@etcsec-com/etc-collector 1.4.0

package/src/services/audit/detectors/azure/conditional-access.detector.ts

@@ -0,0 +1,186 @@
+/**
+ * Conditional Access Detector for Azure AD
+ *
+ * Detects Conditional Access policy vulnerabilities in Azure AD/Entra ID.
+ * Story 1.8: Azure Vulnerability Detection Engine
+ *
+ * Vulnerabilities detected (6):
+ * CRITICAL (2):
+ * - AZURE_NO_MFA_CA_POLICY
+ * - AZURE_NO_LEGACY_AUTH_BLOCK
+ *
+ * MEDIUM (3):
+ * - AZURE_CA_POLICY_DISABLED
+ * - AZURE_CA_POLICY_HAS_EXCLUSIONS
+ * - AZURE_NO_DEVICE_COMPLIANCE_CA
+ *
+ * LOW (1):
+ * - AZURE_CA_POLICY_REPORT_ONLY
+ */
+
+import { AzurePolicy } from '../../../../types/azure.types';
+import { Finding } from '../../../../types/finding.types';
+
+/**
+ * Check for absence of MFA enforcement via Conditional Access
+ */
+export function detectNoMfaCaPolicy(policies: AzurePolicy[], includeDetails: boolean): Finding {
+  const hasMfaPolicy = policies.some((policy) => {
+    if (policy.state !== 'enabled') return false;
+
+    const grantControls = (policy as any).grantControls;
+    if (!grantControls) return false;
+
+    const builtInControls = grantControls.builtInControls || [];
+    return builtInControls.includes('mfa');
+  });
+
+  return {
+    type: 'AZURE_NO_MFA_CA_POLICY',
+    severity: 'critical',
+    category: 'conditionalAccess',
+    title: 'No MFA Enforcement via Conditional Access',
+    description: 'No Conditional Access policy enforcing MFA. Users can authenticate without multi-factor authentication.',
+    count: hasMfaPolicy ? 0 : 1,
+    affectedEntities: includeDetails && !hasMfaPolicy ? ['Tenant-wide'] : undefined,
+  };
+}
+
+/**
+ * Check for absence of legacy authentication blocking
+ */
+export function detectNoLegacyAuthBlock(policies: AzurePolicy[], includeDetails: boolean): Finding {
+  const hasLegacyAuthBlock = policies.some((policy) => {
+    if (policy.state !== 'enabled') return false;
+
+    const conditions = (policy as any).conditions;
+    const clientAppTypes = conditions?.clientAppTypes || [];
+
+    // Check if policy blocks legacy authentication clients
+    const blocksLegacyAuth =
+      clientAppTypes.includes('exchangeActiveSync') ||
+      clientAppTypes.includes('other') ||
+      (clientAppTypes.includes('all') && (policy as any).grantControls?.builtInControls?.includes('block'));
+
+    return blocksLegacyAuth;
+  });
+
+  return {
+    type: 'AZURE_NO_LEGACY_AUTH_BLOCK',
+    severity: 'critical',
+    category: 'conditionalAccess',
+    title: 'No Policy Blocking Legacy Authentication',
+    description: 'No Conditional Access policy blocking legacy authentication protocols. Legacy auth bypasses MFA.',
+    count: hasLegacyAuthBlock ? 0 : 1,
+    affectedEntities: includeDetails && !hasLegacyAuthBlock ? ['Tenant-wide'] : undefined,
+  };
+}
+
+/**
+ * Check for disabled Conditional Access policies
+ */
+export function detectCaPolicyDisabled(policies: AzurePolicy[], includeDetails: boolean): Finding {
+  const affected = policies.filter((policy) => {
+    return policy.state === 'disabled';
+  });
+
+  return {
+    type: 'AZURE_CA_POLICY_DISABLED',
+    severity: 'medium',
+    category: 'conditionalAccess',
+    title: 'Disabled Conditional Access Policy',
+    description: 'Conditional Access policy is disabled. Security controls are not being enforced.',
+    count: affected.length,
+    affectedEntities: includeDetails ? affected.map((p) => p.displayName) : undefined,
+  };
+}
+
+/**
+ * Check for CA policies with user/group exclusions
+ */
+export function detectCaPolicyHasExclusions(policies: AzurePolicy[], includeDetails: boolean): Finding {
+  const affected = policies.filter((policy) => {
+    if (policy.state !== 'enabled') return false;
+
+    const conditions = (policy as any).conditions;
+    const users = conditions?.users;
+
+    const hasExclusions =
+      (users?.excludeUsers && users.excludeUsers.length > 0) ||
+      (users?.excludeGroups && users.excludeGroups.length > 0) ||
+      (users?.excludeRoles && users.excludeRoles.length > 0);
+
+    return hasExclusions;
+  });
+
+  return {
+    type: 'AZURE_CA_POLICY_HAS_EXCLUSIONS',
+    severity: 'medium',
+    category: 'conditionalAccess',
+    title: 'Conditional Access Policy with Exclusions',
+    description: 'CA policy has user, group, or role exclusions. Excluded identities bypass security controls.',
+    count: affected.length,
+    affectedEntities: includeDetails ? affected.map((p) => p.displayName) : undefined,
+  };
+}
+
+/**
+ * Check for absence of device compliance requirement
+ */
+export function detectNoDeviceComplianceCa(policies: AzurePolicy[], includeDetails: boolean): Finding {
+  const hasDeviceCompliancePolicy = policies.some((policy) => {
+    if (policy.state !== 'enabled') return false;
+
+    const grantControls = (policy as any).grantControls;
+    if (!grantControls) return false;
+
+    const builtInControls = grantControls.builtInControls || [];
+    return builtInControls.includes('compliantDevice') || builtInControls.includes('domainJoinedDevice');
+  });
+
+  return {
+    type: 'AZURE_NO_DEVICE_COMPLIANCE_CA',
+    severity: 'medium',
+    category: 'conditionalAccess',
+    title: 'No Device Compliance Requirement',
+    description: 'No Conditional Access policy requiring compliant devices. Unmanaged devices can access resources.',
+    count: hasDeviceCompliancePolicy ? 0 : 1,
+    affectedEntities: includeDetails && !hasDeviceCompliancePolicy ? ['Tenant-wide'] : undefined,
+  };
+}
+
+/**
+ * Check for CA policies in report-only mode
+ */
+export function detectCaPolicyReportOnly(policies: AzurePolicy[], includeDetails: boolean): Finding {
+  const affected = policies.filter((policy) => {
+    return policy.state === 'enabledForReportingButNotEnforced';
+  });
+
+  return {
+    type: 'AZURE_CA_POLICY_REPORT_ONLY',
+    severity: 'low',
+    category: 'conditionalAccess',
+    title: 'Conditional Access Policy in Report-Only Mode',
+    description: 'CA policy in report-only mode. Security controls are not being enforced, only logged.',
+    count: affected.length,
+    affectedEntities: includeDetails ? affected.map((p) => p.displayName) : undefined,
+  };
+}
+
+/**
+ * Detect all Conditional Access vulnerabilities
+ */
+export function detectConditionalAccessVulnerabilities(
+  policies: AzurePolicy[],
+  includeDetails: boolean
+): Finding[] {
+  return [
+    detectNoMfaCaPolicy(policies, includeDetails),
+    detectNoLegacyAuthBlock(policies, includeDetails),
+    detectCaPolicyDisabled(policies, includeDetails),
+    detectCaPolicyHasExclusions(policies, includeDetails),
+    detectNoDeviceComplianceCa(policies, includeDetails),
+    detectCaPolicyReportOnly(policies, includeDetails),
+  ].filter((finding) => finding.count > 0);
+}

package/src/services/audit/detectors/azure/privilege-security.detector.ts

@@ -0,0 +1,176 @@
+/**
+ * Privilege Security Vulnerability Detector for Azure AD
+ *
+ * Detects privileged access vulnerabilities in Azure AD/Entra ID.
+ * Story 1.8: Azure Vulnerability Detection Engine
+ *
+ * Vulnerabilities detected (4):
+ * CRITICAL (2):
+ * - AZURE_GUEST_PRIVILEGED_ACCESS
+ * - AZURE_SERVICE_ACCOUNT_PRIVILEGED
+ *
+ * HIGH (2):
+ * - AZURE_TOO_MANY_GLOBAL_ADMINS
+ * - AZURE_GROUP_DYNAMIC_RISKY_RULE
+ */
+
+import { AzureUser, AzureGroup } from '../../../../types/azure.types';
+import { Finding } from '../../../../types/finding.types';
+import { toAffectedAzureUserEntities, toAffectedAzureGroupEntities } from '../../../../utils/entity-converter';
+
+/**
+ * Check for guest users with privileged roles
+ */
+export function detectGuestPrivilegedAccess(
+  users: AzureUser[],
+  roles: Map<string, string[]>,
+  includeDetails: boolean
+): Finding {
+  const privilegedRoleIds = [
+    '62e90394-69f5-4237-9190-012177145e10', // Global Administrator
+    'e8611ab8-c189-46e8-94e1-60213ab1f814', // Privileged Role Administrator
+    '194ae4cb-b126-40b2-bd5b-6091b380977d', // Security Administrator
+    '29232cdf-9323-42fd-ade2-1d097af3e4de', // Exchange Administrator
+    'f28a1f50-f6e7-4571-818b-6a12f2af6b6c', // SharePoint Administrator
+    '729827e3-9c14-49f7-bb1b-9608f156bbb8', // Helpdesk Administrator
+    'b0f54661-2d74-4c50-afa3-1ec803f12efe', // Billing Administrator
+  ];
+
+  const affected = users.filter((u) => {
+    const isGuest = (u as any).userType === 'Guest';
+    const userRoles = roles.get(u.id) || [];
+    const hasPrivilegedRole = userRoles.some((r) => privilegedRoleIds.includes(r));
+
+    return isGuest && hasPrivilegedRole;
+  });
+
+  return {
+    type: 'AZURE_GUEST_PRIVILEGED_ACCESS',
+    severity: 'critical',
+    category: 'privilegedAccess',
+    title: 'Guest User with Privileged Role',
+    description: 'Guest user from external domain assigned privileged role. High risk from external account compromise.',
+    count: affected.length,
+    affectedEntities: includeDetails ? toAffectedAzureUserEntities(affected) : undefined,
+  };
+}
+
+/**
+ * Check for service accounts with privileged roles
+ */
+export function detectServiceAccountPrivileged(
+  users: AzureUser[],
+  roles: Map<string, string[]>,
+  includeDetails: boolean
+): Finding {
+  const privilegedRoleIds = [
+    '62e90394-69f5-4237-9190-012177145e10', // Global Administrator
+    'e8611ab8-c189-46e8-94e1-60213ab1f814', // Privileged Role Administrator
+    '194ae4cb-b126-40b2-bd5b-6091b380977d', // Security Administrator
+  ];
+
+  const affected = users.filter((u) => {
+    // Service accounts typically: no sign-in, name patterns, or application type
+    const isServiceAccount =
+      !u.lastSignInDateTime ||
+      u.userPrincipalName?.toLowerCase().includes('svc') ||
+      u.userPrincipalName?.toLowerCase().includes('service') ||
+      u.displayName?.toLowerCase().includes('service') ||
+      (u as any).userType === 'Application';
+
+    const userRoles = roles.get(u.id) || [];
+    const hasPrivilegedRole = userRoles.some((r) => privilegedRoleIds.includes(r));
+
+    return isServiceAccount && hasPrivilegedRole;
+  });
+
+  return {
+    type: 'AZURE_SERVICE_ACCOUNT_PRIVILEGED',
+    severity: 'critical',
+    category: 'privilegedAccess',
+    title: 'Service Account with Privileged Role',
+    description: 'Service/application account with privileged role. Service accounts should use managed identities.',
+    count: affected.length,
+    affectedEntities: includeDetails ? toAffectedAzureUserEntities(affected) : undefined,
+  };
+}
+
+/**
+ * Check for excessive number of Global Administrators (>5)
+ */
+export function detectTooManyGlobalAdmins(
+  users: AzureUser[],
+  roles: Map<string, string[]>,
+  includeDetails: boolean
+): Finding {
+  const globalAdminRoleId = '62e90394-69f5-4237-9190-012177145e10';
+
+  const affected = users.filter((u) => {
+    const userRoles = roles.get(u.id) || [];
+    return userRoles.includes(globalAdminRoleId);
+  });
+
+  const threshold = 5;
+  const count = affected.length > threshold ? 1 : 0;
+
+  return {
+    type: 'AZURE_TOO_MANY_GLOBAL_ADMINS',
+    severity: 'high',
+    category: 'privilegedAccess',
+    title: 'Too Many Global Administrators',
+    description: `Tenant has ${affected.length} Global Administrators (recommended: ≤${threshold}). Excessive admin accounts increase attack surface.`,
+    count,
+    affectedEntities: includeDetails && count > 0 ? [`${affected.length} Global Admins`] : undefined,
+  };
+}
+
+/**
+ * Check for dynamic groups with risky membership rules
+ */
+export function detectGroupDynamicRiskyRule(groups: AzureGroup[], includeDetails: boolean): Finding {
+  const riskyPatterns = [
+    'accountEnabled eq true', // Too broad
+    'userType eq "Member"', // All members
+    'userType eq "Guest"', // All guests (less risky but broad)
+    'objectId ne null', // Everyone
+    'mail contains "@"', // Everyone with email
+  ];
+
+  const affected = groups.filter((g) => {
+    const membershipRule = (g as any).membershipRule;
+    if (!membershipRule || (g as any).groupTypes?.includes('DynamicMembership') === false) {
+      return false;
+    }
+
+    // Check if rule contains risky patterns
+    const lowerRule = membershipRule.toLowerCase();
+    return riskyPatterns.some((pattern) => lowerRule.includes(pattern.toLowerCase()));
+  });
+
+  return {
+    type: 'AZURE_GROUP_DYNAMIC_RISKY_RULE',
+    severity: 'high',
+    category: 'privilegedAccess',
+    title: 'Dynamic Group with Risky Membership Rule',
+    description: 'Dynamic group with overly permissive membership rule. May grant unintended access.',
+    count: affected.length,
+    affectedEntities: includeDetails ? toAffectedAzureGroupEntities(affected) : undefined,
+  };
+}
+
+/**
+ * Detect all privilege security vulnerabilities
+ */
+export function detectPrivilegeSecurityVulnerabilities(
+  users: AzureUser[],
+  groups: AzureGroup[],
+  roles: Map<string, string[]>,
+  includeDetails: boolean
+): Finding[] {
+  return [
+    detectGuestPrivilegedAccess(users, roles, includeDetails),
+    detectServiceAccountPrivileged(users, roles, includeDetails),
+    detectTooManyGlobalAdmins(users, roles, includeDetails),
+    detectGroupDynamicRiskyRule(groups, includeDetails),
+  ].filter((finding) => finding.count > 0);
+}

package/src/services/audit/detectors/azure/user-security.detector.ts

@@ -0,0 +1,280 @@
+/**
+ * User Security Vulnerability Detector for Azure AD
+ *
+ * Detects user-related vulnerabilities in Azure AD/Entra ID.
+ * Story 1.8: Azure Vulnerability Detection Engine
+ *
+ * Vulnerabilities detected (10):
+ * CRITICAL (3):
+ * - AZURE_GLOBAL_ADMIN_NO_MFA
+ * - AZURE_PRIVILEGED_USER_NO_MFA
+ * - AZURE_RISKY_USER_HIGH
+ *
+ * HIGH (3):
+ * - AZURE_USER_INACTIVE
+ * - AZURE_USER_PASSWORD_NEVER_EXPIRES
+ * - AZURE_RISKY_USER_MEDIUM
+ *
+ * MEDIUM (4):
+ * - AZURE_PASSWORD_OLD
+ * - AZURE_USER_NEVER_SIGNED_IN
+ * - AZURE_USER_UNLICENSED
+ * - AZURE_USER_EXTERNAL_MEMBER
+ */
+
+import { AzureUser } from '../../../../types/azure.types';
+import { Finding } from '../../../../types/finding.types';
+import { toAffectedAzureUserEntities } from '../../../../utils/entity-converter';
+
+/**
+ * Check for Global Administrators without MFA
+ */
+export function detectGlobalAdminNoMfa(
+  users: AzureUser[],
+  roles: Map<string, string[]>,
+  includeDetails: boolean
+): Finding {
+  const globalAdminRoleId = '62e90394-69f5-4237-9190-012177145e10'; // Well-known Global Admin role ID
+
+  const affected = users.filter((u) => {
+    const userRoles = roles.get(u.id) || [];
+    const isGlobalAdmin = userRoles.includes(globalAdminRoleId);
+    const hasMfa = (u as any).strongAuthenticationMethods?.length > 0 || (u as any).isMfaRegistered === true;
+
+    return isGlobalAdmin && !hasMfa;
+  });
+
+  return {
+    type: 'AZURE_GLOBAL_ADMIN_NO_MFA',
+    severity: 'critical',
+    category: 'identity',
+    title: 'Global Administrator without MFA',
+    description: 'Global Administrator account without Multi-Factor Authentication. Full control over Azure AD if compromised.',
+    count: affected.length,
+    affectedEntities: includeDetails ? toAffectedAzureUserEntities(affected) : undefined,
+  };
+}
+
+/**
+ * Check for privileged users (non-GA) without MFA
+ */
+export function detectPrivilegedUserNoMfa(
+  users: AzureUser[],
+  roles: Map<string, string[]>,
+  includeDetails: boolean
+): Finding {
+  const privilegedRoleIds = [
+    '62e90394-69f5-4237-9190-012177145e10', // Global Administrator
+    'e8611ab8-c189-46e8-94e1-60213ab1f814', // Privileged Role Administrator
+    '194ae4cb-b126-40b2-bd5b-6091b380977d', // Security Administrator
+    '29232cdf-9323-42fd-ade2-1d097af3e4de', // Exchange Administrator
+    'f28a1f50-f6e7-4571-818b-6a12f2af6b6c', // SharePoint Administrator
+  ];
+
+  const affected = users.filter((u) => {
+    const userRoles = roles.get(u.id) || [];
+    const hasPrivilegedRole = userRoles.some((r) => privilegedRoleIds.includes(r));
+    const hasMfa = (u as any).strongAuthenticationMethods?.length > 0 || (u as any).isMfaRegistered === true;
+
+    return hasPrivilegedRole && !hasMfa;
+  });
+
+  return {
+    type: 'AZURE_PRIVILEGED_USER_NO_MFA',
+    severity: 'critical',
+    category: 'identity',
+    title: 'Privileged User without MFA',
+    description: 'Privileged role assigned to user without MFA. High risk if account is compromised.',
+    count: affected.length,
+    affectedEntities: includeDetails ? toAffectedAzureUserEntities(affected) : undefined,
+  };
+}
+
+/**
+ * Check for high-risk users (Identity Protection)
+ */
+export function detectRiskyUserHigh(users: AzureUser[], includeDetails: boolean): Finding {
+  const affected = users.filter((u) => {
+    const riskLevel = (u as any).riskLevel;
+    return riskLevel === 'high';
+  });
+
+  return {
+    type: 'AZURE_RISKY_USER_HIGH',
+    severity: 'critical',
+    category: 'identity',
+    title: 'High-Risk User (Identity Protection)',
+    description: 'User flagged as high risk by Azure Identity Protection. Account may be compromised.',
+    count: affected.length,
+    affectedEntities: includeDetails ? toAffectedAzureUserEntities(affected) : undefined,
+  };
+}
+
+/**
+ * Check for inactive users (90+ days)
+ */
+export function detectUserInactive(users: AzureUser[], includeDetails: boolean): Finding {
+  const now = Date.now();
+  const ninetyDaysAgo = now - 90 * 24 * 60 * 60 * 1000;
+
+  const affected = users.filter((u) => {
+    if (!u.lastSignInDateTime) return false;
+    const lastSignIn = new Date(u.lastSignInDateTime).getTime();
+    return lastSignIn < ninetyDaysAgo;
+  });
+
+  return {
+    type: 'AZURE_USER_INACTIVE',
+    severity: 'high',
+    category: 'accounts',
+    title: 'Inactive User (90+ days)',
+    description: 'User account inactive for 90+ days. Should be disabled or deleted.',
+    count: affected.length,
+    affectedEntities: includeDetails ? toAffectedAzureUserEntities(affected) : undefined,
+  };
+}
+
+/**
+ * Check for users with password never expires
+ */
+export function detectPasswordNeverExpires(users: AzureUser[], includeDetails: boolean): Finding {
+  const affected = users.filter((u) => {
+    return (u as any).passwordPolicies?.includes('DisablePasswordExpiration');
+  });
+
+  return {
+    type: 'AZURE_USER_PASSWORD_NEVER_EXPIRES',
+    severity: 'high',
+    category: 'accounts',
+    title: 'Password Never Expires',
+    description: 'User password expiration disabled. Increases risk of credential compromise.',
+    count: affected.length,
+    affectedEntities: includeDetails ? toAffectedAzureUserEntities(affected) : undefined,
+  };
+}
+
+/**
+ * Check for medium-risk users (Identity Protection)
+ */
+export function detectRiskyUserMedium(users: AzureUser[], includeDetails: boolean): Finding {
+  const affected = users.filter((u) => {
+    const riskLevel = (u as any).riskLevel;
+    return riskLevel === 'medium';
+  });
+
+  return {
+    type: 'AZURE_RISKY_USER_MEDIUM',
+    severity: 'high',
+    category: 'identity',
+    title: 'Medium-Risk User (Identity Protection)',
+    description: 'User flagged as medium risk by Azure Identity Protection. Unusual sign-in activity detected.',
+    count: affected.length,
+    affectedEntities: includeDetails ? toAffectedAzureUserEntities(affected) : undefined,
+  };
+}
+
+/**
+ * Check for old passwords (180+ days)
+ */
+export function detectPasswordOld(users: AzureUser[], includeDetails: boolean): Finding {
+  const now = Date.now();
+  const sixMonthsAgo = now - 180 * 24 * 60 * 60 * 1000;
+
+  const affected = users.filter((u) => {
+    const lastPasswordChange = (u as any).lastPasswordChangeDateTime;
+    if (!lastPasswordChange) return false;
+    return new Date(lastPasswordChange).getTime() < sixMonthsAgo;
+  });
+
+  return {
+    type: 'AZURE_PASSWORD_OLD',
+    severity: 'medium',
+    category: 'accounts',
+    title: 'Old Password (180+ days)',
+    description: 'User password not changed for 180+ days. Increases credential compromise risk.',
+    count: affected.length,
+    affectedEntities: includeDetails ? toAffectedAzureUserEntities(affected) : undefined,
+  };
+}
+
+/**
+ * Check for users who never signed in
+ */
+export function detectUserNeverSignedIn(users: AzureUser[], includeDetails: boolean): Finding {
+  const affected = users.filter((u) => {
+    return u.accountEnabled && !u.lastSignInDateTime;
+  });
+
+  return {
+    type: 'AZURE_USER_NEVER_SIGNED_IN',
+    severity: 'medium',
+    category: 'accounts',
+    title: 'User Never Signed In',
+    description: 'Enabled account that has never been used. Orphaned account should be removed.',
+    count: affected.length,
+    affectedEntities: includeDetails ? toAffectedAzureUserEntities(affected) : undefined,
+  };
+}
+
+/**
+ * Check for unlicensed users
+ */
+export function detectUserUnlicensed(users: AzureUser[], includeDetails: boolean): Finding {
+  const affected = users.filter((u) => {
+    const licenses = (u as any).assignedLicenses;
+    return u.accountEnabled && (!licenses || licenses.length === 0);
+  });
+
+  return {
+    type: 'AZURE_USER_UNLICENSED',
+    severity: 'medium',
+    category: 'accounts',
+    title: 'Unlicensed Active User',
+    description: 'Active user without assigned license. May indicate configuration issue.',
+    count: affected.length,
+    affectedEntities: includeDetails ? toAffectedAzureUserEntities(affected) : undefined,
+  };
+}
+
+/**
+ * Check for external users with Member type
+ */
+export function detectUserExternalMember(users: AzureUser[], includeDetails: boolean): Finding {
+  const affected = users.filter((u) => {
+    const userType = (u as any).userType;
+    const isExternal = u.userPrincipalName?.includes('#EXT#');
+    return userType === 'Member' && isExternal;
+  });
+
+  return {
+    type: 'AZURE_USER_EXTERNAL_MEMBER',
+    severity: 'medium',
+    category: 'accounts',
+    title: 'External User as Member',
+    description: 'External domain user configured as Member instead of Guest. Security misconfiguration.',
+    count: affected.length,
+    affectedEntities: includeDetails ? toAffectedAzureUserEntities(affected) : undefined,
+  };
+}
+
+/**
+ * Detect all user security vulnerabilities
+ */
+export function detectUserSecurityVulnerabilities(
+  users: AzureUser[],
+  roles: Map<string, string[]>,
+  includeDetails: boolean
+): Finding[] {
+  return [
+    detectGlobalAdminNoMfa(users, roles, includeDetails),
+    detectPrivilegedUserNoMfa(users, roles, includeDetails),
+    detectRiskyUserHigh(users, includeDetails),
+    detectUserInactive(users, includeDetails),
+    detectPasswordNeverExpires(users, includeDetails),
+    detectRiskyUserMedium(users, includeDetails),
+    detectPasswordOld(users, includeDetails),
+    detectUserNeverSignedIn(users, includeDetails),
+    detectUserUnlicensed(users, includeDetails),
+    detectUserExternalMember(users, includeDetails),
+  ].filter((finding) => finding.count > 0);
+}

package/src/services/audit/detectors/index.ts

@@ -0,0 +1,18 @@
+/**
+ * Vulnerability Detectors Index
+ *
+ * Central export for all vulnerability detectors (AD, Azure, Intune, Exchange, etc.)
+ * Story 1.7: AD Vulnerability Detection Engine
+ */
+
+// Active Directory detectors
+export * as ADDetectors from './ad';
+
+// Azure AD/Entra ID detectors (future)
+// export * as AzureDetectors from './azure';
+
+// Intune detectors (future)
+// export * as IntuneDetectors from './intune';
+
+// Exchange detectors (future)
+// export * as ExchangeDetectors from './exchange';