@sagentix-inc/evidence-collector 0.3.1 → 0.3.2

package/apps/sos-app/src/data/checks/prowler_okta.json

@@ -21,5 +21,209 @@
   "url": "https://github.com/prowler-cloud/prowler"
  },
  "provider": "okta",
- "checks": []
+ "checks": [
+  {
+   "id": "prowler.okta.apitoken_not_super_admin",
+   "title": "Okta API tokens are not owned by Super Admin users",
+   "scope": "Prowler 5.47.0 check apitoken_not_super_admin (Okta apitoken, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.apitoken_restricted_to_network_zone",
+   "title": "Okta API tokens are restricted to known Network Zones",
+   "scope": "Prowler 5.47.0 check apitoken_restricted_to_network_zone (Okta apitoken, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.application_admin_console_mfa_required",
+   "title": "Okta Admin Console authentication policy enforces multifactor authentication",
+   "scope": "Prowler 5.47.0 check application_admin_console_mfa_required (Okta application, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.okta.application_admin_console_phishing_resistant_authentication",
+   "title": "Okta Admin Console authentication policy enforces phishing-resistant factors",
+   "scope": "Prowler 5.47.0 check application_admin_console_phishing_resistant_authentication (Okta application, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.application_admin_console_session_idle_timeout_15min",
+   "title": "Okta Admin Console app session idle timeout is 15 minutes or less",
+   "scope": "Prowler 5.47.0 check application_admin_console_session_idle_timeout_15min (Okta application, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.application_authentication_policy_network_zone_enforced",
+   "title": "Okta application authentication policies enforce Network Zones",
+   "scope": "Prowler 5.47.0 check application_authentication_policy_network_zone_enforced (Okta application, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.application_dashboard_mfa_required",
+   "title": "Okta Dashboard authentication policy enforces multifactor authentication",
+   "scope": "Prowler 5.47.0 check application_dashboard_mfa_required (Okta application, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.okta.application_dashboard_phishing_resistant_authentication",
+   "title": "Okta Dashboard authentication policy enforces phishing-resistant factors",
+   "scope": "Prowler 5.47.0 check application_dashboard_phishing_resistant_authentication (Okta application, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.authenticator_okta_verify_fips_compliant",
+   "title": "Okta Verify authenticator is active and restricts enrollment to FIPS-compliant devices",
+   "scope": "Prowler 5.47.0 check authenticator_okta_verify_fips_compliant (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_common_password_check",
+   "title": "Every active Okta Password Policy rejects common passwords",
+   "scope": "Prowler 5.47.0 check authenticator_password_common_password_check (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_complexity_lowercase",
+   "title": "Every active Okta Password Policy requires at least one lowercase character",
+   "scope": "Prowler 5.47.0 check authenticator_password_complexity_lowercase (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_complexity_number",
+   "title": "Every active Okta Password Policy requires at least one numeric character",
+   "scope": "Prowler 5.47.0 check authenticator_password_complexity_number (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_complexity_symbol",
+   "title": "Every active Okta Password Policy requires at least one symbol character",
+   "scope": "Prowler 5.47.0 check authenticator_password_complexity_symbol (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_complexity_uppercase",
+   "title": "Every active Okta Password Policy requires at least one uppercase character",
+   "scope": "Prowler 5.47.0 check authenticator_password_complexity_uppercase (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_history_5",
+   "title": "Every active Okta Password Policy remembers at least 5 previous passwords",
+   "scope": "Prowler 5.47.0 check authenticator_password_history_5 (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_lockout_threshold_3",
+   "title": "Every active Okta Password Policy locks accounts after 3 or fewer failed attempts",
+   "scope": "Prowler 5.47.0 check authenticator_password_lockout_threshold_3 (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_maximum_age_60d",
+   "title": "Every active Okta Password Policy enforces a maximum password age of 60 days or less",
+   "scope": "Prowler 5.47.0 check authenticator_password_maximum_age_60d (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_minimum_age_24h",
+   "title": "Every active Okta Password Policy enforces a minimum password age of 24 hours",
+   "scope": "Prowler 5.47.0 check authenticator_password_minimum_age_24h (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "low"
+  },
+  {
+   "id": "prowler.okta.authenticator_password_minimum_length_15",
+   "title": "Every active Okta Password Policy enforces a minimum length of 15 characters",
+   "scope": "Prowler 5.47.0 check authenticator_password_minimum_length_15 (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.authenticator_smart_card_active",
+   "title": "Okta Smart Card IdP authenticator is configured and active",
+   "scope": "Prowler 5.47.0 check authenticator_smart_card_active (Okta authenticator, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.idp_smart_card_dod_approved_ca",
+   "title": "Okta Smart Card (X509) Identity Provider uses a DOD-approved certificate authority",
+   "scope": "Prowler 5.47.0 check idp_smart_card_dod_approved_ca (Okta idp, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.network_zone_block_anonymized_proxies",
+   "title": "Okta uses active Network Zone blocklists for anonymized proxy sources",
+   "scope": "Prowler 5.47.0 check network_zone_block_anonymized_proxies (Okta network, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.signon_dod_warning_banner_configured",
+   "title": "Okta sign-in page displays the Standard Mandatory DOD Notice and Consent Banner",
+   "scope": "Prowler 5.47.0 check signon_dod_warning_banner_configured (Okta signon, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "informational"
+  },
+  {
+   "id": "prowler.okta.signon_global_session_cookies_not_persistent",
+   "title": "Default Global Session Policy has a Priority 1 non-default rule disabling persistent global session cookies",
+   "scope": "Prowler 5.47.0 check signon_global_session_cookies_not_persistent (Okta signon, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.signon_global_session_idle_timeout_15min",
+   "title": "Default Global Session Policy has a Priority 1 non-default rule enforcing 15-minute idle timeout",
+   "scope": "Prowler 5.47.0 check signon_global_session_idle_timeout_15min (Okta signon, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.signon_global_session_lifetime_18h",
+   "title": "Default Global Session Policy has a Priority 1 non-default rule limiting session lifetime to 18 hours",
+   "scope": "Prowler 5.47.0 check signon_global_session_lifetime_18h (Okta signon, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.signon_global_session_policy_network_zone_enforced",
+   "title": "Default Global Session Policy applies a Network Zone condition aligned with the Access Control Policy",
+   "scope": "Prowler 5.47.0 check signon_global_session_policy_network_zone_enforced (Okta signon, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  },
+  {
+   "id": "prowler.okta.systemlog_streaming_enabled",
+   "title": "Okta off-loads audit records to a central log server via Log Streaming",
+   "scope": "Prowler 5.47.0 check systemlog_streaming_enabled (Okta systemlog, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "high"
+  },
+  {
+   "id": "prowler.okta.user_inactivity_automation_35d_enabled",
+   "title": "Okta automation suspends or deactivates users after 35 days of inactivity",
+   "scope": "Prowler 5.47.0 check user_inactivity_automation_35d_enabled (Okta user, resource type NotDefined): one result per resource Prowler evaluates; shows one setting, not the whole control.",
+   "evidenceType": "Configuration",
+   "severity": "medium"
+  }
+ ]
 }

package/collector/package.json

@@ -1,5 +1,5 @@
 {
   "name": "@sagentix-inc/evidence-collector",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "type": "module"
 }

package/collector/src/sources/prowler.js

@@ -31,6 +31,7 @@ export const REFUSED_ARGS = [
 ];
 /** Environment variables whose values never leave the machine, even if Prowler echoes them in a detail. */
 const SECRET_ENVS = [
+    "GITHUB_TOKEN", "CLOUDFLARE_API_TOKEN_READONLY", "ENTRA_CLIENT_SECRET", "M365_CERTIFICATE_CONTENT",
     "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AZURE_CLIENT_SECRET", "GITHUB_PERSONAL_ACCESS_TOKEN", "GITHUB_OAUTH_APP_TOKEN",
     "GITHUB_APP_KEY", "OKTA_PRIVATE_KEY", "CLOUDFLARE_API_TOKEN", "CLOUDFLARE_API_KEY", "GOOGLEWORKSPACE_CREDENTIALS_CONTENT",
 ];
@@ -43,7 +44,12 @@ function catalogIds(dir = DEFAULT_CATALOG_DIR) {
         return [];
     }
 }
-const one = (v) => (typeof v === "string" && v.trim() ? v.trim() : undefined);
+const one = (v) => {
+    const x = Array.isArray(v) ? v[0] : v;
+    return typeof x === "string" && x.trim() ? x.trim() : undefined;
+};
+/** --prowler-provider aws,azure or repeated, in order, without repeats. */
+const providersOf = (v) => [...new Set((Array.isArray(v) ? v : typeof v === "string" ? [v] : []).flatMap((x) => String(x).split(",")).map((x) => x.trim()).filter(Boolean))];
 /** Splits --prowler-args like a shell would for plain words and '…' or "…" quoting (no expansion). */
 export function splitArgs(s) {
     const out = [];
@@ -55,11 +61,22 @@ export function splitArgs(s) {
 }
 /** The provider's authentication flag, chosen from what the environment holds. Everything else Prowler reads from env itself. */
 export function authArgs(provider, env) {
+    // The generated workflow names what the collector's own source reads, so Prowler reads the same scope
+    // (Prowler 5.47.0: aws --region, azure --subscription-ids, gcp --project-ids).
+    const scope = (name, flag) => { const v = (env[name] ?? "").split(/\s+/).filter(Boolean); return v.length ? [flag, ...v] : []; };
     switch (provider) {
-        case "azure":
+        case "aws": return scope("SAGENTIX_PROWLER_AWS_REGIONS", "--region");
+        case "gcp": return scope("SAGENTIX_PROWLER_GCP_PROJECTS", "--project-ids");
         case "m365":
+            // A certificate signs in every Microsoft 365 service, Exchange and Teams included; a secret covers Graph only.
+            // --init-modules installs the PowerShell modules those services need (an ephemeral runner has none).
+            if (env.M365_CERTIFICATE_CONTENT)
+                return ["--certificate-auth", "--init-modules"];
+            return [...(env.AZURE_CLIENT_SECRET ? ["--sp-env-auth"] : ["--az-cli-auth"]), "--init-modules"];
+        case "azure":
             // A client secret in env: service principal; otherwise the session `azure/login` (OIDC) left for the az CLI.
-            return env.AZURE_CLIENT_SECRET ? ["--sp-env-auth"] : ["--az-cli-auth"];
+            return [...(env.AZURE_CLIENT_SECRET ? ["--sp-env-auth"] : ["--az-cli-auth"]),
+                ...(provider === "azure" ? scope("SAGENTIX_PROWLER_AZURE_SUBSCRIPTIONS", "--subscription-ids") : [])];
         case "kubernetes":
             return env.KUBECONFIG ? ["--kubeconfig-file", env.KUBECONFIG] : [];
         default:
@@ -68,6 +85,25 @@ export function authArgs(provider, env) {
             return [];
     }
 }
+/**
+ * Prowler reads its own variable names; the collector's native sources read theirs. So the same read-only credential
+ * the client already stored serves both ways (2026-11-01: each control collected at least two ways): the collector's
+ * name is copied to Prowler's when Prowler's is unset. Names from prowler/providers/<provider> in Prowler 5.47.0.
+ */
+export function prowlerEnv(provider, env) {
+    const alias = {
+        github: { GITHUB_PERSONAL_ACCESS_TOKEN: "GITHUB_TOKEN" },
+        cloudflare: { CLOUDFLARE_API_TOKEN: "CLOUDFLARE_API_TOKEN_READONLY" },
+        googleworkspace: { GOOGLEWORKSPACE_CREDENTIALS_FILE: "GOOGLE_SA_KEY_FILE", GOOGLEWORKSPACE_DELEGATED_USER: "GOOGLE_ADMIN_EMAIL" },
+        m365: { AZURE_TENANT_ID: "ENTRA_TENANT_ID", AZURE_CLIENT_ID: "ENTRA_CLIENT_ID", AZURE_CLIENT_SECRET: "ENTRA_CLIENT_SECRET" },
+        okta: { OKTA_ORG_DOMAIN: "OKTA_DOMAIN" },
+    };
+    const out = { ...env };
+    for (const [theirs, ours] of Object.entries(alias[provider] ?? {}))
+        if (!out[theirs] && env[ours])
+            out[theirs] = env[ours];
+    return out;
+}
 const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 const s = (v) => (typeof v === "string" ? v : "");
 const EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
@@ -184,44 +220,63 @@ export async function runProwler(provider, o) {
 export const prowler = {
     name: "prowler",
     options: {
-        "prowler-provider": { type: "string", help: `Prowler provider to run: ${PROWLER_PROVIDERS.join(", ")}` },
+        "prowler-provider": { type: "string", multiple: true, help: `Prowler providers to run, comma-separated: ${PROWLER_PROVIDERS.join(", ")} (one failing never stops the others)` },
         "prowler-bin": { type: "string", help: "the prowler executable (default prowler on PATH)" },
         "prowler-args": { type: "string", help: "extra Prowler options, written --prowler-args=\"--region us-east-1 ca-central-1\" (never output, send or fix options)" },
         "prowler-output": { type: "string", help: "read this json-ocsf file instead of running Prowler" },
     },
     emits: catalogIds(),
     describe(opts) {
-        const p = one(opts["prowler-provider"]) ?? "(no provider)";
+        const p = providersOf(opts["prowler-provider"]).join(", ") || "(no provider)";
         return one(opts["prowler-output"]) ? `Prowler ${p} findings from a json-ocsf file` : `Prowler ${PROWLER_VERSION} ${p} scan`;
     },
     async run(ctx) {
-        const provider = one(ctx.opts["prowler-provider"]);
-        if (!provider || !PROWLER_PROVIDERS.includes(provider)) {
-            throw new Error(`--prowler-provider is required: one of ${PROWLER_PROVIDERS.join(", ")}.`);
-        }
-        const known = new Set(catalogIds(one(ctx.opts.catalog) ?? DEFAULT_CATALOG_DIR));
-        if (![...known].some((id) => id.startsWith(`prowler.${provider}.`))) {
-            ctx.warn(`prowler: sos-app's catalogue lists no ${provider} check (Prowler maps none to a KSI or SP 800-53 control); every finding will be dropped.`);
+        const providers = providersOf(ctx.opts["prowler-provider"]);
+        const bad = providers.filter((p) => !PROWLER_PROVIDERS.includes(p));
+        if (!providers.length || bad.length) {
+            throw new Error(`--prowler-provider is required: one or more of ${PROWLER_PROVIDERS.join(", ")}${bad.length ? ` (not: ${bad.join(", ")})` : ""}.`);
         }
         const file = one(ctx.opts["prowler-output"]);
-        let text;
-        if (file) {
+        if (file && providers.length > 1)
+            throw new Error("--prowler-output reads one provider's file; name one --prowler-provider with it.");
+        const known = new Set(catalogIds(one(ctx.opts.catalog) ?? DEFAULT_CATALOG_DIR));
+        const results = [];
+        const failures = [];
+        for (const provider of providers) {
+            if (![...known].some((id) => id.startsWith(`prowler.${provider}.`))) {
+                ctx.warn(`prowler: sos-app's catalogue lists no ${provider} check; every finding will be dropped.`);
+            }
+            let text;
             try {
-                text = readFileSync(file, "utf8");
+                if (file) {
+                    try {
+                        text = readFileSync(file, "utf8");
+                    }
+                    catch (e) {
+                        throw new Error(`cannot read --prowler-output ${file}: ${e.code ?? String(e)}`);
+                    }
+                }
+                else {
+                    const spawner = ctx.clients.prowler ?? spawnProwler;
+                    const extra = one(ctx.opts["prowler-args"]) ? splitArgs(one(ctx.opts["prowler-args"])) : [];
+                    text = await runProwler(provider, { bin: one(ctx.opts["prowler-bin"]) ?? "prowler", extra, env: prowlerEnv(provider, ctx.env), spawner });
+                }
             }
             catch (e) {
-                throw new Error(`cannot read --prowler-output ${file}: ${e.code ?? String(e)}`);
+                // A second way that fails leaves the control to its other ways: say so and go on with the next provider.
+                failures.push(e);
+                if (providers.length > 1)
+                    ctx.warn(`prowler: ${provider} did not run (${e.message}); its controls keep their other ways.`);
+                continue;
             }
+            const { results: r, summary } = parseOcsf(text, provider, known);
+            results.push(...r);
+            ctx.warn(`prowler: ${summary.findings} findings; ${summary.kept} results (${summary.merged} merged into the same check and resource, ` +
+                `${summary.muted} muted and ${summary.manual} manual sent as skipped); ${summary.dropped} findings dropped from ${summary.droppedChecks.length} checks not in the catalogue` +
+                (summary.droppedChecks.length ? `: ${summary.droppedChecks.slice(0, 20).join(", ")}${summary.droppedChecks.length > 20 ? ", …" : ""}` : ""));
         }
-        else {
-            const spawner = ctx.clients.prowler ?? spawnProwler;
-            const extra = one(ctx.opts["prowler-args"]) ? splitArgs(one(ctx.opts["prowler-args"])) : [];
-            text = await runProwler(provider, { bin: one(ctx.opts["prowler-bin"]) ?? "prowler", extra, env: ctx.env, spawner });
-        }
-        const { results, summary } = parseOcsf(text, provider, known);
-        ctx.warn(`prowler: ${summary.findings} findings; ${summary.kept} results (${summary.merged} merged into the same check and resource, ` +
-            `${summary.muted} muted and ${summary.manual} manual sent as skipped); ${summary.dropped} findings dropped from ${summary.droppedChecks.length} checks not in the catalogue` +
-            (summary.droppedChecks.length ? `: ${summary.droppedChecks.slice(0, 20).join(", ")}${summary.droppedChecks.length > 20 ? ", …" : ""}` : ""));
+        if (failures.length === providers.length)
+            throw failures[0];
         return scrub(results, SECRET_ENVS.map((n) => ctx.env[n]));
     },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sagentix-inc/evidence-collector",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Customer-side evidence collector: reads systems read-only, runs checks, signs the results and pushes them outbound to sos-app.",
   "type": "module",
   "engines": {