elastic / elastic/cloudbeat

[CIS Azure][Bug] Some CIS Azure rules with rule number 5.2.x is not working properly

Open
#1,527 0 comments 0 reactions 0 assignees View on GitHub
bug cloudbeat Team:Cloud Security
Dominant language
Go
Stars
58
Forks
55
Avg merge
9h 9m
Merged PRs (30d)
424

Description

**Describe the bug**
CIS Azure rules with rule.number :

1. 5.2.4
2. 5.2.5
3. 5.2.6

Still returns **fail** even after I added activity log rules on Azure for the corresponding rules

**Preconditions**
Tested on 8.11.0 BC4

**To Reproduce**
1. Add CIS Azure Integration using the ARM Template
2. Wait until the process is done and then navigate to Findings page and make sure findings is there (it should show as fail for all 5.2.x rules)
3. Go to Azure and create Activity log rules for every single **5.2.x** rules (in this case you can just add for **5.2.4, 5.2.5 and 5.2.5**)
4. Once finished, navigate to the Azure integration you added on step 1 and change the description a bit to trigger re run (or you can also wait if you want)

**Expected behavior**
Rules that has Activity log rules added on Azure should Pass

**Actual Behavior**
Rule 5.2.4, 5.2.5, 5.2.6 still Fails even though we already add Activity log rules on Azure for it
**Screenshots**
-->
Screenshot 2023-10-31 at 1 41 52 AM

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.