elastic / elastic/cloudbeat

[CIS Azure] 2.1.* rules require subscription to Microsoft.Security in order to pull evaluation data

Open
#1,970 0 comments 0 reactions 0 assignees View on GitHub
bug CIS Azure cloudbeat Team:Cloud Security
Dominant language
Go
Stars
58
Forks
55
Avg merge
9h 9m
Merged PRs (30d)
424

Description

**Describe the bug**
There is a requirement from Azure to enroll into the `Microsoft.Security` in order to pull the data that we need for `2.1.*` rules evaluation.

Screenshot 2024-02-20 at 18 29 25

This affects pulling of the following resources:
- `microsoft.security/autoprovisioningsettings`
- `microsoft.security/securitycontacts`

Due to that users that aren't enrolled won't be able to get evaluations for `2.1.*` rules.

**Expected behavior**
We should investigate and try to figure out how to evaluate these rules without any enrollment from the user.
If there is no option to evaluate these rules without the enrollment, then we need to document that and reflect to the customer.

Definition of done
- [ ] Look for a different way to pool the relevant data for evaluation
- [ ] Document enrollment to Microsoft Security as a prerequisite

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.