added appservice templates
Prince Chaddha
parent
37bced9b46
commit
995aa07614
|
|
@ -0,0 +1,53 @@
|
|||
id: azure-appservice-always-on-disabled
|
||||
info:
|
||||
name: Azure App Service Always On Disabled
|
||||
author: princechaddha
|
||||
severity: medium
|
||||
description: |
|
||||
Ensure that your Microsoft Azure App Services web applications have Always On feature enabled in order to prevent applications from being idled out due to inactivity. Always On keeps your websites/web applications loaded even when there's no traffic.
|
||||
impact: |
|
||||
Disabling Always On may lead to your web applications being unloaded during periods of inactivity, potentially causing delayed responses to incoming traffic and impacting user experience.
|
||||
remediation: |
|
||||
Enable the Always On feature for your Azure App Services web applications to ensure they remain active and responsive at all times.
|
||||
reference:
|
||||
- https://docs.microsoft.com/en-us/azure/app-service/configure-common
|
||||
tags: cloud,devops,azure,microsoft,appservice,azure-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1);
|
||||
for (let WebAppData of iterate(template.webAppList)) {
|
||||
set("ids", WebAppData);
|
||||
code(2);
|
||||
}
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp list --output json --query '[*].{id:id}'
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
name: webAppList
|
||||
internal: true
|
||||
json:
|
||||
- '.[].[]'
|
||||
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp config show --ids "$ids" --query 'alwaysOn' --output json
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "false"
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- '"Always On feature is disabled for WebApp with ID: " + id'
|
||||
# digest: 4b0a00483046022100ede765fca6cd8732d7cec591bff77a9210f07ab9dc372df82a36c69c6dd04061022100aff094923b927db64bced8a892831cd8d02efe8a508cf0f43719f8a18c2e8fe9:366f2a24c8eb519f6968bd8801c08ebe
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
id: azure-appservice-auth-disabled
|
||||
info:
|
||||
name: Azure App Service Authentication Not Enabled
|
||||
author: princechaddha
|
||||
severity: medium
|
||||
description: |
|
||||
Ensure that App Service Authentication feature is enabled for Microsoft Azure App Service to add an extra layer of security to the authentication process implemented by your web applications.
|
||||
impact: |
|
||||
Disabling App Service Authentication can expose the application to unauthorized access and potential security vulnerabilities.
|
||||
remediation: |
|
||||
Enable the App Service Authentication feature for Azure App Services to ensure an additional layer of security for your web applications.
|
||||
reference:
|
||||
- https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization
|
||||
tags: cloud,devops,azure,microsoft,appservice,azure-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1);
|
||||
for (let WebAppData of iterate(template.webAppList)) {
|
||||
WebAppData = JSON.parse(WebAppData);
|
||||
set("id", WebAppData.id);
|
||||
code(2);
|
||||
}
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp list --output json --query '[*].{id:id}'
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
name: webAppList
|
||||
internal: true
|
||||
json:
|
||||
- '.[]'
|
||||
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp auth show --ids "$id" --query 'enabled' --output json
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "false"
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'id + " does not have App Service Authentication enabled"'
|
||||
# digest: 490a0046304402201df3032eebcc0b88de97d6a0e45f0e52edf653c18ba231aa4fd724a1f6365e900220127d29312de0c8774d4b055a244c46e0bc3f064bd38df175d92afac1ea36a412:366f2a24c8eb519f6968bd8801c08ebe
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
id: azure-appservice-backup-not-enabled
|
||||
info:
|
||||
name: Azure App Service Automated Backup Not Configured
|
||||
author: princechaddha
|
||||
severity: medium
|
||||
description: |
|
||||
Ensure that Backup and Restore feature is enabled and configured to create custom backups for your Microsoft Azure App Service applications.
|
||||
impact: |
|
||||
If Automated Backups are not enabled and configured, it may lead to potential data loss and non-compliance with regulatory requirements.
|
||||
remediation: |
|
||||
Enable and configure the Backup and Restore feature for Azure App Services applications through the Azure portal or Azure CLI to ensure compliance and data integrity.
|
||||
reference:
|
||||
- https://docs.microsoft.com/en-us/azure/app-service/manage-backup
|
||||
tags: cloud,devops,azure,microsoft,appservice,azure-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1);
|
||||
for (let AppServiceData of iterate(template.appServiceList)) {
|
||||
AppServiceData = JSON.parse(AppServiceData);
|
||||
set("name", AppServiceData.name);
|
||||
set("resourceGroup", AppServiceData.resourceGroup);
|
||||
code(2);
|
||||
}
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp list --output json --query '[*].{name:name, resourceGroup:resourceGroup}'
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
name: appServiceList
|
||||
internal: true
|
||||
json:
|
||||
- '.[]'
|
||||
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp config backup show --webapp-name $name --resource-group $resourceGroup --output json
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
part: stderr
|
||||
words:
|
||||
- "Backup configuration not found"
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'name + " in " + resourceGroup + " does not have automated backups enabled"'
|
||||
# digest: 4a0a0047304502202a3476f1cee0d2c3cdca92b12085504b16acc11e1a9ecb93c9b4cd0875121731022100bc788f3219026ea334a5f83e4f17090bfa44c4b66bfa3a92a6c8fd1c3cbbd65c:366f2a24c8eb519f6968bd8801c08ebe
|
||||
|
|
@ -0,0 +1,56 @@
|
|||
id: azure-appservice-backup-retention-missing
|
||||
info:
|
||||
name: Azure App Service Backup Retention Not Configured
|
||||
author: princechaddha
|
||||
severity: medium
|
||||
description: |
|
||||
Ensure that your Microsoft Azure App Services applications have a sufficient daily backup retention period configured for scheduled backups, in order to follow security and regulatory requirements. Prior to running this rule by the Cloud Conformity engine, the backup retention period must be configured in the rule settings, on the Cloud Conformity account dashboard. A retention value of 0 will keep backup files indefinitely.
|
||||
impact: |
|
||||
Lack of a backup retention configuration can lead to non-compliance with security and regulatory requirements and potential data loss.
|
||||
remediation: |
|
||||
Configure the daily backup retention period for Azure App Services applications in the Cloud Conformity account dashboard to meet security and compliance requirements.
|
||||
reference:
|
||||
- https://docs.microsoft.com/en-us/azure/app-service/manage-backup
|
||||
tags: cloud,devops,azure,microsoft,appservice,azure-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1);
|
||||
for (let AppServiceData of iterate(template.appServiceList)) {
|
||||
AppServiceData = JSON.parse(AppServiceData);
|
||||
set("name", AppServiceData.name);
|
||||
set("resourceGroup", AppServiceData.resourceGroup);
|
||||
code(2);
|
||||
}
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp list --output json --query '[*].{name:name, resourceGroup:resourceGroup}'
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
name: appServiceList
|
||||
internal: true
|
||||
json:
|
||||
- '.[]'
|
||||
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp config backup show --webapp-name $name --resource-group $resourceGroup --query 'backupSchedule.retentionPeriodInDays' --output json
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
part: stderr
|
||||
words:
|
||||
- "Backup configuration not found"
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'name + " in " + resourceGroup + " does not have a backup retention period configured"'
|
||||
# digest: 4a0a0047304502207164338f603a83a3bbf88ae526b46c76a74960ce666cd4d439da40f3a13c88b00221009fa7a9c75233d5a99eb23db9ec5e8de6a9ad16145a50806e226e73be6fb859eb:366f2a24c8eb519f6968bd8801c08ebe
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
id: azure-appservice-client-cert-disabled
|
||||
info:
|
||||
name: Azure App Service Client Certificate Not Required
|
||||
author: princechaddha
|
||||
severity: medium
|
||||
description: |
|
||||
Ensure that your Microsoft Azure App Service web applications are configured to require an SSL certificate from all incoming requests, for security and compliance purposes. Once the certificate is implemented, only web clients that have this valid SSL certificate will be able to reach your web application. By default, incoming client certificates are disabled for Azure App Service web applications.
|
||||
impact: |
|
||||
If incoming client certificates are not required, unauthorized clients might be able to access the web application, which can lead to security breaches.
|
||||
remediation: |
|
||||
Configure Azure App Services to require SSL certificates for incoming requests to enhance security and compliance with regulations.
|
||||
reference:
|
||||
- https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate#require-incoming-certificate
|
||||
tags: cloud,devops,azure,microsoft,appservice,azure-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1);
|
||||
for (let WebAppId of iterate(template.webAppIds)) {
|
||||
set("ids", WebAppId);
|
||||
code(2);
|
||||
}
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp list --output json --query '[*].id'
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
name: webAppIds
|
||||
internal: true
|
||||
json:
|
||||
- '.[]'
|
||||
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp show --ids "$ids" --query 'clientCertEnabled' --output json
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "false"
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- '"Client certificate not required for " + id'
|
||||
# digest: 4a0a00473045022000aabec45e3f1d419b57de2b91022fc5e5ea556d16dbff0c5c4d5f29fc8da4d2022100b033c585b9a7a21cbd8b8b573b28332149e8dba898289058cf89a0f469213fee:366f2a24c8eb519f6968bd8801c08ebe
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
id: azure-appservice-entra-id-missing
|
||||
info:
|
||||
name: Azure App Service Microsoft Entra ID Not Configured
|
||||
author: princechaddha
|
||||
severity: medium
|
||||
description: |
|
||||
Ensure that registration with Microsoft Entra ID is enabled for Microsoft Azure App Service web applications so that your applications can connect to other Azure cloud services securely without the need of access credentials such as user names and passwords.
|
||||
impact: |
|
||||
If the Microsoft Entra ID is not configured, it could prevent secure and simplified access to cloud services, potentially leading to manual management of credentials and increased security risks.
|
||||
remediation: |
|
||||
Enable the Microsoft Entra ID for Azure App Services to ensure secure connectivity to other Azure services without manual credential handling.
|
||||
reference:
|
||||
- https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity
|
||||
tags: cloud,devops,azure,microsoft,appservice,azure-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1);
|
||||
for (let AppServiceData of iterate(template.appServiceList)) {
|
||||
AppServiceData = JSON.parse(AppServiceData);
|
||||
set("id", AppServiceData.id);
|
||||
code(2);
|
||||
}
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp list --output json --query '[*].{id:id}'
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
name: appServiceList
|
||||
internal: true
|
||||
json:
|
||||
- '.[]'
|
||||
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp identity show --ids "$ids" --query 'principalId' --output json
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
part: all
|
||||
words:
|
||||
- ""
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'id + " does not have Microsoft Entra ID configured"'
|
||||
# digest: 490a0046304402203434d9f70ca15d17b2949f8e0878335dff836e8b69f1ec5aa33da19f837e60e902200f28903b9e6a22ae3743f0b60acdef3bc1d200e620484a883dc20836f69a906f:366f2a24c8eb519f6968bd8801c08ebe
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
id: azure-appservice-ftp-deployment-disabled
|
||||
info:
|
||||
name: Azure App Service Plain FTP Deployment Disabled
|
||||
author: princechaddha
|
||||
severity: medium
|
||||
description: |
|
||||
Ensure that your Microsoft Azure App Services web applications are not configured to be deployed over plain FTP. Instead, the deployment can be disabled over FTP or performed over FTPS. FTPS (Secure FTP) is used to enhance security for your Azure web application as it adds an extra layer of security to the FTP protocol, and helps you to comply with industry standards and regulations.
|
||||
impact: |
|
||||
Using plain FTP for deployment could expose sensitive data to interception. Enabling FTPS or disabling FTP deployment ensures compliance with security best practices and regulations.
|
||||
remediation: |
|
||||
Configure the Azure App Services to disable FTP deployment or to use FTPS, ensuring encrypted and secure file transfers.
|
||||
reference:
|
||||
- https://docs.microsoft.com/en-us/azure/app-service/deploy-ftp
|
||||
tags: cloud,devops,azure,microsoft,appservice,azure-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1);
|
||||
for (let WebAppId of iterate(template.webAppIds)) {
|
||||
set("ids", WebAppId);
|
||||
code(2);
|
||||
}
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp list --output json --query '[*].id'
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
name: webAppIds
|
||||
internal: true
|
||||
json:
|
||||
- '.[]'
|
||||
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp config show --ids $ids --output json --query 'ftpsState'
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "AllAllowed"
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'ids + " has FTP deployment enabled, which is not secure"'
|
||||
# digest: 490a00463044022033081603c95622607f43959933f455ebc2b899cda3c40530f72ab70eed7d197b0220057b5acd6ff5ffd94c02845d2134a7bc26117214b08dada065d9d0261d69f6b2:366f2a24c8eb519f6968bd8801c08ebe
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
id: azure-appservice-ftps-only-not-enabled
|
||||
info:
|
||||
name: Azure App Service FTPS-Only Access Not Enabled
|
||||
author: princechaddha
|
||||
severity: medium
|
||||
description: |
|
||||
Ensure that your Azure App Services web applications enforce FTPS-only access to encrypt FTP traffic. FTPS (Secure FTP) is used to enhance security for your Azure web application as it adds an extra layer of security to the FTP protocol, and help you to comply with the industry standards and regulations.
|
||||
impact: |
|
||||
Enabling FTPS-only access enhances the security by encrypting data transfer, thus reducing the risk of data interception and compliance violations.
|
||||
remediation: |
|
||||
Configure the Azure App Services to enforce FTPS-only access in the Azure portal or use Azure CLI commands to modify the FTPS settings.
|
||||
reference:
|
||||
- https://docs.microsoft.com/en-us/azure/app-service/configure-ftp
|
||||
tags: cloud,devops,azure,microsoft,appservice,azure-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1);
|
||||
for (let WebAppId of iterate(template.webAppIdList)) {
|
||||
set("id", WebAppId);
|
||||
code(2);
|
||||
}
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp list --output json --query '[*].id'
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
name: webAppIdList
|
||||
internal: true
|
||||
json:
|
||||
- '.[]'
|
||||
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp config show --ids $id --query 'ftpsState' --output json
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "AllAllowed"
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'id + " does not enforce FTPS-only access"'
|
||||
# digest: 4b0a00483046022100cab004f8642b1933029422f4c360bb008805ff56afabe857ee0d64220ab899fb022100b1ee755aac6ded5e7eee7f10ca58121b944714313d605d30671e04fe3657aaf2:366f2a24c8eb519f6968bd8801c08ebe
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
id: azure-appservice-http2-not-enabled
|
||||
info:
|
||||
name: Azure App Service HTTP/2 Not Enabled
|
||||
author: princechaddha
|
||||
severity: low
|
||||
description: |
|
||||
Ensure that your Microsoft Azure App Service web applications are using the latest version of the HTTP protocol (i.e. HTTP/2) in order to make your web applications load faster. HTTP 2.0 represents a major upgrade of the HTTP/1.1 protocol, with the primary goals of reducing the impact of latency and connection load on web servers through full request and response multiplexing, minimizing protocol overhead via HTTP header field compression, and supporting HTTP request prioritization and server push.
|
||||
impact: |
|
||||
Not using HTTP/2 can result in slower web applications due to increased latency and connection load.
|
||||
remediation: |
|
||||
Enable HTTP/2 on your Azure App Service web applications to improve their performance and adhere to modern web standards.
|
||||
reference:
|
||||
- https://docs.microsoft.com/en-us/azure/app-service/configure-language-http2
|
||||
tags: cloud,devops,azure,microsoft,appservice,azure-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1);
|
||||
for (let WebAppId of iterate(template.webAppIds)) {
|
||||
set("id", WebAppId);
|
||||
code(2);
|
||||
}
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp list --query '[*].id' --output json
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
name: webAppIds
|
||||
internal: true
|
||||
json:
|
||||
- '.[]'
|
||||
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp config show --ids $id --query 'http20Enabled' --output json
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "false"
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'id + " does not have HTTP/2 enabled"'
|
||||
# digest: 4a0a0047304502205cf015a4ea50389f9ba6ea2963ee4a122dc02dab688e8399556b84666890dce202210086281eb40b3018d1bc2ad31a8b84186db402bd6a30dd70c350696157776c3ec1:366f2a24c8eb519f6968bd8801c08ebe
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
id: azure-appservice-https-only-not-enforced
|
||||
info:
|
||||
name: Azure App Service HTTPS-Only Not Enforced
|
||||
author: princechaddha
|
||||
severity: medium
|
||||
description: |
|
||||
Ensure that your Azure App Service web applications redirect all non-secure HTTP traffic to HTTPS in order to encrypt the communication between applications and web clients. HTTPS uses the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocol to provide a secure connection, which is both encrypted and authenticated. This adds an extra layer of security to the HTTP requests made to the web application.
|
||||
impact: |
|
||||
Not enforcing HTTPS only for web applications can lead to unencrypted and unauthenticated traffic, which can be intercepted by attackers.
|
||||
remediation: |
|
||||
Enable the HTTPS-only feature on all Azure App Services to enforce all traffic to be encrypted and secure.
|
||||
reference:
|
||||
- https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https
|
||||
tags: cloud,devops,azure,microsoft,appservice,azure-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1);
|
||||
for (let AppServiceData of iterate(template.appServiceList)) {
|
||||
AppServiceData = JSON.parse(AppServiceData);
|
||||
set("id", AppServiceData.id);
|
||||
code(2);
|
||||
}
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp list --output json --query '[*].{id:id}'
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
name: appServiceList
|
||||
internal: true
|
||||
json:
|
||||
- '.[]'
|
||||
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp show --ids $id --query 'httpsOnly' --output json
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "false"
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'id + " does not enforce HTTPS-only traffic"'
|
||||
# digest: 490a004630440220340fce4e251246fc7d6ad79bcc3abc0d0ddef10af469929131d4f9abfac6712b02201f6c61d7bb2f2283b69424865517b56ce18f0181ceec94a7f5e347e5a92e1601:366f2a24c8eb519f6968bd8801c08ebe
|
||||
|
|
@ -0,0 +1,58 @@
|
|||
id: azure-appservice-insights-not-enabled
|
||||
info:
|
||||
name: Azure App Service Application Insights Not Enabled
|
||||
author: princechaddha
|
||||
severity: medium
|
||||
description: |
|
||||
Ensure that the Application Insights feature is enabled for all your Microsoft Azure App Services applications in order to provide advanced application monitoring. Application Insights is an extensible Application Performance Management (APM) service for developers and DevOps professionals available as monitoring feature within Azure cloud. The feature monitors your live App Services applications to automatically detect performance anomalies. It includes powerful analytics tools to help diagnose issues and understand what users do with your application. Application Insights can be enabled for apps on various platforms including .NET, Node.js, and Java EE, hosted on-premises, hybrid, or other public cloud platforms.
|
||||
impact: |
|
||||
Not enabling Application Insights may lead to a lack of vital application performance data and missed opportunities for optimizing application responsiveness and troubleshooting issues.
|
||||
remediation: |
|
||||
Enable Application Insights for Azure App Services applications through the Azure portal or by using the Azure CLI to ensure comprehensive monitoring and management of application performance.
|
||||
reference:
|
||||
- https://docs.microsoft.com/en-us/azure/azure-monitor/app/app-insights-overview
|
||||
tags: cloud,devops,azure,microsoft,application-insights,azure-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1);
|
||||
for (let AppServiceData of iterate(template.appServiceList)) {
|
||||
AppServiceData = JSON.parse(AppServiceData);
|
||||
set("name", AppServiceData.name);
|
||||
set("resourceGroup", AppServiceData.resourceGroup);
|
||||
code(2);
|
||||
}
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp list --output json --query '[*].{name:name, resourceGroup:resourceGroup}'
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
name: appServiceList
|
||||
internal: true
|
||||
json:
|
||||
- '.[]'
|
||||
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp config appsettings list --name $name --resource-group $resourceGroup --output json
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "APPLICATIONINSIGHTS_CONNECTION_STRING"
|
||||
- "APPINSIGHTS_INSTRUMENTATIONKEY"
|
||||
condition: and
|
||||
negative: true
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'name + " in " + resourceGroup + " does not have Application Insights enabled"'
|
||||
# digest: 4a0a0047304502202d5b7353cd5b9524e3195eb9bd2d6187ea9b881fc24cd5d2c7f640acc1dee781022100c3025e182c8f0edf65a19ced2de988cffe5463bd490c6e0947f954bd5b2aa0c2:366f2a24c8eb519f6968bd8801c08ebe
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
id: azure-appservice-remote-debugging-enabled
|
||||
info:
|
||||
name: Azure App Service Remote Debugging Enabled
|
||||
author: princechaddha
|
||||
severity: high
|
||||
description: |
|
||||
Ensure that your Azure App Services web applications have remote debugging disabled in order to enhance security and protect the applications from unauthorized access. Remote Debugging feature is available for web applications (e.g. ASP.NET, ASP.NET Core, Node.js, Python).
|
||||
impact: |
|
||||
Enabling remote debugging can expose web applications to unauthorized access and potential security vulnerabilities.
|
||||
remediation: |
|
||||
Disable remote debugging for Azure App Services web applications through the Azure portal or using Azure CLI commands to enhance application security.
|
||||
reference:
|
||||
- https://docs.microsoft.com/en-us/azure/app-service/troubleshoot-remote-debug
|
||||
tags: cloud,devops,azure,microsoft,appservice,azure-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1);
|
||||
for (let WebAppData of iterate(template.webAppList)) {
|
||||
set("ids", WebAppData);
|
||||
code(2);
|
||||
}
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp list --query '[*].{id:id}' --output json
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
name: webAppList
|
||||
internal: true
|
||||
json:
|
||||
- '.[].[]'
|
||||
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp config show --ids $ids --query 'remoteDebuggingEnabled' --output json
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "true"
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'id + " has remote debugging enabled."'
|
||||
# digest: 490a004630440221009feb615b77c895c91f10b3854833a77499855d373c0eae5fe237e448a64f47fd021f308342de942441eb892bcca61cfc3b5dae80290898bafa63a01b7d11ff7e4f:366f2a24c8eb519f6968bd8801c08ebe
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
id: azure-appservice-tls-latest-version-missing
|
||||
info:
|
||||
name: Azure App Service TLS Latest Version Not Configured
|
||||
author: princechaddha
|
||||
severity: medium
|
||||
description: |
|
||||
Ensure that all Microsoft Azure App Service web applications are using the latest version of TLS encryption protocol to secure the applications traffic over the Internet and comply with the industry standards. This check verifies if the minimum TLS version configured is not "1.2", indicating that the latest version of TLS is not used.
|
||||
impact: |
|
||||
Using an outdated TLS version can expose the application to security vulnerabilities and non-compliance with industry standards.
|
||||
remediation: |
|
||||
Configure the minimum TLS version to "1.2" in the Azure App Service settings to ensure data is encrypted with the latest security standards.
|
||||
reference:
|
||||
- https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-https
|
||||
tags: cloud,devops,azure,microsoft,appservice,azure-cloud-config
|
||||
|
||||
flow: |
|
||||
code(1);
|
||||
for (let appData of iterate(template.appList)) {
|
||||
appData = JSON.parse(appData);
|
||||
set("id", appData.id);
|
||||
code(2);
|
||||
}
|
||||
|
||||
self-contained: true
|
||||
code:
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp list --output json --query '[*].{id:id}'
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
name: appList
|
||||
internal: true
|
||||
json:
|
||||
- '.[]'
|
||||
|
||||
- engine:
|
||||
- sh
|
||||
- bash
|
||||
source: |
|
||||
az webapp config show --ids $id --query 'minTlsVersion' --output json
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "1.2"
|
||||
negative: true
|
||||
|
||||
extractors:
|
||||
- type: dsl
|
||||
dsl:
|
||||
- 'id + " does not have the latest TLS version configured"'
|
||||
# digest: 4a0a004730450220275db239f6824bae47879a8e3b1fd5ce72d68bd79bbbb91eb73437f667cb7ea9022100bc39ad752ebeefbe6ca222ad94a433abf295891da66b74537432b4d1b14272b8:366f2a24c8eb519f6968bd8801c08ebe
|
||||
|
|
@ -16,7 +16,7 @@ info:
|
|||
flow: |
|
||||
code(1);
|
||||
for (let functionName of iterate(template.functionNames)) {
|
||||
AppData = JSON.parse(functionName);
|
||||
AppData = JSON.parse(functionName);
|
||||
set("functionName", AppData.name)
|
||||
set("resourceGroup", AppData.resourceGroup)
|
||||
code(2);
|
||||
|
|
@ -78,4 +78,4 @@ code:
|
|||
- type: dsl
|
||||
dsl:
|
||||
- 'functionName + " has admin privileges with role " + roleAssignment + " in resource group " + resourceGroup'
|
||||
# digest: 4a0a0047304502206c53befacf7870a0640e4b057b36a6405779335abc7cf916b95f2c7e8b55af400221009b81df9c8b06377aef96689f3cb4df77ed008857c1f83e93ea8cd1b1fe4c0ae6:366f2a24c8eb519f6968bd8801c08ebe
|
||||
# digest: 4a0a00473045022071da38513c734f7f7c1c1052d490dd0d1f910fbd8b37c9a62957d85053a1a20a022100d2804d180821e51ba85b0fa573c75714382f3c4cbeda0e0892f6b43dcf7504ee:366f2a24c8eb519f6968bd8801c08ebe
|
||||
Loading…
Reference in New Issue