Update all rules and rulesets

silverhack · Jan 8, 2025 · 4b75f4a · 4b75f4a
1 parent 2adfee1
commit 4b75f4a
Show file tree

Hide file tree

Showing 331 changed files with 19,226 additions and 16,976 deletions.
diff --git a/....4/azure-activity-log-missing-alerts.json → ....0/azure-activity-log-missing-alerts.json b/....4/azure-activity-log-missing-alerts.json → ....0/azure-activity-log-missing-alerts.json
@@ -1,4 +1,4 @@
-{
+{
   "args": [
 
   ],
@@ -27,7 +27,8 @@
     {
       "name": "CIS Microsoft Azure Foundations",
       "version": "_ARG_3_",
-      "reference": "_ARG_4_"
+      "reference": "_ARG_4_",
+	  "profile": "Level 1"
     }
   ],
   "level": "medium",
@@ -79,13 +80,15 @@
       ],
       "actions": {
         "objectData": {
-          "expand": [
+          "properties": [
             "*"
           ],
+          "expandObject": null,
           "limit": null
         },
         "showGoToButton": false,
-        "showModalButton": false
+        "showModalButton": false,
+        "directLink": null
       }
     },
     "text": {
@@ -118,3 +121,4 @@
 
   ]
 }
+
diff --git a/rules/findings/Azure/Activity Log/CIS1.4/azure-activity-log-disabled-alerts.json b/rules/findings/Azure/Activity Log/CIS1.4/azure-activity-log-disabled-alerts.json
diff --git a/rules/findings/Azure/App Service/CIS3.0/azure-app-service-basic-auth-enabled.json b/rules/findings/Azure/App Service/CIS3.0/azure-app-service-basic-auth-enabled.json
@@ -0,0 +1,103 @@
+{
+  "args": [
+
+  ],
+  "provider": "Azure",
+  "serviceType": "App Services",
+  "serviceName": "Hosted Services",
+  "displayName": "Ensure that 'Basic Authentication' is 'Disabled'",
+  "description": "Basic Authentication provides the ability to create identities and authentication for an App Service without a centralized Identity Provider. For a more effective, capable, and secure solution for Identity, Authentication, Authorization, and Accountability, a centralized Identity Provider such as Entra ID is strongly advised.",
+  "rationale": "Basic Authentication introduces an identity silo which can produce privileged access to a resource. This can be exploited in numerous ways and represents a significant vulnerability and attack vector.",
+  "impact": "An Identity Provider that can be used by the App Service for authenticating users is required.",
+  "remediation": {
+    "text": null,
+    "code": {
+      "powerShell": null,
+      "iac": null,
+      "terraform": null,
+      "other": null
+    }
+  },
+  "recommendation": null,
+  "references": [
+	"https://learn.microsoft.com/en-us/azure/app-service/configure-basic-auth-disable?tabs=portal"
+  ],
+  "compliance": [
+    {
+      "name": "CIS Microsoft Azure Foundations",
+      "version": "3.0.0",
+      "reference": "9.6",
+	  "profile": "Level 1"
+    }
+  ],
+  "level": "medium",
+  "tags": [
+
+  ],
+  "rule": {
+    "path": "",
+    "subPath": null,
+    "selectCondition": {
+
+    },
+    "query": [
+    ],
+    "shouldExist": null,
+    "returnObject": null,
+    "removeIfNotExists": null
+  },
+  "output": {
+    "html": {
+      "data": {
+        "expandObject": null
+      },
+      "table": "asList",
+      "decorate": [
+
+      ],
+      "emphasis": [
+      ],
+      "actions": {
+        "objectData": {
+          "properties": [
+
+          ],
+          "expandObject": null,
+          "limit": null
+        },
+        "showGoToButton": null,
+        "showModalButton": null,
+        "directLink": null
+      }
+    },
+    "text": {
+      "data": {
+        "properties": {
+
+        },
+        "expandObject": null
+      },
+      "status": {
+        "keyName": [
+
+        ],
+        "message": "",
+        "defaultMessage": null
+      },
+      "properties": {
+        "resourceName": null,
+        "resourceId": null,
+        "resourceType": null
+      },
+      "onlyStatus": false
+    }
+  },
+  "idSuffix": "app_service_basic_auth_enabled",
+  "notes": [
+
+  ],
+  "categories": [
+
+  ]
+}
+
diff --git a/rules/findings/Azure/App Service/CIS3.0/azure-app-service-lack-keyvault-secret.json b/rules/findings/Azure/App Service/CIS3.0/azure-app-service-lack-keyvault-secret.json
@@ -0,0 +1,103 @@
+{
+  "args": [
+
+  ],
+  "provider": "Azure",
+  "serviceType": "App Services",
+  "serviceName": "Hosted Services",
+  "displayName": "Ensure Azure Key Vaults are Used to Store Secrets",
+  "description": "Azure Key Vault will store multiple types of sensitive information such as encryption keys, certificate thumbprints, and Managed Identity Credentials. Access to these 'Secrets' can be controlled through granular permissions.",
+  "rationale": "The credentials given to an application have permissions to create, delete, or modify data stored within the systems they access. If these credentials are stored within the application itself, anyone with access to the application or a copy of the code has access to them. Storing within Azure Key Vault as secrets increases security by controlling access. This also allows for updates of the credentials without redeploying the entire application.",
+  "impact": "Integrating references to secrets within the key vault are required to be specifically integrated within the application code. This will require additional configuration to be made during the writing of an application, or refactoring of an already written one. There are also additional costs that are charged per 10000 requests to the Key Vault.",
+  "remediation": {
+    "text": "",
+    "code": {
+      "powerShell": null,
+      "iac": null,
+      "terraform": null,
+      "other": null
+    }
+  },
+  "recommendation": null,
+  "references": [
+    "https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references",
+	"https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management#im-3-manage-application-identities-securely-and-automatically",
+	"https://docs.microsoft.com/en-us/cli/azure/keyvault?view=azure-cli-latest"
+  ],
+  "compliance": [
+    {
+      "name": "CIS Microsoft Azure Foundations",
+      "version": "3.0.0",
+      "reference": "9.11",
+	  "profile": "Level 2"
+    }
+  ],
+  "level": "low",
+  "tags": [
+
+  ],
+  "rule": {
+    "path": "",
+    "subPath": null,
+    "selectCondition": {
+
+    },
+    "query": [
+    ],
+    "shouldExist": null,
+    "returnObject": null,
+    "removeIfNotExists": null
+  },
+  "output": {
+    "html": {
+      "data": {
+        "expandObject": null
+      },
+      "table": "Normal",
+      "decorate": [
+
+      ],
+      "emphasis": [
+
+      ],
+      "actions": {
+        "objectData": {
+          "expandObject": null,
+          "limit": null
+        },
+        "showGoToButton": "True",
+        "showModalButton": "True",
+        "directLink": null
+      }
+    },
+    "text": {
+      "data": {
+        "properties": {
+
+        },
+        "expandObject": null
+      },
+      "status": {
+        "keyName": [
+
+        ],
+        "message": "",
+        "defaultMessage": null
+      },
+      "properties": {
+        "resourceName": null,
+        "resourceId": null,
+        "resourceType": null
+      },
+      "onlyStatus": false
+    }
+  },
+  "idSuffix": "app_service_lack_keyvault_configuration",
+  "notes": [
+
+  ],
+  "categories": [
+
+  ]
+}
+