prowler-cloud 5.12.2__py3-none-any.whl → 5.13.0__py3-none-any.whl

prowler/providers/oraclecloud/services/logging/logging_client.py

@@ -0,0 +1,6 @@
+"""OCI Logging Client Module."""
+
+from prowler.providers.common.provider import Provider
+from prowler.providers.oraclecloud.services.logging.logging_service import Logging
+
+logging_client = Logging(Provider.get_global_provider())

prowler/providers/oraclecloud/services/logging/logging_service.py

@@ -0,0 +1,189 @@
+"""OCI Logging Service Module."""
+
+from datetime import datetime
+from typing import Optional
+
+import oci
+from pydantic import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.oraclecloud.lib.service.service import OCIService
+
+
+class Logging(OCIService):
+    """OCI Logging Service class to retrieve log groups and logs."""
+
+    def __init__(self, provider):
+        """
+        Initialize the Logging service.
+
+        Args:
+            provider: The OCI provider instance
+        """
+        super().__init__("logging", provider)
+        self.log_groups = []
+        self.logs = []
+        self.__threading_call_by_region_and_compartment__(self.__list_log_groups__)
+        self.__threading_call_by_region_and_compartment__(self.__list_logs__)
+
+    def __get_client__(self, region):
+        """
+        Get the Logging Management client for a region.
+
+        Args:
+            region: Region key
+
+        Returns:
+            Logging Management client instance
+        """
+        return self._create_oci_client(
+            oci.logging.LoggingManagementClient, config_overrides={"region": region}
+        )
+
+    def __list_log_groups__(self, region, compartment):
+        """
+        List all log groups in a compartment and region.
+
+        Args:
+            region: OCIRegion object
+            compartment: Compartment object
+        """
+        try:
+            region_key = region.key if hasattr(region, "key") else str(region)
+            logging_client = self.__get_client__(region_key)
+
+            logger.info(
+                f"Logging - Listing Log Groups in {region_key} - {compartment.name}..."
+            )
+
+            log_groups_data = oci.pagination.list_call_get_all_results(
+                logging_client.list_log_groups, compartment_id=compartment.id
+            ).data
+
+            for log_group in log_groups_data:
+                if log_group.lifecycle_state != "DELETED":
+                    self.log_groups.append(
+                        LogGroup(
+                            id=log_group.id,
+                            display_name=log_group.display_name,
+                            description=(
+                                log_group.description
+                                if hasattr(log_group, "description")
+                                and log_group.description
+                                else None
+                            ),
+                            compartment_id=compartment.id,
+                            time_created=log_group.time_created,
+                            lifecycle_state=log_group.lifecycle_state,
+                            region=region_key,
+                        )
+                    )
+
+        except Exception as error:
+            logger.error(
+                f"{region_key if 'region_key' in locals() else region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+    def __list_logs__(self, region, compartment):
+        """
+        List all logs in a compartment and region.
+
+        Args:
+            region: OCIRegion object
+            compartment: Compartment object
+        """
+        try:
+            region_key = region.key if hasattr(region, "key") else str(region)
+            logging_client = self.__get_client__(region_key)
+
+            logger.info(
+                f"Logging - Listing Logs in {region_key} - {compartment.name}..."
+            )
+
+            # Get all log groups in this compartment/region
+            compartment_log_groups = [
+                lg
+                for lg in self.log_groups
+                if lg.compartment_id == compartment.id and lg.region == region_key
+            ]
+
+            for log_group in compartment_log_groups:
+                try:
+                    logs_data = oci.pagination.list_call_get_all_results(
+                        logging_client.list_logs, log_group_id=log_group.id
+                    ).data
+
+                    for log in logs_data:
+                        if log.lifecycle_state != "DELETED":
+                            # Extract configuration details
+                            source_service = None
+                            source_category = None
+                            source_resource = None
+
+                            if hasattr(log, "configuration") and log.configuration:
+                                config = log.configuration
+                                if hasattr(config, "source") and config.source:
+                                    source = config.source
+                                    source_service = getattr(source, "service", None)
+                                    source_category = getattr(source, "category", None)
+                                    source_resource = getattr(source, "resource", None)
+
+                            self.logs.append(
+                                Log(
+                                    id=log.id,
+                                    display_name=log.display_name,
+                                    log_group_id=log_group.id,
+                                    log_type=log.log_type,
+                                    compartment_id=compartment.id,
+                                    time_created=log.time_created,
+                                    lifecycle_state=log.lifecycle_state,
+                                    is_enabled=(
+                                        log.is_enabled
+                                        if hasattr(log, "is_enabled")
+                                        else True
+                                    ),
+                                    source_service=source_service,
+                                    source_category=source_category,
+                                    source_resource=source_resource,
+                                    region=region_key,
+                                )
+                            )
+                except Exception as log_error:
+                    logger.error(
+                        f"Error listing logs for log group {log_group.id}: {log_error.__class__.__name__}[{log_error.__traceback__.tb_lineno}]: {log_error}"
+                    )
+
+        except Exception as error:
+            logger.error(
+                f"{region_key if 'region_key' in locals() else region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+
+# Service Models
+class LogGroup(BaseModel):
+    """OCI Log Group model."""
+
+    id: str
+    display_name: str
+    description: Optional[str]
+    compartment_id: str
+    time_created: datetime
+    lifecycle_state: str
+    region: str
+
+
+class Log(BaseModel):
+    """OCI Log model."""
+
+    id: str
+    display_name: str
+    log_group_id: str
+    log_type: str
+    compartment_id: str
+    time_created: datetime
+    lifecycle_state: str
+    is_enabled: bool
+    source_service: Optional[str]
+    source_category: Optional[str]
+    source_resource: Optional[str]
+    region: str

prowler/providers/oraclecloud/services/network/network_client.py

@@ -0,0 +1,4 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.oraclecloud.services.network.network_service import Network
+
+network_client = Network(Provider.get_global_provider())

prowler/providers/oraclecloud/services/network/network_default_security_list_restricts_traffic/network_default_security_list_restricts_traffic.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "oci",
+  "CheckID": "network_default_security_list_restricts_traffic",
+  "CheckTitle": "Ensure the default security list of every VCN restricts all traffic except ICMP",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "network",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:network:securitylist",
+  "Severity": "high",
+  "ResourceType": "OciNetworkSecurityList",
+  "Description": "Ensure the default security list of every VCN restricts all traffic except ICMP within VCN. A default security list is automatically created when you create a VCN. It is recommended that the default security list restrict all traffic except for ICMP within the VCN.",
+  "Risk": "The default security list should not be used for any purpose other than as a fail-safe. It is recommended to create custom security lists for your resources.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "oci network security-list update --security-list-id <default-security-list-ocid> --ingress-security-rules <restricted-rules-json> --egress-security-rules <restricted-rules-json>",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-Networking/restrict-traffic-for-default-security-lists.html",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Configure the default security list to restrict all traffic except ICMP within the VCN. Create custom security lists for your resources.",
+      "Url": "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securitylists.htm"
+    }
+  },
+  "Categories": [
+    "network-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/network/network_default_security_list_restricts_traffic/network_default_security_list_restricts_traffic.py

@@ -0,0 +1,99 @@
+"""Check if default security list restricts all traffic except ICMP within VCN."""
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.network.network_client import network_client
+
+
+class network_default_security_list_restricts_traffic(Check):
+    """Check if default security list restricts all traffic except ICMP within VCN."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the network_default_security_list_restricts_traffic check.
+
+        Returns:
+            List of Check_Report_OCI objects with findings
+        """
+        findings = []
+
+        for security_list in network_client.security_lists:
+            # Only check default security lists
+            if security_list.is_default:
+                report = Check_Report_OCI(
+                    metadata=self.metadata(),
+                    resource=security_list,
+                    region=security_list.region,
+                    resource_name=security_list.display_name,
+                    resource_id=security_list.id,
+                    compartment_id=security_list.compartment_id,
+                )
+
+                # Check if default security list has overly permissive rules
+                has_permissive_rules = False
+                permissive_rule_details = []
+
+                # Check ingress rules
+                for rule in security_list.ingress_security_rules:
+                    source = rule.get("source")
+                    protocol = rule.get("protocol")
+
+                    # Protocol 1 is ICMP, which is allowed within VCN
+                    if protocol == "1":
+                        continue
+
+                    # Check if source is from internet (0.0.0.0/0)
+                    if source == "0.0.0.0/0":
+                        has_permissive_rules = True
+                        permissive_rule_details.append(
+                            f"ingress from 0.0.0.0/0 with protocol {protocol}"
+                        )
+                    # Check if source is not within VCN CIDR (should only allow VCN traffic)
+                    # For simplicity, we flag any non-ICMP rule as potentially permissive
+                    # In production, you'd want to compare against the VCN CIDR blocks
+                    elif protocol and protocol != "1":
+                        # Get VCN CIDR blocks to validate
+                        vcn = None
+                        for v in network_client.vcns:
+                            if v.id == security_list.vcn_id:
+                                vcn = v
+                                break
+
+                        if vcn:
+                            # Check if source is within VCN CIDR
+                            is_within_vcn = False
+                            for cidr in vcn.cidr_blocks:
+                                if source and source.startswith(cidr.split("/")[0]):
+                                    is_within_vcn = True
+                                    break
+
+                            if not is_within_vcn:
+                                has_permissive_rules = True
+                                permissive_rule_details.append(
+                                    f"ingress from {source} with protocol {protocol}"
+                                )
+
+                # Check egress rules - should also be restricted
+                for rule in security_list.egress_security_rules:
+                    destination = rule.get("destination")
+                    protocol = rule.get("protocol")
+
+                    # Protocol 1 is ICMP, which is allowed within VCN
+                    if protocol == "1":
+                        continue
+
+                    # Check if destination is to internet (0.0.0.0/0) for non-ICMP
+                    if destination == "0.0.0.0/0" and protocol and protocol != "1":
+                        has_permissive_rules = True
+                        permissive_rule_details.append(
+                            f"egress to 0.0.0.0/0 with protocol {protocol}"
+                        )
+
+                if has_permissive_rules:
+                    report.status = "FAIL"
+                    report.status_extended = f"Default security list {security_list.display_name} has permissive rules: {', '.join(permissive_rule_details)}."
+                else:
+                    report.status = "PASS"
+                    report.status_extended = f"Default security list {security_list.display_name} restricts all traffic except ICMP within VCN."
+
+                findings.append(report)
+
+        return findings

prowler/providers/oraclecloud/services/network/network_security_group_ingress_from_internet_to_rdp_port/network_security_group_ingress_from_internet_to_rdp_port.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "oci",
+  "CheckID": "network_security_group_ingress_from_internet_to_rdp_port",
+  "CheckTitle": "Ensure no network security groups allow ingress from 0.0.0.0/0 to port 3389",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "network",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:network:vcn",
+  "Severity": "high",
+  "ResourceType": "OciVcn",
+  "Description": "Network security groups should not allow unrestricted RDP access from the internet.",
+  "Risk": "Not meeting this network security requirement increases risk of unauthorized access.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Network/home.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-Networking/unrestricted-rdp-access-via-nsgs.html",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Ensure no network security groups allow ingress from 0.0.0.0/0 to port 3389",
+      "Url": "https://hub.prowler.com/check/oci/network_security_group_ingress_from_internet_to_rdp_port"
+    }
+  },
+  "Categories": [
+    "network-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/network/network_security_group_ingress_from_internet_to_rdp_port/network_security_group_ingress_from_internet_to_rdp_port.py

@@ -0,0 +1,65 @@
+"""Check Ensure no network security groups allow ingress from 0.0.0.0/0 to port 3389."""
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.network.network_client import network_client
+
+
+class network_security_group_ingress_from_internet_to_rdp_port(Check):
+    """Check Ensure no network security groups allow ingress from 0.0.0.0/0 to port 3389."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the network_security_group_ingress_from_internet_to_rdp_port check."""
+        findings = []
+
+        for nsg in network_client.network_security_groups:
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource=nsg,
+                region=nsg.region,
+                resource_name=nsg.display_name,
+                resource_id=nsg.id,
+                compartment_id=nsg.compartment_id,
+            )
+
+            # Check NSG rules for 0.0.0.0/0 to port 3389
+            has_rdp_from_internet = False
+            for rule in nsg.security_rules:
+                if (
+                    rule.get("direction") == "INGRESS"
+                    and rule.get("source") == "0.0.0.0/0"
+                ):
+                    protocol = rule.get("protocol")
+                    # Protocol 6 is TCP
+                    if protocol == "6":
+                        tcp_options = rule.get("tcp_options")
+                        # If tcp_options is None, all TCP ports are allowed
+                        if not tcp_options:
+                            has_rdp_from_internet = True
+                            break
+                        # If tcp_options exists, check destination port range
+                        dst_port = tcp_options.get("destination_port_range")
+                        if dst_port:
+                            port_min = dst_port.get("min", 0)
+                            port_max = dst_port.get("max", 0)
+                            if port_min <= 3389 <= port_max:
+                                has_rdp_from_internet = True
+                                break
+                        # If no destination port range specified, all ports are allowed
+                        else:
+                            has_rdp_from_internet = True
+                            break
+                    # Protocol "all" or if protocol is not specified
+                    elif protocol == "all" or not protocol:
+                        has_rdp_from_internet = True
+                        break
+
+            if has_rdp_from_internet:
+                report.status = "FAIL"
+                report.status_extended = f"Network security group {nsg.display_name} allows ingress from 0.0.0.0/0 to port 3389 (RDP)."
+            else:
+                report.status = "PASS"
+                report.status_extended = f"Network security group {nsg.display_name} does not ingress from 0.0.0.0/0 to port 3389 (RDP)."
+
+            findings.append(report)
+
+        return findings

prowler/providers/oraclecloud/services/network/network_security_group_ingress_from_internet_to_ssh_port/network_security_group_ingress_from_internet_to_ssh_port.metadata.json

@@ -0,0 +1,37 @@
+{
+  "Provider": "oci",
+  "CheckID": "network_security_group_ingress_from_internet_to_ssh_port",
+  "CheckTitle": "Ensure no network security groups allow ingress from 0.0.0.0/0 to port 22",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "network",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:network:networksecuritygroup",
+  "Severity": "high",
+  "ResourceType": "OciNetworkSecurityGroup",
+  "Description": "Ensure no network security groups allow ingress from 0.0.0.0/0 to port 22. Network security groups provide stateful or stateless filtering of ingress and egress network traffic to OCI resources.",
+  "Risk": "Removing unfettered connectivity to remote console services, such as SSH, reduces a server's exposure to risk.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/networksecuritygroups.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "oci network nsg rules update --nsg-id <nsg-ocid> --security-rules <updated-rules-json>",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-Networking/unrestricted-ssh-access-via-nsgs.html",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Update network security groups to remove ingress rules allowing access from 0.0.0.0/0 to port 22. Restrict SSH access to known IP addresses.",
+      "Url": "https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/networksecuritygroups.htm"
+    }
+  },
+  "Categories": [
+    "internet-exposed",
+    "network-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/network/network_security_group_ingress_from_internet_to_ssh_port/network_security_group_ingress_from_internet_to_ssh_port.py

@@ -0,0 +1,70 @@
+"""Check if network security groups allow ingress from 0.0.0.0/0 to port 22."""
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.network.network_client import network_client
+
+
+class network_security_group_ingress_from_internet_to_ssh_port(Check):
+    """Check if network security groups allow ingress from 0.0.0.0/0 to port 22."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the network_security_group_ingress_from_internet_to_ssh_port check.
+
+        Returns:
+            List of Check_Report_OCI objects with findings
+        """
+        findings = []
+
+        for nsg in network_client.network_security_groups:
+            has_public_ssh_access = False
+
+            # Check security rules for public SSH access
+            for rule in nsg.security_rules:
+                if (
+                    rule.get("direction") == "INGRESS"
+                    and rule.get("source") == "0.0.0.0/0"
+                ):
+                    protocol = rule.get("protocol")
+                    # Protocol 6 is TCP
+                    if protocol == "6":
+                        tcp_options = rule.get("tcp_options")
+                        # If tcp_options is None, all TCP ports are allowed
+                        if not tcp_options:
+                            has_public_ssh_access = True
+                            break
+                        # If tcp_options exists, check destination port range
+                        dst_port = tcp_options.get("destination_port_range")
+                        if dst_port:
+                            port_min = dst_port.get("min", 0)
+                            port_max = dst_port.get("max", 0)
+                            if port_min <= 22 <= port_max:
+                                has_public_ssh_access = True
+                                break
+                        # If no destination port range specified, all ports are allowed
+                        else:
+                            has_public_ssh_access = True
+                            break
+                    # Protocol "all" or if protocol is not specified
+                    elif protocol == "all" or not protocol:
+                        has_public_ssh_access = True
+                        break
+
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource=nsg,
+                region=nsg.region,
+                resource_name=nsg.display_name,
+                resource_id=nsg.id,
+                compartment_id=nsg.compartment_id,
+            )
+
+            if has_public_ssh_access:
+                report.status = "FAIL"
+                report.status_extended = f"Network security group {nsg.display_name} allows ingress from 0.0.0.0/0 to port 22 (SSH)."
+            else:
+                report.status = "PASS"
+                report.status_extended = f"Network security group {nsg.display_name} does not allow ingress from 0.0.0.0/0 to port 22 (SSH)."
+
+            findings.append(report)
+
+        return findings

prowler/providers/oraclecloud/services/network/network_security_list_ingress_from_internet_to_rdp_port/network_security_list_ingress_from_internet_to_rdp_port.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "oci",
+  "CheckID": "network_security_list_ingress_from_internet_to_rdp_port",
+  "CheckTitle": "Ensure no security lists allow ingress from 0.0.0.0/0 to port 3389",
+  "CheckType": [
+    "Software and Configuration Checks",
+    "Industry and Regulatory Standards",
+    "CIS OCI Foundations Benchmark"
+  ],
+  "ServiceName": "network",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "oci:network:vcn",
+  "Severity": "high",
+  "ResourceType": "OciVcn",
+  "Description": "Security lists should not allow unrestricted RDP access from the internet.",
+  "Risk": "Not meeting this network security requirement increases risk of unauthorized access.",
+  "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Network/home.htm",
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-Networking/unrestricted-rdp-access.html",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Ensure no security lists allow ingress from 0.0.0.0/0 to port 3389",
+      "Url": "https://hub.prowler.com/check/oci/network_security_list_ingress_from_internet_to_rdp_port"
+    }
+  },
+  "Categories": [
+    "network-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/oraclecloud/services/network/network_security_list_ingress_from_internet_to_rdp_port/network_security_list_ingress_from_internet_to_rdp_port.py

@@ -0,0 +1,62 @@
+"""Check Ensure no security lists allow ingress from 0.0.0.0/0 to port 3389."""
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.network.network_client import network_client
+
+
+class network_security_list_ingress_from_internet_to_rdp_port(Check):
+    """Check Ensure no security lists allow ingress from 0.0.0.0/0 to port 3389."""
+
+    def execute(self) -> Check_Report_OCI:
+        """Execute the network_security_list_ingress_from_internet_to_rdp_port check."""
+        findings = []
+
+        for security_list in network_client.security_lists:
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource=security_list,
+                region=security_list.region,
+                resource_name=security_list.display_name,
+                resource_id=security_list.id,
+                compartment_id=security_list.compartment_id,
+            )
+
+            # Check ingress rules for 0.0.0.0/0 to port 3389
+            has_rdp_from_internet = False
+            for rule in security_list.ingress_security_rules:
+                if rule.get("source") == "0.0.0.0/0":
+                    protocol = rule.get("protocol")
+                    # Protocol 6 is TCP
+                    if protocol == "6":
+                        tcp_options = rule.get("tcp_options")
+                        # If tcp_options is None, all TCP ports are allowed
+                        if not tcp_options:
+                            has_rdp_from_internet = True
+                            break
+                        # If tcp_options exists, check destination port range
+                        dst_port = tcp_options.get("destination_port_range")
+                        if dst_port:
+                            port_min = dst_port.get("min", 0)
+                            port_max = dst_port.get("max", 0)
+                            if port_min <= 3389 <= port_max:
+                                has_rdp_from_internet = True
+                                break
+                        # If no destination port range specified, all ports are allowed
+                        else:
+                            has_rdp_from_internet = True
+                            break
+                    # Protocol "all" or if protocol is not specified
+                    elif protocol == "all" or not protocol:
+                        has_rdp_from_internet = True
+                        break
+
+            if has_rdp_from_internet:
+                report.status = "FAIL"
+                report.status_extended = f"Security list {security_list.display_name} allows ingress from 0.0.0.0/0 to port 3389 (RDP)."
+            else:
+                report.status = "PASS"
+                report.status_extended = f"Security list {security_list.display_name} does not allow ingress from 0.0.0.0/0 to port 3389 (RDP)."
+
+            findings.append(report)
+
+        return findings