aquasecurity / aquasecurity/cloudsploit
Azure plugins to cover CIS Benchmark
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
I noticed that there are a lot of plugins that assesses Azure environments for CIS Benchmark but they don't generate any output regarding of it. So I modified about 74 Azure plugins to ensure that there is more CIS coverage. The list of plugins is as following:
- ensureNoGuestUser.js
- noCustomOwnerRoles.js
- standardPricingEnabled.js
- autoProvisioningEnabled.js
- monitorSystemUpdates.js
- monitorEndpointProtection.js
- monitorDiskEncryption.js
- monitorNsgEnabled.js
- monitorVMVulnerability.js
- monitorBlobEncryption.js
- monitorJitNetworkAccess.js
- appWhitelistingEnabled.js
- monitorSqlAuditing.js
- monitorSqlEncryption.js
- securityContactsEnabled.js
- securityContactsEnabledPhone.js
- highSeverityAlertsEnabled.js
- adminSecurityAlertsEnabled.js
- storageAccountsHttps.js
- networkAccessDefaultAction.js
- trustedMsAccessEnabled.js
- serverAuditingEnabled.js
- auditActionGroupsEnabled.js
- auditRetentionPolicy.js
- advancedDataSecurityEnabled.js
- sendAlertsEnabled.js
- emailAccountAdminsEnabled.js
- azureADAdminEnabled.js
- tdeProtectorEncrypted.js
- enforceMySQLSSLConnection.js
- logCheckpointsEnabled.js
- enforcePostgresSSLConnection.js
- logConnectionsEnabled.js
- logDisconnectionsEnabled.js
- logDurationEnabled.js
- connectionThrottlingEnabled.js
- logRetentionDays.js
- azureADAdminEnabled.js
- logProfileRetentionPolicy.js
- logProfileArchiveData.js
- logContainerPublicAccess.js
- logStorageEncryption.js
- kvLogAnalyticsEnabled.js
- policyAssignmentLogging.js
- nsgLoggingEnabled.js
- nsgLoggingEnabled.js
- nsgRuleLoggingEnabled.js
- nsgRuleLoggingEnabled.js
- securitySolutionLogging.js
- securitySolutionLogging.js
- sqlServerFirewallRuleEnabled.js
- securityPolicyAlertsEnabled.js
- openRDP.js
- openSSH.js
- noPublicAccess.js
- networkWatcherEnabled.js
- vmDiskOSEncryption.js
- vmDiskDataEncryption.js
- vmEndpointProtection.js
- keyExpirationEnabled.js
- secretExpirationEnabled.js
- managementLockEnabled.js
- kvRecoveryEnabled.js
- rbacEnabled.js
- authEnabled.js
- httpsOnlyEnabled.js
- tlsVersionCheck.js
- clientCertEnabled.js
- identityEnabled.js
- netFrameworkVersion.js
- phpVersion.js
- pythonVersion.js
- javaVersion.js
- http20Enabled.js
There is a new one plugin called securityContactsEnabledPhone.js which is separated from securityContactsEnabled.js because both cover different CIS controls (2.16 and 2.17)
I would like to suggest those modifications as an enhancement, this is a quick look of new CIS controls added (a little bit dislodged) so please let me know how to proceed.

Contributor guide
Research direction
Review the listed Azure plugin files, starting with securityContactsEnabled.js and the separate securityContactsEnabledPhone.js, and compare their current CIS control coverage and output. Determine the expected output for each proposed control and verify the full plugin list consistently reports the added CIS coverage; the issue does not name tests or a specific entry point.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, javascript
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100