Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extract metadata from policy for rules generation #1652

Closed
2 tasks done
BernieWhite opened this issue Sep 16, 2022 · 0 comments · Fixed by #1699
Closed
2 tasks done

Extract metadata from policy for rules generation #1652

BernieWhite opened this issue Sep 16, 2022 · 0 comments · Fixed by #1699
Assignees
Labels
enhancement New feature or request ms-hack-2022 Issues related to Microsoft Global Hackathon 2022 .NET Pull requests that update .net code
Milestone

Comments

@BernieWhite
Copy link
Collaborator

BernieWhite commented Sep 16, 2022

When generating rules from policy lets extract additional metadata from policies for inserting into the rule definition.

An example policy definition.

{
  "Name": "a4fe33eb-e377-4efb-ab31-0784311bc499",
  "ResourceId": "/providers/Microsoft.Authorization/policyDefinitions/a4fe33eb-e377-4efb-ab31-0784311bc499",
  "ResourceName": "a4fe33eb-e377-4efb-ab31-0784311bc499",
  "ResourceType": "Microsoft.Authorization/policyDefinitions",
  "SubscriptionId": null,
  "Properties": {
    "Description": "This policy audits any Windows/Linux virtual machines (VMs) if the Log Analytics agent is not installed which Security Center uses to monitor for security vulnerabilities and threats",
    "DisplayName": "Log Analytics agent should be installed on your virtual machine for Azure Security Center monitoring",
    "Metadata": {
      "version": "1.0.0",
      "category": "Security Center"
    },
    "Mode": "All",
    "Parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "AuditIfNotExists",
          "Disabled"
        ],
        "defaultValue": "AuditIfNotExists"
      }
    },
    "PolicyRule": {
      "if": {
        "field": "type",
        "in": [
          "Microsoft.ClassicCompute/virtualMachines",
          "Microsoft.Compute/virtualMachines"
        ]
      },
      "then": {
        "effect": "[parameters('effect')]",
        "details": {
          "type": "Microsoft.Security/assessments",
          "name": "d1db3318-01ff-16de-29eb-28b344515626",
          "existenceCondition": {
            "field": "Microsoft.Security/assessments/status.code",
            "in": [
              "NotApplicable",
              "Healthy"
            ]
          }
        }
      }
    },
    "PolicyType": 2
  },
  "PolicyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a4fe33eb-e377-4efb-ab31-0784311bc499"
}

Lets extract:

  • Properties.metadata.version as a Azure.Policy/version annotation if it exists.
  • Properties.metadata.category as a Azure.Policy/category tag if it exists.

Related to #181

@BernieWhite BernieWhite added enhancement New feature or request ms-hack-2022 Issues related to Microsoft Global Hackathon 2022 .NET Pull requests that update .net code labels Sep 16, 2022
@BernieWhite BernieWhite self-assigned this Sep 22, 2022
@BernieWhite BernieWhite added this to the v1.20.0 milestone Sep 22, 2022
BernieWhite added a commit to BernieWhite/PSRule.Rules.Azure that referenced this issue Sep 22, 2022
@BernieWhite BernieWhite mentioned this issue Oct 8, 2022
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request ms-hack-2022 Issues related to Microsoft Global Hackathon 2022 .NET Pull requests that update .net code
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant