@sagentix-inc/evidence-collector 0.3.1 → 0.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/apps/sos-app/src/data/checks/prowler_aws.json +1455 -34
- package/apps/sos-app/src/data/checks/prowler_azure.json +497 -0
- package/apps/sos-app/src/data/checks/prowler_cloudflare.json +205 -1
- package/apps/sos-app/src/data/checks/prowler_gcp.json +175 -0
- package/apps/sos-app/src/data/checks/prowler_github.json +191 -1
- package/apps/sos-app/src/data/checks/prowler_googleworkspace.json +457 -1
- package/apps/sos-app/src/data/checks/prowler_kubernetes.json +133 -0
- package/apps/sos-app/src/data/checks/prowler_m365.json +574 -0
- package/apps/sos-app/src/data/checks/prowler_okta.json +205 -1
- package/collector/package.json +1 -1
- package/collector/src/sources/prowler.js +80 -25
- package/package.json +1 -1
|
@@ -17,5 +17,209 @@
|
|
|
17
17
|
"url": "https://github.com/prowler-cloud/prowler"
|
|
18
18
|
},
|
|
19
19
|
"provider": "cloudflare",
|
|
20
|
-
"checks": [
|
|
20
|
+
"checks": [
|
|
21
|
+
{
|
|
22
|
+
"id": "prowler.cloudflare.dns_record_cname_target_valid",
|
|
23
|
+
"title": "DNS records pointing to hostnames have valid targets without takeover risk",
|
|
24
|
+
"scope": "Prowler 5.47.0 check dns_record_cname_target_valid (Cloudflare dns, resource type DNSRecord): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
25
|
+
"evidenceType": "Configuration",
|
|
26
|
+
"severity": "high"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "prowler.cloudflare.dns_record_no_internal_ip",
|
|
30
|
+
"title": "DNS records do not expose internal IP addresses",
|
|
31
|
+
"scope": "Prowler 5.47.0 check dns_record_no_internal_ip (Cloudflare dns, resource type DNSRecord): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
32
|
+
"evidenceType": "Configuration",
|
|
33
|
+
"severity": "high"
|
|
34
|
+
},
|
|
35
|
+
{
|
|
36
|
+
"id": "prowler.cloudflare.dns_record_no_wildcard",
|
|
37
|
+
"title": "DNS records do not use wildcard entries",
|
|
38
|
+
"scope": "Prowler 5.47.0 check dns_record_no_wildcard (Cloudflare dns, resource type DNSRecord): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
39
|
+
"evidenceType": "Configuration",
|
|
40
|
+
"severity": "medium"
|
|
41
|
+
},
|
|
42
|
+
{
|
|
43
|
+
"id": "prowler.cloudflare.dns_record_proxied",
|
|
44
|
+
"title": "Cloudflare proxy is enabled for applicable DNS records",
|
|
45
|
+
"scope": "Prowler 5.47.0 check dns_record_proxied (Cloudflare dns, resource type DNSRecord): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
46
|
+
"evidenceType": "Configuration",
|
|
47
|
+
"severity": "medium"
|
|
48
|
+
},
|
|
49
|
+
{
|
|
50
|
+
"id": "prowler.cloudflare.zone_always_online_disabled",
|
|
51
|
+
"title": "Always Online is disabled",
|
|
52
|
+
"scope": "Prowler 5.47.0 check zone_always_online_disabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
53
|
+
"evidenceType": "Configuration",
|
|
54
|
+
"severity": "high"
|
|
55
|
+
},
|
|
56
|
+
{
|
|
57
|
+
"id": "prowler.cloudflare.zone_automatic_https_rewrites_enabled",
|
|
58
|
+
"title": "Automatic HTTPS Rewrites is enabled",
|
|
59
|
+
"scope": "Prowler 5.47.0 check zone_automatic_https_rewrites_enabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
60
|
+
"evidenceType": "Configuration",
|
|
61
|
+
"severity": "medium"
|
|
62
|
+
},
|
|
63
|
+
{
|
|
64
|
+
"id": "prowler.cloudflare.zone_bot_fight_mode_enabled",
|
|
65
|
+
"title": "Bot Fight Mode is enabled",
|
|
66
|
+
"scope": "Prowler 5.47.0 check zone_bot_fight_mode_enabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
67
|
+
"evidenceType": "Configuration",
|
|
68
|
+
"severity": "medium"
|
|
69
|
+
},
|
|
70
|
+
{
|
|
71
|
+
"id": "prowler.cloudflare.zone_browser_integrity_check_enabled",
|
|
72
|
+
"title": "Cloudflare Zone Browser Integrity Check Is Enabled",
|
|
73
|
+
"scope": "Prowler 5.47.0 check zone_browser_integrity_check_enabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
74
|
+
"evidenceType": "Configuration",
|
|
75
|
+
"severity": "low"
|
|
76
|
+
},
|
|
77
|
+
{
|
|
78
|
+
"id": "prowler.cloudflare.zone_challenge_passage_configured",
|
|
79
|
+
"title": "Cloudflare Zone Challenge Passage Is Configured Between 15 and 45 Minutes",
|
|
80
|
+
"scope": "Prowler 5.47.0 check zone_challenge_passage_configured (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
81
|
+
"evidenceType": "Configuration",
|
|
82
|
+
"severity": "low"
|
|
83
|
+
},
|
|
84
|
+
{
|
|
85
|
+
"id": "prowler.cloudflare.zone_development_mode_disabled",
|
|
86
|
+
"title": "Development mode is disabled for production zones",
|
|
87
|
+
"scope": "Prowler 5.47.0 check zone_development_mode_disabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
88
|
+
"evidenceType": "Configuration",
|
|
89
|
+
"severity": "low"
|
|
90
|
+
},
|
|
91
|
+
{
|
|
92
|
+
"id": "prowler.cloudflare.zone_dnssec_enabled",
|
|
93
|
+
"title": "DNSSEC is enabled",
|
|
94
|
+
"scope": "Prowler 5.47.0 check zone_dnssec_enabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
95
|
+
"evidenceType": "Configuration",
|
|
96
|
+
"severity": "high"
|
|
97
|
+
},
|
|
98
|
+
{
|
|
99
|
+
"id": "prowler.cloudflare.zone_email_obfuscation_enabled",
|
|
100
|
+
"title": "Email Obfuscation is enabled",
|
|
101
|
+
"scope": "Prowler 5.47.0 check zone_email_obfuscation_enabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
102
|
+
"evidenceType": "Configuration",
|
|
103
|
+
"severity": "low"
|
|
104
|
+
},
|
|
105
|
+
{
|
|
106
|
+
"id": "prowler.cloudflare.zone_firewall_blocking_rules_configured",
|
|
107
|
+
"title": "Cloudflare Zone Firewall Rules Use Blocking Actions to Protect Against Threats",
|
|
108
|
+
"scope": "Prowler 5.47.0 check zone_firewall_blocking_rules_configured (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
109
|
+
"evidenceType": "Configuration",
|
|
110
|
+
"severity": "medium"
|
|
111
|
+
},
|
|
112
|
+
{
|
|
113
|
+
"id": "prowler.cloudflare.zone_hotlink_protection_enabled",
|
|
114
|
+
"title": "Hotlink Protection is enabled",
|
|
115
|
+
"scope": "Prowler 5.47.0 check zone_hotlink_protection_enabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
116
|
+
"evidenceType": "Configuration",
|
|
117
|
+
"severity": "low"
|
|
118
|
+
},
|
|
119
|
+
{
|
|
120
|
+
"id": "prowler.cloudflare.zone_hsts_enabled",
|
|
121
|
+
"title": "HSTS is enabled with recommended max-age and includes subdomains",
|
|
122
|
+
"scope": "Prowler 5.47.0 check zone_hsts_enabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
123
|
+
"evidenceType": "Configuration",
|
|
124
|
+
"severity": "high"
|
|
125
|
+
},
|
|
126
|
+
{
|
|
127
|
+
"id": "prowler.cloudflare.zone_https_redirect_enabled",
|
|
128
|
+
"title": "Always Use HTTPS is enabled",
|
|
129
|
+
"scope": "Prowler 5.47.0 check zone_https_redirect_enabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
130
|
+
"evidenceType": "Configuration",
|
|
131
|
+
"severity": "medium"
|
|
132
|
+
},
|
|
133
|
+
{
|
|
134
|
+
"id": "prowler.cloudflare.zone_ip_geolocation_enabled",
|
|
135
|
+
"title": "IP Geolocation is enabled",
|
|
136
|
+
"scope": "Prowler 5.47.0 check zone_ip_geolocation_enabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
137
|
+
"evidenceType": "Configuration",
|
|
138
|
+
"severity": "low"
|
|
139
|
+
},
|
|
140
|
+
{
|
|
141
|
+
"id": "prowler.cloudflare.zone_min_tls_version_secure",
|
|
142
|
+
"title": "Minimum TLS version is set to 1.2 or higher",
|
|
143
|
+
"scope": "Prowler 5.47.0 check zone_min_tls_version_secure (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
144
|
+
"evidenceType": "Configuration",
|
|
145
|
+
"severity": "high"
|
|
146
|
+
},
|
|
147
|
+
{
|
|
148
|
+
"id": "prowler.cloudflare.zone_rate_limiting_enabled",
|
|
149
|
+
"title": "Rate limiting is configured for the zone",
|
|
150
|
+
"scope": "Prowler 5.47.0 check zone_rate_limiting_enabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
151
|
+
"evidenceType": "Configuration",
|
|
152
|
+
"severity": "high"
|
|
153
|
+
},
|
|
154
|
+
{
|
|
155
|
+
"id": "prowler.cloudflare.zone_record_caa_exists",
|
|
156
|
+
"title": "CAA record exists with issue or issuewild tag",
|
|
157
|
+
"scope": "Prowler 5.47.0 check zone_record_caa_exists (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
158
|
+
"evidenceType": "Configuration",
|
|
159
|
+
"severity": "low"
|
|
160
|
+
},
|
|
161
|
+
{
|
|
162
|
+
"id": "prowler.cloudflare.zone_record_dkim_exists",
|
|
163
|
+
"title": "DKIM record exists with valid public key",
|
|
164
|
+
"scope": "Prowler 5.47.0 check zone_record_dkim_exists (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
165
|
+
"evidenceType": "Configuration",
|
|
166
|
+
"severity": "medium"
|
|
167
|
+
},
|
|
168
|
+
{
|
|
169
|
+
"id": "prowler.cloudflare.zone_record_dmarc_exists",
|
|
170
|
+
"title": "DMARC record exists with enforcement policy (p=reject or p=quarantine)",
|
|
171
|
+
"scope": "Prowler 5.47.0 check zone_record_dmarc_exists (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
172
|
+
"evidenceType": "Configuration",
|
|
173
|
+
"severity": "medium"
|
|
174
|
+
},
|
|
175
|
+
{
|
|
176
|
+
"id": "prowler.cloudflare.zone_record_spf_exists",
|
|
177
|
+
"title": "SPF record exists with strict policy (-all)",
|
|
178
|
+
"scope": "Prowler 5.47.0 check zone_record_spf_exists (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
179
|
+
"evidenceType": "Configuration",
|
|
180
|
+
"severity": "medium"
|
|
181
|
+
},
|
|
182
|
+
{
|
|
183
|
+
"id": "prowler.cloudflare.zone_security_under_attack_disabled",
|
|
184
|
+
"title": "Under Attack Mode is disabled during normal operations",
|
|
185
|
+
"scope": "Prowler 5.47.0 check zone_security_under_attack_disabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
186
|
+
"evidenceType": "Configuration",
|
|
187
|
+
"severity": "low"
|
|
188
|
+
},
|
|
189
|
+
{
|
|
190
|
+
"id": "prowler.cloudflare.zone_ssl_strict",
|
|
191
|
+
"title": "SSL/TLS encryption mode is set to Full (Strict)",
|
|
192
|
+
"scope": "Prowler 5.47.0 check zone_ssl_strict (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
193
|
+
"evidenceType": "Configuration",
|
|
194
|
+
"severity": "high"
|
|
195
|
+
},
|
|
196
|
+
{
|
|
197
|
+
"id": "prowler.cloudflare.zone_tls_1_3_enabled",
|
|
198
|
+
"title": "TLS 1.3 is enabled",
|
|
199
|
+
"scope": "Prowler 5.47.0 check zone_tls_1_3_enabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
200
|
+
"evidenceType": "Configuration",
|
|
201
|
+
"severity": "medium"
|
|
202
|
+
},
|
|
203
|
+
{
|
|
204
|
+
"id": "prowler.cloudflare.zone_universal_ssl_enabled",
|
|
205
|
+
"title": "Universal SSL is enabled",
|
|
206
|
+
"scope": "Prowler 5.47.0 check zone_universal_ssl_enabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
207
|
+
"evidenceType": "Configuration",
|
|
208
|
+
"severity": "high"
|
|
209
|
+
},
|
|
210
|
+
{
|
|
211
|
+
"id": "prowler.cloudflare.zone_waf_enabled",
|
|
212
|
+
"title": "WAF is enabled",
|
|
213
|
+
"scope": "Prowler 5.47.0 check zone_waf_enabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
214
|
+
"evidenceType": "Configuration",
|
|
215
|
+
"severity": "high"
|
|
216
|
+
},
|
|
217
|
+
{
|
|
218
|
+
"id": "prowler.cloudflare.zone_waf_owasp_ruleset_enabled",
|
|
219
|
+
"title": "Cloudflare Zone OWASP Managed WAF Rulesets Are Enabled",
|
|
220
|
+
"scope": "Prowler 5.47.0 check zone_waf_owasp_ruleset_enabled (Cloudflare zone, resource type Zone): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
221
|
+
"evidenceType": "Configuration",
|
|
222
|
+
"severity": "high"
|
|
223
|
+
}
|
|
224
|
+
]
|
|
21
225
|
}
|
|
@@ -14,6 +14,13 @@
|
|
|
14
14
|
},
|
|
15
15
|
"provider": "gcp",
|
|
16
16
|
"checks": [
|
|
17
|
+
{
|
|
18
|
+
"id": "prowler.gcp.apikeys_api_restricted_with_gemini_api",
|
|
19
|
+
"title": "API key is restricted to specific Google APIs when the Gemini (Generative Language) API is enabled",
|
|
20
|
+
"scope": "Prowler 5.47.0 check apikeys_api_restricted_with_gemini_api (Google Cloud apikeys, resource type apikeys.googleapis.com/Key): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
21
|
+
"evidenceType": "Configuration",
|
|
22
|
+
"severity": "high"
|
|
23
|
+
},
|
|
17
24
|
{
|
|
18
25
|
"id": "prowler.gcp.apikeys_api_restrictions_configured",
|
|
19
26
|
"title": "API key is restricted to specific Google APIs",
|
|
@@ -105,6 +112,20 @@
|
|
|
105
112
|
"evidenceType": "Configuration",
|
|
106
113
|
"severity": "medium"
|
|
107
114
|
},
|
|
115
|
+
{
|
|
116
|
+
"id": "prowler.gcp.cloudsql_instance_mysql_local_infile_flag",
|
|
117
|
+
"title": "Cloud SQL MySQL instance has the local_infile database flag set to off",
|
|
118
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_mysql_local_infile_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
119
|
+
"evidenceType": "Configuration",
|
|
120
|
+
"severity": "high"
|
|
121
|
+
},
|
|
122
|
+
{
|
|
123
|
+
"id": "prowler.gcp.cloudsql_instance_mysql_skip_show_database_flag",
|
|
124
|
+
"title": "Cloud SQL MySQL instance has skip_show_database flag set to on",
|
|
125
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_mysql_skip_show_database_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
126
|
+
"evidenceType": "Configuration",
|
|
127
|
+
"severity": "low"
|
|
128
|
+
},
|
|
108
129
|
{
|
|
109
130
|
"id": "prowler.gcp.cloudsql_instance_postgres_enable_pgaudit_flag",
|
|
110
131
|
"title": "Cloud SQL PostgreSQL instance has 'cloudsql.enable_pgaudit' flag set to 'on'",
|
|
@@ -182,6 +203,13 @@
|
|
|
182
203
|
"evidenceType": "Configuration",
|
|
183
204
|
"severity": "high"
|
|
184
205
|
},
|
|
206
|
+
{
|
|
207
|
+
"id": "prowler.gcp.cloudsql_instance_sqlserver_contained_database_authentication_flag",
|
|
208
|
+
"title": "Cloud SQL for SQL Server instance has 'contained database authentication' flag set to off",
|
|
209
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_sqlserver_contained_database_authentication_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
210
|
+
"evidenceType": "Configuration",
|
|
211
|
+
"severity": "medium"
|
|
212
|
+
},
|
|
185
213
|
{
|
|
186
214
|
"id": "prowler.gcp.cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag",
|
|
187
215
|
"title": "Cloud SQL SQL Server instance has 'cross db ownership chaining' flag set to off",
|
|
@@ -210,6 +238,20 @@
|
|
|
210
238
|
"evidenceType": "Configuration",
|
|
211
239
|
"severity": "medium"
|
|
212
240
|
},
|
|
241
|
+
{
|
|
242
|
+
"id": "prowler.gcp.cloudsql_instance_sqlserver_user_connections_flag",
|
|
243
|
+
"title": "Cloud SQL SQL Server instance has the 'user connections' database flag set to 0",
|
|
244
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_sqlserver_user_connections_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
245
|
+
"evidenceType": "Configuration",
|
|
246
|
+
"severity": "medium"
|
|
247
|
+
},
|
|
248
|
+
{
|
|
249
|
+
"id": "prowler.gcp.cloudsql_instance_sqlserver_user_options_flag",
|
|
250
|
+
"title": "Cloud SQL for SQL Server instance does not have the 'user options' flag configured",
|
|
251
|
+
"scope": "Prowler 5.47.0 check cloudsql_instance_sqlserver_user_options_flag (Google Cloud cloudsql, resource type sqladmin.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
252
|
+
"evidenceType": "Configuration",
|
|
253
|
+
"severity": "medium"
|
|
254
|
+
},
|
|
213
255
|
{
|
|
214
256
|
"id": "prowler.gcp.cloudsql_instance_ssl_connections",
|
|
215
257
|
"title": "Cloud SQL database instance requires SSL for all incoming connections",
|
|
@@ -224,6 +266,13 @@
|
|
|
224
266
|
"evidenceType": "Configuration",
|
|
225
267
|
"severity": "medium"
|
|
226
268
|
},
|
|
269
|
+
{
|
|
270
|
+
"id": "prowler.gcp.cloudstorage_bucket_lifecycle_management_enabled",
|
|
271
|
+
"title": "Cloud Storage bucket has lifecycle management enabled with at least one valid rule",
|
|
272
|
+
"scope": "Prowler 5.47.0 check cloudstorage_bucket_lifecycle_management_enabled (Google Cloud cloudstorage, resource type storage.googleapis.com/Bucket): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
273
|
+
"evidenceType": "Configuration",
|
|
274
|
+
"severity": "low"
|
|
275
|
+
},
|
|
227
276
|
{
|
|
228
277
|
"id": "prowler.gcp.cloudstorage_bucket_log_retention_policy_lock",
|
|
229
278
|
"title": "Cloud Storage log sink bucket has a retention policy with Bucket Lock enabled",
|
|
@@ -336,6 +385,20 @@
|
|
|
336
385
|
"evidenceType": "Configuration",
|
|
337
386
|
"severity": "medium"
|
|
338
387
|
},
|
|
388
|
+
{
|
|
389
|
+
"id": "prowler.gcp.compute_instance_deletion_protection_enabled",
|
|
390
|
+
"title": "VM instance has deletion protection enabled",
|
|
391
|
+
"scope": "Prowler 5.47.0 check compute_instance_deletion_protection_enabled (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
392
|
+
"evidenceType": "Configuration",
|
|
393
|
+
"severity": "medium"
|
|
394
|
+
},
|
|
395
|
+
{
|
|
396
|
+
"id": "prowler.gcp.compute_instance_disk_auto_delete_disabled",
|
|
397
|
+
"title": "VM instance attached disks have auto-delete disabled",
|
|
398
|
+
"scope": "Prowler 5.47.0 check compute_instance_disk_auto_delete_disabled (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
399
|
+
"evidenceType": "Configuration",
|
|
400
|
+
"severity": "medium"
|
|
401
|
+
},
|
|
339
402
|
{
|
|
340
403
|
"id": "prowler.gcp.compute_instance_encryption_with_csek_enabled",
|
|
341
404
|
"title": "VM instance has all disks encrypted with Customer-Supplied Encryption Keys (CSEK)",
|
|
@@ -392,6 +455,13 @@
|
|
|
392
455
|
"evidenceType": "Configuration",
|
|
393
456
|
"severity": "high"
|
|
394
457
|
},
|
|
458
|
+
{
|
|
459
|
+
"id": "prowler.gcp.compute_instance_serial_ports_in_use",
|
|
460
|
+
"title": "VM instance has 'Enable Connecting to Serial Ports' disabled",
|
|
461
|
+
"scope": "Prowler 5.47.0 check compute_instance_serial_ports_in_use (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
462
|
+
"evidenceType": "Configuration",
|
|
463
|
+
"severity": "medium"
|
|
464
|
+
},
|
|
395
465
|
{
|
|
396
466
|
"id": "prowler.gcp.compute_instance_shielded_vm_enabled",
|
|
397
467
|
"title": "Compute instance has vTPM and Integrity Monitoring enabled",
|
|
@@ -406,6 +476,13 @@
|
|
|
406
476
|
"evidenceType": "Configuration",
|
|
407
477
|
"severity": "medium"
|
|
408
478
|
},
|
|
479
|
+
{
|
|
480
|
+
"id": "prowler.gcp.compute_instance_suspended_without_persistent_disks",
|
|
481
|
+
"title": "Suspended VM instance does not have persistent disks attached",
|
|
482
|
+
"scope": "Prowler 5.47.0 check compute_instance_suspended_without_persistent_disks (Google Cloud compute, resource type compute.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
483
|
+
"evidenceType": "Configuration",
|
|
484
|
+
"severity": "medium"
|
|
485
|
+
},
|
|
409
486
|
{
|
|
410
487
|
"id": "prowler.gcp.compute_loadbalancer_logging_enabled",
|
|
411
488
|
"title": "HTTP(S) load balancer has logging enabled",
|
|
@@ -427,6 +504,41 @@
|
|
|
427
504
|
"evidenceType": "Configuration",
|
|
428
505
|
"severity": "medium"
|
|
429
506
|
},
|
|
507
|
+
{
|
|
508
|
+
"id": "prowler.gcp.compute_network_not_legacy",
|
|
509
|
+
"title": "VPC network is not legacy",
|
|
510
|
+
"scope": "Prowler 5.47.0 check compute_network_not_legacy (Google Cloud compute, resource type compute.googleapis.com/Network): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
511
|
+
"evidenceType": "Configuration",
|
|
512
|
+
"severity": "medium"
|
|
513
|
+
},
|
|
514
|
+
{
|
|
515
|
+
"id": "prowler.gcp.compute_project_os_login_2fa_enabled",
|
|
516
|
+
"title": "GCP project has OS Login with 2FA enabled",
|
|
517
|
+
"scope": "Prowler 5.47.0 check compute_project_os_login_2fa_enabled (Google Cloud compute, resource type compute.googleapis.com/Project): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
518
|
+
"evidenceType": "Configuration",
|
|
519
|
+
"severity": "high"
|
|
520
|
+
},
|
|
521
|
+
{
|
|
522
|
+
"id": "prowler.gcp.compute_project_os_login_enabled",
|
|
523
|
+
"title": "Project has OS Login enabled",
|
|
524
|
+
"scope": "Prowler 5.47.0 check compute_project_os_login_enabled (Google Cloud compute, resource type compute.googleapis.com/Project): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
525
|
+
"evidenceType": "Configuration",
|
|
526
|
+
"severity": "low"
|
|
527
|
+
},
|
|
528
|
+
{
|
|
529
|
+
"id": "prowler.gcp.compute_public_address_shodan",
|
|
530
|
+
"title": "Public IP address is not listed in Shodan",
|
|
531
|
+
"scope": "Prowler 5.47.0 check compute_public_address_shodan (Google Cloud compute, resource type compute.googleapis.com/Address): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
532
|
+
"evidenceType": "Configuration",
|
|
533
|
+
"severity": "medium"
|
|
534
|
+
},
|
|
535
|
+
{
|
|
536
|
+
"id": "prowler.gcp.compute_snapshot_not_outdated",
|
|
537
|
+
"title": "Compute Engine disk snapshot is not outdated",
|
|
538
|
+
"scope": "Prowler 5.47.0 check compute_snapshot_not_outdated (Google Cloud compute, resource type compute.googleapis.com/Snapshot): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
539
|
+
"evidenceType": "Configuration",
|
|
540
|
+
"severity": "low"
|
|
541
|
+
},
|
|
430
542
|
{
|
|
431
543
|
"id": "prowler.gcp.compute_subnet_flow_logs_enabled",
|
|
432
544
|
"title": "Subnet has VPC Flow Logs enabled",
|
|
@@ -469,6 +581,27 @@
|
|
|
469
581
|
"evidenceType": "Configuration",
|
|
470
582
|
"severity": "medium"
|
|
471
583
|
},
|
|
584
|
+
{
|
|
585
|
+
"id": "prowler.gcp.gemini_api_disabled",
|
|
586
|
+
"title": "Gemini (Generative Language) API is disabled",
|
|
587
|
+
"scope": "Prowler 5.47.0 check gemini_api_disabled (Google Cloud gemini, resource type serviceusage.googleapis.com/Service): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
588
|
+
"evidenceType": "Configuration",
|
|
589
|
+
"severity": "medium"
|
|
590
|
+
},
|
|
591
|
+
{
|
|
592
|
+
"id": "prowler.gcp.gke_cluster_no_default_service_account",
|
|
593
|
+
"title": "GKE cluster does not use the Compute Engine default service account",
|
|
594
|
+
"scope": "Prowler 5.47.0 check gke_cluster_no_default_service_account (Google Cloud gke, resource type container.googleapis.com/Cluster): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
595
|
+
"evidenceType": "Configuration",
|
|
596
|
+
"severity": "medium"
|
|
597
|
+
},
|
|
598
|
+
{
|
|
599
|
+
"id": "prowler.gcp.iam_account_access_approval_enabled",
|
|
600
|
+
"title": "Project has Access Approval enabled",
|
|
601
|
+
"scope": "Prowler 5.47.0 check iam_account_access_approval_enabled (Google Cloud iam, resource type accessapproval.googleapis.com/AccessApprovalSettings): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
602
|
+
"evidenceType": "Configuration",
|
|
603
|
+
"severity": "high"
|
|
604
|
+
},
|
|
472
605
|
{
|
|
473
606
|
"id": "prowler.gcp.iam_audit_logs_enabled",
|
|
474
607
|
"title": "GCP project has Cloud Audit Logs enabled",
|
|
@@ -490,6 +623,13 @@
|
|
|
490
623
|
"evidenceType": "Configuration",
|
|
491
624
|
"severity": "medium"
|
|
492
625
|
},
|
|
626
|
+
{
|
|
627
|
+
"id": "prowler.gcp.iam_organization_essential_contacts_configured",
|
|
628
|
+
"title": "Organization has Essential Contacts configured",
|
|
629
|
+
"scope": "Prowler 5.47.0 check iam_organization_essential_contacts_configured (Google Cloud iam, resource type cloudresourcemanager.googleapis.com/Organization): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
630
|
+
"evidenceType": "Configuration",
|
|
631
|
+
"severity": "medium"
|
|
632
|
+
},
|
|
493
633
|
{
|
|
494
634
|
"id": "prowler.gcp.iam_role_kms_enforce_separation_of_duties",
|
|
495
635
|
"title": "Project members are not assigned both Cloud KMS Admin and CryptoKey Encrypter/Decrypter roles",
|
|
@@ -650,6 +790,41 @@
|
|
|
650
790
|
"scope": "Prowler 5.47.0 check secretmanager_secret_rotation_enabled (Google Cloud secretmanager, resource type secretmanager.googleapis.com/Secret): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
651
791
|
"evidenceType": "Configuration",
|
|
652
792
|
"severity": "medium"
|
|
793
|
+
},
|
|
794
|
+
{
|
|
795
|
+
"id": "prowler.gcp.vertexai_workbench_instance_auto_upgrade_enabled",
|
|
796
|
+
"title": "Vertex AI Workbench instance has automatic upgrades scheduled",
|
|
797
|
+
"scope": "Prowler 5.47.0 check vertexai_workbench_instance_auto_upgrade_enabled (Google Cloud vertexai, resource type notebooks.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
798
|
+
"evidenceType": "Configuration",
|
|
799
|
+
"severity": "low"
|
|
800
|
+
},
|
|
801
|
+
{
|
|
802
|
+
"id": "prowler.gcp.vertexai_workbench_instance_file_download_disabled",
|
|
803
|
+
"title": "Vertex AI Workbench instance has file downloads disabled",
|
|
804
|
+
"scope": "Prowler 5.47.0 check vertexai_workbench_instance_file_download_disabled (Google Cloud vertexai, resource type notebooks.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
805
|
+
"evidenceType": "Configuration",
|
|
806
|
+
"severity": "medium"
|
|
807
|
+
},
|
|
808
|
+
{
|
|
809
|
+
"id": "prowler.gcp.vertexai_workbench_instance_public_ip_disabled",
|
|
810
|
+
"title": "Vertex AI Workbench instance does not have a public IP address",
|
|
811
|
+
"scope": "Prowler 5.47.0 check vertexai_workbench_instance_public_ip_disabled (Google Cloud vertexai, resource type notebooks.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
812
|
+
"evidenceType": "Configuration",
|
|
813
|
+
"severity": "high"
|
|
814
|
+
},
|
|
815
|
+
{
|
|
816
|
+
"id": "prowler.gcp.vertexai_workbench_instance_root_access_disabled",
|
|
817
|
+
"title": "Vertex AI Workbench instance has root access disabled",
|
|
818
|
+
"scope": "Prowler 5.47.0 check vertexai_workbench_instance_root_access_disabled (Google Cloud vertexai, resource type notebooks.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
819
|
+
"evidenceType": "Configuration",
|
|
820
|
+
"severity": "medium"
|
|
821
|
+
},
|
|
822
|
+
{
|
|
823
|
+
"id": "prowler.gcp.vertexai_workbench_instance_terminal_access_disabled",
|
|
824
|
+
"title": "Vertex AI Workbench instance has terminal access disabled",
|
|
825
|
+
"scope": "Prowler 5.47.0 check vertexai_workbench_instance_terminal_access_disabled (Google Cloud vertexai, resource type notebooks.googleapis.com/Instance): one result per resource Prowler evaluates; shows one setting, not the whole control.",
|
|
826
|
+
"evidenceType": "Configuration",
|
|
827
|
+
"severity": "medium"
|
|
653
828
|
}
|
|
654
829
|
]
|
|
655
830
|
}
|