_privileged_user_has_mfa" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.4 Administration systems", + "Service": "entra" + } + ] + }, + { + "Id": "11.5.2.a", + "Description": "set up unique identities for network and information systems and their users;", + "Checks": [ + "app_function_identity_is_configured" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.5 Identification", + "Service": "app" + } + ] + }, + { + "Id": "11.5.2.d", + "Description": "apply logging to the management of identities.", + "Checks": [ + "monitor_alert_create_policy_assignment", + "monitor_alert_create_update_nsg", + "monitor_alert_create_update_public_ip_address_rule", + "monitor_alert_create_update_security_solution", + "monitor_alert_create_update_sqlserver_fr", + "monitor_alert_delete_nsg", + "monitor_alert_delete_policy_assignment", + "monitor_alert_delete_public_ip_address_rule", + "monitor_alert_delete_security_solution", + "monitor_alert_delete_sqlserver_fr" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.5 Identification", + "Service": "monitor" + } + ] + }, + { + "Id": "11.6.1", + "Description": "The relevant entities shall implement secure authentication procedures and technologies based on access restrictions and the policy on access control.", + "Checks": [ + "app_ensure_auth_is_set_up", + "app_function_ftps_deployment_disabled", + "aisearch_service_not_publicly_accessible", + "aks_network_policy_enabled", + "containerregistry_not_publicly_accessible" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.6 Authentication", + "Service": "generic" + } + ] + }, + { + "Id": "11.6.2.a", + "Description": "ensure the strength of authentication is appropriate to the classification of the asset to be accessed;", + "Checks": [ + "entra_conditional_access_policy_require_mfa_for_management_api", + "entra_non_privileged_user_has_mfa", + "entra_privileged_user_has_mfa", + "entra_user_with_vm_access_has_mfa" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.6 Authentication", + "Service": "entra" + } + ] + }, + { + "Id": "11.6.2.c", + "Description": "require the change of authentication credentials initially, at predefined intervals and upon suspicion that the credentials were compromised;", + "Checks": [ + "keyvault_key_rotation_enabled", + "storage_key_rotation_90_days" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.6 Authentication", + "Service": "generic" + } + ] + }, + { + "Id": "11.7.2", + "Description": "The relevant entities shall ensure that the strength of authentication is appropriate for the classification of the asset to be accessed.", + "Checks": [ + "entra_conditional_access_policy_require_mfa_for_management_api", + "entra_non_privileged_user_has_mfa", + "entra_privileged_user_has_mfa", + "entra_user_with_vm_access_has_mfa" + ], + "Attributes": [ + { + "Section": "11 ACCESS CONTROL (ARTICLE 21(2), POINTS (I) AND (J), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "11.7 Multi-factor authentication", + "Service": "generic" + } + ] + }, + { + "Id": "12.1.2.c", + "Description": "align the availability requirements of the assets with the delivery and recovery objectives set out in their business continuity and disaster recovery plans.", + "Checks": [ + "keyvault_recoverable" + ], + "Attributes": [ + { + "Section": "12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "12.1 Asset classification", + "Service": "keyvault" + } + ] + }, + { + "Id": "12.2.2.a", + "Description": "cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;", + "Checks": [ + "keyvault_key_expiration_set_in_non_rbac", + "keyvault_non_rbac_secret_expiration_set", + "keyvault_rbac_key_expiration_set", + "keyvault_rbac_secret_expiration_set", + "network_flow_log_more_than_90_days", + "postgresql_flexible_server_log_retention_days_greater_3", + "sqlserver_auditing_retention_90_days", + "storage_blob_public_access_level_is_disabled", + "storage_default_network_access_rule_is_denied", + "storage_ensure_azure_services_are_trusted_to_access_is_enabled", + "storage_ensure_encryption_with_customer_managed_keys", + "storage_ensure_minimum_tls_version_12", + "storage_ensure_private_endpoints_in_storage_accounts", + "storage_ensure_soft_delete_is_enabled", + "storage_infrastructure_encryption_is_enabled", + "storage_key_rotation_90_days", + "storage_secure_transfer_required_is_enabled" + ], + "Attributes": [ + { + "Section": "12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "12.2 Handling of assets", + "Service": "generic" + } + ] + }, + { + "Id": "12.2.2.b", + "Description": "provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the assets;", + "Checks": [ + "storage_ensure_soft_delete_is_enabled", + "keyvault_recoverable", + "storage_secure_transfer_required_is_enabled", + "app_minimum_tls_version_12", + "monitor_storage_account_with_activity_logs_cmk_encrypted", + "sqlserver_tde_encrypted_with_cmk", + "sqlserver_tde_encryption_enabled", + "storage_ensure_encryption_with_customer_managed_keys", + "storage_infrastructure_encryption_is_enabled", + "vm_ensure_attached_disks_encrypted_with_cmk", + "vm_ensure_unattached_disks_encrypted_with_cmk" + ], + "Attributes": [ + { + "Section": "12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "12.2 Handling of assets", + "Service": "generic" + } + ] + }, + { + "Id": "12.2.2.c", + "Description": "provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.", + "Checks": [ + "storage_secure_transfer_required_is_enabled", + "app_minimum_tls_version_12", + "mysql_flexible_server_minimum_tls_version_12", + "sqlserver_recommended_minimal_tls_version", + "storage_ensure_minimum_tls_version_12", + "sqlserver_tde_encrypted_with_cmk", + "sqlserver_tde_encryption_enabled" + ], + "Attributes": [ + { + "Section": "12 ASSET MANAGEMENT (ARTICLE 21(2), POINT (I), OF DIRECTIVE (EU) 2022/2555)", + "SubSection": "12.2 Handling of assets", + "Service": "generic" + } + ] + } + ] +} diff --git a/prowler/lib/check/models.py b/prowler/lib/check/models.py index fc1bf32cd5..3ed98d8c2b 100644 --- a/prowler/lib/check/models.py +++ b/prowler/lib/check/models.py @@ -329,9 +329,8 @@ class CheckMetadata(BaseModel): checks = set() if service: - # This is a special case for the AWS provider since `lambda` is a reserved keyword in Python - if service == "awslambda": - service = "lambda" + if service == "lambda": + service = "awslambda" checks = { check_name for check_name, check_metadata in bulk_checks_metadata.items() diff --git a/prowler/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high.metadata.json b/prowler/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high.metadata.json index 20fc3d837c..d8a4f1812b 100644 --- a/prowler/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high.metadata.json +++ b/prowler/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high.metadata.json @@ -1,16 +1,16 @@ { "Provider": "azure", "CheckID": "defender_ensure_notify_alerts_severity_is_high", - "CheckTitle": "Ensure That 'Notify about alerts with the following severity' is Set to 'High'", + "CheckTitle": "Ensure that email notifications are configured for alerts with a minimum severity of 'High' or lower", "CheckType": [], "ServiceName": "defender", "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AzureEmailNotifications", - "Description": "Microsoft Defender for Cloud emails the subscription owners whenever a high-severity alert is triggered for their subscription. You should provide a security contact email address as an additional email address.", - "Risk": "Microsoft Defender for Cloud emails the Subscription Owner to notify them about security alerts. Adding your Security Contact's email address to the 'Additional email addresses' field ensures that your organization's Security Team is included in these alerts. This ensures that the proper people are aware of any potential compromise in order to mitigate the risk in a timely fashion.", - "RelatedUrl": "https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details", + "Description": "Microsoft Defender for Cloud sends email notifications when alerts of a certain severity level or higher are triggered. By setting the minimum severity to 'High', 'Medium', or even 'Low', you ensure that alerts with equal or greater severity (e.g., High or Critical) are still delivered. Selecting a lower threshold like 'Low' results in more comprehensive alert coverage.", + "Risk": "If this setting is too restrictive (e.g., set to 'Critical' only), important security alerts with 'High' or 'Medium' severity might be missed. Ensuring that 'High' or a lower threshold is configured helps security teams stay informed about significant threats and respond in a timely manner.", + "RelatedUrl": "https://learn.microsoft.com/en-us/azure/defender-for-cloud/email-notifications-alerts#manage-notifications-on-email", "Remediation": { "Code": { "CLI": "", @@ -19,7 +19,7 @@ "Terraform": "https://docs.prowler.com/checks/azure/azure-general-policies/bc_azr_general_4#terraform" }, "Recommendation": { - "Text": "1. From Azure Home select the Portal Menu 2. Select Microsoft Defender for Cloud 3. Click on Environment Settings 4. Click on the appropriate Management Group, Subscription, or Workspace 5. Click on Email notifications 6. Enter a valid security contact email address (or multiple addresses separated by commas) in the Additional email addresses field 7. Click Save", + "Text": "1. From Azure Home select the Portal Menu. 2. Select Microsoft Defender for Cloud. 3. Click on Environment Settings. 4. Click on the appropriate Management Group, Subscription, or Workspace. 5. Click on Email notifications. 6. Under 'Notify about alerts with the following severity (or higher)', select at least 'High' (or optionally 'Medium' or 'Low' for broader coverage). 7. Click Save.", "Url": "https://docs.microsoft.com/en-us/rest/api/securitycenter/securitycontacts/list" } }, diff --git a/prowler/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high.py b/prowler/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high.py index b7154e99aa..34eaab9624 100644 --- a/prowler/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high.py +++ b/prowler/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high.py @@ -13,12 +13,15 @@ class defender_ensure_notify_alerts_severity_is_high(Check): for contact in security_contacts.values(): report = Check_Report_Azure(metadata=self.metadata(), resource=contact) report.subscription = subscription_name - report.status = "PASS" - report.status_extended = f"Notifiy alerts are enabled for severity high in subscription {subscription_name}." + report.status = "FAIL" + report.status_extended = f"Notifications are not enabled for alerts with a minimum severity of high or lower in subscription {subscription_name}." - if contact.alert_notifications_minimal_severity != "High": - report.status = "FAIL" - report.status_extended = f"Notifiy alerts are not enabled for severity high in subscription {subscription_name}." + if ( + contact.alert_notifications_minimal_severity != "Critical" + and contact.alert_notifications_minimal_severity != "" + ): + report.status = "PASS" + report.status_extended = f"Notifications are enabled for alerts with a minimum severity of high or lower ({contact.alert_notifications_minimal_severity}) in subscription {subscription_name}." findings.append(report) diff --git a/prowler/providers/m365/services/admincenter/admincenter_groups_not_public_visibility/admincenter_groups_not_public_visibility.py b/prowler/providers/m365/services/admincenter/admincenter_groups_not_public_visibility/admincenter_groups_not_public_visibility.py index d61fdec68d..f38f94f64f 100644 --- a/prowler/providers/m365/services/admincenter/admincenter_groups_not_public_visibility/admincenter_groups_not_public_visibility.py +++ b/prowler/providers/m365/services/admincenter/admincenter_groups_not_public_visibility/admincenter_groups_not_public_visibility.py @@ -36,7 +36,7 @@ class admincenter_groups_not_public_visibility(Check): report.status = "FAIL" report.status_extended = f"Group {group.name} has {group.visibility} visibility and should be Private." - if group.visibility != "Public": + if group.visibility and group.visibility != "Public": report.status = "PASS" report.status_extended = ( f"Group {group.name} has {group.visibility} visibility." diff --git a/prowler/providers/m365/services/admincenter/admincenter_service.py b/prowler/providers/m365/services/admincenter/admincenter_service.py index 2d9db75ddf..7c28ff15a2 100644 --- a/prowler/providers/m365/services/admincenter/admincenter_service.py +++ b/prowler/providers/m365/services/admincenter/admincenter_service.py @@ -11,8 +11,6 @@ from prowler.providers.m365.m365_provider import M365Provider class AdminCenter(M365Service): def __init__(self, provider: M365Provider): super().__init__(provider) - if self.powershell: - self.powershell.close() self.organization_config = None self.sharing_policy = None @@ -203,7 +201,7 @@ class DirectoryRole(BaseModel): class Group(BaseModel): id: str name: str - visibility: str + visibility: Optional[str] class Domain(BaseModel): diff --git a/prowler/providers/m365/services/entra/entra_service.py b/prowler/providers/m365/services/entra/entra_service.py index cea86ebfe7..e7159e1787 100644 --- a/prowler/providers/m365/services/entra/entra_service.py +++ b/prowler/providers/m365/services/entra/entra_service.py @@ -493,6 +493,7 @@ class ConditionalAccessGrantControl(Enum): BLOCK = "block" DOMAIN_JOINED_DEVICE = "domainJoinedDevice" PASSWORD_CHANGE = "passwordChange" + COMPLIANT_DEVICE = "compliantDevice" class GrantControlOperator(Enum): diff --git a/tests/lib/check/models_test.py b/tests/lib/check/models_test.py index 414de90288..fdbb8b6d70 100644 --- a/tests/lib/check/models_test.py +++ b/tests/lib/check/models_test.py @@ -37,7 +37,7 @@ mock_metadata_lambda = CheckMetadata( CheckID="awslambda_function_url_public", CheckTitle="Check 1", CheckType=["type1"], - ServiceName="lambda", + ServiceName="awslambda", SubServiceName="subservice1", ResourceIdTemplate="template1", Severity="high", diff --git a/tests/lib/outputs/compliance/fixtures.py b/tests/lib/outputs/compliance/fixtures.py index 427c467776..3dcf26f2c4 100644 --- a/tests/lib/outputs/compliance/fixtures.py +++ b/tests/lib/outputs/compliance/fixtures.py @@ -857,7 +857,6 @@ KISA_ISMSP_AWS = Compliance( ], ) -PROWLER_THREATSCORE_AWS_NAME = "prowler_threatscore_aws" PROWLER_THREATSCORE_AWS = Compliance( Framework="ProwlerThreatScore", Version="1.0", @@ -901,7 +900,6 @@ PROWLER_THREATSCORE_AWS = Compliance( ], ) -PROWLER_THREATSCORE_AZURE_NAME = "prowler_threatscore_azure" PROWLER_THREATSCORE_AZURE = Compliance( Framework="ProwlerThreatScore", Version="1.0", @@ -945,7 +943,6 @@ PROWLER_THREATSCORE_AZURE = Compliance( ], ) -PROWLER_THREATSCORE_GCP_NAME = "prowler_threatscore_gcp" PROWLER_THREATSCORE_GCP = Compliance( Framework="ProwlerThreatScore", Version="1.0", @@ -989,7 +986,6 @@ PROWLER_THREATSCORE_GCP = Compliance( ], ) -PROWLER_THREATSCORE_M365_NAME = "prowler_threatscore_m365" PROWLER_THREATSCORE_M365 = Compliance( Framework="ProwlerThreatScore", Version="1.0", diff --git a/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_aws_test.py b/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_aws_test.py index b4771b6139..bae12554ee 100644 --- a/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_aws_test.py +++ b/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_aws_test.py @@ -10,10 +10,7 @@ from prowler.lib.outputs.compliance.prowler_threatscore.models import ( from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_aws import ( ProwlerThreatScoreAWS, ) -from tests.lib.outputs.compliance.fixtures import ( - PROWLER_THREATSCORE_AWS, - PROWLER_THREATSCORE_AWS_NAME, -) +from tests.lib.outputs.compliance.fixtures import PROWLER_THREATSCORE_AWS from tests.lib.outputs.fixtures.fixtures import generate_finding_output from tests.providers.aws.utils import AWS_ACCOUNT_NUMBER, AWS_REGION_EU_WEST_1 @@ -24,9 +21,7 @@ class TestProwlerThreatScoreAWS: generate_finding_output(compliance={"ProwlerThreatScore-1.0": "1.1.1"}) ] - output = ProwlerThreatScoreAWS( - findings, PROWLER_THREATSCORE_AWS, PROWLER_THREATSCORE_AWS_NAME - ) + output = ProwlerThreatScoreAWS(findings, PROWLER_THREATSCORE_AWS) output_data = output.data[0] assert isinstance(output_data, ProwlerThreatScoreAWSModel) assert output_data.Provider == "aws" @@ -134,9 +129,7 @@ class TestProwlerThreatScoreAWS: findings = [ generate_finding_output(compliance={"ProwlerThreatScore-1.0": "1.1.1"}) ] - output = ProwlerThreatScoreAWS( - findings, PROWLER_THREATSCORE_AWS, PROWLER_THREATSCORE_AWS_NAME - ) + output = ProwlerThreatScoreAWS(findings, PROWLER_THREATSCORE_AWS) output._file_descriptor = mock_file with patch.object(mock_file, "close", return_value=None): diff --git a/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_azure_test.py b/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_azure_test.py index 64b79acb9e..d259641967 100644 --- a/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_azure_test.py +++ b/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_azure_test.py @@ -10,10 +10,7 @@ from prowler.lib.outputs.compliance.prowler_threatscore.models import ( from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_azure import ( ProwlerThreatScoreAzure, ) -from tests.lib.outputs.compliance.fixtures import ( - PROWLER_THREATSCORE_AZURE, - PROWLER_THREATSCORE_AZURE_NAME, -) +from tests.lib.outputs.compliance.fixtures import PROWLER_THREATSCORE_AZURE from tests.lib.outputs.fixtures.fixtures import generate_finding_output from tests.providers.azure.azure_fixtures import ( AZURE_SUBSCRIPTION_ID, @@ -33,9 +30,7 @@ class TestProwlerThreatScoreAzure: ) ] - output = ProwlerThreatScoreAzure( - findings, PROWLER_THREATSCORE_AZURE, PROWLER_THREATSCORE_AZURE_NAME - ) + output = ProwlerThreatScoreAzure(findings, PROWLER_THREATSCORE_AZURE) output_data = output.data[0] assert isinstance(output_data, ProwlerThreatScoreAzureModel) assert output_data.Provider == "azure" @@ -144,9 +139,7 @@ class TestProwlerThreatScoreAzure: findings = [ generate_finding_output(compliance={"ProwlerThreatScore-1.0": "1.1.1"}) ] - output = ProwlerThreatScoreAzure( - findings, PROWLER_THREATSCORE_AZURE, PROWLER_THREATSCORE_AZURE_NAME - ) + output = ProwlerThreatScoreAzure(findings, PROWLER_THREATSCORE_AZURE) output._file_descriptor = mock_file with patch.object(mock_file, "close", return_value=None): diff --git a/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_gcp_test.py b/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_gcp_test.py index 4727cc748c..5318392ea3 100644 --- a/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_gcp_test.py +++ b/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_gcp_test.py @@ -10,10 +10,7 @@ from prowler.lib.outputs.compliance.prowler_threatscore.models import ( from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_gcp import ( ProwlerThreatScoreGCP, ) -from tests.lib.outputs.compliance.fixtures import ( - PROWLER_THREATSCORE_GCP, - PROWLER_THREATSCORE_GCP_NAME, -) +from tests.lib.outputs.compliance.fixtures import PROWLER_THREATSCORE_GCP from tests.lib.outputs.fixtures.fixtures import generate_finding_output from tests.providers.gcp.gcp_fixtures import GCP_PROJECT_ID @@ -30,9 +27,7 @@ class TestProwlerThreatScoreGCP: ) ] - output = ProwlerThreatScoreGCP( - findings, PROWLER_THREATSCORE_GCP, PROWLER_THREATSCORE_GCP_NAME - ) + output = ProwlerThreatScoreGCP(findings, PROWLER_THREATSCORE_GCP) output_data = output.data[0] assert isinstance(output_data, ProwlerThreatScoreGCPModel) assert output_data.Provider == "gcp" @@ -140,9 +135,7 @@ class TestProwlerThreatScoreGCP: findings = [ generate_finding_output(compliance={"ProwlerThreatScore-1.0": "1.1.1"}) ] - output = ProwlerThreatScoreGCP( - findings, PROWLER_THREATSCORE_GCP, PROWLER_THREATSCORE_GCP_NAME - ) + output = ProwlerThreatScoreGCP(findings, PROWLER_THREATSCORE_GCP) output._file_descriptor = mock_file with patch.object(mock_file, "close", return_value=None): diff --git a/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_m365_test.py b/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_m365_test.py index ea0b3e529f..fa43a336ec 100644 --- a/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_m365_test.py +++ b/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_m365_test.py @@ -10,10 +10,7 @@ from prowler.lib.outputs.compliance.prowler_threatscore.models import ( from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_m365 import ( ProwlerThreatScoreM365, ) -from tests.lib.outputs.compliance.fixtures import ( - PROWLER_THREATSCORE_M365, - PROWLER_THREATSCORE_M365_NAME, -) +from tests.lib.outputs.compliance.fixtures import PROWLER_THREATSCORE_M365 from tests.lib.outputs.fixtures.fixtures import generate_finding_output from tests.providers.m365.m365_fixtures import TENANT_ID @@ -30,9 +27,7 @@ class TestProwlerThreatScoreM365: ) ] - output = ProwlerThreatScoreM365( - findings, PROWLER_THREATSCORE_M365, PROWLER_THREATSCORE_M365_NAME - ) + output = ProwlerThreatScoreM365(findings, PROWLER_THREATSCORE_M365) output_data = output.data[0] assert isinstance(output_data, ProwlerThreatScoreM365Model) assert output_data.Provider == "m365" @@ -142,9 +137,7 @@ class TestProwlerThreatScoreM365: findings = [ generate_finding_output(compliance={"ProwlerThreatScore-1.0": "1.1.1"}) ] - output = ProwlerThreatScoreM365( - findings, PROWLER_THREATSCORE_M365, PROWLER_THREATSCORE_M365_NAME - ) + output = ProwlerThreatScoreM365(findings, PROWLER_THREATSCORE_M365) output._file_descriptor = mock_file with patch.object(mock_file, "close", return_value=None): diff --git a/tests/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high_test.py b/tests/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high_test.py index a2764139c6..23aadef795 100644 --- a/tests/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high_test.py +++ b/tests/providers/azure/services/defender/defender_ensure_notify_alerts_severity_is_high/defender_ensure_notify_alerts_severity_is_high_test.py @@ -31,7 +31,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high: result = check.execute() assert len(result) == 0 - def test_defender_severity_alerts_low(self): + def test_defender_severity_alerts_critical(self): resource_id = str(uuid4()) defender_client = mock.MagicMock defender_client.security_contacts = { @@ -41,7 +41,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high: name="default", emails="", phone="", - alert_notifications_minimal_severity="Low", + alert_notifications_minimal_severity="Critical", alert_notifications_state="On", notified_roles=["Contributor"], notified_roles_state="On", @@ -69,7 +69,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high: assert result[0].status == "FAIL" assert ( result[0].status_extended - == f"Notifiy alerts are not enabled for severity high in subscription {AZURE_SUBSCRIPTION_ID}." + == f"Notifications are not enabled for alerts with a minimum severity of high or lower in subscription {AZURE_SUBSCRIPTION_ID}." ) assert result[0].subscription == AZURE_SUBSCRIPTION_ID assert result[0].resource_name == "default" @@ -113,7 +113,51 @@ class Test_defender_ensure_notify_alerts_severity_is_high: assert result[0].status == "PASS" assert ( result[0].status_extended - == f"Notifiy alerts are enabled for severity high in subscription {AZURE_SUBSCRIPTION_ID}." + == f"Notifications are enabled for alerts with a minimum severity of high or lower (High) in subscription {AZURE_SUBSCRIPTION_ID}." + ) + assert result[0].subscription == AZURE_SUBSCRIPTION_ID + assert result[0].resource_name == "default" + assert result[0].resource_id == resource_id + + def test_defender_severity_alerts_low(self): + resource_id = str(uuid4()) + defender_client = mock.MagicMock + defender_client.security_contacts = { + AZURE_SUBSCRIPTION_ID: { + resource_id: SecurityContacts( + resource_id=resource_id, + name="default", + emails="", + phone="", + alert_notifications_minimal_severity="Low", + alert_notifications_state="On", + notified_roles=["Contributor"], + notified_roles_state="On", + ) + } + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.defender.defender_ensure_notify_alerts_severity_is_high.defender_ensure_notify_alerts_severity_is_high.defender_client", + new=defender_client, + ), + ): + from prowler.providers.azure.services.defender.defender_ensure_notify_alerts_severity_is_high.defender_ensure_notify_alerts_severity_is_high import ( + defender_ensure_notify_alerts_severity_is_high, + ) + + check = defender_ensure_notify_alerts_severity_is_high() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Notifications are enabled for alerts with a minimum severity of high or lower (Low) in subscription {AZURE_SUBSCRIPTION_ID}." ) assert result[0].subscription == AZURE_SUBSCRIPTION_ID assert result[0].resource_name == "default" @@ -156,7 +200,7 @@ class Test_defender_ensure_notify_alerts_severity_is_high: assert result[0].status == "FAIL" assert ( result[0].status_extended - == f"Notifiy alerts are not enabled for severity high in subscription {AZURE_SUBSCRIPTION_ID}." + == f"Notifications are not enabled for alerts with a minimum severity of high or lower in subscription {AZURE_SUBSCRIPTION_ID}." ) assert result[0].subscription == AZURE_SUBSCRIPTION_ID assert result[0].resource_name == "default" diff --git a/tests/providers/azure/services/entra/entra_service_test.py b/tests/providers/azure/services/entra/entra_service_test.py index b09b6edaa4..11cd49b40c 100644 --- a/tests/providers/azure/services/entra/entra_service_test.py +++ b/tests/providers/azure/services/entra/entra_service_test.py @@ -93,7 +93,7 @@ async def mock_entra_get_conditional_access_policy(_): "include": ["797f4846-ba00-4fd7-ba43-dac1f8f63013"], "exclude": [], }, - access_controls={"grant": ["MFA"], "block": []}, + access_controls={"grant": ["MFA", "compliantDevice"], "block": []}, ) } } @@ -216,7 +216,7 @@ class Test_Entra_Service: ) assert entra_client.conditional_access_policy[DOMAIN]["id-1"].access_controls[ "grant" - ] == ["MFA"] + ] == ["MFA", "compliantDevice"] assert ( entra_client.conditional_access_policy[DOMAIN]["id-1"].access_controls[ "block" diff --git a/tests/providers/m365/services/admincenter/admincenter_groups_not_public_visibility/admincenter_groups_not_public_visibility_test.py b/tests/providers/m365/services/admincenter/admincenter_groups_not_public_visibility/admincenter_groups_not_public_visibility_test.py index 81209d67a4..7391bd102e 100644 --- a/tests/providers/m365/services/admincenter/admincenter_groups_not_public_visibility/admincenter_groups_not_public_visibility_test.py +++ b/tests/providers/m365/services/admincenter/admincenter_groups_not_public_visibility/admincenter_groups_not_public_visibility_test.py @@ -114,3 +114,91 @@ class Test_admincenter_groups_not_public_visibility: assert result[0].resource_name == "Group1" assert result[0].resource_id == id_group1 assert result[0].location == "global" + + def test_admincenter_group_public_visibility(self): + admincenter_client = mock.MagicMock + admincenter_client.audited_tenant = "audited_tenant" + admincenter_client.audited_domain = DOMAIN + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_m365_provider(), + ), + mock.patch( + "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online" + ), + mock.patch( + "prowler.providers.m365.services.admincenter.admincenter_groups_not_public_visibility.admincenter_groups_not_public_visibility.admincenter_client", + new=admincenter_client, + ), + ): + from prowler.providers.m365.services.admincenter.admincenter_groups_not_public_visibility.admincenter_groups_not_public_visibility import ( + admincenter_groups_not_public_visibility, + ) + from prowler.providers.m365.services.admincenter.admincenter_service import ( + Group, + ) + + id_group1 = str(uuid4()) + + admincenter_client.groups = { + id_group1: Group(id=id_group1, name="Group1", visibility="Public"), + } + + check = admincenter_groups_not_public_visibility() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == "Group Group1 has Public visibility and should be Private." + ) + assert result[0].resource == admincenter_client.groups[id_group1].dict() + assert result[0].resource_name == "Group1" + assert result[0].resource_id == id_group1 + assert result[0].location == "global" + + def test_admincenter_group_none_visibility(self): + admincenter_client = mock.MagicMock + admincenter_client.audited_tenant = "audited_tenant" + admincenter_client.audited_domain = DOMAIN + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_m365_provider(), + ), + mock.patch( + "prowler.providers.m365.lib.powershell.m365_powershell.M365PowerShell.connect_exchange_online" + ), + mock.patch( + "prowler.providers.m365.services.admincenter.admincenter_groups_not_public_visibility.admincenter_groups_not_public_visibility.admincenter_client", + new=admincenter_client, + ), + ): + from prowler.providers.m365.services.admincenter.admincenter_groups_not_public_visibility.admincenter_groups_not_public_visibility import ( + admincenter_groups_not_public_visibility, + ) + from prowler.providers.m365.services.admincenter.admincenter_service import ( + Group, + ) + + id_group1 = str(uuid4()) + + admincenter_client.groups = { + id_group1: Group(id=id_group1, name="Group1", visibility=None), + } + + check = admincenter_groups_not_public_visibility() + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == "Group Group1 has None visibility and should be Private." + ) + assert result[0].resource == admincenter_client.groups[id_group1].dict() + assert result[0].resource_name == "Group1" + assert result[0].resource_id == id_group1 + assert result[0].location == "global" diff --git a/tests/providers/m365/services/entra/microsoft365_entra_service_test.py b/tests/providers/m365/services/entra/microsoft365_entra_service_test.py index 46e92aa1f1..defe476e4b 100644 --- a/tests/providers/m365/services/entra/microsoft365_entra_service_test.py +++ b/tests/providers/m365/services/entra/microsoft365_entra_service_test.py @@ -68,7 +68,10 @@ async def mock_entra_get_conditional_access_policies(_): ), ), grant_controls=GrantControls( - built_in_controls=[ConditionalAccessGrantControl.BLOCK], + built_in_controls=[ + ConditionalAccessGrantControl.BLOCK, + ConditionalAccessGrantControl.COMPLIANT_DEVICE, + ], operator=GrantControlOperator.OR, authentication_strength=AuthenticationStrength.PHISHING_RESISTANT_MFA, ), @@ -211,7 +214,10 @@ class Test_Entra_Service: ), ), grant_controls=GrantControls( - built_in_controls=[ConditionalAccessGrantControl.BLOCK], + built_in_controls=[ + ConditionalAccessGrantControl.BLOCK, + ConditionalAccessGrantControl.COMPLIANT_DEVICE, + ], operator=GrantControlOperator.OR, authentication_strength=AuthenticationStrength.PHISHING_RESISTANT_MFA, ), diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md index 6ba9950320..01480c765e 100644 --- a/ui/CHANGELOG.md +++ b/ui/CHANGELOG.md @@ -11,6 +11,11 @@ All notable changes to the **Prowler UI** are documented in this file. - Possibility to edit the organization name. [(#7829)](https://github.com/prowler-cloud/prowler/pull/7829) - Add `Provider UID` filter to scans page. [(#7820)](https://github.com/prowler-cloud/prowler/pull/7820) - Download report behaviour updated to show feedback based on API response. [(#7758)](https://github.com/prowler-cloud/prowler/pull/7758) +- Missing KISA and ProwlerThreat icons added to the compliance page. [(#7860)(https://github.com/prowler-cloud/prowler/pull/7860)] +- Improve CustomDropdownFilter component. [(#7868)(https://github.com/prowler-cloud/prowler/pull/7868)] + +### 🐞 Fixes +- Retrieve more than 10 scans in /compliance page. [(#7865)](https://github.com/prowler-cloud/prowler/pull/7865) --- diff --git a/ui/app/(prowler)/compliance/page.tsx b/ui/app/(prowler)/compliance/page.tsx index e3dab9e762..56b6dc9d62 100644 --- a/ui/app/(prowler)/compliance/page.tsx +++ b/ui/app/(prowler)/compliance/page.tsx @@ -33,6 +33,7 @@ export default async function Compliance({ filters: { "filter[state]": "completed", }, + pageSize: 50, }); if (!scansData?.data) { diff --git a/ui/components/icons/compliance/IconCompliance.tsx b/ui/components/icons/compliance/IconCompliance.tsx index 543f6c68c8..c73d0d14ee 100644 --- a/ui/components/icons/compliance/IconCompliance.tsx +++ b/ui/components/icons/compliance/IconCompliance.tsx @@ -8,9 +8,12 @@ import GDPRLogo from "./gdpr.svg"; import GxPLogo from "./gxp-aws.svg"; import HIPAALogo from "./hipaa.svg"; import ISOLogo from "./iso-27001.svg"; +import KISALogo from "./kisa.svg"; import MITRELogo from "./mitre-attack.svg"; +import NIS2Logo from "./nis2.svg"; import NISTLogo from "./nist.svg"; import PCILogo from "./pci-dss.svg"; +import PROWLERTHREATLogo from "./prowlerThreat.svg"; import RBILogo from "./rbi.svg"; import SOC2Logo from "./soc2.svg"; @@ -60,4 +63,13 @@ export const getComplianceIcon = (complianceTitle: string) => { if (complianceTitle.toLowerCase().includes("soc2")) { return SOC2Logo; } + if (complianceTitle.toLowerCase().includes("kisa")) { + return KISALogo; + } + if (complianceTitle.toLowerCase().includes("prowlerthreatscore")) { + return PROWLERTHREATLogo; + } + if (complianceTitle.toLowerCase().includes("nis2")) { + return NIS2Logo; + } }; diff --git a/ui/components/icons/compliance/kisa.svg b/ui/components/icons/compliance/kisa.svg new file mode 100644 index 0000000000..8450a6566d --- /dev/null +++ b/ui/components/icons/compliance/kisa.svg @@ -0,0 +1,439 @@ + +Created with Fabric.js 5.2.4 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/ui/components/icons/compliance/nis2.svg b/ui/components/icons/compliance/nis2.svg new file mode 100644 index 0000000000..a8773aed8f --- /dev/null +++ b/ui/components/icons/compliance/nis2.svg @@ -0,0 +1,28966 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/ui/components/icons/compliance/prowlerThreat.svg b/ui/components/icons/compliance/prowlerThreat.svg new file mode 100644 index 0000000000..f14d50c323 --- /dev/null +++ b/ui/components/icons/compliance/prowlerThreat.svg @@ -0,0 +1,16 @@ + + + + + + + + diff --git a/ui/components/ui/custom/custom-dropdown-filter.tsx b/ui/components/ui/custom/custom-dropdown-filter.tsx index 5664122e89..254efa5024 100644 --- a/ui/components/ui/custom/custom-dropdown-filter.tsx +++ b/ui/components/ui/custom/custom-dropdown-filter.tsx @@ -10,167 +10,183 @@ import { PopoverTrigger, ScrollShadow, } from "@nextui-org/react"; -import { XCircle } from "lucide-react"; +import { ChevronDown, X } from "lucide-react"; import { useSearchParams } from "next/navigation"; import React, { useCallback, useEffect, useMemo, useState } from "react"; -import { PlusCircleIcon } from "@/components/icons"; -import { useUrlFilters } from "@/hooks/use-url-filters"; import { CustomDropdownFilterProps } from "@/types"; import { EntityInfoShort } from "../entities"; -const filterSelectedClass = - "inline-flex items-center border py-1 text-xs transition-colors border-transparent bg-default-500 text-secondary-foreground hover:bg-default-500/80 rounded-md px-2 font-normal"; - -export const CustomDropdownFilter: React.FC = ({ +export const CustomDropdownFilter = ({ filter, onFilterChange, -}) => { +}: CustomDropdownFilterProps) => { const searchParams = useSearchParams(); - const { clearFilter } = useUrlFilters(); const [groupSelected, setGroupSelected] = useState(new Set()); - const [pendingClearFilter, setPendingClearFilter] = useState( - null, + const [isOpen, setIsOpen] = useState(false); + + const filterValues = useMemo(() => filter?.values || [], [filter?.values]); + const selectedValues = Array.from(groupSelected).filter( + (value) => value !== "all", ); + const isAllSelected = + selectedValues.length === filterValues.length && filterValues.length > 0; - const allFilterKeys = useMemo(() => filter?.values || [], [filter?.values]); - - const getActiveFilter = useMemo(() => { - const currentFilters: Record = {}; - Array.from(searchParams.entries()).forEach(([key, value]) => { - if (key.startsWith("filter[") && key.endsWith("]")) { - const filterKey = key.slice(7, -1); - if (filter && filter.key === filterKey) { - // eslint-disable-next-line security/detect-object-injection - currentFilters[filterKey] = value; - } - } - }); - return currentFilters; - }, [searchParams, filter]); - - const memoizedFilterValues = useMemo( - () => filter?.values || [], - [filter?.values], - ); + const activeFilterValue = useMemo(() => { + const filterParam = searchParams.get(`filter[${filter?.key}]`); + return filterParam ? filterParam.split(",") : []; + }, [searchParams, filter?.key]); + // Sync URL state with component state useEffect(() => { - if (filter && getActiveFilter[filter.key]) { - const activeValues = getActiveFilter[filter.key].split(","); - const newSelection = new Set(activeValues); - if (newSelection.size === memoizedFilterValues.length) { + if (activeFilterValue.length > 0) { + const newSelection = new Set(activeFilterValue); + if (newSelection.size === filterValues.length) { newSelection.add("all"); } setGroupSelected(newSelection); } else { setGroupSelected(new Set()); } - }, [getActiveFilter, filter?.key, memoizedFilterValues, filter]); + }, [activeFilterValue, filterValues.length]); + + const updateSelection = useCallback( + (newValues: string[]) => { + const actualValues = newValues.filter((key) => key !== "all"); + const newSelection = new Set(actualValues); + + // Auto-add "all" if all items are selected + if ( + actualValues.length === filterValues.length && + filterValues.length > 0 + ) { + newSelection.add("all"); + } + + setGroupSelected(newSelection); + + // Notify parent with actual values (excluding "all") + onFilterChange?.(filter.key, actualValues); + }, + [filterValues.length, onFilterChange, filter.key], + ); const onSelectionChange = useCallback( (keys: string[]) => { - setGroupSelected((prevGroupSelected) => { - const newSelection = new Set(keys); + const currentSelection = Array.from(groupSelected); + const newKeys = new Set(keys); + const oldKeys = new Set(currentSelection); - if ( - newSelection.size === allFilterKeys.length && - !newSelection.has("all") - ) { - return new Set(["all", ...allFilterKeys]); - } else if (prevGroupSelected.has("all")) { - newSelection.delete("all"); - return new Set(allFilterKeys.filter((key) => newSelection.has(key))); - } - return newSelection; - }); + // Check if "all" was just toggled + const allWasSelected = oldKeys.has("all"); + const allIsSelected = newKeys.has("all"); - if (onFilterChange && filter) { - const selectedValues = keys.filter((key) => key !== "all"); - onFilterChange(filter.key, selectedValues); + if (allIsSelected && !allWasSelected) { + // "all" was just selected - select all items + updateSelection(filterValues); + } else if (!allIsSelected && allWasSelected) { + // "all" was just deselected - deselect all items + updateSelection([]); + } else if (allIsSelected && allWasSelected) { + // "all" was already selected, but individual items changed + // Remove "all" and keep only the individual selections + const individualSelections = keys.filter((key) => key !== "all"); + updateSelection(individualSelections); + } else { + // Normal individual selection without "all" + updateSelection(keys); } }, - [allFilterKeys, onFilterChange, filter], + [groupSelected, updateSelection, filterValues], ); - const handleSelectAllClick = useCallback(() => { - setGroupSelected((prevGroupSelected: Set) => { - const newSelection: Set = prevGroupSelected.has("all") - ? new Set() - : new Set(["all", ...allFilterKeys]); + const handleClearAll = useCallback( + (e: React.MouseEvent) => { + e.stopPropagation(); + updateSelection([]); + }, + [updateSelection], + ); - if (onFilterChange && filter) { - const selectedValues = Array.from(newSelection).filter( - (key) => key !== "all", - ); - onFilterChange(filter.key, selectedValues); - } - - return newSelection; - }); - }, [allFilterKeys, onFilterChange, filter]); - - // Update the pending clear filter - const onClearFilter = useCallback((filterKey: string) => { - setPendingClearFilter(filterKey); - }, []); - - // Execute the update in the router after the render - useEffect(() => { - if (pendingClearFilter && filter) { - clearFilter(pendingClearFilter); - setPendingClearFilter(null); // Reset the state - } - }, [pendingClearFilter, clearFilter, filter]); + const getDisplayLabel = useCallback( + (value: string) => { + const entity = filter.valueLabelMapping?.find((entry) => entry[value])?.[ + value + ]; + return entity?.alias || entity?.uid || value; + }, + [filter.valueLabelMapping], + ); return ( -
- - -
+
= ({ wrapper: "checkbox-update", }} value="all" - isSelected={groupSelected.has("all")} - onClick={handleSelectAllClick} > Select All - {memoizedFilterValues.map((value) => { - // Find the corresponding entity from valueLabelMapping - const matchingEntry = filter.valueLabelMapping?.find( + {filterValues.map((value) => { + const entity = filter.valueLabelMapping?.find( (entry) => entry[value], - ); - const entity = matchingEntry?.[value]; + )?.[value]; return (