aquasecurity / aquasecurity/cloudsploit
Azure Security Center: Monitor plugins broken
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
All of the Azure Security Center plugins which audit for monitoring of various vulnerable configurations are broken. The reasons are varied, but right now these tests appear to be just generating noise. They should be fixed or removed (preferably the latter).
- **Monitor Blob Encryption**
Deprecated as blob encryption is now enabled by default and cannot be disabled. Plugin can probably be removed.
- **Monitor Disk Encryption**
Appears to be replaced by the "_Disk encryption should be applied on virtual machines_" policy.
- **Monitor Endpoint Protection**
Appears to be replaced by the "_Endpoint protection solution should be installed on virtual machine scale sets_" and "_Monitor missing Endpoint Protection in Azure Security Center_" policies.
- **Monitor JIT Network Access**
Appears to be replaced by the "_Management ports of virtual machines should be protected with just-in-time network access control_" policy.
- **Monitor NSG Enabled**
This policy appears to have been replaced with several more granular policies.
- **Monitor SQL Auditing**
Replaced by the "_Auditing should be enabled on advanced data security settings on SQL Server_" policy.
- **Monitor SQL Encryption**
Replaced by the "_Transparent Data Encryption on SQL databases should be enabled_" policy.
- **Monitor System Updates**
Appears to be replaced by the "_System updates should be installed on your machines_" policy.
- **Monitor VM Vulnerability**
Appears to be replaced by the "_A vulnerability assessment solution should be enabled on your virtual machines_" policy.
I think there's a strong argument that the general approach of these plugins needs a rethink, as they're ultimately auditing a small subset of the broader controls the built-in Azure policy sets provide. If that's the case, these plugins I'd suggest should still be removed until such an overhaul is implemented, as right now they're just generating alerts which effectively can't be actioned.
Contributor guide
Research direction
Locate the Azure Security Center monitoring plugin implementations and any related tests, then review each listed plugin against the replacement Azure policies named in the issue. Done means removing obsolete checks or fixing them so they no longer generate unactionable noise, with coverage for the resulting behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, javascript
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100