[
    {
        "id": "003ec732-5bd5-4312-9c0a-533386288937",
        "ruleTemplateId": "c75fa0c8-335e-4e16-b911-7ee8e3bb259d",
        "ruleName": "networkPort139ExposedToInternetGCP_25082021",
        "ruleTemplate": "{{.prefix}}{{.name}}{{.suffix}}[retVal] {\n    rule := input.google_compute_firewall[_]\n    config := rule.config\n    config.direction == \"INGRESS\"\n    config.source_ranges[_] == \"0.0.0.0/0\"\n    fire_rule := config.allow[_]\n    fire_rule.protocol == \"{{.protocol}}\"\n    fire_rule.ports[_] == \"{{.portNumber}}\"\n\n    expected := [ item | item := validate_source(config.source_ranges[_]) ]\n\ttraverse := \"source_ranges\"\n\n     retVal := {\n       \"Id\": rule.id,\n       \"ReplaceType\": \"edit\",\n       \"CodeType\": \"attribute\",\n       \"Traverse\": traverse,\n       \"Attribute\": traverse,\n       \"AttributeDataType\": \"list\",\n       \"Expected\": expected,\n       \"Actual\": config.source_ranges\n     }\n}\n\nvalidate_source(source) = value {\n\tsource == \"0.0.0.0/0\"\n    value := \"<cidr>\"\n}\nvalidate_source(source) = value {\n\tsource != \"0.0.0.0/0\"\n    value := source\n}",
        "ruleTemplateName": "networkPortExposedToInternetGCP_25082021",
        "ruleArgument": "{\"name\":\"networkPort139ExposedToInternetGCP\",\"portNumber\":139,\"prefix\":\"\",\"protocol\":\"tcp\",\"suffix\":\"_25082021\"}",
        "severity": "HIGH",
        "vulnerability": "NetBios Session Service (TCP:139) is exposed to entire internet for Google Compute Firewall.",
        "remediation": "Limit the access scope for NetBios Session Service to only allow access in internal networks and limited scope. If public interface exists, remove it and limit the access scope within the VNET only to applications or instances that requires access.",
        "engineType": "terraform",
        "provider": "gcp",
        "managedBy": "Accurics Inc",
        "ruleDisplayName": "Ensure NetBios Session Service (TCP:139) is not exposed to entire internet for Google Compute Firewall",
        "category": "Infrastructure Security",
        "policyRelevance": "NIST-800-53:SC-7(11)&SC-7(21) ISO-27001:A.9.1.2&A.13.1.1 SOC2:CC6.6",
        "ruleReferenceId": "AC_GCP_0095",
        "policy": "Accurics Security Best Practices for GCP v2",
        "version": 2,
        "custom": false,
        "resourceType": "google_compute_firewall"
    },
    {
        "id": "04eac6e0-c02a-41d2-8fae-3a0ef74d55b0",
        "ruleTemplateId": "473369ba-4e7d-43e1-b66c-73a5f92e8b87",
        "ruleName": "awsNoRetentionPolicyCloudwatchLogGroup",
        "ruleTemplate": "{{.prefix}}{{.name}}{{.suffix}}[retVal] {\n    cw_log_group := input.aws_cloudwatch_log_group[_]\n    cw_log_group.config.retention_in_days == 0\n\n    traverse := \"retention_in_days\"\n\n    retVal := {\n        \"Id\": cw_log_group.id,\n        \"ReplaceType\": \"edit\",\n        \"CodeType\": \"attribute\",\n        \"Traverse\": traverse,\n        \"Attribute\": traverse,\n        \"AttributeDataType\": \"int\",\n        \"Expected\": 120,\n        \"Actual\": cw_log_group.config.retention_in_days\n    }\n}",
        "ruleTemplateName": "awsNoRetentionPolicyCloudwatchLogGroup",
        "ruleArgument": "{\"name\":\"awsNoRetentionPolicyCloudwatchLogGroup\",\"prefix\":\"\",\"suffix\":\"\"}",
        "severity": "MEDIUM",
        "vulnerability": "AWS CloudWatch Log Group does not have a retention policy set in order to establish how long log events are kept in AWS CloudWatch Logs.",
        "remediation": "AWS CloudWatch Log Group can be set with a log retention policy using AWS Console.\n In AWS Console - \n 1. Sign into AWS Console and go to the CloudWatch console.\n 2. Select Log Groups in the navigation pane.\n 3. Select the log group to update.\n 4. Select 'Edit retention' and change the log retention value to 120 days.",
        "engineType": "terraform",
        "provider": "aws",
        "managedBy": "Accurics Inc",
        "ruleDisplayName": "Ensure log retention policy is set for AWS CloudWatch Log Group",
        "category": "Security Best Practices",
        "policyRelevance": "",
        "ruleReferenceId": "AC_AWS_0452",
        "policy": "Accurics Security Best Practices for AWS v2",
        "version": 2,
        "custom": false,
        "resourceType": "aws_cloudwatch_log_group"
    },
    {
        "id": "058ef84d-9ad0-4ea1-83eb-9fd2f3e8f2d8",
        "ruleTemplateId": "86e88b41-a767-4b9f-9bbc-33a86bd9f6b7",
        "ruleName": "ensureMcasInArm_25082021",
        "ruleTemplate": "{{.prefix}}{{.name}}{{.suffix}}[retval] {\n    security_center_settings := input.azurerm_security_center_setting[_]\n    upper(security_center_settings.config.setting_name) != \"{{.value}}\"\n    security_center_settings.config.enabled != true\n\n    retval := {\n        \"Id\": security_center_settings.id,\n        \"ReplaceType\": \"edit\",\n        \"CodeType\": \"attribute\",\n        \"Traverse\": \"enabled\",\n        \"Attribute\": \"enabled\",\n        \"AttributeDataType\": \"bool\",\n        \"Expected\": true,\n        \"Actual\": security_center_settings.config.enabled\n    }\n}",
        "ruleTemplateName": "ensureProperSettings_25082021",
        "ruleArgument": "\"name\":\"ensureMcasInArm\"\"prefix\"\"\",[]\"suffix\":\"_25082021\",\"value\":\"MCAS\"}",
        "severity": "MEDIUM",
        "vulnerability": "Disabled MCAS in Azure Security Center Setting goes against compliance.",
        "remediation": "Ensure MCAS setting is enabled in Azure Security Center Setting.",
        "engineType": "terraform",
        "provider": "azure",
        "managedBy": "Accurics Inc",
        "ruleDisplayName": "Ensure that Microsoft Cloud App Security (MCAS) integration is selected in Azure Security Center Setting",
        "category": "Compliance Validation",
        "policyRelevance": "CIS-1.3:2.10",
        "ruleReferenceId": "AC_AZURE_0330",
        "policy": "Accurics Security Best Practices for Azure v2",
        "version": 2,
        "custom": false,
        "resourceType": "azurerm_security_center_setting"
    }
]