@sagentix-inc/evidence-collector 0.3.0 → 0.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/THIRD_PARTY_NOTICES.md +14 -14
- package/apps/sos-app/src/data/checks/aws.json +2 -2
- package/apps/sos-app/src/data/checks/checkov.json +59 -59
- package/apps/sos-app/src/data/checks/kubescape.json +1 -1
- package/apps/sos-app/src/data/checks/prowler_aws.json +1926 -491
- package/apps/sos-app/src/data/checks/prowler_azure.json +634 -137
- package/apps/sos-app/src/data/checks/prowler_cloudflare.json +207 -3
- package/apps/sos-app/src/data/checks/prowler_gcp.json +274 -92
- package/apps/sos-app/src/data/checks/prowler_github.json +193 -3
- package/apps/sos-app/src/data/checks/prowler_googleworkspace.json +459 -3
- package/apps/sos-app/src/data/checks/prowler_kubernetes.json +208 -75
- package/apps/sos-app/src/data/checks/prowler_m365.json +643 -69
- package/apps/sos-app/src/data/checks/prowler_okta.json +207 -3
- package/apps/sos-app/src/data/fedramp_rules.json +1 -1
- package/collector/package.json +1 -1
- package/collector/src/sources/aws/checks.js +4 -1
- package/collector/src/sources/prowler.js +81 -26
- package/package.json +1 -1
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"source": "prowler",
|
|
3
|
-
"title": "Prowler 5.
|
|
3
|
+
"title": "Prowler 5.47.0: Azure (runs in the customer's CI with read-only credentials)",
|
|
4
4
|
"readScopes": [
|
|
5
5
|
"Reader (subscription)",
|
|
6
6
|
"ProwlerRole custom role (prowler-azure-custom-role.json)",
|
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
],
|
|
11
11
|
"engine": {
|
|
12
12
|
"name": "Prowler",
|
|
13
|
-
"version": "5.
|
|
13
|
+
"version": "5.47.0",
|
|
14
14
|
"licence": "Apache-2.0",
|
|
15
15
|
"url": "https://github.com/prowler-cloud/prowler"
|
|
16
16
|
},
|
|
@@ -19,924 +19,1421 @@
|
|
|
19
19
|
{
|
|
20
20
|
"id": "prowler.azure.aisearch_service_not_publicly_accessible",
|
|
21
21
|
"title": "AI Search service has public network access disabled",
|
|
22
|
-
"scope": "Prowler 5.
|
|
22
|
+
"scope": "Prowler 5.47.0 check aisearch_service_not_publicly_accessible (Azure aisearch, resource type microsoft.search/searchservices): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
23
23
|
"evidenceType": "Configuration",
|
|
24
24
|
"severity": "high"
|
|
25
25
|
},
|
|
26
|
+
{
|
|
27
|
+
"id": "prowler.azure.aiservices_account_diagnostic_logging_enabled",
|
|
28
|
+
"title": "AI services account sends audit logs through a diagnostic setting",
|
|
29
|
+
"scope": "Prowler 5.47.0 check aiservices_account_diagnostic_logging_enabled (Azure aiservices, resource type microsoft.cognitiveservices/accounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
30
|
+
"evidenceType": "Configuration",
|
|
31
|
+
"severity": "medium"
|
|
32
|
+
},
|
|
33
|
+
{
|
|
34
|
+
"id": "prowler.azure.aiservices_account_encrypted_with_cmk",
|
|
35
|
+
"title": "AI services account is encrypted with a customer-managed key",
|
|
36
|
+
"scope": "Prowler 5.47.0 check aiservices_account_encrypted_with_cmk (Azure aiservices, resource type microsoft.cognitiveservices/accounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
37
|
+
"evidenceType": "Configuration",
|
|
38
|
+
"severity": "medium"
|
|
39
|
+
},
|
|
40
|
+
{
|
|
41
|
+
"id": "prowler.azure.aiservices_account_local_auth_disabled",
|
|
42
|
+
"title": "AI services account has local (API key) authentication disabled",
|
|
43
|
+
"scope": "Prowler 5.47.0 check aiservices_account_local_auth_disabled (Azure aiservices, resource type microsoft.cognitiveservices/accounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
44
|
+
"evidenceType": "Configuration",
|
|
45
|
+
"severity": "high"
|
|
46
|
+
},
|
|
47
|
+
{
|
|
48
|
+
"id": "prowler.azure.aiservices_account_managed_identity_enabled",
|
|
49
|
+
"title": "AI services account has a managed identity",
|
|
50
|
+
"scope": "Prowler 5.47.0 check aiservices_account_managed_identity_enabled (Azure aiservices, resource type microsoft.cognitiveservices/accounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
51
|
+
"evidenceType": "Configuration",
|
|
52
|
+
"severity": "low"
|
|
53
|
+
},
|
|
54
|
+
{
|
|
55
|
+
"id": "prowler.azure.aiservices_account_network_acls_default_action_deny",
|
|
56
|
+
"title": "AI services account network access rules deny public traffic by default",
|
|
57
|
+
"scope": "Prowler 5.47.0 check aiservices_account_network_acls_default_action_deny (Azure aiservices, resource type microsoft.cognitiveservices/accounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
58
|
+
"evidenceType": "Configuration",
|
|
59
|
+
"severity": "medium"
|
|
60
|
+
},
|
|
61
|
+
{
|
|
62
|
+
"id": "prowler.azure.aiservices_account_outbound_network_restricted",
|
|
63
|
+
"title": "AI services account restricts outbound network access to an allowed FQDN list",
|
|
64
|
+
"scope": "Prowler 5.47.0 check aiservices_account_outbound_network_restricted (Azure aiservices, resource type microsoft.cognitiveservices/accounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
65
|
+
"evidenceType": "Configuration",
|
|
66
|
+
"severity": "medium"
|
|
67
|
+
},
|
|
68
|
+
{
|
|
69
|
+
"id": "prowler.azure.aiservices_account_public_network_access_disabled",
|
|
70
|
+
"title": "AI services account has public network access disabled",
|
|
71
|
+
"scope": "Prowler 5.47.0 check aiservices_account_public_network_access_disabled (Azure aiservices, resource type microsoft.cognitiveservices/accounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
72
|
+
"evidenceType": "Configuration",
|
|
73
|
+
"severity": "high"
|
|
74
|
+
},
|
|
75
|
+
{
|
|
76
|
+
"id": "prowler.azure.aiservices_account_uses_private_endpoint",
|
|
77
|
+
"title": "AI services account has an approved private endpoint connection",
|
|
78
|
+
"scope": "Prowler 5.47.0 check aiservices_account_uses_private_endpoint (Azure aiservices, resource type microsoft.cognitiveservices/accounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
79
|
+
"evidenceType": "Configuration",
|
|
80
|
+
"severity": "medium"
|
|
81
|
+
},
|
|
82
|
+
{
|
|
83
|
+
"id": "prowler.azure.aiservices_deployment_content_filter_prompt_shield_enabled",
|
|
84
|
+
"title": "AI services model deployment blocks jailbreak attempts with Prompt Shields",
|
|
85
|
+
"scope": "Prowler 5.47.0 check aiservices_deployment_content_filter_prompt_shield_enabled (Azure aiservices, resource type microsoft.cognitiveservices/accounts/deployments): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
86
|
+
"evidenceType": "Configuration",
|
|
87
|
+
"severity": "high"
|
|
88
|
+
},
|
|
89
|
+
{
|
|
90
|
+
"id": "prowler.azure.aks_cluster_auto_upgrade_enabled",
|
|
91
|
+
"title": "AKS cluster has automatic upgrade enabled",
|
|
92
|
+
"scope": "Prowler 5.47.0 check aks_cluster_auto_upgrade_enabled (Azure aks, resource type microsoft.containerservice/managedclusters): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
93
|
+
"evidenceType": "Configuration",
|
|
94
|
+
"severity": "medium"
|
|
95
|
+
},
|
|
26
96
|
{
|
|
27
97
|
"id": "prowler.azure.aks_cluster_azure_monitor_enabled",
|
|
28
98
|
"title": "AKS cluster has Azure Monitor metrics enabled",
|
|
29
|
-
"scope": "Prowler 5.
|
|
99
|
+
"scope": "Prowler 5.47.0 check aks_cluster_azure_monitor_enabled (Azure aks, resource type microsoft.containerservice/managedclusters): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
30
100
|
"evidenceType": "Configuration",
|
|
31
101
|
"severity": "medium"
|
|
32
102
|
},
|
|
103
|
+
{
|
|
104
|
+
"id": "prowler.azure.aks_cluster_defender_enabled",
|
|
105
|
+
"title": "AKS cluster has Microsoft Defender security profile enabled",
|
|
106
|
+
"scope": "Prowler 5.47.0 check aks_cluster_defender_enabled (Azure aks, resource type microsoft.containerservice/managedclusters): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
107
|
+
"evidenceType": "Configuration",
|
|
108
|
+
"severity": "high"
|
|
109
|
+
},
|
|
33
110
|
{
|
|
34
111
|
"id": "prowler.azure.aks_cluster_local_accounts_disabled",
|
|
35
112
|
"title": "AKS cluster has local accounts disabled",
|
|
36
|
-
"scope": "Prowler 5.
|
|
113
|
+
"scope": "Prowler 5.47.0 check aks_cluster_local_accounts_disabled (Azure aks, resource type microsoft.containerservice/managedclusters): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
37
114
|
"evidenceType": "Configuration",
|
|
38
115
|
"severity": "high"
|
|
39
116
|
},
|
|
40
117
|
{
|
|
41
118
|
"id": "prowler.azure.aks_cluster_rbac_enabled",
|
|
42
119
|
"title": "AKS cluster has RBAC enabled",
|
|
43
|
-
"scope": "Prowler 5.
|
|
120
|
+
"scope": "Prowler 5.47.0 check aks_cluster_rbac_enabled (Azure aks, resource type microsoft.containerservice/managedclusters): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
44
121
|
"evidenceType": "Configuration",
|
|
45
122
|
"severity": "high"
|
|
46
123
|
},
|
|
47
124
|
{
|
|
48
125
|
"id": "prowler.azure.aks_clusters_created_with_private_nodes",
|
|
49
126
|
"title": "AKS cluster nodes do not have public IP addresses",
|
|
50
|
-
"scope": "Prowler 5.
|
|
127
|
+
"scope": "Prowler 5.47.0 check aks_clusters_created_with_private_nodes (Azure aks, resource type microsoft.containerservice/managedclusters): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
51
128
|
"evidenceType": "Configuration",
|
|
52
129
|
"severity": "high"
|
|
53
130
|
},
|
|
54
131
|
{
|
|
55
132
|
"id": "prowler.azure.aks_clusters_public_access_disabled",
|
|
56
133
|
"title": "AKS cluster has a private endpoint and node public access is disabled",
|
|
57
|
-
"scope": "Prowler 5.
|
|
134
|
+
"scope": "Prowler 5.47.0 check aks_clusters_public_access_disabled (Azure aks, resource type microsoft.containerservice/managedclusters): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
58
135
|
"evidenceType": "Configuration",
|
|
59
136
|
"severity": "high"
|
|
60
137
|
},
|
|
61
138
|
{
|
|
62
139
|
"id": "prowler.azure.aks_network_policy_enabled",
|
|
63
140
|
"title": "AKS cluster has network policy enabled",
|
|
64
|
-
"scope": "Prowler 5.
|
|
141
|
+
"scope": "Prowler 5.47.0 check aks_network_policy_enabled (Azure aks, resource type microsoft.containerservice/managedclusters): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
65
142
|
"evidenceType": "Configuration",
|
|
66
143
|
"severity": "medium"
|
|
67
144
|
},
|
|
145
|
+
{
|
|
146
|
+
"id": "prowler.azure.apim_threat_detection_llm_jacking",
|
|
147
|
+
"title": "No potential LLM Jacking attacks detected across all Azure API Management instances",
|
|
148
|
+
"scope": "Prowler 5.47.0 check apim_threat_detection_llm_jacking (Azure apim, resource type microsoft.apimanagement/service): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
149
|
+
"evidenceType": "Configuration",
|
|
150
|
+
"severity": "critical"
|
|
151
|
+
},
|
|
68
152
|
{
|
|
69
153
|
"id": "prowler.azure.app_client_certificates_on",
|
|
70
154
|
"title": "Web app requires incoming client certificates",
|
|
71
|
-
"scope": "Prowler 5.
|
|
155
|
+
"scope": "Prowler 5.47.0 check app_client_certificates_on (Azure app, resource type microsoft.web/sites/config): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
72
156
|
"evidenceType": "Configuration",
|
|
73
157
|
"severity": "medium"
|
|
74
158
|
},
|
|
75
159
|
{
|
|
76
160
|
"id": "prowler.azure.app_ensure_auth_is_set_up",
|
|
77
161
|
"title": "App Service app has App Service Authentication enabled",
|
|
78
|
-
"scope": "Prowler 5.
|
|
162
|
+
"scope": "Prowler 5.47.0 check app_ensure_auth_is_set_up (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
79
163
|
"evidenceType": "Configuration",
|
|
80
164
|
"severity": "medium"
|
|
81
165
|
},
|
|
82
166
|
{
|
|
83
167
|
"id": "prowler.azure.app_ensure_http_is_redirected_to_https",
|
|
84
168
|
"title": "App Service web app redirects HTTP to HTTPS",
|
|
85
|
-
"scope": "Prowler 5.
|
|
169
|
+
"scope": "Prowler 5.47.0 check app_ensure_http_is_redirected_to_https (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
86
170
|
"evidenceType": "Configuration",
|
|
87
171
|
"severity": "high"
|
|
88
172
|
},
|
|
89
173
|
{
|
|
90
174
|
"id": "prowler.azure.app_ensure_java_version_is_latest",
|
|
91
|
-
"title": "App Service web app
|
|
92
|
-
"scope": "Prowler 5.
|
|
175
|
+
"title": "App Service web app runs a supported Java version (17 or newer by default)",
|
|
176
|
+
"scope": "Prowler 5.47.0 check app_ensure_java_version_is_latest (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
93
177
|
"evidenceType": "Configuration",
|
|
94
178
|
"severity": "low"
|
|
95
179
|
},
|
|
96
180
|
{
|
|
97
181
|
"id": "prowler.azure.app_ensure_php_version_is_latest",
|
|
98
|
-
"title": "App Service web app
|
|
99
|
-
"scope": "Prowler 5.
|
|
182
|
+
"title": "App Service web app runs a supported PHP version (8.5 or newer by default)",
|
|
183
|
+
"scope": "Prowler 5.47.0 check app_ensure_php_version_is_latest (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
100
184
|
"evidenceType": "Configuration",
|
|
101
185
|
"severity": "low"
|
|
102
186
|
},
|
|
103
187
|
{
|
|
104
188
|
"id": "prowler.azure.app_ensure_python_version_is_latest",
|
|
105
|
-
"title": "App Service web app
|
|
106
|
-
"scope": "Prowler 5.
|
|
189
|
+
"title": "App Service web app runs a supported Python version (3.12 or newer by default)",
|
|
190
|
+
"scope": "Prowler 5.47.0 check app_ensure_python_version_is_latest (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
191
|
+
"evidenceType": "Configuration",
|
|
192
|
+
"severity": "low"
|
|
193
|
+
},
|
|
194
|
+
{
|
|
195
|
+
"id": "prowler.azure.app_ensure_using_http20",
|
|
196
|
+
"title": "App Service web app has HTTP/2.0 enabled",
|
|
197
|
+
"scope": "Prowler 5.47.0 check app_ensure_using_http20 (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
107
198
|
"evidenceType": "Configuration",
|
|
108
199
|
"severity": "low"
|
|
109
200
|
},
|
|
110
201
|
{
|
|
111
202
|
"id": "prowler.azure.app_ftp_deployment_disabled",
|
|
112
203
|
"title": "App Service web app has FTP disabled or FTPS-only enforced",
|
|
113
|
-
"scope": "Prowler 5.
|
|
204
|
+
"scope": "Prowler 5.47.0 check app_ftp_deployment_disabled (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
205
|
+
"evidenceType": "Configuration",
|
|
206
|
+
"severity": "high"
|
|
207
|
+
},
|
|
208
|
+
{
|
|
209
|
+
"id": "prowler.azure.app_function_access_keys_configured",
|
|
210
|
+
"title": "Function app has function keys configured",
|
|
211
|
+
"scope": "Prowler 5.47.0 check app_function_access_keys_configured (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
114
212
|
"evidenceType": "Configuration",
|
|
115
213
|
"severity": "high"
|
|
116
214
|
},
|
|
117
215
|
{
|
|
118
216
|
"id": "prowler.azure.app_function_application_insights_enabled",
|
|
119
217
|
"title": "Function App has Application Insights configured",
|
|
120
|
-
"scope": "Prowler 5.
|
|
218
|
+
"scope": "Prowler 5.47.0 check app_function_application_insights_enabled (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
121
219
|
"evidenceType": "Configuration",
|
|
122
220
|
"severity": "medium"
|
|
123
221
|
},
|
|
124
222
|
{
|
|
125
223
|
"id": "prowler.azure.app_function_ensure_http_is_redirected_to_https",
|
|
126
224
|
"title": "Function app redirects HTTP to HTTPS",
|
|
127
|
-
"scope": "Prowler 5.
|
|
225
|
+
"scope": "Prowler 5.47.0 check app_function_ensure_http_is_redirected_to_https (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
128
226
|
"evidenceType": "Configuration",
|
|
129
227
|
"severity": "high"
|
|
130
228
|
},
|
|
131
229
|
{
|
|
132
230
|
"id": "prowler.azure.app_function_ftps_deployment_disabled",
|
|
133
231
|
"title": "Function app has FTP and FTPS deployments disabled",
|
|
134
|
-
"scope": "Prowler 5.
|
|
232
|
+
"scope": "Prowler 5.47.0 check app_function_ftps_deployment_disabled (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
135
233
|
"evidenceType": "Configuration",
|
|
136
234
|
"severity": "medium"
|
|
137
235
|
},
|
|
138
236
|
{
|
|
139
237
|
"id": "prowler.azure.app_function_identity_is_configured",
|
|
140
238
|
"title": "Function app has a system-assigned or user-assigned managed identity enabled",
|
|
141
|
-
"scope": "Prowler 5.
|
|
239
|
+
"scope": "Prowler 5.47.0 check app_function_identity_is_configured (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
142
240
|
"evidenceType": "Configuration",
|
|
143
241
|
"severity": "medium"
|
|
144
242
|
},
|
|
145
243
|
{
|
|
146
244
|
"id": "prowler.azure.app_function_identity_without_admin_privileges",
|
|
147
245
|
"title": "Function app managed identity is not assigned Owner, Contributor, User Access Administrator, or Role Based Access Control Administrator roles",
|
|
148
|
-
"scope": "Prowler 5.
|
|
246
|
+
"scope": "Prowler 5.47.0 check app_function_identity_without_admin_privileges (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
149
247
|
"evidenceType": "Configuration",
|
|
150
248
|
"severity": "high"
|
|
151
249
|
},
|
|
152
250
|
{
|
|
153
251
|
"id": "prowler.azure.app_function_latest_runtime_version",
|
|
154
252
|
"title": "Function app uses the latest supported runtime version (~4)",
|
|
155
|
-
"scope": "Prowler 5.
|
|
253
|
+
"scope": "Prowler 5.47.0 check app_function_latest_runtime_version (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
156
254
|
"evidenceType": "Configuration",
|
|
157
255
|
"severity": "medium"
|
|
158
256
|
},
|
|
159
257
|
{
|
|
160
258
|
"id": "prowler.azure.app_function_not_publicly_accessible",
|
|
161
259
|
"title": "Function app is not publicly accessible",
|
|
162
|
-
"scope": "Prowler 5.
|
|
260
|
+
"scope": "Prowler 5.47.0 check app_function_not_publicly_accessible (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
163
261
|
"evidenceType": "Configuration",
|
|
164
262
|
"severity": "high"
|
|
165
263
|
},
|
|
264
|
+
{
|
|
265
|
+
"id": "prowler.azure.app_function_vnet_integration_enabled",
|
|
266
|
+
"title": "Function app has Virtual Network integration enabled",
|
|
267
|
+
"scope": "Prowler 5.47.0 check app_function_vnet_integration_enabled (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
268
|
+
"evidenceType": "Configuration",
|
|
269
|
+
"severity": "medium"
|
|
270
|
+
},
|
|
166
271
|
{
|
|
167
272
|
"id": "prowler.azure.app_http_logs_enabled",
|
|
168
273
|
"title": "App Service web app has HTTP logs enabled in diagnostic settings",
|
|
169
|
-
"scope": "Prowler 5.
|
|
274
|
+
"scope": "Prowler 5.47.0 check app_http_logs_enabled (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
170
275
|
"evidenceType": "Configuration",
|
|
171
276
|
"severity": "low"
|
|
172
277
|
},
|
|
173
278
|
{
|
|
174
279
|
"id": "prowler.azure.app_minimum_tls_version_12",
|
|
175
280
|
"title": "App Service web app has minimum TLS version set to 1.2 or 1.3",
|
|
176
|
-
"scope": "Prowler 5.
|
|
281
|
+
"scope": "Prowler 5.47.0 check app_minimum_tls_version_12 (Azure app, resource type microsoft.web/sites/config): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
177
282
|
"evidenceType": "Configuration",
|
|
178
283
|
"severity": "medium"
|
|
179
284
|
},
|
|
180
285
|
{
|
|
181
286
|
"id": "prowler.azure.app_register_with_identity",
|
|
182
287
|
"title": "App Service web app has a managed identity configured",
|
|
183
|
-
"scope": "Prowler 5.
|
|
288
|
+
"scope": "Prowler 5.47.0 check app_register_with_identity (Azure app, resource type microsoft.web/sites): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
184
289
|
"evidenceType": "Configuration",
|
|
185
290
|
"severity": "medium"
|
|
186
291
|
},
|
|
187
292
|
{
|
|
188
293
|
"id": "prowler.azure.appinsights_ensure_is_configured",
|
|
189
294
|
"title": "Subscription has at least one Application Insights resource configured",
|
|
190
|
-
"scope": "Prowler 5.
|
|
295
|
+
"scope": "Prowler 5.47.0 check appinsights_ensure_is_configured (Azure appinsights, resource type microsoft.insights/components): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
191
296
|
"evidenceType": "Configuration",
|
|
192
297
|
"severity": "low"
|
|
193
298
|
},
|
|
299
|
+
{
|
|
300
|
+
"id": "prowler.azure.containerregistry_admin_user_disabled",
|
|
301
|
+
"title": "Container Registry admin user is disabled",
|
|
302
|
+
"scope": "Prowler 5.47.0 check containerregistry_admin_user_disabled (Azure containerregistry, resource type microsoft.containerregistry/registries): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
303
|
+
"evidenceType": "Configuration",
|
|
304
|
+
"severity": "high"
|
|
305
|
+
},
|
|
194
306
|
{
|
|
195
307
|
"id": "prowler.azure.containerregistry_not_publicly_accessible",
|
|
196
308
|
"title": "Container Registry public network access is disabled",
|
|
197
|
-
"scope": "Prowler 5.
|
|
309
|
+
"scope": "Prowler 5.47.0 check containerregistry_not_publicly_accessible (Azure containerregistry, resource type microsoft.containerregistry/registries): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
310
|
+
"evidenceType": "Configuration",
|
|
311
|
+
"severity": "high"
|
|
312
|
+
},
|
|
313
|
+
{
|
|
314
|
+
"id": "prowler.azure.containerregistry_uses_private_link",
|
|
315
|
+
"title": "Container Registry uses a private endpoint (Private Link)",
|
|
316
|
+
"scope": "Prowler 5.47.0 check containerregistry_uses_private_link (Azure containerregistry, resource type microsoft.containerregistry/registries): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
198
317
|
"evidenceType": "Configuration",
|
|
199
318
|
"severity": "high"
|
|
200
319
|
},
|
|
201
320
|
{
|
|
202
321
|
"id": "prowler.azure.cosmosdb_account_automatic_failover_enabled",
|
|
203
322
|
"title": "Cosmos DB account has automatic failover enabled",
|
|
204
|
-
"scope": "Prowler 5.
|
|
323
|
+
"scope": "Prowler 5.47.0 check cosmosdb_account_automatic_failover_enabled (Azure cosmosdb, resource type microsoft.documentdb/databaseaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
205
324
|
"evidenceType": "Configuration",
|
|
206
325
|
"severity": "medium"
|
|
207
326
|
},
|
|
208
327
|
{
|
|
209
328
|
"id": "prowler.azure.cosmosdb_account_backup_policy_continuous",
|
|
210
329
|
"title": "Cosmos DB account uses continuous backup policy",
|
|
211
|
-
"scope": "Prowler 5.
|
|
330
|
+
"scope": "Prowler 5.47.0 check cosmosdb_account_backup_policy_continuous (Azure cosmosdb, resource type microsoft.documentdb/databaseaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
331
|
+
"evidenceType": "Configuration",
|
|
332
|
+
"severity": "medium"
|
|
333
|
+
},
|
|
334
|
+
{
|
|
335
|
+
"id": "prowler.azure.cosmosdb_account_firewall_use_selected_networks",
|
|
336
|
+
"title": "Cosmos DB account firewall allows access only from selected networks",
|
|
337
|
+
"scope": "Prowler 5.47.0 check cosmosdb_account_firewall_use_selected_networks (Azure cosmosdb, resource type microsoft.documentdb/databaseaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
212
338
|
"evidenceType": "Configuration",
|
|
213
339
|
"severity": "medium"
|
|
214
340
|
},
|
|
215
341
|
{
|
|
216
342
|
"id": "prowler.azure.cosmosdb_account_minimum_tls_version",
|
|
217
343
|
"title": "Cosmos DB account enforces TLS 1.2 or higher",
|
|
218
|
-
"scope": "Prowler 5.
|
|
344
|
+
"scope": "Prowler 5.47.0 check cosmosdb_account_minimum_tls_version (Azure cosmosdb, resource type microsoft.documentdb/databaseaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
219
345
|
"evidenceType": "Configuration",
|
|
220
346
|
"severity": "medium"
|
|
221
347
|
},
|
|
222
348
|
{
|
|
223
349
|
"id": "prowler.azure.cosmosdb_account_public_network_access_disabled",
|
|
224
350
|
"title": "Cosmos DB account has public network access disabled",
|
|
225
|
-
"scope": "Prowler 5.
|
|
351
|
+
"scope": "Prowler 5.47.0 check cosmosdb_account_public_network_access_disabled (Azure cosmosdb, resource type microsoft.documentdb/databaseaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
226
352
|
"evidenceType": "Configuration",
|
|
227
353
|
"severity": "medium"
|
|
228
354
|
},
|
|
229
355
|
{
|
|
230
356
|
"id": "prowler.azure.cosmosdb_account_use_aad_and_rbac",
|
|
231
357
|
"title": "Cosmos DB account has local authentication disabled and uses Azure AD authentication with Azure RBAC",
|
|
232
|
-
"scope": "Prowler 5.
|
|
358
|
+
"scope": "Prowler 5.47.0 check cosmosdb_account_use_aad_and_rbac (Azure cosmosdb, resource type microsoft.documentdb/databaseaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
359
|
+
"evidenceType": "Configuration",
|
|
360
|
+
"severity": "high"
|
|
361
|
+
},
|
|
362
|
+
{
|
|
363
|
+
"id": "prowler.azure.cosmosdb_account_use_private_endpoints",
|
|
364
|
+
"title": "Cosmos DB account uses private endpoint connections",
|
|
365
|
+
"scope": "Prowler 5.47.0 check cosmosdb_account_use_private_endpoints (Azure cosmosdb, resource type microsoft.documentdb/databaseaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
233
366
|
"evidenceType": "Configuration",
|
|
234
367
|
"severity": "high"
|
|
235
368
|
},
|
|
236
369
|
{
|
|
237
370
|
"id": "prowler.azure.databricks_workspace_cmk_encryption_enabled",
|
|
238
371
|
"title": "Databricks workspace uses a customer-managed key (CMK) for encryption at rest",
|
|
239
|
-
"scope": "Prowler 5.
|
|
372
|
+
"scope": "Prowler 5.47.0 check databricks_workspace_cmk_encryption_enabled (Azure databricks, resource type microsoft.databricks/workspaces): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
240
373
|
"evidenceType": "Configuration",
|
|
241
374
|
"severity": "high"
|
|
242
375
|
},
|
|
243
376
|
{
|
|
244
377
|
"id": "prowler.azure.databricks_workspace_no_public_ip_enabled",
|
|
245
378
|
"title": "Databricks workspace has secure cluster connectivity (no public IP)",
|
|
246
|
-
"scope": "Prowler 5.
|
|
379
|
+
"scope": "Prowler 5.47.0 check databricks_workspace_no_public_ip_enabled (Azure databricks, resource type microsoft.databricks/workspaces): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
247
380
|
"evidenceType": "Configuration",
|
|
248
381
|
"severity": "medium"
|
|
249
382
|
},
|
|
250
383
|
{
|
|
251
384
|
"id": "prowler.azure.databricks_workspace_public_network_access_disabled",
|
|
252
385
|
"title": "Databricks workspace has public network access disabled",
|
|
253
|
-
"scope": "Prowler 5.
|
|
386
|
+
"scope": "Prowler 5.47.0 check databricks_workspace_public_network_access_disabled (Azure databricks, resource type microsoft.databricks/workspaces): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
387
|
+
"evidenceType": "Configuration",
|
|
388
|
+
"severity": "high"
|
|
389
|
+
},
|
|
390
|
+
{
|
|
391
|
+
"id": "prowler.azure.databricks_workspace_vnet_injection_enabled",
|
|
392
|
+
"title": "Databricks workspace is deployed in a customer-managed VNet (VNet Injection enabled)",
|
|
393
|
+
"scope": "Prowler 5.47.0 check databricks_workspace_vnet_injection_enabled (Azure databricks, resource type microsoft.databricks/workspaces): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
394
|
+
"evidenceType": "Configuration",
|
|
395
|
+
"severity": "high"
|
|
396
|
+
},
|
|
397
|
+
{
|
|
398
|
+
"id": "prowler.azure.defender_additional_email_configured_with_a_security_contact",
|
|
399
|
+
"title": "Security contact has additional email addresses configured",
|
|
400
|
+
"scope": "Prowler 5.47.0 check defender_additional_email_configured_with_a_security_contact (Azure defender, resource type microsoft.resources/subscriptions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
401
|
+
"evidenceType": "Configuration",
|
|
402
|
+
"severity": "low"
|
|
403
|
+
},
|
|
404
|
+
{
|
|
405
|
+
"id": "prowler.azure.defender_assessments_vm_endpoint_protection_installed",
|
|
406
|
+
"title": "All virtual machines in the subscription have endpoint protection installed",
|
|
407
|
+
"scope": "Prowler 5.47.0 check defender_assessments_vm_endpoint_protection_installed (Azure defender, resource type microsoft.security/assessments/governanceassignments): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
408
|
+
"evidenceType": "Configuration",
|
|
409
|
+
"severity": "high"
|
|
410
|
+
},
|
|
411
|
+
{
|
|
412
|
+
"id": "prowler.azure.defender_attack_path_notifications_properly_configured",
|
|
413
|
+
"title": "Security contact has attack path email notifications enabled at or above the configured minimum risk level",
|
|
414
|
+
"scope": "Prowler 5.47.0 check defender_attack_path_notifications_properly_configured (Azure defender, resource type microsoft.resources/subscriptions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
254
415
|
"evidenceType": "Configuration",
|
|
255
416
|
"severity": "high"
|
|
256
417
|
},
|
|
257
418
|
{
|
|
258
419
|
"id": "prowler.azure.defender_auto_provisioning_log_analytics_agent_vms_on",
|
|
259
420
|
"title": "Defender auto-provisioning of Log Analytics agent for Azure VMs is enabled",
|
|
260
|
-
"scope": "Prowler 5.
|
|
421
|
+
"scope": "Prowler 5.47.0 check defender_auto_provisioning_log_analytics_agent_vms_on (Azure defender, resource type microsoft.resources/subscriptions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
261
422
|
"evidenceType": "Configuration",
|
|
262
423
|
"severity": "high"
|
|
263
424
|
},
|
|
425
|
+
{
|
|
426
|
+
"id": "prowler.azure.defender_auto_provisioning_vulnerabilty_assessments_machines_on",
|
|
427
|
+
"title": "All virtual machines in the subscription have a vulnerability assessment solution installed",
|
|
428
|
+
"scope": "Prowler 5.47.0 check defender_auto_provisioning_vulnerabilty_assessments_machines_on (Azure defender, resource type microsoft.security/assessmentssample): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
429
|
+
"evidenceType": "Configuration",
|
|
430
|
+
"severity": "medium"
|
|
431
|
+
},
|
|
264
432
|
{
|
|
265
433
|
"id": "prowler.azure.defender_container_images_resolved_vulnerabilities",
|
|
266
434
|
"title": "All Azure running container images in the subscription have no unresolved vulnerabilities",
|
|
267
|
-
"scope": "Prowler 5.
|
|
435
|
+
"scope": "Prowler 5.47.0 check defender_container_images_resolved_vulnerabilities (Azure defender, resource type microsoft.security/assessmentssample): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
268
436
|
"evidenceType": "Configuration",
|
|
269
437
|
"severity": "critical"
|
|
270
438
|
},
|
|
271
439
|
{
|
|
272
440
|
"id": "prowler.azure.defender_container_images_scan_enabled",
|
|
273
441
|
"title": "Subscription has container image vulnerability scanning enabled",
|
|
274
|
-
"scope": "Prowler 5.
|
|
442
|
+
"scope": "Prowler 5.47.0 check defender_container_images_scan_enabled (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
275
443
|
"evidenceType": "Configuration",
|
|
276
444
|
"severity": "high"
|
|
277
445
|
},
|
|
278
446
|
{
|
|
279
447
|
"id": "prowler.azure.defender_ensure_defender_cspm_is_on",
|
|
280
448
|
"title": "Microsoft Defender CSPM is set to On",
|
|
281
|
-
"scope": "Prowler 5.
|
|
449
|
+
"scope": "Prowler 5.47.0 check defender_ensure_defender_cspm_is_on (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
450
|
+
"evidenceType": "Configuration",
|
|
451
|
+
"severity": "medium"
|
|
452
|
+
},
|
|
453
|
+
{
|
|
454
|
+
"id": "prowler.azure.defender_ensure_defender_for_app_services_is_on",
|
|
455
|
+
"title": "Defender for App Services is set to On (Standard pricing tier)",
|
|
456
|
+
"scope": "Prowler 5.47.0 check defender_ensure_defender_for_app_services_is_on (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
457
|
+
"evidenceType": "Configuration",
|
|
458
|
+
"severity": "high"
|
|
459
|
+
},
|
|
460
|
+
{
|
|
461
|
+
"id": "prowler.azure.defender_ensure_defender_for_arm_is_on",
|
|
462
|
+
"title": "Defender for Azure Resource Manager is set to On (Standard pricing tier)",
|
|
463
|
+
"scope": "Prowler 5.47.0 check defender_ensure_defender_for_arm_is_on (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
464
|
+
"evidenceType": "Configuration",
|
|
465
|
+
"severity": "high"
|
|
466
|
+
},
|
|
467
|
+
{
|
|
468
|
+
"id": "prowler.azure.defender_ensure_defender_for_azure_sql_databases_is_on",
|
|
469
|
+
"title": "Defender for Azure SQL databases is set to On (Standard pricing tier)",
|
|
470
|
+
"scope": "Prowler 5.47.0 check defender_ensure_defender_for_azure_sql_databases_is_on (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
471
|
+
"evidenceType": "Configuration",
|
|
472
|
+
"severity": "high"
|
|
473
|
+
},
|
|
474
|
+
{
|
|
475
|
+
"id": "prowler.azure.defender_ensure_defender_for_containers_is_on",
|
|
476
|
+
"title": "Defender for Containers is set to On (Standard pricing tier)",
|
|
477
|
+
"scope": "Prowler 5.47.0 check defender_ensure_defender_for_containers_is_on (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
478
|
+
"evidenceType": "Configuration",
|
|
479
|
+
"severity": "high"
|
|
480
|
+
},
|
|
481
|
+
{
|
|
482
|
+
"id": "prowler.azure.defender_ensure_defender_for_cosmosdb_is_on",
|
|
483
|
+
"title": "Defender for Cosmos DB is set to On (Standard pricing tier)",
|
|
484
|
+
"scope": "Prowler 5.47.0 check defender_ensure_defender_for_cosmosdb_is_on (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
485
|
+
"evidenceType": "Configuration",
|
|
486
|
+
"severity": "high"
|
|
487
|
+
},
|
|
488
|
+
{
|
|
489
|
+
"id": "prowler.azure.defender_ensure_defender_for_databases_is_on",
|
|
490
|
+
"title": "Defender for Databases is set to On (Standard pricing tier)",
|
|
491
|
+
"scope": "Prowler 5.47.0 check defender_ensure_defender_for_databases_is_on (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
492
|
+
"evidenceType": "Configuration",
|
|
493
|
+
"severity": "high"
|
|
494
|
+
},
|
|
495
|
+
{
|
|
496
|
+
"id": "prowler.azure.defender_ensure_defender_for_dns_is_on",
|
|
497
|
+
"title": "Defender for DNS is set to On (Standard pricing tier)",
|
|
498
|
+
"scope": "Prowler 5.47.0 check defender_ensure_defender_for_dns_is_on (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
499
|
+
"evidenceType": "Configuration",
|
|
500
|
+
"severity": "high"
|
|
501
|
+
},
|
|
502
|
+
{
|
|
503
|
+
"id": "prowler.azure.defender_ensure_defender_for_keyvault_is_on",
|
|
504
|
+
"title": "Defender for Key Vaults is set to On (Standard pricing tier)",
|
|
505
|
+
"scope": "Prowler 5.47.0 check defender_ensure_defender_for_keyvault_is_on (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
506
|
+
"evidenceType": "Configuration",
|
|
507
|
+
"severity": "high"
|
|
508
|
+
},
|
|
509
|
+
{
|
|
510
|
+
"id": "prowler.azure.defender_ensure_defender_for_os_relational_databases_is_on",
|
|
511
|
+
"title": "Defender for Open-Source Relational Databases is set to On (Standard pricing tier)",
|
|
512
|
+
"scope": "Prowler 5.47.0 check defender_ensure_defender_for_os_relational_databases_is_on (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
513
|
+
"evidenceType": "Configuration",
|
|
514
|
+
"severity": "high"
|
|
515
|
+
},
|
|
516
|
+
{
|
|
517
|
+
"id": "prowler.azure.defender_ensure_defender_for_server_is_on",
|
|
518
|
+
"title": "Defender for Servers is set to On (Standard pricing tier)",
|
|
519
|
+
"scope": "Prowler 5.47.0 check defender_ensure_defender_for_server_is_on (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
520
|
+
"evidenceType": "Configuration",
|
|
521
|
+
"severity": "high"
|
|
522
|
+
},
|
|
523
|
+
{
|
|
524
|
+
"id": "prowler.azure.defender_ensure_defender_for_sql_servers_is_on",
|
|
525
|
+
"title": "Defender for SQL servers on machines is set to On (Standard pricing tier)",
|
|
526
|
+
"scope": "Prowler 5.47.0 check defender_ensure_defender_for_sql_servers_is_on (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
527
|
+
"evidenceType": "Configuration",
|
|
528
|
+
"severity": "high"
|
|
529
|
+
},
|
|
530
|
+
{
|
|
531
|
+
"id": "prowler.azure.defender_ensure_defender_for_storage_is_on",
|
|
532
|
+
"title": "Defender for Storage is set to On (Standard pricing tier)",
|
|
533
|
+
"scope": "Prowler 5.47.0 check defender_ensure_defender_for_storage_is_on (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
534
|
+
"evidenceType": "Configuration",
|
|
535
|
+
"severity": "high"
|
|
536
|
+
},
|
|
537
|
+
{
|
|
538
|
+
"id": "prowler.azure.defender_ensure_iot_hub_defender_is_on",
|
|
539
|
+
"title": "Defender for IoT Hub is set to On",
|
|
540
|
+
"scope": "Prowler 5.47.0 check defender_ensure_iot_hub_defender_is_on (Azure defender, resource type microsoft.security/iotsecuritysolutions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
541
|
+
"evidenceType": "Configuration",
|
|
542
|
+
"severity": "high"
|
|
543
|
+
},
|
|
544
|
+
{
|
|
545
|
+
"id": "prowler.azure.defender_ensure_mcas_is_enabled",
|
|
546
|
+
"title": "Defender for Cloud Apps is enabled",
|
|
547
|
+
"scope": "Prowler 5.47.0 check defender_ensure_mcas_is_enabled (Azure defender, resource type microsoft.security/pricings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
548
|
+
"evidenceType": "Configuration",
|
|
549
|
+
"severity": "medium"
|
|
550
|
+
},
|
|
551
|
+
{
|
|
552
|
+
"id": "prowler.azure.defender_ensure_notify_alerts_severity_is_high",
|
|
553
|
+
"title": "Security contact has alert notifications enabled with minimum severity High or lower",
|
|
554
|
+
"scope": "Prowler 5.47.0 check defender_ensure_notify_alerts_severity_is_high (Azure defender, resource type microsoft.resources/subscriptions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
555
|
+
"evidenceType": "Configuration",
|
|
556
|
+
"severity": "high"
|
|
557
|
+
},
|
|
558
|
+
{
|
|
559
|
+
"id": "prowler.azure.defender_ensure_notify_emails_to_owners",
|
|
560
|
+
"title": "Security contact notifications include the Owner role",
|
|
561
|
+
"scope": "Prowler 5.47.0 check defender_ensure_notify_emails_to_owners (Azure defender, resource type microsoft.resources/subscriptions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
282
562
|
"evidenceType": "Configuration",
|
|
283
563
|
"severity": "medium"
|
|
284
564
|
},
|
|
285
565
|
{
|
|
286
566
|
"id": "prowler.azure.defender_ensure_system_updates_are_applied",
|
|
287
567
|
"title": "All virtual machines in the subscription have system updates applied",
|
|
288
|
-
"scope": "Prowler 5.
|
|
568
|
+
"scope": "Prowler 5.47.0 check defender_ensure_system_updates_are_applied (Azure defender, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
569
|
+
"evidenceType": "Configuration",
|
|
570
|
+
"severity": "high"
|
|
571
|
+
},
|
|
572
|
+
{
|
|
573
|
+
"id": "prowler.azure.defender_ensure_wdatp_is_enabled",
|
|
574
|
+
"title": "Defender for Endpoint is enabled",
|
|
575
|
+
"scope": "Prowler 5.47.0 check defender_ensure_wdatp_is_enabled (Azure defender, resource type microsoft.security/integrations): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
289
576
|
"evidenceType": "Configuration",
|
|
290
577
|
"severity": "high"
|
|
291
578
|
},
|
|
292
579
|
{
|
|
293
580
|
"id": "prowler.azure.entra_app_registration_credential_not_expired",
|
|
294
581
|
"title": "App registration credentials are not expired or expiring soon",
|
|
295
|
-
"scope": "Prowler 5.
|
|
582
|
+
"scope": "Prowler 5.47.0 check entra_app_registration_credential_not_expired (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
296
583
|
"evidenceType": "Configuration",
|
|
297
584
|
"severity": "high"
|
|
298
585
|
},
|
|
586
|
+
{
|
|
587
|
+
"id": "prowler.azure.entra_authentication_methods_policy_strong_auth_enforced",
|
|
588
|
+
"title": "Strong authentication methods are enabled with registration enforcement",
|
|
589
|
+
"scope": "Prowler 5.47.0 check entra_authentication_methods_policy_strong_auth_enforced (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
590
|
+
"evidenceType": "Configuration",
|
|
591
|
+
"severity": "high"
|
|
592
|
+
},
|
|
593
|
+
{
|
|
594
|
+
"id": "prowler.azure.entra_conditional_access_policy_require_mfa_for_admin_portals",
|
|
595
|
+
"title": "Conditional Access policy requires MFA for Microsoft Admin Portals",
|
|
596
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_require_mfa_for_admin_portals (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
597
|
+
"evidenceType": "Configuration",
|
|
598
|
+
"severity": "medium"
|
|
599
|
+
},
|
|
600
|
+
{
|
|
601
|
+
"id": "prowler.azure.entra_conditional_access_policy_require_mfa_for_management_api",
|
|
602
|
+
"title": "Multifactor Authentication is required for Windows Azure Service Management API",
|
|
603
|
+
"scope": "Prowler 5.47.0 check entra_conditional_access_policy_require_mfa_for_management_api (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
604
|
+
"evidenceType": "Configuration",
|
|
605
|
+
"severity": "medium"
|
|
606
|
+
},
|
|
299
607
|
{
|
|
300
608
|
"id": "prowler.azure.entra_global_admin_in_less_than_five_users",
|
|
301
609
|
"title": "Global Administrator role has fewer than 5 members",
|
|
302
|
-
"scope": "Prowler 5.
|
|
610
|
+
"scope": "Prowler 5.47.0 check entra_global_admin_in_less_than_five_users (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
303
611
|
"evidenceType": "Configuration",
|
|
304
612
|
"severity": "high"
|
|
305
613
|
},
|
|
614
|
+
{
|
|
615
|
+
"id": "prowler.azure.entra_non_privileged_user_has_mfa",
|
|
616
|
+
"title": "Non-privileged user has multi-factor authentication enabled",
|
|
617
|
+
"scope": "Prowler 5.47.0 check entra_non_privileged_user_has_mfa (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
618
|
+
"evidenceType": "Configuration",
|
|
619
|
+
"severity": "medium"
|
|
620
|
+
},
|
|
306
621
|
{
|
|
307
622
|
"id": "prowler.azure.entra_policy_default_users_cannot_create_security_groups",
|
|
308
623
|
"title": "Authorization policy disallows non-privileged users from creating security groups",
|
|
309
|
-
"scope": "Prowler 5.
|
|
624
|
+
"scope": "Prowler 5.47.0 check entra_policy_default_users_cannot_create_security_groups (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
310
625
|
"evidenceType": "Configuration",
|
|
311
626
|
"severity": "medium"
|
|
312
627
|
},
|
|
313
628
|
{
|
|
314
629
|
"id": "prowler.azure.entra_policy_ensure_default_user_cannot_create_apps",
|
|
315
630
|
"title": "Tenant does not allow non-admin users to register applications",
|
|
316
|
-
"scope": "Prowler 5.
|
|
631
|
+
"scope": "Prowler 5.47.0 check entra_policy_ensure_default_user_cannot_create_apps (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
317
632
|
"evidenceType": "Configuration",
|
|
318
633
|
"severity": "high"
|
|
319
634
|
},
|
|
320
635
|
{
|
|
321
636
|
"id": "prowler.azure.entra_policy_ensure_default_user_cannot_create_tenants",
|
|
322
637
|
"title": "Authorization policy restricts non-admin users from creating tenants",
|
|
323
|
-
"scope": "Prowler 5.
|
|
638
|
+
"scope": "Prowler 5.47.0 check entra_policy_ensure_default_user_cannot_create_tenants (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
324
639
|
"evidenceType": "Configuration",
|
|
325
640
|
"severity": "medium"
|
|
326
641
|
},
|
|
327
642
|
{
|
|
328
643
|
"id": "prowler.azure.entra_policy_guest_invite_only_for_admin_roles",
|
|
329
644
|
"title": "Tenant authorization policy restricts guest invitations to users with specific admin roles or disables guest invitations",
|
|
330
|
-
"scope": "Prowler 5.
|
|
645
|
+
"scope": "Prowler 5.47.0 check entra_policy_guest_invite_only_for_admin_roles (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
331
646
|
"evidenceType": "Configuration",
|
|
332
647
|
"severity": "high"
|
|
333
648
|
},
|
|
334
649
|
{
|
|
335
650
|
"id": "prowler.azure.entra_policy_guest_users_access_restrictions",
|
|
336
651
|
"title": "Authorization policy restricts guest user access to properties and memberships of their own directory objects",
|
|
337
|
-
"scope": "Prowler 5.
|
|
652
|
+
"scope": "Prowler 5.47.0 check entra_policy_guest_users_access_restrictions (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
338
653
|
"evidenceType": "Configuration",
|
|
339
654
|
"severity": "medium"
|
|
340
655
|
},
|
|
341
656
|
{
|
|
342
657
|
"id": "prowler.azure.entra_policy_restricts_user_consent_for_apps",
|
|
343
658
|
"title": "Entra authorization policy disallows user consent for applications",
|
|
344
|
-
"scope": "Prowler 5.
|
|
659
|
+
"scope": "Prowler 5.47.0 check entra_policy_restricts_user_consent_for_apps (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
345
660
|
"evidenceType": "Configuration",
|
|
346
661
|
"severity": "high"
|
|
347
662
|
},
|
|
348
663
|
{
|
|
349
664
|
"id": "prowler.azure.entra_policy_user_consent_for_verified_apps",
|
|
350
665
|
"title": "Entra tenant does not allow users to consent to non-verified applications",
|
|
351
|
-
"scope": "Prowler 5.
|
|
666
|
+
"scope": "Prowler 5.47.0 check entra_policy_user_consent_for_verified_apps (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
352
667
|
"evidenceType": "Configuration",
|
|
353
668
|
"severity": "high"
|
|
354
669
|
},
|
|
670
|
+
{
|
|
671
|
+
"id": "prowler.azure.entra_privileged_user_has_mfa",
|
|
672
|
+
"title": "Privileged user has multi-factor authentication enabled",
|
|
673
|
+
"scope": "Prowler 5.47.0 check entra_privileged_user_has_mfa (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
674
|
+
"evidenceType": "Configuration",
|
|
675
|
+
"severity": "high"
|
|
676
|
+
},
|
|
677
|
+
{
|
|
678
|
+
"id": "prowler.azure.entra_security_defaults_enabled",
|
|
679
|
+
"title": "Microsoft Entra ID tenant has Security Defaults enabled",
|
|
680
|
+
"scope": "Prowler 5.47.0 check entra_security_defaults_enabled (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
681
|
+
"evidenceType": "Configuration",
|
|
682
|
+
"severity": "critical"
|
|
683
|
+
},
|
|
684
|
+
{
|
|
685
|
+
"id": "prowler.azure.entra_trusted_named_locations_exists",
|
|
686
|
+
"title": "Entra tenant has a trusted named location with IP ranges defined",
|
|
687
|
+
"scope": "Prowler 5.47.0 check entra_trusted_named_locations_exists (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
688
|
+
"evidenceType": "Configuration",
|
|
689
|
+
"severity": "low"
|
|
690
|
+
},
|
|
355
691
|
{
|
|
356
692
|
"id": "prowler.azure.entra_user_with_recent_sign_in",
|
|
357
693
|
"title": "Enabled user has signed in within the last 90 days",
|
|
358
|
-
"scope": "Prowler 5.
|
|
694
|
+
"scope": "Prowler 5.47.0 check entra_user_with_recent_sign_in (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
359
695
|
"evidenceType": "Configuration",
|
|
360
696
|
"severity": "medium"
|
|
361
697
|
},
|
|
698
|
+
{
|
|
699
|
+
"id": "prowler.azure.entra_user_with_vm_access_has_mfa",
|
|
700
|
+
"title": "Entra ID user with VM access has multi-factor authentication enabled",
|
|
701
|
+
"scope": "Prowler 5.47.0 check entra_user_with_vm_access_has_mfa (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
702
|
+
"evidenceType": "Configuration",
|
|
703
|
+
"severity": "high"
|
|
704
|
+
},
|
|
362
705
|
{
|
|
363
706
|
"id": "prowler.azure.entra_users_cannot_create_microsoft_365_groups",
|
|
364
707
|
"title": "Microsoft 365 group creation by users is disabled",
|
|
365
|
-
"scope": "Prowler 5.
|
|
708
|
+
"scope": "Prowler 5.47.0 check entra_users_cannot_create_microsoft_365_groups (Azure entra, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
366
709
|
"evidenceType": "Configuration",
|
|
367
710
|
"severity": "medium"
|
|
368
711
|
},
|
|
369
712
|
{
|
|
370
713
|
"id": "prowler.azure.iam_custom_role_has_permissions_to_administer_resource_locks",
|
|
371
714
|
"title": "Custom role has permission to administer resource locks",
|
|
372
|
-
"scope": "Prowler 5.
|
|
715
|
+
"scope": "Prowler 5.47.0 check iam_custom_role_has_permissions_to_administer_resource_locks (Azure iam, resource type microsoft.authorization/roledefinitions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
373
716
|
"evidenceType": "Configuration",
|
|
374
717
|
"severity": "medium"
|
|
375
718
|
},
|
|
376
719
|
{
|
|
377
720
|
"id": "prowler.azure.iam_role_user_access_admin_restricted",
|
|
378
721
|
"title": "Role assignment does not grant the User Access Administrator role",
|
|
379
|
-
"scope": "Prowler 5.
|
|
722
|
+
"scope": "Prowler 5.47.0 check iam_role_user_access_admin_restricted (Azure iam, resource type microsoft.authorization/roleassignments): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
723
|
+
"evidenceType": "Configuration",
|
|
724
|
+
"severity": "high"
|
|
725
|
+
},
|
|
726
|
+
{
|
|
727
|
+
"id": "prowler.azure.iam_subscription_owners_between_2_and_3",
|
|
728
|
+
"title": "Subscription has between 2 and 3 principals assigned the Owner role",
|
|
729
|
+
"scope": "Prowler 5.47.0 check iam_subscription_owners_between_2_and_3 (Azure iam, resource type microsoft.resources/subscriptions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
380
730
|
"evidenceType": "Configuration",
|
|
381
731
|
"severity": "high"
|
|
382
732
|
},
|
|
383
733
|
{
|
|
384
734
|
"id": "prowler.azure.iam_subscription_roles_owner_custom_not_created",
|
|
385
735
|
"title": "Custom role is not a subscription owner role",
|
|
386
|
-
"scope": "Prowler 5.
|
|
736
|
+
"scope": "Prowler 5.47.0 check iam_subscription_roles_owner_custom_not_created (Azure iam, resource type microsoft.authorization/roledefinitions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
737
|
+
"evidenceType": "Configuration",
|
|
738
|
+
"severity": "high"
|
|
739
|
+
},
|
|
740
|
+
{
|
|
741
|
+
"id": "prowler.azure.keyvault_access_only_through_private_endpoints",
|
|
742
|
+
"title": "Key Vault using private endpoints has public network access disabled",
|
|
743
|
+
"scope": "Prowler 5.47.0 check keyvault_access_only_through_private_endpoints (Azure keyvault, resource type microsoft.keyvault/vaults): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
387
744
|
"evidenceType": "Configuration",
|
|
388
745
|
"severity": "high"
|
|
389
746
|
},
|
|
390
747
|
{
|
|
391
748
|
"id": "prowler.azure.keyvault_key_expiration_set_in_non_rbac",
|
|
392
749
|
"title": "Key in non-RBAC Key Vault has expiration date set",
|
|
393
|
-
"scope": "Prowler 5.
|
|
750
|
+
"scope": "Prowler 5.47.0 check keyvault_key_expiration_set_in_non_rbac (Azure keyvault, resource type microsoft.keyvault/vaults/keys): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
394
751
|
"evidenceType": "Configuration",
|
|
395
752
|
"severity": "high"
|
|
396
753
|
},
|
|
397
754
|
{
|
|
398
755
|
"id": "prowler.azure.keyvault_key_rotation_enabled",
|
|
399
756
|
"title": "Key Vault key has automatic rotation enabled",
|
|
400
|
-
"scope": "Prowler 5.
|
|
757
|
+
"scope": "Prowler 5.47.0 check keyvault_key_rotation_enabled (Azure keyvault, resource type microsoft.keyvault/vaults/keys): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
758
|
+
"evidenceType": "Configuration",
|
|
759
|
+
"severity": "high"
|
|
760
|
+
},
|
|
761
|
+
{
|
|
762
|
+
"id": "prowler.azure.keyvault_logging_enabled",
|
|
763
|
+
"title": "Key Vault has at least one diagnostic setting with audit logging enabled",
|
|
764
|
+
"scope": "Prowler 5.47.0 check keyvault_logging_enabled (Azure keyvault, resource type microsoft.keyvault/vaults): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
401
765
|
"evidenceType": "Configuration",
|
|
402
766
|
"severity": "high"
|
|
403
767
|
},
|
|
404
768
|
{
|
|
405
769
|
"id": "prowler.azure.keyvault_non_rbac_secret_expiration_set",
|
|
406
770
|
"title": "Secret in non-RBAC Key Vault has expiration date set",
|
|
407
|
-
"scope": "Prowler 5.
|
|
771
|
+
"scope": "Prowler 5.47.0 check keyvault_non_rbac_secret_expiration_set (Azure keyvault, resource type microsoft.keyvault/vaults/secrets): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
408
772
|
"evidenceType": "Configuration",
|
|
409
773
|
"severity": "medium"
|
|
410
774
|
},
|
|
775
|
+
{
|
|
776
|
+
"id": "prowler.azure.keyvault_private_endpoints",
|
|
777
|
+
"title": "Key Vault uses private endpoints",
|
|
778
|
+
"scope": "Prowler 5.47.0 check keyvault_private_endpoints (Azure keyvault, resource type microsoft.keyvault/vaults): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
779
|
+
"evidenceType": "Configuration",
|
|
780
|
+
"severity": "high"
|
|
781
|
+
},
|
|
411
782
|
{
|
|
412
783
|
"id": "prowler.azure.keyvault_rbac_enabled",
|
|
413
784
|
"title": "Key Vault uses Azure RBAC for access control",
|
|
414
|
-
"scope": "Prowler 5.
|
|
785
|
+
"scope": "Prowler 5.47.0 check keyvault_rbac_enabled (Azure keyvault, resource type microsoft.keyvault/vaults): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
415
786
|
"evidenceType": "Configuration",
|
|
416
787
|
"severity": "high"
|
|
417
788
|
},
|
|
418
789
|
{
|
|
419
790
|
"id": "prowler.azure.keyvault_rbac_key_expiration_set",
|
|
420
791
|
"title": "Key in RBAC-enabled Key Vault has expiration date set",
|
|
421
|
-
"scope": "Prowler 5.
|
|
792
|
+
"scope": "Prowler 5.47.0 check keyvault_rbac_key_expiration_set (Azure keyvault, resource type microsoft.keyvault/vaults/keys): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
422
793
|
"evidenceType": "Configuration",
|
|
423
794
|
"severity": "medium"
|
|
424
795
|
},
|
|
425
796
|
{
|
|
426
797
|
"id": "prowler.azure.keyvault_rbac_secret_expiration_set",
|
|
427
798
|
"title": "Secret in RBAC-enabled Key Vault has expiration date set",
|
|
428
|
-
"scope": "Prowler 5.
|
|
799
|
+
"scope": "Prowler 5.47.0 check keyvault_rbac_secret_expiration_set (Azure keyvault, resource type microsoft.keyvault/vaults/secrets): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
429
800
|
"evidenceType": "Configuration",
|
|
430
801
|
"severity": "medium"
|
|
431
802
|
},
|
|
432
803
|
{
|
|
433
804
|
"id": "prowler.azure.keyvault_recoverable",
|
|
434
805
|
"title": "Key Vault has soft delete and purge protection enabled",
|
|
435
|
-
"scope": "Prowler 5.
|
|
806
|
+
"scope": "Prowler 5.47.0 check keyvault_recoverable (Azure keyvault, resource type microsoft.keyvault/vaults): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
436
807
|
"evidenceType": "Configuration",
|
|
437
808
|
"severity": "high"
|
|
438
809
|
},
|
|
439
810
|
{
|
|
440
811
|
"id": "prowler.azure.monitor_alert_create_policy_assignment",
|
|
441
812
|
"title": "Subscription has an Azure Monitor activity log alert for policy assignment creation",
|
|
442
|
-
"scope": "Prowler 5.
|
|
813
|
+
"scope": "Prowler 5.47.0 check monitor_alert_create_policy_assignment (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
443
814
|
"evidenceType": "Configuration",
|
|
444
815
|
"severity": "medium"
|
|
445
816
|
},
|
|
446
817
|
{
|
|
447
818
|
"id": "prowler.azure.monitor_alert_create_update_nsg",
|
|
448
819
|
"title": "Subscription has an Activity Log alert for Network Security Group create or update operations",
|
|
449
|
-
"scope": "Prowler 5.
|
|
820
|
+
"scope": "Prowler 5.47.0 check monitor_alert_create_update_nsg (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
450
821
|
"evidenceType": "Configuration",
|
|
451
822
|
"severity": "high"
|
|
452
823
|
},
|
|
453
824
|
{
|
|
454
825
|
"id": "prowler.azure.monitor_alert_create_update_public_ip_address_rule",
|
|
455
826
|
"title": "Subscription has an Activity Log Alert for Public IP address create or update operations",
|
|
456
|
-
"scope": "Prowler 5.
|
|
827
|
+
"scope": "Prowler 5.47.0 check monitor_alert_create_update_public_ip_address_rule (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
457
828
|
"evidenceType": "Configuration",
|
|
458
829
|
"severity": "medium"
|
|
459
830
|
},
|
|
460
831
|
{
|
|
461
832
|
"id": "prowler.azure.monitor_alert_create_update_security_solution",
|
|
462
833
|
"title": "Subscription has Activity Log alert for Security Solution create or update",
|
|
463
|
-
"scope": "Prowler 5.
|
|
834
|
+
"scope": "Prowler 5.47.0 check monitor_alert_create_update_security_solution (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
464
835
|
"evidenceType": "Configuration",
|
|
465
836
|
"severity": "medium"
|
|
466
837
|
},
|
|
467
838
|
{
|
|
468
839
|
"id": "prowler.azure.monitor_alert_create_update_sqlserver_fr",
|
|
469
840
|
"title": "Subscription has an Activity Log alert for SQL Server firewall rule create or update events",
|
|
470
|
-
"scope": "Prowler 5.
|
|
841
|
+
"scope": "Prowler 5.47.0 check monitor_alert_create_update_sqlserver_fr (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
471
842
|
"evidenceType": "Configuration",
|
|
472
843
|
"severity": "medium"
|
|
473
844
|
},
|
|
474
845
|
{
|
|
475
846
|
"id": "prowler.azure.monitor_alert_delete_nsg",
|
|
476
847
|
"title": "Subscription has an Activity Log alert for Network Security Group delete operations",
|
|
477
|
-
"scope": "Prowler 5.
|
|
848
|
+
"scope": "Prowler 5.47.0 check monitor_alert_delete_nsg (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
478
849
|
"evidenceType": "Configuration",
|
|
479
850
|
"severity": "high"
|
|
480
851
|
},
|
|
481
852
|
{
|
|
482
853
|
"id": "prowler.azure.monitor_alert_delete_policy_assignment",
|
|
483
854
|
"title": "Subscription has an Activity Log alert for policy assignment deletion",
|
|
484
|
-
"scope": "Prowler 5.
|
|
855
|
+
"scope": "Prowler 5.47.0 check monitor_alert_delete_policy_assignment (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
485
856
|
"evidenceType": "Configuration",
|
|
486
857
|
"severity": "high"
|
|
487
858
|
},
|
|
488
859
|
{
|
|
489
860
|
"id": "prowler.azure.monitor_alert_delete_public_ip_address_rule",
|
|
490
861
|
"title": "Azure subscription has an Activity Log alert for public IP address deletion",
|
|
491
|
-
"scope": "Prowler 5.
|
|
862
|
+
"scope": "Prowler 5.47.0 check monitor_alert_delete_public_ip_address_rule (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
492
863
|
"evidenceType": "Configuration",
|
|
493
864
|
"severity": "medium"
|
|
494
865
|
},
|
|
495
866
|
{
|
|
496
867
|
"id": "prowler.azure.monitor_alert_delete_security_solution",
|
|
497
868
|
"title": "Subscription has an Azure Monitor Activity Log alert for Microsoft.Security/securitySolutions delete operations",
|
|
498
|
-
"scope": "Prowler 5.
|
|
869
|
+
"scope": "Prowler 5.47.0 check monitor_alert_delete_security_solution (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
499
870
|
"evidenceType": "Configuration",
|
|
500
871
|
"severity": "medium"
|
|
501
872
|
},
|
|
502
873
|
{
|
|
503
874
|
"id": "prowler.azure.monitor_alert_delete_sqlserver_fr",
|
|
504
875
|
"title": "Subscription has an Activity Log Alert for SQL Server firewall rule deletions",
|
|
505
|
-
"scope": "Prowler 5.
|
|
876
|
+
"scope": "Prowler 5.47.0 check monitor_alert_delete_sqlserver_fr (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
877
|
+
"evidenceType": "Configuration",
|
|
878
|
+
"severity": "medium"
|
|
879
|
+
},
|
|
880
|
+
{
|
|
881
|
+
"id": "prowler.azure.monitor_alert_service_health_exists",
|
|
882
|
+
"title": "Azure subscription has an enabled Activity Log alert for Service Health incidents",
|
|
883
|
+
"scope": "Prowler 5.47.0 check monitor_alert_service_health_exists (Azure monitor, resource type microsoft.insights/activitylogalerts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
506
884
|
"evidenceType": "Configuration",
|
|
507
885
|
"severity": "medium"
|
|
508
886
|
},
|
|
509
887
|
{
|
|
510
888
|
"id": "prowler.azure.monitor_diagnostic_setting_with_appropriate_categories",
|
|
511
889
|
"title": "Subscription has a diagnostic setting capturing Administrative, Security, Alert, and Policy categories",
|
|
512
|
-
"scope": "Prowler 5.
|
|
890
|
+
"scope": "Prowler 5.47.0 check monitor_diagnostic_setting_with_appropriate_categories (Azure monitor, resource type microsoft.resources/subscriptions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
513
891
|
"evidenceType": "Configuration",
|
|
514
892
|
"severity": "high"
|
|
515
893
|
},
|
|
516
894
|
{
|
|
517
895
|
"id": "prowler.azure.monitor_diagnostic_settings_exists",
|
|
518
896
|
"title": "Subscription has an Activity Log diagnostic setting",
|
|
519
|
-
"scope": "Prowler 5.
|
|
897
|
+
"scope": "Prowler 5.47.0 check monitor_diagnostic_settings_exists (Azure monitor, resource type microsoft.resources/subscriptions): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
520
898
|
"evidenceType": "Configuration",
|
|
521
899
|
"severity": "high"
|
|
522
900
|
},
|
|
523
901
|
{
|
|
524
902
|
"id": "prowler.azure.monitor_storage_account_with_activity_logs_cmk_encrypted",
|
|
525
903
|
"title": "Storage account storing Activity Log data is encrypted with a customer-managed key",
|
|
526
|
-
"scope": "Prowler 5.
|
|
904
|
+
"scope": "Prowler 5.47.0 check monitor_storage_account_with_activity_logs_cmk_encrypted (Azure monitor, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
527
905
|
"evidenceType": "Configuration",
|
|
528
906
|
"severity": "medium"
|
|
529
907
|
},
|
|
530
908
|
{
|
|
531
909
|
"id": "prowler.azure.monitor_storage_account_with_activity_logs_is_private",
|
|
532
910
|
"title": "Storage account storing activity logs does not allow public blob access",
|
|
533
|
-
"scope": "Prowler 5.
|
|
911
|
+
"scope": "Prowler 5.47.0 check monitor_storage_account_with_activity_logs_is_private (Azure monitor, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
534
912
|
"evidenceType": "Configuration",
|
|
535
913
|
"severity": "high"
|
|
536
914
|
},
|
|
537
915
|
{
|
|
538
916
|
"id": "prowler.azure.mysql_flexible_server_audit_log_connection_activated",
|
|
539
917
|
"title": "MySQL flexible server has audit_log_events including CONNECTION",
|
|
540
|
-
"scope": "Prowler 5.
|
|
918
|
+
"scope": "Prowler 5.47.0 check mysql_flexible_server_audit_log_connection_activated (Azure mysql, resource type microsoft.dbformysql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
541
919
|
"evidenceType": "Configuration",
|
|
542
920
|
"severity": "medium"
|
|
543
921
|
},
|
|
544
922
|
{
|
|
545
923
|
"id": "prowler.azure.mysql_flexible_server_audit_log_enabled",
|
|
546
924
|
"title": "MySQL flexible server has audit_log_enabled set to ON",
|
|
547
|
-
"scope": "Prowler 5.
|
|
925
|
+
"scope": "Prowler 5.47.0 check mysql_flexible_server_audit_log_enabled (Azure mysql, resource type microsoft.dbformysql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
548
926
|
"evidenceType": "Configuration",
|
|
549
927
|
"severity": "medium"
|
|
550
928
|
},
|
|
551
929
|
{
|
|
552
930
|
"id": "prowler.azure.mysql_flexible_server_geo_redundant_backup_enabled",
|
|
553
931
|
"title": "MySQL flexible server has geo-redundant backup enabled",
|
|
554
|
-
"scope": "Prowler 5.
|
|
932
|
+
"scope": "Prowler 5.47.0 check mysql_flexible_server_geo_redundant_backup_enabled (Azure mysql, resource type microsoft.dbformysql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
555
933
|
"evidenceType": "Configuration",
|
|
556
934
|
"severity": "medium"
|
|
557
935
|
},
|
|
558
936
|
{
|
|
559
937
|
"id": "prowler.azure.mysql_flexible_server_high_availability_enabled",
|
|
560
938
|
"title": "MySQL flexible server has high availability enabled",
|
|
561
|
-
"scope": "Prowler 5.
|
|
939
|
+
"scope": "Prowler 5.47.0 check mysql_flexible_server_high_availability_enabled (Azure mysql, resource type microsoft.dbformysql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
562
940
|
"evidenceType": "Configuration",
|
|
563
941
|
"severity": "medium"
|
|
564
942
|
},
|
|
565
943
|
{
|
|
566
944
|
"id": "prowler.azure.mysql_flexible_server_minimum_tls_version_12",
|
|
567
945
|
"title": "MySQL flexible server enforces TLS 1.2 or higher",
|
|
568
|
-
"scope": "Prowler 5.
|
|
946
|
+
"scope": "Prowler 5.47.0 check mysql_flexible_server_minimum_tls_version_12 (Azure mysql, resource type microsoft.dbformysql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
569
947
|
"evidenceType": "Configuration",
|
|
570
948
|
"severity": "high"
|
|
571
949
|
},
|
|
572
950
|
{
|
|
573
951
|
"id": "prowler.azure.mysql_flexible_server_ssl_connection_enabled",
|
|
574
952
|
"title": "MySQL Flexible Server enforces SSL connections",
|
|
575
|
-
"scope": "Prowler 5.
|
|
953
|
+
"scope": "Prowler 5.47.0 check mysql_flexible_server_ssl_connection_enabled (Azure mysql, resource type microsoft.dbformysql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
576
954
|
"evidenceType": "Configuration",
|
|
577
955
|
"severity": "high"
|
|
578
956
|
},
|
|
957
|
+
{
|
|
958
|
+
"id": "prowler.azure.network_application_gateway_http2_enabled",
|
|
959
|
+
"title": "Application Gateway has HTTP/2 enabled",
|
|
960
|
+
"scope": "Prowler 5.47.0 check network_application_gateway_http2_enabled (Azure network, resource type microsoft.network/applicationgateways): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
961
|
+
"evidenceType": "Configuration",
|
|
962
|
+
"severity": "low"
|
|
963
|
+
},
|
|
964
|
+
{
|
|
965
|
+
"id": "prowler.azure.network_application_gateway_waf_enabled",
|
|
966
|
+
"title": "Application Gateway has an enabled Web Application Firewall policy associated",
|
|
967
|
+
"scope": "Prowler 5.47.0 check network_application_gateway_waf_enabled (Azure network, resource type microsoft.network/applicationgateways): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
968
|
+
"evidenceType": "Configuration",
|
|
969
|
+
"severity": "medium"
|
|
970
|
+
},
|
|
579
971
|
{
|
|
580
972
|
"id": "prowler.azure.network_bastion_host_exists",
|
|
581
973
|
"title": "Azure subscription has at least one Bastion Host",
|
|
582
|
-
"scope": "Prowler 5.
|
|
974
|
+
"scope": "Prowler 5.47.0 check network_bastion_host_exists (Azure network, resource type microsoft.network/bastionhosts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
583
975
|
"evidenceType": "Configuration",
|
|
584
976
|
"severity": "medium"
|
|
585
977
|
},
|
|
586
978
|
{
|
|
587
979
|
"id": "prowler.azure.network_flow_log_captured_sent",
|
|
588
980
|
"title": "Network Watcher has flow logs enabled and sent to a Log Analytics workspace",
|
|
589
|
-
"scope": "Prowler 5.
|
|
981
|
+
"scope": "Prowler 5.47.0 check network_flow_log_captured_sent (Azure network, resource type microsoft.network/networkwatchers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
590
982
|
"evidenceType": "Configuration",
|
|
591
983
|
"severity": "high"
|
|
592
984
|
},
|
|
593
985
|
{
|
|
594
986
|
"id": "prowler.azure.network_flow_log_more_than_90_days",
|
|
595
987
|
"title": "Network Watcher has all flow logs enabled with retention set to 0 or at least 90 days",
|
|
596
|
-
"scope": "Prowler 5.
|
|
988
|
+
"scope": "Prowler 5.47.0 check network_flow_log_more_than_90_days (Azure network, resource type microsoft.network/networkwatchers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
597
989
|
"evidenceType": "Configuration",
|
|
598
990
|
"severity": "medium"
|
|
599
991
|
},
|
|
600
992
|
{
|
|
601
993
|
"id": "prowler.azure.network_http_internet_access_restricted",
|
|
602
994
|
"title": "Network security group restricts inbound HTTP (port 80) access from the Internet",
|
|
603
|
-
"scope": "Prowler 5.
|
|
995
|
+
"scope": "Prowler 5.47.0 check network_http_internet_access_restricted (Azure network, resource type microsoft.network/networksecuritygroups): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
996
|
+
"evidenceType": "Configuration",
|
|
997
|
+
"severity": "high"
|
|
998
|
+
},
|
|
999
|
+
{
|
|
1000
|
+
"id": "prowler.azure.network_public_ip_shodan",
|
|
1001
|
+
"title": "Azure public IP address is not listed in Shodan",
|
|
1002
|
+
"scope": "Prowler 5.47.0 check network_public_ip_shodan (Azure network, resource type microsoft.network/publicipaddresses): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
604
1003
|
"evidenceType": "Configuration",
|
|
605
1004
|
"severity": "high"
|
|
606
1005
|
},
|
|
607
1006
|
{
|
|
608
1007
|
"id": "prowler.azure.network_rdp_internet_access_restricted",
|
|
609
1008
|
"title": "Network security group does not allow inbound RDP (TCP 3389) from the Internet",
|
|
610
|
-
"scope": "Prowler 5.
|
|
1009
|
+
"scope": "Prowler 5.47.0 check network_rdp_internet_access_restricted (Azure network, resource type microsoft.network/networksecuritygroups): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
611
1010
|
"evidenceType": "Configuration",
|
|
612
1011
|
"severity": "high"
|
|
613
1012
|
},
|
|
614
1013
|
{
|
|
615
1014
|
"id": "prowler.azure.network_ssh_internet_access_restricted",
|
|
616
1015
|
"title": "Network security group does not allow inbound SSH (TCP port 22) from the Internet",
|
|
617
|
-
"scope": "Prowler 5.
|
|
1016
|
+
"scope": "Prowler 5.47.0 check network_ssh_internet_access_restricted (Azure network, resource type microsoft.network/networksecuritygroups): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
618
1017
|
"evidenceType": "Configuration",
|
|
619
1018
|
"severity": "high"
|
|
620
1019
|
},
|
|
621
1020
|
{
|
|
622
1021
|
"id": "prowler.azure.network_subnet_nsg_associated",
|
|
623
1022
|
"title": "Subnet has a network security group associated",
|
|
624
|
-
"scope": "Prowler 5.
|
|
1023
|
+
"scope": "Prowler 5.47.0 check network_subnet_nsg_associated (Azure network, resource type microsoft.network/virtualnetworks/subnets): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
625
1024
|
"evidenceType": "Configuration",
|
|
626
1025
|
"severity": "high"
|
|
627
1026
|
},
|
|
628
1027
|
{
|
|
629
1028
|
"id": "prowler.azure.network_udp_internet_access_restricted",
|
|
630
1029
|
"title": "Network security group does not allow inbound UDP from the Internet",
|
|
631
|
-
"scope": "Prowler 5.
|
|
1030
|
+
"scope": "Prowler 5.47.0 check network_udp_internet_access_restricted (Azure network, resource type microsoft.network/networksecuritygroups): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
632
1031
|
"evidenceType": "Configuration",
|
|
633
1032
|
"severity": "high"
|
|
634
1033
|
},
|
|
635
1034
|
{
|
|
636
1035
|
"id": "prowler.azure.network_vnet_ddos_protection_enabled",
|
|
637
1036
|
"title": "Virtual network has Azure DDoS Network Protection enabled",
|
|
638
|
-
"scope": "Prowler 5.
|
|
1037
|
+
"scope": "Prowler 5.47.0 check network_vnet_ddos_protection_enabled (Azure network, resource type microsoft.network/virtualnetworks): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
639
1038
|
"evidenceType": "Configuration",
|
|
640
1039
|
"severity": "medium"
|
|
641
1040
|
},
|
|
642
1041
|
{
|
|
643
1042
|
"id": "prowler.azure.network_watcher_enabled",
|
|
644
1043
|
"title": "Network Watcher is enabled for all locations in the subscription",
|
|
645
|
-
"scope": "Prowler 5.
|
|
1044
|
+
"scope": "Prowler 5.47.0 check network_watcher_enabled (Azure network, resource type microsoft.network/networkwatchers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
646
1045
|
"evidenceType": "Configuration",
|
|
647
1046
|
"severity": "high"
|
|
648
1047
|
},
|
|
649
1048
|
{
|
|
650
1049
|
"id": "prowler.azure.policy_ensure_asc_enforcement_enabled",
|
|
651
1050
|
"title": "Security Center built-in policy assignment has enforcement mode set to Default",
|
|
652
|
-
"scope": "Prowler 5.
|
|
1051
|
+
"scope": "Prowler 5.47.0 check policy_ensure_asc_enforcement_enabled (Azure policy, resource type microsoft.authorization/policyassignments): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
653
1052
|
"evidenceType": "Configuration",
|
|
654
1053
|
"severity": "medium"
|
|
655
1054
|
},
|
|
656
1055
|
{
|
|
657
1056
|
"id": "prowler.azure.postgresql_flexible_server_allow_access_services_disabled",
|
|
658
1057
|
"title": "PostgreSQL flexible server has 'Allow public access from any Azure service' disabled",
|
|
659
|
-
"scope": "Prowler 5.
|
|
1058
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_allow_access_services_disabled (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
660
1059
|
"evidenceType": "Configuration",
|
|
661
1060
|
"severity": "high"
|
|
662
1061
|
},
|
|
663
1062
|
{
|
|
664
1063
|
"id": "prowler.azure.postgresql_flexible_server_connection_throttling_on",
|
|
665
1064
|
"title": "Flexible PostgreSQL server has connection_throttling enabled",
|
|
666
|
-
"scope": "Prowler 5.
|
|
1065
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_connection_throttling_on (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
667
1066
|
"evidenceType": "Configuration",
|
|
668
1067
|
"severity": "medium"
|
|
669
1068
|
},
|
|
670
1069
|
{
|
|
671
1070
|
"id": "prowler.azure.postgresql_flexible_server_enforce_ssl_enabled",
|
|
672
1071
|
"title": "PostgreSQL Flexible Server enforces SSL connections",
|
|
673
|
-
"scope": "Prowler 5.
|
|
1072
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_enforce_ssl_enabled (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
674
1073
|
"evidenceType": "Configuration",
|
|
675
1074
|
"severity": "high"
|
|
676
1075
|
},
|
|
1076
|
+
{
|
|
1077
|
+
"id": "prowler.azure.postgresql_flexible_server_entra_id_authentication_enabled",
|
|
1078
|
+
"title": "Microsoft Entra ID authentication is enabled for PostgreSQL Flexible Server",
|
|
1079
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_entra_id_authentication_enabled (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1080
|
+
"evidenceType": "Configuration",
|
|
1081
|
+
"severity": "medium"
|
|
1082
|
+
},
|
|
677
1083
|
{
|
|
678
1084
|
"id": "prowler.azure.postgresql_flexible_server_geo_redundant_backup_enabled",
|
|
679
1085
|
"title": "PostgreSQL flexible server has geo-redundant backup enabled",
|
|
680
|
-
"scope": "Prowler 5.
|
|
1086
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_geo_redundant_backup_enabled (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
681
1087
|
"evidenceType": "Configuration",
|
|
682
1088
|
"severity": "medium"
|
|
683
1089
|
},
|
|
684
1090
|
{
|
|
685
1091
|
"id": "prowler.azure.postgresql_flexible_server_high_availability_enabled",
|
|
686
1092
|
"title": "PostgreSQL flexible server has high availability enabled",
|
|
687
|
-
"scope": "Prowler 5.
|
|
1093
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_high_availability_enabled (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
688
1094
|
"evidenceType": "Configuration",
|
|
689
1095
|
"severity": "medium"
|
|
690
1096
|
},
|
|
691
1097
|
{
|
|
692
1098
|
"id": "prowler.azure.postgresql_flexible_server_log_checkpoints_on",
|
|
693
1099
|
"title": "PostgreSQL Flexible Server has checkpoint logging enabled",
|
|
694
|
-
"scope": "Prowler 5.
|
|
1100
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_log_checkpoints_on (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
695
1101
|
"evidenceType": "Configuration",
|
|
696
1102
|
"severity": "low"
|
|
697
1103
|
},
|
|
698
1104
|
{
|
|
699
1105
|
"id": "prowler.azure.postgresql_flexible_server_log_connections_on",
|
|
700
1106
|
"title": "PostgreSQL flexible server has log_connections enabled",
|
|
701
|
-
"scope": "Prowler 5.
|
|
1107
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_log_connections_on (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
702
1108
|
"evidenceType": "Configuration",
|
|
703
1109
|
"severity": "medium"
|
|
704
1110
|
},
|
|
705
1111
|
{
|
|
706
1112
|
"id": "prowler.azure.postgresql_flexible_server_log_disconnections_on",
|
|
707
1113
|
"title": "PostgreSQL Flexible Server has disconnection logging enabled",
|
|
708
|
-
"scope": "Prowler 5.
|
|
1114
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_log_disconnections_on (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1115
|
+
"evidenceType": "Configuration",
|
|
1116
|
+
"severity": "medium"
|
|
1117
|
+
},
|
|
1118
|
+
{
|
|
1119
|
+
"id": "prowler.azure.postgresql_flexible_server_log_retention_days_greater_3",
|
|
1120
|
+
"title": "PostgreSQL flexible server log_retention_days is between 4 and 7 days",
|
|
1121
|
+
"scope": "Prowler 5.47.0 check postgresql_flexible_server_log_retention_days_greater_3 (Azure postgresql, resource type microsoft.dbforpostgresql/flexibleservers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
709
1122
|
"evidenceType": "Configuration",
|
|
710
1123
|
"severity": "medium"
|
|
711
1124
|
},
|
|
712
1125
|
{
|
|
713
1126
|
"id": "prowler.azure.recovery_vault_backup_policy_retention_adequate",
|
|
714
1127
|
"title": "Recovery Services backup policy has at least 30 days retention",
|
|
715
|
-
"scope": "Prowler 5.
|
|
1128
|
+
"scope": "Prowler 5.47.0 check recovery_vault_backup_policy_retention_adequate (Azure recovery, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
716
1129
|
"evidenceType": "Configuration",
|
|
717
1130
|
"severity": "medium"
|
|
718
1131
|
},
|
|
719
1132
|
{
|
|
720
1133
|
"id": "prowler.azure.recovery_vault_has_protected_items",
|
|
721
1134
|
"title": "Recovery Services vault has backup protected items configured",
|
|
722
|
-
"scope": "Prowler 5.
|
|
1135
|
+
"scope": "Prowler 5.47.0 check recovery_vault_has_protected_items (Azure recovery, resource type microsoft.recoveryservices/vaults): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
723
1136
|
"evidenceType": "Configuration",
|
|
724
1137
|
"severity": "medium"
|
|
725
1138
|
},
|
|
726
1139
|
{
|
|
727
1140
|
"id": "prowler.azure.sqlserver_auditing_enabled",
|
|
728
1141
|
"title": "SQL Server has an auditing policy configured",
|
|
729
|
-
"scope": "Prowler 5.
|
|
1142
|
+
"scope": "Prowler 5.47.0 check sqlserver_auditing_enabled (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
730
1143
|
"evidenceType": "Configuration",
|
|
731
1144
|
"severity": "high"
|
|
732
1145
|
},
|
|
733
1146
|
{
|
|
734
1147
|
"id": "prowler.azure.sqlserver_auditing_retention_90_days",
|
|
735
1148
|
"title": "SQL server has auditing enabled with retention greater than 90 days",
|
|
736
|
-
"scope": "Prowler 5.
|
|
1149
|
+
"scope": "Prowler 5.47.0 check sqlserver_auditing_retention_90_days (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1150
|
+
"evidenceType": "Configuration",
|
|
1151
|
+
"severity": "medium"
|
|
1152
|
+
},
|
|
1153
|
+
{
|
|
1154
|
+
"id": "prowler.azure.sqlserver_azuread_administrator_enabled",
|
|
1155
|
+
"title": "SQL Server has an Azure Active Directory administrator configured",
|
|
1156
|
+
"scope": "Prowler 5.47.0 check sqlserver_azuread_administrator_enabled (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
737
1157
|
"evidenceType": "Configuration",
|
|
738
1158
|
"severity": "medium"
|
|
739
1159
|
},
|
|
1160
|
+
{
|
|
1161
|
+
"id": "prowler.azure.sqlserver_microsoft_defender_enabled",
|
|
1162
|
+
"title": "SQL Server has Microsoft Defender for SQL enabled",
|
|
1163
|
+
"scope": "Prowler 5.47.0 check sqlserver_microsoft_defender_enabled (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1164
|
+
"evidenceType": "Configuration",
|
|
1165
|
+
"severity": "high"
|
|
1166
|
+
},
|
|
740
1167
|
{
|
|
741
1168
|
"id": "prowler.azure.sqlserver_recommended_minimal_tls_version",
|
|
742
1169
|
"title": "SQL server enforces minimal TLS version 1.2 or 1.3",
|
|
743
|
-
"scope": "Prowler 5.
|
|
1170
|
+
"scope": "Prowler 5.47.0 check sqlserver_recommended_minimal_tls_version (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
744
1171
|
"evidenceType": "Configuration",
|
|
745
1172
|
"severity": "medium"
|
|
746
1173
|
},
|
|
747
1174
|
{
|
|
748
1175
|
"id": "prowler.azure.sqlserver_tde_encrypted_with_cmk",
|
|
749
1176
|
"title": "SQL server uses a customer-managed key for the TDE protector and all databases have TDE enabled",
|
|
750
|
-
"scope": "Prowler 5.
|
|
1177
|
+
"scope": "Prowler 5.47.0 check sqlserver_tde_encrypted_with_cmk (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
751
1178
|
"evidenceType": "Configuration",
|
|
752
1179
|
"severity": "critical"
|
|
753
1180
|
},
|
|
754
1181
|
{
|
|
755
1182
|
"id": "prowler.azure.sqlserver_tde_encryption_enabled",
|
|
756
1183
|
"title": "SQL database has Transparent Data Encryption (TDE) enabled",
|
|
757
|
-
"scope": "Prowler 5.
|
|
1184
|
+
"scope": "Prowler 5.47.0 check sqlserver_tde_encryption_enabled (Azure sqlserver, resource type microsoft.sql/servers/databases): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
758
1185
|
"evidenceType": "Configuration",
|
|
759
1186
|
"severity": "high"
|
|
760
1187
|
},
|
|
761
1188
|
{
|
|
762
1189
|
"id": "prowler.azure.sqlserver_unrestricted_inbound_access",
|
|
763
1190
|
"title": "Azure SQL Server does not have firewall rules allowing 0.0.0.0-255.255.255.255",
|
|
764
|
-
"scope": "Prowler 5.
|
|
1191
|
+
"scope": "Prowler 5.47.0 check sqlserver_unrestricted_inbound_access (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
765
1192
|
"evidenceType": "Configuration",
|
|
766
1193
|
"severity": "critical"
|
|
767
1194
|
},
|
|
1195
|
+
{
|
|
1196
|
+
"id": "prowler.azure.sqlserver_va_emails_notifications_admins_enabled",
|
|
1197
|
+
"title": "SQL Server has Vulnerability Assessment enabled and email notifications to subscription admins configured",
|
|
1198
|
+
"scope": "Prowler 5.47.0 check sqlserver_va_emails_notifications_admins_enabled (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1199
|
+
"evidenceType": "Configuration",
|
|
1200
|
+
"severity": "medium"
|
|
1201
|
+
},
|
|
768
1202
|
{
|
|
769
1203
|
"id": "prowler.azure.sqlserver_va_periodic_recurring_scans_enabled",
|
|
770
1204
|
"title": "SQL Server has Vulnerability Assessment periodic recurring scans enabled",
|
|
771
|
-
"scope": "Prowler 5.
|
|
1205
|
+
"scope": "Prowler 5.47.0 check sqlserver_va_periodic_recurring_scans_enabled (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1206
|
+
"evidenceType": "Configuration",
|
|
1207
|
+
"severity": "medium"
|
|
1208
|
+
},
|
|
1209
|
+
{
|
|
1210
|
+
"id": "prowler.azure.sqlserver_va_scan_reports_configured",
|
|
1211
|
+
"title": "SQL server has Vulnerability Assessment enabled and scan report recipients configured",
|
|
1212
|
+
"scope": "Prowler 5.47.0 check sqlserver_va_scan_reports_configured (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
772
1213
|
"evidenceType": "Configuration",
|
|
773
1214
|
"severity": "medium"
|
|
774
1215
|
},
|
|
775
1216
|
{
|
|
776
1217
|
"id": "prowler.azure.sqlserver_vulnerability_assessment_enabled",
|
|
777
1218
|
"title": "SQL server has vulnerability assessment enabled with storage container configured",
|
|
778
|
-
"scope": "Prowler 5.
|
|
1219
|
+
"scope": "Prowler 5.47.0 check sqlserver_vulnerability_assessment_enabled (Azure sqlserver, resource type microsoft.sql/servers): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
779
1220
|
"evidenceType": "Configuration",
|
|
780
1221
|
"severity": "medium"
|
|
781
1222
|
},
|
|
782
1223
|
{
|
|
783
1224
|
"id": "prowler.azure.storage_account_key_access_disabled",
|
|
784
1225
|
"title": "Storage account has shared key access disabled",
|
|
785
|
-
"scope": "Prowler 5.
|
|
1226
|
+
"scope": "Prowler 5.47.0 check storage_account_key_access_disabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
786
1227
|
"evidenceType": "Configuration",
|
|
787
1228
|
"severity": "high"
|
|
788
1229
|
},
|
|
789
1230
|
{
|
|
790
1231
|
"id": "prowler.azure.storage_account_public_network_access_disabled",
|
|
791
1232
|
"title": "Storage account has 'Public Network Access' disabled",
|
|
792
|
-
"scope": "Prowler 5.
|
|
1233
|
+
"scope": "Prowler 5.47.0 check storage_account_public_network_access_disabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
793
1234
|
"evidenceType": "Configuration",
|
|
794
1235
|
"severity": "high"
|
|
795
1236
|
},
|
|
796
1237
|
{
|
|
797
1238
|
"id": "prowler.azure.storage_blob_public_access_level_is_disabled",
|
|
798
1239
|
"title": "Storage account has 'Allow Blob Anonymous Access' disabled",
|
|
799
|
-
"scope": "Prowler 5.
|
|
1240
|
+
"scope": "Prowler 5.47.0 check storage_blob_public_access_level_is_disabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
800
1241
|
"evidenceType": "Configuration",
|
|
801
1242
|
"severity": "high"
|
|
802
1243
|
},
|
|
803
1244
|
{
|
|
804
1245
|
"id": "prowler.azure.storage_blob_versioning_is_enabled",
|
|
805
1246
|
"title": "Storage account has blob versioning enabled",
|
|
806
|
-
"scope": "Prowler 5.
|
|
1247
|
+
"scope": "Prowler 5.47.0 check storage_blob_versioning_is_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
807
1248
|
"evidenceType": "Configuration",
|
|
808
1249
|
"severity": "medium"
|
|
809
1250
|
},
|
|
1251
|
+
{
|
|
1252
|
+
"id": "prowler.azure.storage_cross_tenant_replication_disabled",
|
|
1253
|
+
"title": "Storage account has cross-tenant replication disabled",
|
|
1254
|
+
"scope": "Prowler 5.47.0 check storage_cross_tenant_replication_disabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1255
|
+
"evidenceType": "Configuration",
|
|
1256
|
+
"severity": "high"
|
|
1257
|
+
},
|
|
810
1258
|
{
|
|
811
1259
|
"id": "prowler.azure.storage_default_network_access_rule_is_denied",
|
|
812
1260
|
"title": "Storage account default network access rule is set to Deny",
|
|
813
|
-
"scope": "Prowler 5.
|
|
1261
|
+
"scope": "Prowler 5.47.0 check storage_default_network_access_rule_is_denied (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
814
1262
|
"evidenceType": "Configuration",
|
|
815
1263
|
"severity": "high"
|
|
816
1264
|
},
|
|
817
1265
|
{
|
|
818
1266
|
"id": "prowler.azure.storage_default_to_entra_authorization_enabled",
|
|
819
1267
|
"title": "Storage account uses Microsoft Entra authorization by default",
|
|
820
|
-
"scope": "Prowler 5.
|
|
1268
|
+
"scope": "Prowler 5.47.0 check storage_default_to_entra_authorization_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1269
|
+
"evidenceType": "Configuration",
|
|
1270
|
+
"severity": "medium"
|
|
1271
|
+
},
|
|
1272
|
+
{
|
|
1273
|
+
"id": "prowler.azure.storage_ensure_azure_services_are_trusted_to_access_is_enabled",
|
|
1274
|
+
"title": "Storage account has 'Allow trusted Microsoft services to access this storage account' enabled",
|
|
1275
|
+
"scope": "Prowler 5.47.0 check storage_ensure_azure_services_are_trusted_to_access_is_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
821
1276
|
"evidenceType": "Configuration",
|
|
822
1277
|
"severity": "medium"
|
|
823
1278
|
},
|
|
824
1279
|
{
|
|
825
1280
|
"id": "prowler.azure.storage_ensure_encryption_with_customer_managed_keys",
|
|
826
1281
|
"title": "Azure Storage account uses customer-managed keys (CMKs) for encryption",
|
|
827
|
-
"scope": "Prowler 5.
|
|
1282
|
+
"scope": "Prowler 5.47.0 check storage_ensure_encryption_with_customer_managed_keys (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
828
1283
|
"evidenceType": "Configuration",
|
|
829
1284
|
"severity": "high"
|
|
830
1285
|
},
|
|
831
1286
|
{
|
|
832
1287
|
"id": "prowler.azure.storage_ensure_file_shares_soft_delete_is_enabled",
|
|
833
1288
|
"title": "Storage account has soft delete enabled for file shares",
|
|
834
|
-
"scope": "Prowler 5.
|
|
1289
|
+
"scope": "Prowler 5.47.0 check storage_ensure_file_shares_soft_delete_is_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
835
1290
|
"evidenceType": "Configuration",
|
|
836
1291
|
"severity": "medium"
|
|
837
1292
|
},
|
|
838
1293
|
{
|
|
839
1294
|
"id": "prowler.azure.storage_ensure_minimum_tls_version_12",
|
|
840
1295
|
"title": "Storage account minimum TLS version is 1.2",
|
|
841
|
-
"scope": "Prowler 5.
|
|
1296
|
+
"scope": "Prowler 5.47.0 check storage_ensure_minimum_tls_version_12 (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1297
|
+
"evidenceType": "Configuration",
|
|
1298
|
+
"severity": "medium"
|
|
1299
|
+
},
|
|
1300
|
+
{
|
|
1301
|
+
"id": "prowler.azure.storage_ensure_private_endpoints_in_storage_accounts",
|
|
1302
|
+
"title": "Storage account has private endpoint connections",
|
|
1303
|
+
"scope": "Prowler 5.47.0 check storage_ensure_private_endpoints_in_storage_accounts (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
842
1304
|
"evidenceType": "Configuration",
|
|
843
1305
|
"severity": "medium"
|
|
844
1306
|
},
|
|
845
1307
|
{
|
|
846
1308
|
"id": "prowler.azure.storage_ensure_soft_delete_is_enabled",
|
|
847
1309
|
"title": "Storage account has soft delete for containers enabled",
|
|
848
|
-
"scope": "Prowler 5.
|
|
1310
|
+
"scope": "Prowler 5.47.0 check storage_ensure_soft_delete_is_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
849
1311
|
"evidenceType": "Configuration",
|
|
850
1312
|
"severity": "medium"
|
|
851
1313
|
},
|
|
852
1314
|
{
|
|
853
1315
|
"id": "prowler.azure.storage_geo_redundant_enabled",
|
|
854
1316
|
"title": "Azure Storage account uses geo-redundant replication (GRS, GZRS, RA-GRS, or RA-GZRS)",
|
|
855
|
-
"scope": "Prowler 5.
|
|
1317
|
+
"scope": "Prowler 5.47.0 check storage_geo_redundant_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
856
1318
|
"evidenceType": "Configuration",
|
|
857
1319
|
"severity": "medium"
|
|
858
1320
|
},
|
|
859
1321
|
{
|
|
860
1322
|
"id": "prowler.azure.storage_infrastructure_encryption_is_enabled",
|
|
861
1323
|
"title": "Storage account has infrastructure encryption enabled",
|
|
862
|
-
"scope": "Prowler 5.
|
|
1324
|
+
"scope": "Prowler 5.47.0 check storage_infrastructure_encryption_is_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
863
1325
|
"evidenceType": "Configuration",
|
|
864
1326
|
"severity": "low"
|
|
865
1327
|
},
|
|
866
1328
|
{
|
|
867
1329
|
"id": "prowler.azure.storage_key_rotation_90_days",
|
|
868
1330
|
"title": "Storage account has access key expiration period set to 90 days or less",
|
|
869
|
-
"scope": "Prowler 5.
|
|
1331
|
+
"scope": "Prowler 5.47.0 check storage_key_rotation_90_days (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
870
1332
|
"evidenceType": "Configuration",
|
|
871
1333
|
"severity": "medium"
|
|
872
1334
|
},
|
|
873
1335
|
{
|
|
874
1336
|
"id": "prowler.azure.storage_secure_transfer_required_is_enabled",
|
|
875
1337
|
"title": "Storage account has secure transfer required enabled",
|
|
876
|
-
"scope": "Prowler 5.
|
|
1338
|
+
"scope": "Prowler 5.47.0 check storage_secure_transfer_required_is_enabled (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
877
1339
|
"evidenceType": "Configuration",
|
|
878
1340
|
"severity": "high"
|
|
879
1341
|
},
|
|
880
1342
|
{
|
|
881
1343
|
"id": "prowler.azure.storage_smb_channel_encryption_with_secure_algorithm",
|
|
882
1344
|
"title": "Storage account uses AES-256-GCM for SMB channel encryption on file shares",
|
|
883
|
-
"scope": "Prowler 5.
|
|
1345
|
+
"scope": "Prowler 5.47.0 check storage_smb_channel_encryption_with_secure_algorithm (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1346
|
+
"evidenceType": "Configuration",
|
|
1347
|
+
"severity": "medium"
|
|
1348
|
+
},
|
|
1349
|
+
{
|
|
1350
|
+
"id": "prowler.azure.storage_smb_protocol_version_is_latest",
|
|
1351
|
+
"title": "Storage account allows only the latest SMB protocol version for file shares",
|
|
1352
|
+
"scope": "Prowler 5.47.0 check storage_smb_protocol_version_is_latest (Azure storage, resource type microsoft.storage/storageaccounts): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
884
1353
|
"evidenceType": "Configuration",
|
|
885
1354
|
"severity": "medium"
|
|
886
1355
|
},
|
|
887
1356
|
{
|
|
888
1357
|
"id": "prowler.azure.vm_backup_enabled",
|
|
889
1358
|
"title": "Virtual Machine is protected by Azure Backup",
|
|
890
|
-
"scope": "Prowler 5.
|
|
1359
|
+
"scope": "Prowler 5.47.0 check vm_backup_enabled (Azure vm, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
891
1360
|
"evidenceType": "Configuration",
|
|
892
1361
|
"severity": "high"
|
|
893
1362
|
},
|
|
1363
|
+
{
|
|
1364
|
+
"id": "prowler.azure.vm_desired_sku_size",
|
|
1365
|
+
"title": "Virtual Machine uses an organization-approved SKU size",
|
|
1366
|
+
"scope": "Prowler 5.47.0 check vm_desired_sku_size (Azure vm, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1367
|
+
"evidenceType": "Configuration",
|
|
1368
|
+
"severity": "medium"
|
|
1369
|
+
},
|
|
894
1370
|
{
|
|
895
1371
|
"id": "prowler.azure.vm_ensure_attached_disks_encrypted_with_cmk",
|
|
896
1372
|
"title": "Virtual Machine OS or data disk is encrypted with a customer-managed key (CMK)",
|
|
897
|
-
"scope": "Prowler 5.
|
|
1373
|
+
"scope": "Prowler 5.47.0 check vm_ensure_attached_disks_encrypted_with_cmk (Azure vm, resource type microsoft.compute/disks): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
898
1374
|
"evidenceType": "Configuration",
|
|
899
1375
|
"severity": "medium"
|
|
900
1376
|
},
|
|
901
1377
|
{
|
|
902
1378
|
"id": "prowler.azure.vm_ensure_unattached_disks_encrypted_with_cmk",
|
|
903
1379
|
"title": "Unattached disk is encrypted with a customer-managed key (CMK)",
|
|
904
|
-
"scope": "Prowler 5.
|
|
1380
|
+
"scope": "Prowler 5.47.0 check vm_ensure_unattached_disks_encrypted_with_cmk (Azure vm, resource type microsoft.compute/disks): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
905
1381
|
"evidenceType": "Configuration",
|
|
906
1382
|
"severity": "medium"
|
|
907
1383
|
},
|
|
1384
|
+
{
|
|
1385
|
+
"id": "prowler.azure.vm_ensure_using_approved_images",
|
|
1386
|
+
"title": "Virtual Machine uses an approved custom machine image",
|
|
1387
|
+
"scope": "Prowler 5.47.0 check vm_ensure_using_approved_images (Azure vm, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1388
|
+
"evidenceType": "Configuration",
|
|
1389
|
+
"severity": "high"
|
|
1390
|
+
},
|
|
1391
|
+
{
|
|
1392
|
+
"id": "prowler.azure.vm_ensure_using_managed_disks",
|
|
1393
|
+
"title": "Virtual Machine uses managed disks for OS and data disks",
|
|
1394
|
+
"scope": "Prowler 5.47.0 check vm_ensure_using_managed_disks (Azure vm, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1395
|
+
"evidenceType": "Configuration",
|
|
1396
|
+
"severity": "high"
|
|
1397
|
+
},
|
|
908
1398
|
{
|
|
909
1399
|
"id": "prowler.azure.vm_jit_access_enabled",
|
|
910
1400
|
"title": "Virtual Machine has Just-in-Time (JIT) access enabled",
|
|
911
|
-
"scope": "Prowler 5.
|
|
1401
|
+
"scope": "Prowler 5.47.0 check vm_jit_access_enabled (Azure vm, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
912
1402
|
"evidenceType": "Configuration",
|
|
913
1403
|
"severity": "medium"
|
|
914
1404
|
},
|
|
915
1405
|
{
|
|
916
1406
|
"id": "prowler.azure.vm_linux_enforce_ssh_authentication",
|
|
917
1407
|
"title": "Linux Virtual Machine has password authentication disabled (SSH key authentication enforced)",
|
|
918
|
-
"scope": "Prowler 5.
|
|
1408
|
+
"scope": "Prowler 5.47.0 check vm_linux_enforce_ssh_authentication (Azure vm, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
919
1409
|
"evidenceType": "Configuration",
|
|
920
1410
|
"severity": "high"
|
|
921
1411
|
},
|
|
922
1412
|
{
|
|
923
1413
|
"id": "prowler.azure.vm_scaleset_associated_with_load_balancer",
|
|
924
1414
|
"title": "Virtual Machine Scale Set is associated with a load balancer backend pool",
|
|
925
|
-
"scope": "Prowler 5.
|
|
1415
|
+
"scope": "Prowler 5.47.0 check vm_scaleset_associated_with_load_balancer (Azure vm, resource type microsoft.compute/virtualmachinescalesets): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
1416
|
+
"evidenceType": "Configuration",
|
|
1417
|
+
"severity": "medium"
|
|
1418
|
+
},
|
|
1419
|
+
{
|
|
1420
|
+
"id": "prowler.azure.vm_scaleset_not_empty",
|
|
1421
|
+
"title": "Virtual Machine Scale Set has at least one VM instance",
|
|
1422
|
+
"scope": "Prowler 5.47.0 check vm_scaleset_not_empty (Azure vm, resource type microsoft.compute/virtualmachinescalesets): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
926
1423
|
"evidenceType": "Configuration",
|
|
927
1424
|
"severity": "medium"
|
|
928
1425
|
},
|
|
929
1426
|
{
|
|
930
1427
|
"id": "prowler.azure.vm_sufficient_daily_backup_retention_period",
|
|
931
1428
|
"title": "Virtual Machine has a backup policy with a daily retention period meeting the configured minimum",
|
|
932
|
-
"scope": "Prowler 5.
|
|
1429
|
+
"scope": "Prowler 5.47.0 check vm_sufficient_daily_backup_retention_period (Azure vm, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
933
1430
|
"evidenceType": "Configuration",
|
|
934
1431
|
"severity": "medium"
|
|
935
1432
|
},
|
|
936
1433
|
{
|
|
937
1434
|
"id": "prowler.azure.vm_trusted_launch_enabled",
|
|
938
1435
|
"title": "Virtual Machine has Trusted Launch with Secure Boot and vTPM enabled",
|
|
939
|
-
"scope": "Prowler 5.
|
|
1436
|
+
"scope": "Prowler 5.47.0 check vm_trusted_launch_enabled (Azure vm, resource type microsoft.compute/virtualmachines): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
940
1437
|
"evidenceType": "Configuration",
|
|
941
1438
|
"severity": "medium"
|
|
942
1439
|
}
|