Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CIS AZURE][Dependency Lock] 2.1.20 List security contact data - payload changed #2242

Closed
moukoublen opened this issue May 31, 2024 · 1 comment · Fixed by #2450
Closed
Assignees

Comments

@moukoublen
Copy link
Member

moukoublen commented May 31, 2024

Motivation
The payload of security contacts details that is used in CIS Rule 2.1.20 has changed from

{
  "id": "/subscriptions/<subID>/providers/Microsoft.Security/securityContacts/default",
  "name": "default",
  "type": "Microsoft.Security/securityContacts",
  "properties": {
    "alertNotifications": {
      "state": "On",
      "minimalSeverity": "High"
    },
    "notificationsByRole": {
      "state": "On",
      "roles": [
        "Owner"
      ]
    },
    "emails": "...",
    "phone": ""
  }
}

to
https://learn.microsoft.com/en-us/rest/api/defenderforcloud/security-contacts/list?view=rest-defenderforcloud-2023-12-01-preview&tabs=HTTP#list-security-contact-data

{
  "id": "/subscriptions/<Your_Subscription_Id>/providers/Microsoft.Security/securityContact/default",
  "name": "default",
  "type": "Microsoft.Security/securityContact",
  "properties": {
    "notificationsByRole": {
      "state": "On",
      "roles": [
        "Owner",
        "Admin"
      ]
    },
    "isEnabled": true,
    "emails": "[email protected];[email protected]",
    "phone": "(214)275-4038",
    "notificationsSources": [
      {
        "sourceType": "AttackPath",
        "minimalRiskLevel": "Critical"
      },
      {
        "sourceType": "Alert",
        "minimalSeverity": "Medium"
      }
    ]
  }
}

For the same reason, the latest Azure SDK arm security version has breaking changes in our code.

Because of this pre-existing bug in this specific call of Azure SDK in Cloudbeat, a generic arm.NewClient was used as described here.

It seems we can now revert to using the specialized client and not the generic one.

The current Cloudbeat's code should work as expected since it uses 2020-01-01-preview version of the API and the new payload introduced in 2023-12-01-preview.

Definition of done
Cloudbeat's code and possible rego rule need to be updated according to the latest SDK version / new payload.

References
https://learn.microsoft.com/en-us/rest/api/defenderforcloud/security-contacts/list?view=rest-defenderforcloud-2023-12-01-preview&tabs=HTTP#list-security-contact-data

https://github.com/Azure/azure-sdk-for-go/pull/22668/files#diff-a077f61aaeaeaab8f5eb2aea4011aa1f67ae05f2c4fc16840f97afcc47e7a14cR2458-R2460

https://github.com/Azure/azure-sdk-for-go/pull/22668/files#diff-a077f61aaeaeaab8f5eb2aea4011aa1f67ae05f2c4fc16840f97afcc47e7a14cR2458-R2460

https://github.com/Azure/azure-sdk-for-go/pull/22668/files#diff-a077f61aaeaeaab8f5eb2aea4011aa1f67ae05f2c4fc16840f97afcc47e7a14cR5901-R5940

@moukoublen moukoublen added the Team:Cloud Security Cloud Security team related label May 31, 2024
romulets added a commit that referenced this issue Aug 5, 2024
romulets added a commit that referenced this issue Aug 5, 2024
* Bump the azure group with 3 updates

Bumps the azure group with 3 updates: [github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/security/armsecurity](https://github.com/Azure/azure-sdk-for-go), [github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage](https://github.com/Azure/azure-sdk-for-go) and [github.com/Azure/azure-sdk-for-go/sdk/azcore](https://github.com/Azure/azure-sdk-for-go).


Updates `github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/security/armsecurity` from 0.13.0 to 0.14.0
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-go/blob/main/documentation/release.md)
- [Commits](Azure/azure-sdk-for-go@sdk/azcore/v0.13.0...sdk/azcore/v0.14.0)

Updates `github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-go/blob/main/documentation/release.md)
- [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.5.0...sdk/azcore/v1.6.0)

Updates `github.com/Azure/azure-sdk-for-go/sdk/azcore` from 1.12.0 to 1.13.0
- [Release notes](https://github.com/Azure/azure-sdk-for-go/releases)
- [Changelog](https://github.com/Azure/azure-sdk-for-go/blob/main/documentation/release.md)
- [Commits](Azure/azure-sdk-for-go@sdk/azcore/v1.12.0...sdk/azcore/v1.13.0)

---
updated-dependencies:
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/security/armsecurity
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: azure
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: azure
- dependency-name: github.com/Azure/azure-sdk-for-go/sdk/azcore
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: azure
...

Signed-off-by: dependabot[bot] <[email protected]>

* Downgrade armsecurity because of #2242

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Rômulo Farias <[email protected]>
@oren-zohar oren-zohar changed the title [CIS AZURE] 2.1.20 List security contact data - payload changed [CIS AZURE][Dependency Lock] 2.1.20 List security contact data - payload changed Aug 6, 2024
@kubasobon
Copy link
Member

Verified
Image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants