@sagentix-inc/evidence-collector 0.2.1 → 0.3.1

package/apps/sos-app/src/data/checks/checkov.json

@@ -6,10 +6,10 @@
  ],
  "engine": {
   "name": "Checkov",
-  "version": "3.3.27",
-  "tag": "3.3.27",
-  "commit": "22ba0d2077cd3a09fc1547ae80be9ffe4e471e6c",
-  "tarballSha256": "8404798c2257fede6d169bde4be9beaba9dc6f6b597cc9098145dfd8b0738042",
+  "version": "3.3.29",
+  "tag": "3.3.29",
+  "commit": "e40023ab262c7c8b7b0a8f0975072b42d1b601f9",
+  "tarballSha256": "23f236b9793b00c7911efdb0bf814a594ab9b4048c298a63b4f3f76ebb134cc4",
   "licence": "Apache-2.0",
   "url": "https://github.com/bridgecrewio/checkov"
  },
@@ -17,331 +17,331 @@
   {
    "id": "checkov.ckv_aws_1",
    "title": "CKV_AWS_1: IAM policy documents grant no full '*:*' administrative privileges",
-   "scope": "Checkov 3.3.27 check CKV_AWS_1 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no wildcard admin grant. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_1 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no wildcard admin grant. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_103",
    "title": "CKV_AWS_103: Load balancer listeners use TLS 1.2 or later",
-   "scope": "Checkov 3.3.27 check CKV_AWS_103 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_103 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_145",
    "title": "CKV_AWS_145: S3 buckets are encrypted with KMS by default",
-   "scope": "Checkov 3.3.27 check CKV_AWS_145 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_145 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_158",
    "title": "CKV_AWS_158: CloudWatch log groups are encrypted with KMS",
-   "scope": "Checkov 3.3.27 check CKV_AWS_158 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_158 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_16",
    "title": "CKV_AWS_16: RDS instances are encrypted at rest",
-   "scope": "Checkov 3.3.27 check CKV_AWS_16 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_16 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_17",
    "title": "CKV_AWS_17: RDS instances are not publicly accessible",
-   "scope": "Checkov 3.3.27 check CKV_AWS_17 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public endpoint. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_17 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public endpoint. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_18",
    "title": "CKV_AWS_18: S3 buckets have access logging",
-   "scope": "Checkov 3.3.27 check CKV_AWS_18 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_18 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_19",
    "title": "CKV_AWS_19: S3 buckets have server-side encryption",
-   "scope": "Checkov 3.3.27 check CKV_AWS_19 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_19 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_2",
    "title": "CKV_AWS_2: Application load balancers listen on HTTPS",
-   "scope": "Checkov 3.3.27 check CKV_AWS_2 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_2 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_20",
    "title": "CKV_AWS_20: S3 buckets do not grant READ to everyone",
-   "scope": "Checkov 3.3.27 check CKV_AWS_20 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public read. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_20 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public read. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_24",
    "title": "CKV_AWS_24: Security groups do not allow SSH (22) from 0.0.0.0/0",
-   "scope": "Checkov 3.3.27 check CKV_AWS_24 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_24 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_25",
    "title": "CKV_AWS_25: Security groups do not allow RDP (3389) from 0.0.0.0/0",
-   "scope": "Checkov 3.3.27 check CKV_AWS_25 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_25 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_26",
    "title": "CKV_AWS_26: SNS topics are encrypted at rest",
-   "scope": "Checkov 3.3.27 check CKV_AWS_26 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_26 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_27",
    "title": "CKV_AWS_27: SQS queues are encrypted at rest",
-   "scope": "Checkov 3.3.27 check CKV_AWS_27 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_27 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_3",
    "title": "CKV_AWS_3: EBS volumes are encrypted at rest",
-   "scope": "Checkov 3.3.27 check CKV_AWS_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_338",
    "title": "CKV_AWS_338: CloudWatch log groups keep logs for at least one year",
-   "scope": "Checkov 3.3.27 check CKV_AWS_338 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; audit record retention. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_338 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; audit record retention. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_35",
    "title": "CKV_AWS_35: CloudTrail logs are encrypted at rest with KMS",
-   "scope": "Checkov 3.3.27 check CKV_AWS_35 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; audit logs are encrypted and protected. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_35 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; audit logs are encrypted and protected. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_36",
    "title": "CKV_AWS_36: CloudTrail log file validation is enabled",
-   "scope": "Checkov 3.3.27 check CKV_AWS_36 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; audit logs carry a cryptographic integrity check. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_36 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; audit logs carry a cryptographic integrity check. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_41",
    "title": "CKV_AWS_41: No hard-coded AWS access key in the provider block",
-   "scope": "Checkov 3.3.27 check CKV_AWS_41 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no embedded credentials. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_41 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no embedded credentials. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_45",
    "title": "CKV_AWS_45: No hard-coded secret in Lambda environment variables",
-   "scope": "Checkov 3.3.27 check CKV_AWS_45 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no embedded credentials. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_45 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no embedded credentials. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_46",
    "title": "CKV_AWS_46: No hard-coded secret in EC2 user data",
-   "scope": "Checkov 3.3.27 check CKV_AWS_46 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no embedded credentials. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_46 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no embedded credentials. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_53",
    "title": "CKV_AWS_53: S3 public access block: block public ACLs",
-   "scope": "Checkov 3.3.27 check CKV_AWS_53 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_53 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_54",
    "title": "CKV_AWS_54: S3 public access block: block public policy",
-   "scope": "Checkov 3.3.27 check CKV_AWS_54 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_54 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_55",
    "title": "CKV_AWS_55: S3 public access block: ignore public ACLs",
-   "scope": "Checkov 3.3.27 check CKV_AWS_55 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_55 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_56",
    "title": "CKV_AWS_56: S3 public access block: restrict public buckets",
-   "scope": "Checkov 3.3.27 check CKV_AWS_56 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_56 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; public access blocked. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_57",
    "title": "CKV_AWS_57: S3 buckets do not grant WRITE to everyone",
-   "scope": "Checkov 3.3.27 check CKV_AWS_57 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public write. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_57 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public write. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_62",
    "title": "CKV_AWS_62: IAM policies grant no full '*:*' administrative privileges",
-   "scope": "Checkov 3.3.27 check CKV_AWS_62 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no wildcard admin grant. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_62 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no wildcard admin grant. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_63",
    "title": "CKV_AWS_63: IAM policy documents allow no '*' action",
-   "scope": "Checkov 3.3.27 check CKV_AWS_63 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no wildcard action. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_63 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no wildcard action. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_64",
    "title": "CKV_AWS_64: Redshift clusters are encrypted at rest",
-   "scope": "Checkov 3.3.27 check CKV_AWS_64 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_64 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_67",
    "title": "CKV_AWS_67: CloudTrail is enabled in all regions",
-   "scope": "Checkov 3.3.27 check CKV_AWS_67 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; account activity is logged. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_67 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; account activity is logged. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_7",
    "title": "CKV_AWS_7: Customer-managed KMS keys rotate",
-   "scope": "Checkov 3.3.27 check CKV_AWS_7 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; key rotation is automated. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_7 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; key rotation is automated. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_8",
    "title": "CKV_AWS_8: Launch configurations and instances encrypt their EBS volumes",
-   "scope": "Checkov 3.3.27 check CKV_AWS_8 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_8 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_aws_84",
    "title": "CKV_AWS_84: Elasticsearch/OpenSearch domains have logging enabled",
-   "scope": "Checkov 3.3.27 check CKV_AWS_84 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AWS_84 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_azure_10",
    "title": "CKV_AZURE_10: Network security groups restrict SSH from the internet",
-   "scope": "Checkov 3.3.27 check CKV_AZURE_10 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AZURE_10 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_azure_2",
    "title": "CKV_AZURE_2: Azure managed disks are encrypted",
-   "scope": "Checkov 3.3.27 check CKV_AZURE_2 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AZURE_2 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption at rest. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_azure_3",
    "title": "CKV_AZURE_3: Azure storage accounts accept HTTPS only",
-   "scope": "Checkov 3.3.27 check CKV_AZURE_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AZURE_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_azure_33",
    "title": "CKV_AZURE_33: Azure queue storage logs read, write and delete requests",
-   "scope": "Checkov 3.3.27 check CKV_AZURE_33 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AZURE_33 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_azure_44",
    "title": "CKV_AZURE_44: Azure storage accounts require the latest TLS version",
-   "scope": "Checkov 3.3.27 check CKV_AZURE_44 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AZURE_44 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_azure_59",
    "title": "CKV_AZURE_59: Azure storage accounts disallow public access",
-   "scope": "Checkov 3.3.27 check CKV_AZURE_59 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public access. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AZURE_59 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public access. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_azure_9",
    "title": "CKV_AZURE_9: Network security groups restrict RDP from the internet",
-   "scope": "Checkov 3.3.27 check CKV_AZURE_9 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_AZURE_9 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_docker_3",
    "title": "CKV_DOCKER_3: Dockerfiles create and use a non-root user",
-   "scope": "Checkov 3.3.27 check CKV_DOCKER_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; least privilege. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_DOCKER_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; least privilege. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_gcp_2",
    "title": "CKV_GCP_2: Compute firewall ingress does not allow unrestricted SSH",
-   "scope": "Checkov 3.3.27 check CKV_GCP_2 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_GCP_2 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_gcp_28",
    "title": "CKV_GCP_28: Cloud Storage buckets are not anonymously or publicly accessible",
-   "scope": "Checkov 3.3.27 check CKV_GCP_28 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public access. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_GCP_28 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no public access. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_gcp_3",
    "title": "CKV_GCP_3: Compute firewall ingress does not allow unrestricted RDP",
-   "scope": "Checkov 3.3.27 check CKV_GCP_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_GCP_3 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no unrestricted remote-admin ingress. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_gcp_43",
    "title": "CKV_GCP_43: Cloud KMS keys rotate within 90 days",
-   "scope": "Checkov 3.3.27 check CKV_GCP_43 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; key rotation is automated. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_GCP_43 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; key rotation is automated. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_gcp_6",
    "title": "CKV_GCP_6: Cloud SQL instances require SSL for incoming connections",
-   "scope": "Checkov 3.3.27 check CKV_GCP_6 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_GCP_6 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; encryption in transit. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_gcp_62",
    "title": "CKV_GCP_62: Cloud Storage buckets log access",
-   "scope": "Checkov 3.3.27 check CKV_GCP_62 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_GCP_62 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; access is logged. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_16",
    "title": "CKV_K8S_16: Kubernetes containers are not privileged",
-   "scope": "Checkov 3.3.27 check CKV_K8S_16 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; container isolation. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_16 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; container isolation. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_17",
    "title": "CKV_K8S_17: Kubernetes containers do not share the host PID namespace",
-   "scope": "Checkov 3.3.27 check CKV_K8S_17 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; process isolation. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_17 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; process isolation. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_18",
    "title": "CKV_K8S_18: Kubernetes containers do not share the host IPC namespace",
-   "scope": "Checkov 3.3.27 check CKV_K8S_18 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; process isolation. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_18 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; process isolation. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_19",
    "title": "CKV_K8S_19: Kubernetes containers do not share the host network namespace",
-   "scope": "Checkov 3.3.27 check CKV_K8S_19 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; network isolation. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_19 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; network isolation. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_20",
    "title": "CKV_K8S_20: Kubernetes containers do not allow privilege escalation",
-   "scope": "Checkov 3.3.27 check CKV_K8S_20 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no setuid escalation. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_20 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; no setuid escalation. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_22",
    "title": "CKV_K8S_22: Kubernetes containers use a read-only root filesystem",
-   "scope": "Checkov 3.3.27 check CKV_K8S_22 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; a change needs a redeployment, not an edit in place. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_22 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; a change needs a redeployment, not an edit in place. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_23",
    "title": "CKV_K8S_23: Kubernetes containers do not run as root",
-   "scope": "Checkov 3.3.27 check CKV_K8S_23 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; least privilege. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_23 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; least privilege. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {
    "id": "checkov.ckv_k8s_35",
    "title": "CKV_K8S_35: Kubernetes secrets are mounted as files, not environment variables",
-   "scope": "Checkov 3.3.27 check CKV_K8S_35 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; authenticators protected. Resources deployed outside that code are not seen.",
+   "scope": "Checkov 3.3.29 check CKV_K8S_35 over the infrastructure-as-code files or Terraform plan in one report: one result per report, counting the resources it evaluated; authenticators protected. Resources deployed outside that code are not seen.",
    "evidenceType": "Configuration"
   },
   {

package/apps/sos-app/src/data/checks/configmgr.json

@@ -0,0 +1,45 @@
+{
+ "source": "configmgr",
+ "title": "Microsoft Configuration Manager (administration service REST API, Windows authentication, Read-only Analyst)",
+ "readScopes": [
+  "A domain service account added as a Configuration Manager administrative user (Administration > Security > Administrative Users > Add User or Group) with the built-in security role Read-only Analyst (\"Grants permissions to view all Configuration Manager objects\"). It reads, with GET only, https://<SMS Provider>/AdminService/wmi/ SMS_CombinedDeviceResources, SMS_SoftwareUpdate, SMS_UpdateComplianceStatus and SMS_G_System_CI_ComplianceState. The collector runs as that account on a domain-joined Windows host that reaches the SMS Provider on port 443 and trusts its certificate; CONFIGMGR_PROVIDER is the SMS Provider's FQDN. No secret is stored."
+ ],
+ "checks": [
+  {
+   "id": "configmgr.client_installed",
+   "title": "Each discovered device runs the Configuration Manager client",
+   "scope": "Every device in SMS_CombinedDeviceResources except unknown and obsolete records, from IsClient; a device without a client skips every other check.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "configmgr.last_seen",
+   "title": "Each client has been active within the last 14 days",
+   "scope": "Every client, from LastActiveTime (client health), else LastPolicyRequest; the window is --configmgr-seen-days.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "configmgr.antimalware_enabled",
+   "title": "Endpoint Protection antimalware and antivirus are on",
+   "scope": "Every client whose antimalware Configuration Manager manages, from EPEnabled and EPAntivirusEnabled; a client with EPEnabled empty is skipped.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "configmgr.antimalware_signatures_current",
+   "title": "Antivirus signatures updated within the last 7 days",
+   "scope": "Every client with Endpoint Protection status, from EPAntivirusSignatureLastUpdateDateTime; the window is --configmgr-signature-days.",
+   "evidenceType": "Report"
+  },
+  {
+   "id": "configmgr.updates_installed",
+   "title": "No deployed software update published more than 30 days ago is still required",
+   "scope": "Every client, from SMS_UpdateComplianceStatus rows with Status 2 (required) for updates where IsDeployed is true and IsExpired is false, published (DatePosted) more than --configmgr-patch-days ago. Rows with Status 0 (detection unknown) make the result skipped. A client that never reported an update scan has no row and passes; read last_seen beside it. Updates that are not deployed are not judged.",
+   "evidenceType": "Report"
+  },
+  {
+   "id": "configmgr.baselines_compliant",
+   "title": "No configuration baseline item on the client is non-compliant or in error",
+   "scope": "Every client, from SMS_G_System_CI_ComplianceState: ComplianceState 2 (Non-Compliant) or 4 (Error) fails, 1 (Compliant) passes; a client with no known state is skipped. It shows only what the deployed baselines test.",
+   "evidenceType": "Configuration"
+  }
+ ]
+}

package/apps/sos-app/src/data/checks/endpoint_central.json

@@ -0,0 +1,45 @@
+{
+ "source": "endpoint_central",
+ "title": "ManageEngine Endpoint Central, cloud edition (Zoho self client, READ scopes only)",
+ "readScopes": [
+  "A Zoho self client (API console of the organization's data centre, e.g. api-console.zoho.com) whose refresh token was generated for the scopes DesktopCentralCloud.Inventory.READ and DesktopCentralCloud.PatchMgmt.READ and nothing else, by an Endpoint Central user whose role has Read Access to Inventory and Patch Management (the predefined Guest role does). The collector reads GET /dcapi/inventory/viewData/scanComputers, GET /dcapi/inventory/computers/{resourceID}/diskEncryptionStatus, GET /dcapi/inventory/computers/{resourceID}/firewall and GET /dcapi/patch/reports/systemHealth. ENDPOINT_CENTRAL_URL is https://endpointcentral.manageengine.<com|eu|in|com.au|cn|jp|ca|uk|sa>; ENDPOINT_CENTRAL_CLIENT_ID, ENDPOINT_CENTRAL_CLIENT_SECRET and ENDPOINT_CENTRAL_REFRESH_TOKEN hold the self client's credentials."
+ ],
+ "checks": [
+  {
+   "id": "endpoint_central.disk_encryption",
+   "title": "Every drive the agent reports on the computer is encrypted",
+   "scope": "Every computer with an installed agent, from diskEncryptionStatusDetails: any drive Not Encrypted fails, all Encrypted passes; a computer with no drive in either state is skipped. Removable drives the agent lists count too.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "endpoint_central.firewall",
+   "title": "The firewall is on: all three Windows Firewall profiles enabled, or a third-party firewall enabled",
+   "scope": "Every computer with an installed agent, from the firewall endpoint: domain, private and public profiles Enabled, or an external firewall with protectionStatus Enabled, passes; a computer with neither reported (Macs and Linux hosts, as far as the docs show) is skipped.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "endpoint_central.os_minimum",
+   "title": "Each computer runs an OS at or above the given minimum version",
+   "scope": "Every computer whose platform (os_platform 1 Windows, 2 Mac, 3 Linux) has a --endpoint-central-min-os floor, from os_version in the scan list; without the option the check is skipped once.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "endpoint_central.os_patches",
+   "title": "Each computer has no more missing OS patches than allowed",
+   "scope": "Every computer matched by name and domain to a row of the patch system health report: MissingOsPatches at most --endpoint-central-max-missing-os-patches (default 0). Third-party, driver and BIOS patches are not judged.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "endpoint_central.last_contact",
+   "title": "Each computer's agent has contacted the server within the last 14 days",
+   "scope": "Every computer in the scan list, from agent_last_contact_time; the window is --endpoint-central-contact-days.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "endpoint_central.agent_installed",
+   "title": "Each computer in scope has the Endpoint Central agent installed",
+   "scope": "Every computer in the scan list, from installation_status: 22 (installed) passes; 21, 23, 24 and 29 fail.",
+   "evidenceType": "Configuration"
+  }
+ ]
+}

package/apps/sos-app/src/data/checks/google_endpoints.json

@@ -0,0 +1,39 @@
+{
+ "source": "google_endpoints",
+ "title": "Google endpoint management (Cloud Identity Devices API, read-only scope through domain-wide delegation)",
+ "readScopes": [
+  "OAuth scope https://www.googleapis.com/auth/cloud-identity.devices.readonly, added to the google_workspace service account's domain-wide delegation, acting as GOOGLE_ADMIN_EMAIL. It reads GET https://cloudidentity.googleapis.com/v1/devices (devices.list, view USER_ASSIGNED_DEVICES). Google documents that a service account cannot call the Devices API directly; domain-wide delegation is required."
+ ],
+ "checks": [
+  {
+   "id": "google_endpoints.disk_encryption",
+   "title": "Each device reports its storage as encrypted",
+   "scope": "Every listed device, one result per device, from encryptionState: ENCRYPTED passes, NOT_ENCRYPTED fails, UNSUPPORTED_BY_DEVICE and unspecified are skipped.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "google_endpoints.firewall",
+   "title": "The operating system's built-in firewall is on",
+   "scope": "Every device that reports through Endpoint Verification, from additionalSignals.is_os_native_firewall_enabled; other devices are skipped.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "google_endpoints.os_minimum",
+   "title": "Each device runs an OS at or above the given minimum version",
+   "scope": "Every listed device, from osVersion against --google-endpoints-min-os for its deviceType (mac_os, windows, linux, chrome_os, android, ios); without that option the check is skipped once.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "google_endpoints.last_sync",
+   "title": "Each device has synced with Google within the last 14 days",
+   "scope": "Every listed device, from lastSyncTime; the window is --google-endpoints-sync-days.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "google_endpoints.compromised",
+   "title": "No device is reported compromised",
+   "scope": "Every listed device, from compromisedState: UNCOMPROMISED passes, COMPROMISED fails, unspecified is skipped.",
+   "evidenceType": "Configuration"
+  }
+ ]
+}

package/apps/sos-app/src/data/checks/ivanti_mdm.json

@@ -0,0 +1,51 @@
+{
+ "source": "ivanti_mdm",
+ "title": "Ivanti Neurons for MDM, formerly MobileIron Cloud (Customer Integration API, GET only, Device Read Only admin)",
+ "readScopes": [
+  "A dedicated Ivanti Neurons for MDM admin user (Users > Users) holding only the space-specific \"Device Read Only\" role for the device space read, whose user name and password go in IVANTI_MDM_USERNAME and IVANTI_MDM_PASSWORD; the tenant's admin portal address is IVANTI_MDM_URL. Calls: GET /api/v1/metadata/tenant, GET /api/v1/device and GET /api/v1/device/{id}. The API takes HTTP Basic authentication, which does not work when the admin portal requires a password and PIN."
+ ],
+ "checks": [
+  {
+   "id": "ivanti_mdm.device_compliant",
+   "title": "Each active device is compliant with its Ivanti policies",
+   "scope": "Every active device in the device space, one result per device, from complianceState in the device search. A device is only as compliant as the policies assigned to it.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "ivanti_mdm.disk_encryption",
+   "title": "Each Mac has FileVault on, and each device reporting BitLocker is fully encrypted",
+   "scope": "Macs (platformType OSX) from osxFdeEnabled in Get Device Details; other devices from bitLockerEncryptionStatus where they report one (FULLY_ENCRYPTED passes, NOT_ENCRYPTED and PARTIALLY_ENCRYPTED fail, UNKNOWN is skipped). iOS and Android devices expose no encryption field and are not judged.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "ivanti_mdm.os_minimum",
+   "title": "Each active device runs an OS at or above the given minimum for its platform",
+   "scope": "Every active device, from platformVersion against --ivanti-mdm-min-os keyed by platformType (osx or macos, ios, android); without that option the check is skipped once. Vendor support dates are not looked up.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "ivanti_mdm.last_checkin",
+   "title": "Each active device has checked in within the last 14 days",
+   "scope": "Every active device, from lastCheckin (\"Last client checkin\"); the window is --ivanti-mdm-checkin-days.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "ivanti_mdm.passcode_compliant",
+   "title": "Each iOS and Android device's passcode meets its Ivanti profiles",
+   "scope": "iOS and Android devices, from passcodeCompliantWithProfiles, else passcodeCompliant (iOS). It shows the passcode meets what the profiles demand, not the idle time before lock.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "ivanti_mdm.firewall",
+   "title": "The macOS application firewall is on",
+   "scope": "Macs, from osxFirewallSettings.firewallEnabled in Get Device Details; skipped once when the space has no Mac.",
+   "evidenceType": "Configuration"
+  },
+  {
+   "id": "ivanti_mdm.system_integrity",
+   "title": "System Integrity Protection is enabled on each Mac",
+   "scope": "Macs, from osxSystemIntegrityProtectionEnabled in Get Device Details; skipped once when the space has no Mac.",
+   "evidenceType": "Configuration"
+  }
+ ]
+}