@sagentix-inc/evidence-collector 0.3.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/THIRD_PARTY_NOTICES.md +14 -14
- package/apps/sos-app/src/data/checks/aws.json +2 -2
- package/apps/sos-app/src/data/checks/checkov.json +59 -59
- package/apps/sos-app/src/data/checks/kubescape.json +1 -1
- package/apps/sos-app/src/data/checks/prowler_aws.json +478 -464
- package/apps/sos-app/src/data/checks/prowler_azure.json +137 -137
- package/apps/sos-app/src/data/checks/prowler_cloudflare.json +2 -2
- package/apps/sos-app/src/data/checks/prowler_gcp.json +99 -92
- package/apps/sos-app/src/data/checks/prowler_github.json +2 -2
- package/apps/sos-app/src/data/checks/prowler_googleworkspace.json +2 -2
- package/apps/sos-app/src/data/checks/prowler_kubernetes.json +75 -75
- package/apps/sos-app/src/data/checks/prowler_m365.json +69 -69
- package/apps/sos-app/src/data/checks/prowler_okta.json +2 -2
- package/apps/sos-app/src/data/fedramp_rules.json +1 -1
- package/collector/package.json +1 -1
- package/collector/src/sources/aws/checks.js +4 -1
- package/collector/src/sources/prowler.js +1 -1
- package/package.json +1 -1
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"source": "prowler",
|
|
3
|
-
"title": "Prowler 5.
|
|
3
|
+
"title": "Prowler 5.47.0: Azure (runs in the customer's CI with read-only credentials)",
|
|
4
4
|
"readScopes": [
|
|
5
5
|
"Reader (subscription)",
|
|
6
6
|
"ProwlerRole custom role (prowler-azure-custom-role.json)",
|
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
],
|
|
11
11
|
"engine": {
|
|
12
12
|
"name": "Prowler",
|
|
13
|
-
"version": "5.
|
|
13
|
+
"version": "5.47.0",
|
|
14
14
|
"licence": "Apache-2.0",
|
|
15
15
|
"url": "https://github.com/prowler-cloud/prowler"
|
|
16
16
|
},
|
|
@@ -19,924 +19,924 @@
|
|
|
19
19
|
{
|
|
20
20
|
"id": "prowler.azure.aisearch_service_not_publicly_accessible",
|
|
21
21
|
"title": "AI Search service has public network access disabled",
|
|
22
|
-
"scope": "Prowler 5.
|
|
22
|
+
"scope": "Prowler 5.47.0 check aisearch_service_not_publicly_accessible (Azure aisearch, resource type microsoft.search/searchservices): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
23
23
|
"evidenceType": "Configuration",
|
|
24
24
|
"severity": "high"
|
|
25
25
|
},
|
|
26
26
|
{
|
|
27
27
|
"id": "prowler.azure.aks_cluster_azure_monitor_enabled",
|
|
28
28
|
"title": "AKS cluster has Azure Monitor metrics enabled",
|
|
29
|
-
"scope": "Prowler 5.
|
|
29
|
+
"scope": "Prowler 5.47.0 check aks_cluster_azure_monitor_enabled (Azure aks, resource type microsoft.containerservice/managedclusters): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
30
30
|
"evidenceType": "Configuration",
|
|
31
31
|
"severity": "medium"
|
|
32
32
|
},
|
|
33
33
|
{
|
|
34
34
|
"id": "prowler.azure.aks_cluster_local_accounts_disabled",
|
|
35
35
|
"title": "AKS cluster has local accounts disabled",
|
|
36
|
-
"scope": "Prowler 5.
|
|
36
|
+
"scope": "Prowler 5.47.0 check aks_cluster_local_accounts_disabled (Azure aks, resource type microsoft.containerservice/managedclusters): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
37
37
|
"evidenceType": "Configuration",
|
|
38
38
|
"severity": "high"
|
|
39
39
|
},
|
|
40
40
|
{
|
|
41
41
|
"id": "prowler.azure.aks_cluster_rbac_enabled",
|
|
42
42
|
"title": "AKS cluster has RBAC enabled",
|
|
43
|
-
"scope": "Prowler 5.
|
|
43
|
+
"scope": "Prowler 5.47.0 check aks_cluster_rbac_enabled (Azure aks, resource type microsoft.containerservice/managedclusters): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
44
44
|
"evidenceType": "Configuration",
|
|
45
45
|
"severity": "high"
|
|
46
46
|
},
|
|
47
47
|
{
|
|
48
48
|
"id": "prowler.azure.aks_clusters_created_with_private_nodes",
|
|
49
49
|
"title": "AKS cluster nodes do not have public IP addresses",
|
|
50
|
-
"scope": "Prowler 5.
|
|
50
|
+
"scope": "Prowler 5.47.0 check aks_clusters_created_with_private_nodes (Azure aks, resource type microsoft.containerservice/managedclusters): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
51
51
|
"evidenceType": "Configuration",
|
|
52
52
|
"severity": "high"
|
|
53
53
|
},
|
|
54
54
|
{
|
|
55
55
|
"id": "prowler.azure.aks_clusters_public_access_disabled",
|
|
56
56
|
"title": "AKS cluster has a private endpoint and node public access is disabled",
|
|
57
|
-
"scope": "Prowler 5.
|
|
57
|
+
"scope": "Prowler 5.47.0 check aks_clusters_public_access_disabled (Azure aks, resource type microsoft.containerservice/managedclusters): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
58
58
|
"evidenceType": "Configuration",
|
|
59
59
|
"severity": "high"
|
|
60
60
|
},
|
|
61
61
|
{
|
|
62
62
|
"id": "prowler.azure.aks_network_policy_enabled",
|
|
63
63
|
"title": "AKS cluster has network policy enabled",
|
|
64
|
-
"scope": "Prowler 5.
|
|
64
|
+
"scope": "Prowler 5.47.0 check aks_network_policy_enabled (Azure aks, resource type microsoft.containerservice/managedclusters): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
65
65
|
"evidenceType": "Configuration",
|
|
66
66
|
"severity": "medium"
|
|
67
67
|
},
|
|
68
68
|
{
|
|
69
69
|
"id": "prowler.azure.app_client_certificates_on",
|
|
70
70
|
"title": "Web app requires incoming client certificates",
|
|
71
|
-
"scope": "Prowler 5.
|
|
71
|
+
"scope": "Prowler 5.47.0 check app_client_certificates_on (Azure app, resource type microsoft.web/sites/config): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
72
72
|
"evidenceType": "Configuration",
|
|
73
73
|
"severity": "medium"
|
|
74
74
|
},
|
|
75
75
|
{
|
|
76
76
|
"id": "prowler.azure.app_ensure_auth_is_set_up",
|
|
77
77
|
"title": "App Service app has App Service Authentication enabled",
|
|
78
|
-
"scope": "Prowler 5.
|
|
78
|
+
"scope": "Prowler 5.47.0 check app_ensure_auth_is_set_up (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
79
79
|
"evidenceType": "Configuration",
|
|
80
80
|
"severity": "medium"
|
|
81
81
|
},
|
|
82
82
|
{
|
|
83
83
|
"id": "prowler.azure.app_ensure_http_is_redirected_to_https",
|
|
84
84
|
"title": "App Service web app redirects HTTP to HTTPS",
|
|
85
|
-
"scope": "Prowler 5.
|
|
85
|
+
"scope": "Prowler 5.47.0 check app_ensure_http_is_redirected_to_https (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
86
86
|
"evidenceType": "Configuration",
|
|
87
87
|
"severity": "high"
|
|
88
88
|
},
|
|
89
89
|
{
|
|
90
90
|
"id": "prowler.azure.app_ensure_java_version_is_latest",
|
|
91
|
-
"title": "App Service web app
|
|
92
|
-
"scope": "Prowler 5.
|
|
91
|
+
"title": "App Service web app runs a supported Java version (17 or newer by default)",
|
|
92
|
+
"scope": "Prowler 5.47.0 check app_ensure_java_version_is_latest (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
93
93
|
"evidenceType": "Configuration",
|
|
94
94
|
"severity": "low"
|
|
95
95
|
},
|
|
96
96
|
{
|
|
97
97
|
"id": "prowler.azure.app_ensure_php_version_is_latest",
|
|
98
|
-
"title": "App Service web app
|
|
99
|
-
"scope": "Prowler 5.
|
|
98
|
+
"title": "App Service web app runs a supported PHP version (8.5 or newer by default)",
|
|
99
|
+
"scope": "Prowler 5.47.0 check app_ensure_php_version_is_latest (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
100
100
|
"evidenceType": "Configuration",
|
|
101
101
|
"severity": "low"
|
|
102
102
|
},
|
|
103
103
|
{
|
|
104
104
|
"id": "prowler.azure.app_ensure_python_version_is_latest",
|
|
105
|
-
"title": "App Service web app
|
|
106
|
-
"scope": "Prowler 5.
|
|
105
|
+
"title": "App Service web app runs a supported Python version (3.12 or newer by default)",
|
|
106
|
+
"scope": "Prowler 5.47.0 check app_ensure_python_version_is_latest (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
107
107
|
"evidenceType": "Configuration",
|
|
108
108
|
"severity": "low"
|
|
109
109
|
},
|
|
110
110
|
{
|
|
111
111
|
"id": "prowler.azure.app_ftp_deployment_disabled",
|
|
112
112
|
"title": "App Service web app has FTP disabled or FTPS-only enforced",
|
|
113
|
-
"scope": "Prowler 5.
|
|
113
|
+
"scope": "Prowler 5.47.0 check app_ftp_deployment_disabled (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
114
114
|
"evidenceType": "Configuration",
|
|
115
115
|
"severity": "high"
|
|
116
116
|
},
|
|
117
117
|
{
|
|
118
118
|
"id": "prowler.azure.app_function_application_insights_enabled",
|
|
119
119
|
"title": "Function App has Application Insights configured",
|
|
120
|
-
"scope": "Prowler 5.
|
|
120
|
+
"scope": "Prowler 5.47.0 check app_function_application_insights_enabled (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
121
121
|
"evidenceType": "Configuration",
|
|
122
122
|
"severity": "medium"
|
|
123
123
|
},
|
|
124
124
|
{
|
|
125
125
|
"id": "prowler.azure.app_function_ensure_http_is_redirected_to_https",
|
|
126
126
|
"title": "Function app redirects HTTP to HTTPS",
|
|
127
|
-
"scope": "Prowler 5.
|
|
127
|
+
"scope": "Prowler 5.47.0 check app_function_ensure_http_is_redirected_to_https (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
128
128
|
"evidenceType": "Configuration",
|
|
129
129
|
"severity": "high"
|
|
130
130
|
},
|
|
131
131
|
{
|
|
132
132
|
"id": "prowler.azure.app_function_ftps_deployment_disabled",
|
|
133
133
|
"title": "Function app has FTP and FTPS deployments disabled",
|
|
134
|
-
"scope": "Prowler 5.
|
|
134
|
+
"scope": "Prowler 5.47.0 check app_function_ftps_deployment_disabled (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
135
135
|
"evidenceType": "Configuration",
|
|
136
136
|
"severity": "medium"
|
|
137
137
|
},
|
|
138
138
|
{
|
|
139
139
|
"id": "prowler.azure.app_function_identity_is_configured",
|
|
140
140
|
"title": "Function app has a system-assigned or user-assigned managed identity enabled",
|
|
141
|
-
"scope": "Prowler 5.
|
|
141
|
+
"scope": "Prowler 5.47.0 check app_function_identity_is_configured (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
142
142
|
"evidenceType": "Configuration",
|
|
143
143
|
"severity": "medium"
|
|
144
144
|
},
|
|
145
145
|
{
|
|
146
146
|
"id": "prowler.azure.app_function_identity_without_admin_privileges",
|
|
147
147
|
"title": "Function app managed identity is not assigned Owner, Contributor, User Access Administrator, or Role Based Access Control Administrator roles",
|
|
148
|
-
"scope": "Prowler 5.
|
|
148
|
+
"scope": "Prowler 5.47.0 check app_function_identity_without_admin_privileges (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
149
149
|
"evidenceType": "Configuration",
|
|
150
150
|
"severity": "high"
|
|
151
151
|
},
|
|
152
152
|
{
|
|
153
153
|
"id": "prowler.azure.app_function_latest_runtime_version",
|
|
154
154
|
"title": "Function app uses the latest supported runtime version (~4)",
|
|
155
|
-
"scope": "Prowler 5.
|
|
155
|
+
"scope": "Prowler 5.47.0 check app_function_latest_runtime_version (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
156
156
|
"evidenceType": "Configuration",
|
|
157
157
|
"severity": "medium"
|
|
158
158
|
},
|
|
159
159
|
{
|
|
160
160
|
"id": "prowler.azure.app_function_not_publicly_accessible",
|
|
161
161
|
"title": "Function app is not publicly accessible",
|
|
162
|
-
"scope": "Prowler 5.
|
|
162
|
+
"scope": "Prowler 5.47.0 check app_function_not_publicly_accessible (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
163
163
|
"evidenceType": "Configuration",
|
|
164
164
|
"severity": "high"
|
|
165
165
|
},
|
|
166
166
|
{
|
|
167
167
|
"id": "prowler.azure.app_http_logs_enabled",
|
|
168
168
|
"title": "App Service web app has HTTP logs enabled in diagnostic settings",
|
|
169
|
-
"scope": "Prowler 5.
|
|
169
|
+
"scope": "Prowler 5.47.0 check app_http_logs_enabled (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
170
170
|
"evidenceType": "Configuration",
|
|
171
171
|
"severity": "low"
|
|
172
172
|
},
|
|
173
173
|
{
|
|
174
174
|
"id": "prowler.azure.app_minimum_tls_version_12",
|
|
175
175
|
"title": "App Service web app has minimum TLS version set to 1.2 or 1.3",
|
|
176
|
-
"scope": "Prowler 5.
|
|
176
|
+
"scope": "Prowler 5.47.0 check app_minimum_tls_version_12 (Azure app, resource type microsoft.web/sites/config): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
177
177
|
"evidenceType": "Configuration",
|
|
178
178
|
"severity": "medium"
|
|
179
179
|
},
|
|
180
180
|
{
|
|
181
181
|
"id": "prowler.azure.app_register_with_identity",
|
|
182
182
|
"title": "App Service web app has a managed identity configured",
|
|
183
|
-
"scope": "Prowler 5.
|
|
183
|
+
"scope": "Prowler 5.47.0 check app_register_with_identity (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
184
184
|
"evidenceType": "Configuration",
|
|
185
185
|
"severity": "medium"
|
|
186
186
|
},
|
|
187
187
|
{
|
|
188
188
|
"id": "prowler.azure.appinsights_ensure_is_configured",
|
|
189
189
|
"title": "Subscription has at least one Application Insights resource configured",
|
|
190
|
-
"scope": "Prowler 5.
|
|
190
|
+
"scope": "Prowler 5.47.0 check appinsights_ensure_is_configured (Azure appinsights, resource type microsoft.insights/components): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
191
191
|
"evidenceType": "Configuration",
|
|
192
192
|
"severity": "low"
|
|
193
193
|
},
|
|
194
194
|
{
|
|
195
195
|
"id": "prowler.azure.containerregistry_not_publicly_accessible",
|
|
196
196
|
"title": "Container Registry public network access is disabled",
|
|
197
|
-
"scope": "Prowler 5.
|
|
197
|
+
"scope": "Prowler 5.47.0 check containerregistry_not_publicly_accessible (Azure containerregistry, resource type microsoft.containerregistry/registries): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
198
198
|
"evidenceType": "Configuration",
|
|
199
199
|
"severity": "high"
|
|
200
200
|
},
|
|
201
201
|
{
|
|
202
202
|
"id": "prowler.azure.cosmosdb_account_automatic_failover_enabled",
|
|
203
203
|
"title": "Cosmos DB account has automatic failover enabled",
|
|
204
|
-
"scope": "Prowler 5.
|
|
204
|
+
"scope": "Prowler 5.47.0 check cosmosdb_account_automatic_failover_enabled (Azure cosmosdb, resource type microsoft.documentdb/databaseaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
205
205
|
"evidenceType": "Configuration",
|
|
206
206
|
"severity": "medium"
|
|
207
207
|
},
|
|
208
208
|
{
|
|
209
209
|
"id": "prowler.azure.cosmosdb_account_backup_policy_continuous",
|
|
210
210
|
"title": "Cosmos DB account uses continuous backup policy",
|
|
211
|
-
"scope": "Prowler 5.
|
|
211
|
+
"scope": "Prowler 5.47.0 check cosmosdb_account_backup_policy_continuous (Azure cosmosdb, resource type microsoft.documentdb/databaseaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
212
212
|
"evidenceType": "Configuration",
|
|
213
213
|
"severity": "medium"
|
|
214
214
|
},
|
|
215
215
|
{
|
|
216
216
|
"id": "prowler.azure.cosmosdb_account_minimum_tls_version",
|
|
217
217
|
"title": "Cosmos DB account enforces TLS 1.2 or higher",
|
|
218
|
-
"scope": "Prowler 5.
|
|
218
|
+
"scope": "Prowler 5.47.0 check cosmosdb_account_minimum_tls_version (Azure cosmosdb, resource type microsoft.documentdb/databaseaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
219
219
|
"evidenceType": "Configuration",
|
|
220
220
|
"severity": "medium"
|
|
221
221
|
},
|
|
222
222
|
{
|
|
223
223
|
"id": "prowler.azure.cosmosdb_account_public_network_access_disabled",
|
|
224
224
|
"title": "Cosmos DB account has public network access disabled",
|
|
225
|
-
"scope": "Prowler 5.
|
|
225
|
+
"scope": "Prowler 5.47.0 check cosmosdb_account_public_network_access_disabled (Azure cosmosdb, resource type microsoft.documentdb/databaseaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
226
226
|
"evidenceType": "Configuration",
|
|
227
227
|
"severity": "medium"
|
|
228
228
|
},
|
|
229
229
|
{
|
|
230
230
|
"id": "prowler.azure.cosmosdb_account_use_aad_and_rbac",
|
|
231
231
|
"title": "Cosmos DB account has local authentication disabled and uses Azure AD authentication with Azure RBAC",
|
|
232
|
-
"scope": "Prowler 5.
|
|
232
|
+
"scope": "Prowler 5.47.0 check cosmosdb_account_use_aad_and_rbac (Azure cosmosdb, resource type microsoft.documentdb/databaseaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
233
233
|
"evidenceType": "Configuration",
|
|
234
234
|
"severity": "high"
|
|
235
235
|
},
|
|
236
236
|
{
|
|
237
237
|
"id": "prowler.azure.databricks_workspace_cmk_encryption_enabled",
|
|
238
238
|
"title": "Databricks workspace uses a customer-managed key (CMK) for encryption at rest",
|
|
239
|
-
"scope": "Prowler 5.
|
|
239
|
+
"scope": "Prowler 5.47.0 check databricks_workspace_cmk_encryption_enabled (Azure databricks, resource type microsoft.databricks/workspaces): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
240
240
|
"evidenceType": "Configuration",
|
|
241
241
|
"severity": "high"
|
|
242
242
|
},
|
|
243
243
|
{
|
|
244
244
|
"id": "prowler.azure.databricks_workspace_no_public_ip_enabled",
|
|
245
245
|
"title": "Databricks workspace has secure cluster connectivity (no public IP)",
|
|
246
|
-
"scope": "Prowler 5.
|
|
246
|
+
"scope": "Prowler 5.47.0 check databricks_workspace_no_public_ip_enabled (Azure databricks, resource type microsoft.databricks/workspaces): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
247
247
|
"evidenceType": "Configuration",
|
|
248
248
|
"severity": "medium"
|
|
249
249
|
},
|
|
250
250
|
{
|
|
251
251
|
"id": "prowler.azure.databricks_workspace_public_network_access_disabled",
|
|
252
252
|
"title": "Databricks workspace has public network access disabled",
|
|
253
|
-
"scope": "Prowler 5.
|
|
253
|
+
"scope": "Prowler 5.47.0 check databricks_workspace_public_network_access_disabled (Azure databricks, resource type microsoft.databricks/workspaces): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
254
254
|
"evidenceType": "Configuration",
|
|
255
255
|
"severity": "high"
|
|
256
256
|
},
|
|
257
257
|
{
|
|
258
258
|
"id": "prowler.azure.defender_auto_provisioning_log_analytics_agent_vms_on",
|
|
259
259
|
"title": "Defender auto-provisioning of Log Analytics agent for Azure VMs is enabled",
|
|
260
|
-
"scope": "Prowler 5.
|
|
260
|
+
"scope": "Prowler 5.47.0 check defender_auto_provisioning_log_analytics_agent_vms_on (Azure defender, resource type microsoft.resources/subscriptions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
261
261
|
"evidenceType": "Configuration",
|
|
262
262
|
"severity": "high"
|
|
263
263
|
},
|
|
264
264
|
{
|
|
265
265
|
"id": "prowler.azure.defender_container_images_resolved_vulnerabilities",
|
|
266
266
|
"title": "All Azure running container images in the subscription have no unresolved vulnerabilities",
|
|
267
|
-
"scope": "Prowler 5.
|
|
267
|
+
"scope": "Prowler 5.47.0 check defender_container_images_resolved_vulnerabilities (Azure defender, resource type microsoft.security/assessmentssample): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
268
268
|
"evidenceType": "Configuration",
|
|
269
269
|
"severity": "critical"
|
|
270
270
|
},
|
|
271
271
|
{
|
|
272
272
|
"id": "prowler.azure.defender_container_images_scan_enabled",
|
|
273
273
|
"title": "Subscription has container image vulnerability scanning enabled",
|
|
274
|
-
"scope": "Prowler 5.
|
|
274
|
+
"scope": "Prowler 5.47.0 check defender_container_images_scan_enabled (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
275
275
|
"evidenceType": "Configuration",
|
|
276
276
|
"severity": "high"
|
|
277
277
|
},
|
|
278
278
|
{
|
|
279
279
|
"id": "prowler.azure.defender_ensure_defender_cspm_is_on",
|
|
280
280
|
"title": "Microsoft Defender CSPM is set to On",
|
|
281
|
-
"scope": "Prowler 5.
|
|
281
|
+
"scope": "Prowler 5.47.0 check defender_ensure_defender_cspm_is_on (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
282
282
|
"evidenceType": "Configuration",
|
|
283
283
|
"severity": "medium"
|
|
284
284
|
},
|
|
285
285
|
{
|
|
286
286
|
"id": "prowler.azure.defender_ensure_system_updates_are_applied",
|
|
287
287
|
"title": "All virtual machines in the subscription have system updates applied",
|
|
288
|
-
"scope": "Prowler 5.
|
|
288
|
+
"scope": "Prowler 5.47.0 check defender_ensure_system_updates_are_applied (Azure defender, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
289
289
|
"evidenceType": "Configuration",
|
|
290
290
|
"severity": "high"
|
|
291
291
|
},
|
|
292
292
|
{
|
|
293
293
|
"id": "prowler.azure.entra_app_registration_credential_not_expired",
|
|
294
294
|
"title": "App registration credentials are not expired or expiring soon",
|
|
295
|
-
"scope": "Prowler 5.
|
|
295
|
+
"scope": "Prowler 5.47.0 check entra_app_registration_credential_not_expired (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
296
296
|
"evidenceType": "Configuration",
|
|
297
297
|
"severity": "high"
|
|
298
298
|
},
|
|
299
299
|
{
|
|
300
300
|
"id": "prowler.azure.entra_global_admin_in_less_than_five_users",
|
|
301
301
|
"title": "Global Administrator role has fewer than 5 members",
|
|
302
|
-
"scope": "Prowler 5.
|
|
302
|
+
"scope": "Prowler 5.47.0 check entra_global_admin_in_less_than_five_users (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
303
303
|
"evidenceType": "Configuration",
|
|
304
304
|
"severity": "high"
|
|
305
305
|
},
|
|
306
306
|
{
|
|
307
307
|
"id": "prowler.azure.entra_policy_default_users_cannot_create_security_groups",
|
|
308
308
|
"title": "Authorization policy disallows non-privileged users from creating security groups",
|
|
309
|
-
"scope": "Prowler 5.
|
|
309
|
+
"scope": "Prowler 5.47.0 check entra_policy_default_users_cannot_create_security_groups (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
310
310
|
"evidenceType": "Configuration",
|
|
311
311
|
"severity": "medium"
|
|
312
312
|
},
|
|
313
313
|
{
|
|
314
314
|
"id": "prowler.azure.entra_policy_ensure_default_user_cannot_create_apps",
|
|
315
315
|
"title": "Tenant does not allow non-admin users to register applications",
|
|
316
|
-
"scope": "Prowler 5.
|
|
316
|
+
"scope": "Prowler 5.47.0 check entra_policy_ensure_default_user_cannot_create_apps (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
317
317
|
"evidenceType": "Configuration",
|
|
318
318
|
"severity": "high"
|
|
319
319
|
},
|
|
320
320
|
{
|
|
321
321
|
"id": "prowler.azure.entra_policy_ensure_default_user_cannot_create_tenants",
|
|
322
322
|
"title": "Authorization policy restricts non-admin users from creating tenants",
|
|
323
|
-
"scope": "Prowler 5.
|
|
323
|
+
"scope": "Prowler 5.47.0 check entra_policy_ensure_default_user_cannot_create_tenants (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
324
324
|
"evidenceType": "Configuration",
|
|
325
325
|
"severity": "medium"
|
|
326
326
|
},
|
|
327
327
|
{
|
|
328
328
|
"id": "prowler.azure.entra_policy_guest_invite_only_for_admin_roles",
|
|
329
329
|
"title": "Tenant authorization policy restricts guest invitations to users with specific admin roles or disables guest invitations",
|
|
330
|
-
"scope": "Prowler 5.
|
|
330
|
+
"scope": "Prowler 5.47.0 check entra_policy_guest_invite_only_for_admin_roles (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
331
331
|
"evidenceType": "Configuration",
|
|
332
332
|
"severity": "high"
|
|
333
333
|
},
|
|
334
334
|
{
|
|
335
335
|
"id": "prowler.azure.entra_policy_guest_users_access_restrictions",
|
|
336
336
|
"title": "Authorization policy restricts guest user access to properties and memberships of their own directory objects",
|
|
337
|
-
"scope": "Prowler 5.
|
|
337
|
+
"scope": "Prowler 5.47.0 check entra_policy_guest_users_access_restrictions (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
338
338
|
"evidenceType": "Configuration",
|
|
339
339
|
"severity": "medium"
|
|
340
340
|
},
|
|
341
341
|
{
|
|
342
342
|
"id": "prowler.azure.entra_policy_restricts_user_consent_for_apps",
|
|
343
343
|
"title": "Entra authorization policy disallows user consent for applications",
|
|
344
|
-
"scope": "Prowler 5.
|
|
344
|
+
"scope": "Prowler 5.47.0 check entra_policy_restricts_user_consent_for_apps (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
345
345
|
"evidenceType": "Configuration",
|
|
346
346
|
"severity": "high"
|
|
347
347
|
},
|
|
348
348
|
{
|
|
349
349
|
"id": "prowler.azure.entra_policy_user_consent_for_verified_apps",
|
|
350
350
|
"title": "Entra tenant does not allow users to consent to non-verified applications",
|
|
351
|
-
"scope": "Prowler 5.
|
|
351
|
+
"scope": "Prowler 5.47.0 check entra_policy_user_consent_for_verified_apps (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
352
352
|
"evidenceType": "Configuration",
|
|
353
353
|
"severity": "high"
|
|
354
354
|
},
|
|
355
355
|
{
|
|
356
356
|
"id": "prowler.azure.entra_user_with_recent_sign_in",
|
|
357
357
|
"title": "Enabled user has signed in within the last 90 days",
|
|
358
|
-
"scope": "Prowler 5.
|
|
358
|
+
"scope": "Prowler 5.47.0 check entra_user_with_recent_sign_in (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
359
359
|
"evidenceType": "Configuration",
|
|
360
360
|
"severity": "medium"
|
|
361
361
|
},
|
|
362
362
|
{
|
|
363
363
|
"id": "prowler.azure.entra_users_cannot_create_microsoft_365_groups",
|
|
364
364
|
"title": "Microsoft 365 group creation by users is disabled",
|
|
365
|
-
"scope": "Prowler 5.
|
|
365
|
+
"scope": "Prowler 5.47.0 check entra_users_cannot_create_microsoft_365_groups (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
366
366
|
"evidenceType": "Configuration",
|
|
367
367
|
"severity": "medium"
|
|
368
368
|
},
|
|
369
369
|
{
|
|
370
370
|
"id": "prowler.azure.iam_custom_role_has_permissions_to_administer_resource_locks",
|
|
371
371
|
"title": "Custom role has permission to administer resource locks",
|
|
372
|
-
"scope": "Prowler 5.
|
|
372
|
+
"scope": "Prowler 5.47.0 check iam_custom_role_has_permissions_to_administer_resource_locks (Azure iam, resource type microsoft.authorization/roledefinitions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
373
373
|
"evidenceType": "Configuration",
|
|
374
374
|
"severity": "medium"
|
|
375
375
|
},
|
|
376
376
|
{
|
|
377
377
|
"id": "prowler.azure.iam_role_user_access_admin_restricted",
|
|
378
378
|
"title": "Role assignment does not grant the User Access Administrator role",
|
|
379
|
-
"scope": "Prowler 5.
|
|
379
|
+
"scope": "Prowler 5.47.0 check iam_role_user_access_admin_restricted (Azure iam, resource type microsoft.authorization/roleassignments): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
380
380
|
"evidenceType": "Configuration",
|
|
381
381
|
"severity": "high"
|
|
382
382
|
},
|
|
383
383
|
{
|
|
384
384
|
"id": "prowler.azure.iam_subscription_roles_owner_custom_not_created",
|
|
385
385
|
"title": "Custom role is not a subscription owner role",
|
|
386
|
-
"scope": "Prowler 5.
|
|
386
|
+
"scope": "Prowler 5.47.0 check iam_subscription_roles_owner_custom_not_created (Azure iam, resource type microsoft.authorization/roledefinitions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
387
387
|
"evidenceType": "Configuration",
|
|
388
388
|
"severity": "high"
|
|
389
389
|
},
|
|
390
390
|
{
|
|
391
391
|
"id": "prowler.azure.keyvault_key_expiration_set_in_non_rbac",
|
|
392
392
|
"title": "Key in non-RBAC Key Vault has expiration date set",
|
|
393
|
-
"scope": "Prowler 5.
|
|
393
|
+
"scope": "Prowler 5.47.0 check keyvault_key_expiration_set_in_non_rbac (Azure keyvault, resource type microsoft.keyvault/vaults/keys): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
394
394
|
"evidenceType": "Configuration",
|
|
395
395
|
"severity": "high"
|
|
396
396
|
},
|
|
397
397
|
{
|
|
398
398
|
"id": "prowler.azure.keyvault_key_rotation_enabled",
|
|
399
399
|
"title": "Key Vault key has automatic rotation enabled",
|
|
400
|
-
"scope": "Prowler 5.
|
|
400
|
+
"scope": "Prowler 5.47.0 check keyvault_key_rotation_enabled (Azure keyvault, resource type microsoft.keyvault/vaults/keys): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
401
401
|
"evidenceType": "Configuration",
|
|
402
402
|
"severity": "high"
|
|
403
403
|
},
|
|
404
404
|
{
|
|
405
405
|
"id": "prowler.azure.keyvault_non_rbac_secret_expiration_set",
|
|
406
406
|
"title": "Secret in non-RBAC Key Vault has expiration date set",
|
|
407
|
-
"scope": "Prowler 5.
|
|
407
|
+
"scope": "Prowler 5.47.0 check keyvault_non_rbac_secret_expiration_set (Azure keyvault, resource type microsoft.keyvault/vaults/secrets): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
408
408
|
"evidenceType": "Configuration",
|
|
409
409
|
"severity": "medium"
|
|
410
410
|
},
|
|
411
411
|
{
|
|
412
412
|
"id": "prowler.azure.keyvault_rbac_enabled",
|
|
413
413
|
"title": "Key Vault uses Azure RBAC for access control",
|
|
414
|
-
"scope": "Prowler 5.
|
|
414
|
+
"scope": "Prowler 5.47.0 check keyvault_rbac_enabled (Azure keyvault, resource type microsoft.keyvault/vaults): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
415
415
|
"evidenceType": "Configuration",
|
|
416
416
|
"severity": "high"
|
|
417
417
|
},
|
|
418
418
|
{
|
|
419
419
|
"id": "prowler.azure.keyvault_rbac_key_expiration_set",
|
|
420
420
|
"title": "Key in RBAC-enabled Key Vault has expiration date set",
|
|
421
|
-
"scope": "Prowler 5.
|
|
421
|
+
"scope": "Prowler 5.47.0 check keyvault_rbac_key_expiration_set (Azure keyvault, resource type microsoft.keyvault/vaults/keys): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
422
422
|
"evidenceType": "Configuration",
|
|
423
423
|
"severity": "medium"
|
|
424
424
|
},
|
|
425
425
|
{
|
|
426
426
|
"id": "prowler.azure.keyvault_rbac_secret_expiration_set",
|
|
427
427
|
"title": "Secret in RBAC-enabled Key Vault has expiration date set",
|
|
428
|
-
"scope": "Prowler 5.
|
|
428
|
+
"scope": "Prowler 5.47.0 check keyvault_rbac_secret_expiration_set (Azure keyvault, resource type microsoft.keyvault/vaults/secrets): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
429
429
|
"evidenceType": "Configuration",
|
|
430
430
|
"severity": "medium"
|
|
431
431
|
},
|
|
432
432
|
{
|
|
433
433
|
"id": "prowler.azure.keyvault_recoverable",
|
|
434
434
|
"title": "Key Vault has soft delete and purge protection enabled",
|
|
435
|
-
"scope": "Prowler 5.
|
|
435
|
+
"scope": "Prowler 5.47.0 check keyvault_recoverable (Azure keyvault, resource type microsoft.keyvault/vaults): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
436
436
|
"evidenceType": "Configuration",
|
|
437
437
|
"severity": "high"
|
|
438
438
|
},
|
|
439
439
|
{
|
|
440
440
|
"id": "prowler.azure.monitor_alert_create_policy_assignment",
|
|
441
441
|
"title": "Subscription has an Azure Monitor activity log alert for policy assignment creation",
|
|
442
|
-
"scope": "Prowler 5.
|
|
442
|
+
"scope": "Prowler 5.47.0 check monitor_alert_create_policy_assignment (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
443
443
|
"evidenceType": "Configuration",
|
|
444
444
|
"severity": "medium"
|
|
445
445
|
},
|
|
446
446
|
{
|
|
447
447
|
"id": "prowler.azure.monitor_alert_create_update_nsg",
|
|
448
448
|
"title": "Subscription has an Activity Log alert for Network Security Group create or update operations",
|
|
449
|
-
"scope": "Prowler 5.
|
|
449
|
+
"scope": "Prowler 5.47.0 check monitor_alert_create_update_nsg (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
450
450
|
"evidenceType": "Configuration",
|
|
451
451
|
"severity": "high"
|
|
452
452
|
},
|
|
453
453
|
{
|
|
454
454
|
"id": "prowler.azure.monitor_alert_create_update_public_ip_address_rule",
|
|
455
455
|
"title": "Subscription has an Activity Log Alert for Public IP address create or update operations",
|
|
456
|
-
"scope": "Prowler 5.
|
|
456
|
+
"scope": "Prowler 5.47.0 check monitor_alert_create_update_public_ip_address_rule (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
457
457
|
"evidenceType": "Configuration",
|
|
458
458
|
"severity": "medium"
|
|
459
459
|
},
|
|
460
460
|
{
|
|
461
461
|
"id": "prowler.azure.monitor_alert_create_update_security_solution",
|
|
462
462
|
"title": "Subscription has Activity Log alert for Security Solution create or update",
|
|
463
|
-
"scope": "Prowler 5.
|
|
463
|
+
"scope": "Prowler 5.47.0 check monitor_alert_create_update_security_solution (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
464
464
|
"evidenceType": "Configuration",
|
|
465
465
|
"severity": "medium"
|
|
466
466
|
},
|
|
467
467
|
{
|
|
468
468
|
"id": "prowler.azure.monitor_alert_create_update_sqlserver_fr",
|
|
469
469
|
"title": "Subscription has an Activity Log alert for SQL Server firewall rule create or update events",
|
|
470
|
-
"scope": "Prowler 5.
|
|
470
|
+
"scope": "Prowler 5.47.0 check monitor_alert_create_update_sqlserver_fr (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
471
471
|
"evidenceType": "Configuration",
|
|
472
472
|
"severity": "medium"
|
|
473
473
|
},
|
|
474
474
|
{
|
|
475
475
|
"id": "prowler.azure.monitor_alert_delete_nsg",
|
|
476
476
|
"title": "Subscription has an Activity Log alert for Network Security Group delete operations",
|
|
477
|
-
"scope": "Prowler 5.
|
|
477
|
+
"scope": "Prowler 5.47.0 check monitor_alert_delete_nsg (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
478
478
|
"evidenceType": "Configuration",
|
|
479
479
|
"severity": "high"
|
|
480
480
|
},
|
|
481
481
|
{
|
|
482
482
|
"id": "prowler.azure.monitor_alert_delete_policy_assignment",
|
|
483
483
|
"title": "Subscription has an Activity Log alert for policy assignment deletion",
|
|
484
|
-
"scope": "Prowler 5.
|
|
484
|
+
"scope": "Prowler 5.47.0 check monitor_alert_delete_policy_assignment (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
485
485
|
"evidenceType": "Configuration",
|
|
486
486
|
"severity": "high"
|
|
487
487
|
},
|
|
488
488
|
{
|
|
489
489
|
"id": "prowler.azure.monitor_alert_delete_public_ip_address_rule",
|
|
490
490
|
"title": "Azure subscription has an Activity Log alert for public IP address deletion",
|
|
491
|
-
"scope": "Prowler 5.
|
|
491
|
+
"scope": "Prowler 5.47.0 check monitor_alert_delete_public_ip_address_rule (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
492
492
|
"evidenceType": "Configuration",
|
|
493
493
|
"severity": "medium"
|
|
494
494
|
},
|
|
495
495
|
{
|
|
496
496
|
"id": "prowler.azure.monitor_alert_delete_security_solution",
|
|
497
497
|
"title": "Subscription has an Azure Monitor Activity Log alert for Microsoft.Security/securitySolutions delete operations",
|
|
498
|
-
"scope": "Prowler 5.
|
|
498
|
+
"scope": "Prowler 5.47.0 check monitor_alert_delete_security_solution (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
499
499
|
"evidenceType": "Configuration",
|
|
500
500
|
"severity": "medium"
|
|
501
501
|
},
|
|
502
502
|
{
|
|
503
503
|
"id": "prowler.azure.monitor_alert_delete_sqlserver_fr",
|
|
504
504
|
"title": "Subscription has an Activity Log Alert for SQL Server firewall rule deletions",
|
|
505
|
-
"scope": "Prowler 5.
|
|
505
|
+
"scope": "Prowler 5.47.0 check monitor_alert_delete_sqlserver_fr (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
506
506
|
"evidenceType": "Configuration",
|
|
507
507
|
"severity": "medium"
|
|
508
508
|
},
|
|
509
509
|
{
|
|
510
510
|
"id": "prowler.azure.monitor_diagnostic_setting_with_appropriate_categories",
|
|
511
511
|
"title": "Subscription has a diagnostic setting capturing Administrative, Security, Alert, and Policy categories",
|
|
512
|
-
"scope": "Prowler 5.
|
|
512
|
+
"scope": "Prowler 5.47.0 check monitor_diagnostic_setting_with_appropriate_categories (Azure monitor, resource type microsoft.resources/subscriptions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
513
513
|
"evidenceType": "Configuration",
|
|
514
514
|
"severity": "high"
|
|
515
515
|
},
|
|
516
516
|
{
|
|
517
517
|
"id": "prowler.azure.monitor_diagnostic_settings_exists",
|
|
518
518
|
"title": "Subscription has an Activity Log diagnostic setting",
|
|
519
|
-
"scope": "Prowler 5.
|
|
519
|
+
"scope": "Prowler 5.47.0 check monitor_diagnostic_settings_exists (Azure monitor, resource type microsoft.resources/subscriptions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
520
520
|
"evidenceType": "Configuration",
|
|
521
521
|
"severity": "high"
|
|
522
522
|
},
|
|
523
523
|
{
|
|
524
524
|
"id": "prowler.azure.monitor_storage_account_with_activity_logs_cmk_encrypted",
|
|
525
525
|
"title": "Storage account storing Activity Log data is encrypted with a customer-managed key",
|
|
526
|
-
"scope": "Prowler 5.
|
|
526
|
+
"scope": "Prowler 5.47.0 check monitor_storage_account_with_activity_logs_cmk_encrypted (Azure monitor, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
527
527
|
"evidenceType": "Configuration",
|
|
528
528
|
"severity": "medium"
|
|
529
529
|
},
|
|
530
530
|
{
|
|
531
531
|
"id": "prowler.azure.monitor_storage_account_with_activity_logs_is_private",
|
|
532
532
|
"title": "Storage account storing activity logs does not allow public blob access",
|
|
533
|
-
"scope": "Prowler 5.
|
|
533
|
+
"scope": "Prowler 5.47.0 check monitor_storage_account_with_activity_logs_is_private (Azure monitor, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
534
534
|
"evidenceType": "Configuration",
|
|
535
535
|
"severity": "high"
|
|
536
536
|
},
|
|
537
537
|
{
|
|
538
538
|
"id": "prowler.azure.mysql_flexible_server_audit_log_connection_activated",
|
|
539
539
|
"title": "MySQL flexible server has audit_log_events including CONNECTION",
|
|
540
|
-
"scope": "Prowler 5.
|
|
540
|
+
"scope": "Prowler 5.47.0 check mysql_flexible_server_audit_log_connection_activated (Azure mysql, resource type microsoft.dbformysql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
541
541
|
"evidenceType": "Configuration",
|
|
542
542
|
"severity": "medium"
|
|
543
543
|
},
|
|
544
544
|
{
|
|
545
545
|
"id": "prowler.azure.mysql_flexible_server_audit_log_enabled",
|
|
546
546
|
"title": "MySQL flexible server has audit_log_enabled set to ON",
|
|
547
|
-
"scope": "Prowler 5.
|
|
547
|
+
"scope": "Prowler 5.47.0 check mysql_flexible_server_audit_log_enabled (Azure mysql, resource type microsoft.dbformysql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
548
548
|
"evidenceType": "Configuration",
|
|
549
549
|
"severity": "medium"
|
|
550
550
|
},
|
|
551
551
|
{
|
|
552
552
|
"id": "prowler.azure.mysql_flexible_server_geo_redundant_backup_enabled",
|
|
553
553
|
"title": "MySQL flexible server has geo-redundant backup enabled",
|
|
554
|
-
"scope": "Prowler 5.
|
|
554
|
+
"scope": "Prowler 5.47.0 check mysql_flexible_server_geo_redundant_backup_enabled (Azure mysql, resource type microsoft.dbformysql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
555
555
|
"evidenceType": "Configuration",
|
|
556
556
|
"severity": "medium"
|
|
557
557
|
},
|
|
558
558
|
{
|
|
559
559
|
"id": "prowler.azure.mysql_flexible_server_high_availability_enabled",
|
|
560
560
|
"title": "MySQL flexible server has high availability enabled",
|
|
561
|
-
"scope": "Prowler 5.
|
|
561
|
+
"scope": "Prowler 5.47.0 check mysql_flexible_server_high_availability_enabled (Azure mysql, resource type microsoft.dbformysql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
562
562
|
"evidenceType": "Configuration",
|
|
563
563
|
"severity": "medium"
|
|
564
564
|
},
|
|
565
565
|
{
|
|
566
566
|
"id": "prowler.azure.mysql_flexible_server_minimum_tls_version_12",
|
|
567
567
|
"title": "MySQL flexible server enforces TLS 1.2 or higher",
|
|
568
|
-
"scope": "Prowler 5.
|
|
568
|
+
"scope": "Prowler 5.47.0 check mysql_flexible_server_minimum_tls_version_12 (Azure mysql, resource type microsoft.dbformysql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
569
569
|
"evidenceType": "Configuration",
|
|
570
570
|
"severity": "high"
|
|
571
571
|
},
|
|
572
572
|
{
|
|
573
573
|
"id": "prowler.azure.mysql_flexible_server_ssl_connection_enabled",
|
|
574
574
|
"title": "MySQL Flexible Server enforces SSL connections",
|
|
575
|
-
"scope": "Prowler 5.
|
|
575
|
+
"scope": "Prowler 5.47.0 check mysql_flexible_server_ssl_connection_enabled (Azure mysql, resource type microsoft.dbformysql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
576
576
|
"evidenceType": "Configuration",
|
|
577
577
|
"severity": "high"
|
|
578
578
|
},
|
|
579
579
|
{
|
|
580
580
|
"id": "prowler.azure.network_bastion_host_exists",
|
|
581
581
|
"title": "Azure subscription has at least one Bastion Host",
|
|
582
|
-
"scope": "Prowler 5.
|
|
582
|
+
"scope": "Prowler 5.47.0 check network_bastion_host_exists (Azure network, resource type microsoft.network/bastionhosts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
583
583
|
"evidenceType": "Configuration",
|
|
584
584
|
"severity": "medium"
|
|
585
585
|
},
|
|
586
586
|
{
|
|
587
587
|
"id": "prowler.azure.network_flow_log_captured_sent",
|
|
588
588
|
"title": "Network Watcher has flow logs enabled and sent to a Log Analytics workspace",
|
|
589
|
-
"scope": "Prowler 5.
|
|
589
|
+
"scope": "Prowler 5.47.0 check network_flow_log_captured_sent (Azure network, resource type microsoft.network/networkwatchers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
590
590
|
"evidenceType": "Configuration",
|
|
591
591
|
"severity": "high"
|
|
592
592
|
},
|
|
593
593
|
{
|
|
594
594
|
"id": "prowler.azure.network_flow_log_more_than_90_days",
|
|
595
595
|
"title": "Network Watcher has all flow logs enabled with retention set to 0 or at least 90 days",
|
|
596
|
-
"scope": "Prowler 5.
|
|
596
|
+
"scope": "Prowler 5.47.0 check network_flow_log_more_than_90_days (Azure network, resource type microsoft.network/networkwatchers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
597
597
|
"evidenceType": "Configuration",
|
|
598
598
|
"severity": "medium"
|
|
599
599
|
},
|
|
600
600
|
{
|
|
601
601
|
"id": "prowler.azure.network_http_internet_access_restricted",
|
|
602
602
|
"title": "Network security group restricts inbound HTTP (port 80) access from the Internet",
|
|
603
|
-
"scope": "Prowler 5.
|
|
603
|
+
"scope": "Prowler 5.47.0 check network_http_internet_access_restricted (Azure network, resource type microsoft.network/networksecuritygroups): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
604
604
|
"evidenceType": "Configuration",
|
|
605
605
|
"severity": "high"
|
|
606
606
|
},
|
|
607
607
|
{
|
|
608
608
|
"id": "prowler.azure.network_rdp_internet_access_restricted",
|
|
609
609
|
"title": "Network security group does not allow inbound RDP (TCP 3389) from the Internet",
|
|
610
|
-
"scope": "Prowler 5.
|
|
610
|
+
"scope": "Prowler 5.47.0 check network_rdp_internet_access_restricted (Azure network, resource type microsoft.network/networksecuritygroups): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
611
611
|
"evidenceType": "Configuration",
|
|
612
612
|
"severity": "high"
|
|
613
613
|
},
|
|
614
614
|
{
|
|
615
615
|
"id": "prowler.azure.network_ssh_internet_access_restricted",
|
|
616
616
|
"title": "Network security group does not allow inbound SSH (TCP port 22) from the Internet",
|
|
617
|
-
"scope": "Prowler 5.
|
|
617
|
+
"scope": "Prowler 5.47.0 check network_ssh_internet_access_restricted (Azure network, resource type microsoft.network/networksecuritygroups): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
618
618
|
"evidenceType": "Configuration",
|
|
619
619
|
"severity": "high"
|
|
620
620
|
},
|
|
621
621
|
{
|
|
622
622
|
"id": "prowler.azure.network_subnet_nsg_associated",
|
|
623
623
|
"title": "Subnet has a network security group associated",
|
|
624
|
-
"scope": "Prowler 5.
|
|
624
|
+
"scope": "Prowler 5.47.0 check network_subnet_nsg_associated (Azure network, resource type microsoft.network/virtualnetworks/subnets): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
625
625
|
"evidenceType": "Configuration",
|
|
626
626
|
"severity": "high"
|
|
627
627
|
},
|
|
628
628
|
{
|
|
629
629
|
"id": "prowler.azure.network_udp_internet_access_restricted",
|
|
630
630
|
"title": "Network security group does not allow inbound UDP from the Internet",
|
|
631
|
-
"scope": "Prowler 5.
|
|
631
|
+
"scope": "Prowler 5.47.0 check network_udp_internet_access_restricted (Azure network, resource type microsoft.network/networksecuritygroups): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
632
632
|
"evidenceType": "Configuration",
|
|
633
633
|
"severity": "high"
|
|
634
634
|
},
|
|
635
635
|
{
|
|
636
636
|
"id": "prowler.azure.network_vnet_ddos_protection_enabled",
|
|
637
637
|
"title": "Virtual network has Azure DDoS Network Protection enabled",
|
|
638
|
-
"scope": "Prowler 5.
|
|
638
|
+
"scope": "Prowler 5.47.0 check network_vnet_ddos_protection_enabled (Azure network, resource type microsoft.network/virtualnetworks): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
639
639
|
"evidenceType": "Configuration",
|
|
640
640
|
"severity": "medium"
|
|
641
641
|
},
|
|
642
642
|
{
|
|
643
643
|
"id": "prowler.azure.network_watcher_enabled",
|
|
644
644
|
"title": "Network Watcher is enabled for all locations in the subscription",
|
|
645
|
-
"scope": "Prowler 5.
|
|
645
|
+
"scope": "Prowler 5.47.0 check network_watcher_enabled (Azure network, resource type microsoft.network/networkwatchers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
646
646
|
"evidenceType": "Configuration",
|
|
647
647
|
"severity": "high"
|
|
648
648
|
},
|
|
649
649
|
{
|
|
650
650
|
"id": "prowler.azure.policy_ensure_asc_enforcement_enabled",
|
|
651
651
|
"title": "Security Center built-in policy assignment has enforcement mode set to Default",
|
|
652
|
-
"scope": "Prowler 5.
|
|
652
|
+
"scope": "Prowler 5.47.0 check policy_ensure_asc_enforcement_enabled (Azure policy, resource type microsoft.authorization/policyassignments): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
653
653
|
"evidenceType": "Configuration",
|
|
654
654
|
"severity": "medium"
|
|
655
655
|
},
|
|
656
656
|
{
|
|
657
657
|
"id": "prowler.azure.postgresql_flexible_server_allow_access_services_disabled",
|
|
658
658
|
"title": "PostgreSQL flexible server has 'Allow public access from any Azure service' disabled",
|
|
659
|
-
"scope": "Prowler 5.
|
|
659
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_allow_access_services_disabled (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
660
660
|
"evidenceType": "Configuration",
|
|
661
661
|
"severity": "high"
|
|
662
662
|
},
|
|
663
663
|
{
|
|
664
664
|
"id": "prowler.azure.postgresql_flexible_server_connection_throttling_on",
|
|
665
665
|
"title": "Flexible PostgreSQL server has connection_throttling enabled",
|
|
666
|
-
"scope": "Prowler 5.
|
|
666
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_connection_throttling_on (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
667
667
|
"evidenceType": "Configuration",
|
|
668
668
|
"severity": "medium"
|
|
669
669
|
},
|
|
670
670
|
{
|
|
671
671
|
"id": "prowler.azure.postgresql_flexible_server_enforce_ssl_enabled",
|
|
672
672
|
"title": "PostgreSQL Flexible Server enforces SSL connections",
|
|
673
|
-
"scope": "Prowler 5.
|
|
673
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_enforce_ssl_enabled (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
674
674
|
"evidenceType": "Configuration",
|
|
675
675
|
"severity": "high"
|
|
676
676
|
},
|
|
677
677
|
{
|
|
678
678
|
"id": "prowler.azure.postgresql_flexible_server_geo_redundant_backup_enabled",
|
|
679
679
|
"title": "PostgreSQL flexible server has geo-redundant backup enabled",
|
|
680
|
-
"scope": "Prowler 5.
|
|
680
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_geo_redundant_backup_enabled (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
681
681
|
"evidenceType": "Configuration",
|
|
682
682
|
"severity": "medium"
|
|
683
683
|
},
|
|
684
684
|
{
|
|
685
685
|
"id": "prowler.azure.postgresql_flexible_server_high_availability_enabled",
|
|
686
686
|
"title": "PostgreSQL flexible server has high availability enabled",
|
|
687
|
-
"scope": "Prowler 5.
|
|
687
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_high_availability_enabled (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
688
688
|
"evidenceType": "Configuration",
|
|
689
689
|
"severity": "medium"
|
|
690
690
|
},
|
|
691
691
|
{
|
|
692
692
|
"id": "prowler.azure.postgresql_flexible_server_log_checkpoints_on",
|
|
693
693
|
"title": "PostgreSQL Flexible Server has checkpoint logging enabled",
|
|
694
|
-
"scope": "Prowler 5.
|
|
694
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_log_checkpoints_on (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
695
695
|
"evidenceType": "Configuration",
|
|
696
696
|
"severity": "low"
|
|
697
697
|
},
|
|
698
698
|
{
|
|
699
699
|
"id": "prowler.azure.postgresql_flexible_server_log_connections_on",
|
|
700
700
|
"title": "PostgreSQL flexible server has log_connections enabled",
|
|
701
|
-
"scope": "Prowler 5.
|
|
701
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_log_connections_on (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
702
702
|
"evidenceType": "Configuration",
|
|
703
703
|
"severity": "medium"
|
|
704
704
|
},
|
|
705
705
|
{
|
|
706
706
|
"id": "prowler.azure.postgresql_flexible_server_log_disconnections_on",
|
|
707
707
|
"title": "PostgreSQL Flexible Server has disconnection logging enabled",
|
|
708
|
-
"scope": "Prowler 5.
|
|
708
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_log_disconnections_on (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
709
709
|
"evidenceType": "Configuration",
|
|
710
710
|
"severity": "medium"
|
|
711
711
|
},
|
|
712
712
|
{
|
|
713
713
|
"id": "prowler.azure.recovery_vault_backup_policy_retention_adequate",
|
|
714
714
|
"title": "Recovery Services backup policy has at least 30 days retention",
|
|
715
|
-
"scope": "Prowler 5.
|
|
715
|
+
"scope": "Prowler 5.47.0 check recovery_vault_backup_policy_retention_adequate (Azure recovery, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
716
716
|
"evidenceType": "Configuration",
|
|
717
717
|
"severity": "medium"
|
|
718
718
|
},
|
|
719
719
|
{
|
|
720
720
|
"id": "prowler.azure.recovery_vault_has_protected_items",
|
|
721
721
|
"title": "Recovery Services vault has backup protected items configured",
|
|
722
|
-
"scope": "Prowler 5.
|
|
722
|
+
"scope": "Prowler 5.47.0 check recovery_vault_has_protected_items (Azure recovery, resource type microsoft.recoveryservices/vaults): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
723
723
|
"evidenceType": "Configuration",
|
|
724
724
|
"severity": "medium"
|
|
725
725
|
},
|
|
726
726
|
{
|
|
727
727
|
"id": "prowler.azure.sqlserver_auditing_enabled",
|
|
728
728
|
"title": "SQL Server has an auditing policy configured",
|
|
729
|
-
"scope": "Prowler 5.
|
|
729
|
+
"scope": "Prowler 5.47.0 check sqlserver_auditing_enabled (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
730
730
|
"evidenceType": "Configuration",
|
|
731
731
|
"severity": "high"
|
|
732
732
|
},
|
|
733
733
|
{
|
|
734
734
|
"id": "prowler.azure.sqlserver_auditing_retention_90_days",
|
|
735
735
|
"title": "SQL server has auditing enabled with retention greater than 90 days",
|
|
736
|
-
"scope": "Prowler 5.
|
|
736
|
+
"scope": "Prowler 5.47.0 check sqlserver_auditing_retention_90_days (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
737
737
|
"evidenceType": "Configuration",
|
|
738
738
|
"severity": "medium"
|
|
739
739
|
},
|
|
740
740
|
{
|
|
741
741
|
"id": "prowler.azure.sqlserver_recommended_minimal_tls_version",
|
|
742
742
|
"title": "SQL server enforces minimal TLS version 1.2 or 1.3",
|
|
743
|
-
"scope": "Prowler 5.
|
|
743
|
+
"scope": "Prowler 5.47.0 check sqlserver_recommended_minimal_tls_version (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
744
744
|
"evidenceType": "Configuration",
|
|
745
745
|
"severity": "medium"
|
|
746
746
|
},
|
|
747
747
|
{
|
|
748
748
|
"id": "prowler.azure.sqlserver_tde_encrypted_with_cmk",
|
|
749
749
|
"title": "SQL server uses a customer-managed key for the TDE protector and all databases have TDE enabled",
|
|
750
|
-
"scope": "Prowler 5.
|
|
750
|
+
"scope": "Prowler 5.47.0 check sqlserver_tde_encrypted_with_cmk (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
751
751
|
"evidenceType": "Configuration",
|
|
752
752
|
"severity": "critical"
|
|
753
753
|
},
|
|
754
754
|
{
|
|
755
755
|
"id": "prowler.azure.sqlserver_tde_encryption_enabled",
|
|
756
756
|
"title": "SQL database has Transparent Data Encryption (TDE) enabled",
|
|
757
|
-
"scope": "Prowler 5.
|
|
757
|
+
"scope": "Prowler 5.47.0 check sqlserver_tde_encryption_enabled (Azure sqlserver, resource type microsoft.sql/servers/databases): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
758
758
|
"evidenceType": "Configuration",
|
|
759
759
|
"severity": "high"
|
|
760
760
|
},
|
|
761
761
|
{
|
|
762
762
|
"id": "prowler.azure.sqlserver_unrestricted_inbound_access",
|
|
763
763
|
"title": "Azure SQL Server does not have firewall rules allowing 0.0.0.0-255.255.255.255",
|
|
764
|
-
"scope": "Prowler 5.
|
|
764
|
+
"scope": "Prowler 5.47.0 check sqlserver_unrestricted_inbound_access (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
765
765
|
"evidenceType": "Configuration",
|
|
766
766
|
"severity": "critical"
|
|
767
767
|
},
|
|
768
768
|
{
|
|
769
769
|
"id": "prowler.azure.sqlserver_va_periodic_recurring_scans_enabled",
|
|
770
770
|
"title": "SQL Server has Vulnerability Assessment periodic recurring scans enabled",
|
|
771
|
-
"scope": "Prowler 5.
|
|
771
|
+
"scope": "Prowler 5.47.0 check sqlserver_va_periodic_recurring_scans_enabled (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
772
772
|
"evidenceType": "Configuration",
|
|
773
773
|
"severity": "medium"
|
|
774
774
|
},
|
|
775
775
|
{
|
|
776
776
|
"id": "prowler.azure.sqlserver_vulnerability_assessment_enabled",
|
|
777
777
|
"title": "SQL server has vulnerability assessment enabled with storage container configured",
|
|
778
|
-
"scope": "Prowler 5.
|
|
778
|
+
"scope": "Prowler 5.47.0 check sqlserver_vulnerability_assessment_enabled (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
779
779
|
"evidenceType": "Configuration",
|
|
780
780
|
"severity": "medium"
|
|
781
781
|
},
|
|
782
782
|
{
|
|
783
783
|
"id": "prowler.azure.storage_account_key_access_disabled",
|
|
784
784
|
"title": "Storage account has shared key access disabled",
|
|
785
|
-
"scope": "Prowler 5.
|
|
785
|
+
"scope": "Prowler 5.47.0 check storage_account_key_access_disabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
786
786
|
"evidenceType": "Configuration",
|
|
787
787
|
"severity": "high"
|
|
788
788
|
},
|
|
789
789
|
{
|
|
790
790
|
"id": "prowler.azure.storage_account_public_network_access_disabled",
|
|
791
791
|
"title": "Storage account has 'Public Network Access' disabled",
|
|
792
|
-
"scope": "Prowler 5.
|
|
792
|
+
"scope": "Prowler 5.47.0 check storage_account_public_network_access_disabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
793
793
|
"evidenceType": "Configuration",
|
|
794
794
|
"severity": "high"
|
|
795
795
|
},
|
|
796
796
|
{
|
|
797
797
|
"id": "prowler.azure.storage_blob_public_access_level_is_disabled",
|
|
798
798
|
"title": "Storage account has 'Allow Blob Anonymous Access' disabled",
|
|
799
|
-
"scope": "Prowler 5.
|
|
799
|
+
"scope": "Prowler 5.47.0 check storage_blob_public_access_level_is_disabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
800
800
|
"evidenceType": "Configuration",
|
|
801
801
|
"severity": "high"
|
|
802
802
|
},
|
|
803
803
|
{
|
|
804
804
|
"id": "prowler.azure.storage_blob_versioning_is_enabled",
|
|
805
805
|
"title": "Storage account has blob versioning enabled",
|
|
806
|
-
"scope": "Prowler 5.
|
|
806
|
+
"scope": "Prowler 5.47.0 check storage_blob_versioning_is_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
807
807
|
"evidenceType": "Configuration",
|
|
808
808
|
"severity": "medium"
|
|
809
809
|
},
|
|
810
810
|
{
|
|
811
811
|
"id": "prowler.azure.storage_default_network_access_rule_is_denied",
|
|
812
812
|
"title": "Storage account default network access rule is set to Deny",
|
|
813
|
-
"scope": "Prowler 5.
|
|
813
|
+
"scope": "Prowler 5.47.0 check storage_default_network_access_rule_is_denied (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
814
814
|
"evidenceType": "Configuration",
|
|
815
815
|
"severity": "high"
|
|
816
816
|
},
|
|
817
817
|
{
|
|
818
818
|
"id": "prowler.azure.storage_default_to_entra_authorization_enabled",
|
|
819
819
|
"title": "Storage account uses Microsoft Entra authorization by default",
|
|
820
|
-
"scope": "Prowler 5.
|
|
820
|
+
"scope": "Prowler 5.47.0 check storage_default_to_entra_authorization_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
821
821
|
"evidenceType": "Configuration",
|
|
822
822
|
"severity": "medium"
|
|
823
823
|
},
|
|
824
824
|
{
|
|
825
825
|
"id": "prowler.azure.storage_ensure_encryption_with_customer_managed_keys",
|
|
826
826
|
"title": "Azure Storage account uses customer-managed keys (CMKs) for encryption",
|
|
827
|
-
"scope": "Prowler 5.
|
|
827
|
+
"scope": "Prowler 5.47.0 check storage_ensure_encryption_with_customer_managed_keys (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
828
828
|
"evidenceType": "Configuration",
|
|
829
829
|
"severity": "high"
|
|
830
830
|
},
|
|
831
831
|
{
|
|
832
832
|
"id": "prowler.azure.storage_ensure_file_shares_soft_delete_is_enabled",
|
|
833
833
|
"title": "Storage account has soft delete enabled for file shares",
|
|
834
|
-
"scope": "Prowler 5.
|
|
834
|
+
"scope": "Prowler 5.47.0 check storage_ensure_file_shares_soft_delete_is_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
835
835
|
"evidenceType": "Configuration",
|
|
836
836
|
"severity": "medium"
|
|
837
837
|
},
|
|
838
838
|
{
|
|
839
839
|
"id": "prowler.azure.storage_ensure_minimum_tls_version_12",
|
|
840
840
|
"title": "Storage account minimum TLS version is 1.2",
|
|
841
|
-
"scope": "Prowler 5.
|
|
841
|
+
"scope": "Prowler 5.47.0 check storage_ensure_minimum_tls_version_12 (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
842
842
|
"evidenceType": "Configuration",
|
|
843
843
|
"severity": "medium"
|
|
844
844
|
},
|
|
845
845
|
{
|
|
846
846
|
"id": "prowler.azure.storage_ensure_soft_delete_is_enabled",
|
|
847
847
|
"title": "Storage account has soft delete for containers enabled",
|
|
848
|
-
"scope": "Prowler 5.
|
|
848
|
+
"scope": "Prowler 5.47.0 check storage_ensure_soft_delete_is_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
849
849
|
"evidenceType": "Configuration",
|
|
850
850
|
"severity": "medium"
|
|
851
851
|
},
|
|
852
852
|
{
|
|
853
853
|
"id": "prowler.azure.storage_geo_redundant_enabled",
|
|
854
854
|
"title": "Azure Storage account uses geo-redundant replication (GRS, GZRS, RA-GRS, or RA-GZRS)",
|
|
855
|
-
"scope": "Prowler 5.
|
|
855
|
+
"scope": "Prowler 5.47.0 check storage_geo_redundant_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
856
856
|
"evidenceType": "Configuration",
|
|
857
857
|
"severity": "medium"
|
|
858
858
|
},
|
|
859
859
|
{
|
|
860
860
|
"id": "prowler.azure.storage_infrastructure_encryption_is_enabled",
|
|
861
861
|
"title": "Storage account has infrastructure encryption enabled",
|
|
862
|
-
"scope": "Prowler 5.
|
|
862
|
+
"scope": "Prowler 5.47.0 check storage_infrastructure_encryption_is_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
863
863
|
"evidenceType": "Configuration",
|
|
864
864
|
"severity": "low"
|
|
865
865
|
},
|
|
866
866
|
{
|
|
867
867
|
"id": "prowler.azure.storage_key_rotation_90_days",
|
|
868
868
|
"title": "Storage account has access key expiration period set to 90 days or less",
|
|
869
|
-
"scope": "Prowler 5.
|
|
869
|
+
"scope": "Prowler 5.47.0 check storage_key_rotation_90_days (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
870
870
|
"evidenceType": "Configuration",
|
|
871
871
|
"severity": "medium"
|
|
872
872
|
},
|
|
873
873
|
{
|
|
874
874
|
"id": "prowler.azure.storage_secure_transfer_required_is_enabled",
|
|
875
875
|
"title": "Storage account has secure transfer required enabled",
|
|
876
|
-
"scope": "Prowler 5.
|
|
876
|
+
"scope": "Prowler 5.47.0 check storage_secure_transfer_required_is_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
877
877
|
"evidenceType": "Configuration",
|
|
878
878
|
"severity": "high"
|
|
879
879
|
},
|
|
880
880
|
{
|
|
881
881
|
"id": "prowler.azure.storage_smb_channel_encryption_with_secure_algorithm",
|
|
882
882
|
"title": "Storage account uses AES-256-GCM for SMB channel encryption on file shares",
|
|
883
|
-
"scope": "Prowler 5.
|
|
883
|
+
"scope": "Prowler 5.47.0 check storage_smb_channel_encryption_with_secure_algorithm (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
884
884
|
"evidenceType": "Configuration",
|
|
885
885
|
"severity": "medium"
|
|
886
886
|
},
|
|
887
887
|
{
|
|
888
888
|
"id": "prowler.azure.vm_backup_enabled",
|
|
889
889
|
"title": "Virtual Machine is protected by Azure Backup",
|
|
890
|
-
"scope": "Prowler 5.
|
|
890
|
+
"scope": "Prowler 5.47.0 check vm_backup_enabled (Azure vm, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
891
891
|
"evidenceType": "Configuration",
|
|
892
892
|
"severity": "high"
|
|
893
893
|
},
|
|
894
894
|
{
|
|
895
895
|
"id": "prowler.azure.vm_ensure_attached_disks_encrypted_with_cmk",
|
|
896
896
|
"title": "Virtual Machine OS or data disk is encrypted with a customer-managed key (CMK)",
|
|
897
|
-
"scope": "Prowler 5.
|
|
897
|
+
"scope": "Prowler 5.47.0 check vm_ensure_attached_disks_encrypted_with_cmk (Azure vm, resource type microsoft.compute/disks): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
898
898
|
"evidenceType": "Configuration",
|
|
899
899
|
"severity": "medium"
|
|
900
900
|
},
|
|
901
901
|
{
|
|
902
902
|
"id": "prowler.azure.vm_ensure_unattached_disks_encrypted_with_cmk",
|
|
903
903
|
"title": "Unattached disk is encrypted with a customer-managed key (CMK)",
|
|
904
|
-
"scope": "Prowler 5.
|
|
904
|
+
"scope": "Prowler 5.47.0 check vm_ensure_unattached_disks_encrypted_with_cmk (Azure vm, resource type microsoft.compute/disks): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
905
905
|
"evidenceType": "Configuration",
|
|
906
906
|
"severity": "medium"
|
|
907
907
|
},
|
|
908
908
|
{
|
|
909
909
|
"id": "prowler.azure.vm_jit_access_enabled",
|
|
910
910
|
"title": "Virtual Machine has Just-in-Time (JIT) access enabled",
|
|
911
|
-
"scope": "Prowler 5.
|
|
911
|
+
"scope": "Prowler 5.47.0 check vm_jit_access_enabled (Azure vm, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
912
912
|
"evidenceType": "Configuration",
|
|
913
913
|
"severity": "medium"
|
|
914
914
|
},
|
|
915
915
|
{
|
|
916
916
|
"id": "prowler.azure.vm_linux_enforce_ssh_authentication",
|
|
917
917
|
"title": "Linux Virtual Machine has password authentication disabled (SSH key authentication enforced)",
|
|
918
|
-
"scope": "Prowler 5.
|
|
918
|
+
"scope": "Prowler 5.47.0 check vm_linux_enforce_ssh_authentication (Azure vm, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
919
919
|
"evidenceType": "Configuration",
|
|
920
920
|
"severity": "high"
|
|
921
921
|
},
|
|
922
922
|
{
|
|
923
923
|
"id": "prowler.azure.vm_scaleset_associated_with_load_balancer",
|
|
924
924
|
"title": "Virtual Machine Scale Set is associated with a load balancer backend pool",
|
|
925
|
-
"scope": "Prowler 5.
|
|
925
|
+
"scope": "Prowler 5.47.0 check vm_scaleset_associated_with_load_balancer (Azure vm, resource type microsoft.compute/virtualmachinescalesets): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
926
926
|
"evidenceType": "Configuration",
|
|
927
927
|
"severity": "medium"
|
|
928
928
|
},
|
|
929
929
|
{
|
|
930
930
|
"id": "prowler.azure.vm_sufficient_daily_backup_retention_period",
|
|
931
931
|
"title": "Virtual Machine has a backup policy with a daily retention period meeting the configured minimum",
|
|
932
|
-
"scope": "Prowler 5.
|
|
932
|
+
"scope": "Prowler 5.47.0 check vm_sufficient_daily_backup_retention_period (Azure vm, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
933
933
|
"evidenceType": "Configuration",
|
|
934
934
|
"severity": "medium"
|
|
935
935
|
},
|
|
936
936
|
{
|
|
937
937
|
"id": "prowler.azure.vm_trusted_launch_enabled",
|
|
938
938
|
"title": "Virtual Machine has Trusted Launch with Secure Boot and vTPM enabled",
|
|
939
|
-
"scope": "Prowler 5.
|
|
939
|
+
"scope": "Prowler 5.47.0 check vm_trusted_launch_enabled (Azure vm, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
940
940
|
"evidenceType": "Configuration",
|
|
941
941
|
"severity": "medium"
|
|
942
942
|
}
|