knarayan/cloud_posture_checks huggingface dataset:
Alibaba Cloud disk encryption is disabled
This policy identifies disks for which encryption is disabled. As a best practice enable disk encryption to improve data security without making changes to your business or applications. Snapshots created from encrypted disks and new disks created from these snapshots are automatically encrypted.
This is applicable to alibaba_cloud cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: Alibaba Cloud disk can only be encrypted at the time of disk creation. So to resolve this alert, create a new disk with encryption and then migrate all required disk data from the reported disk to this newly created disk.

To create an Alibaba Cloud disk with encryption:
1. Log in to Alibaba Cloud Portal
2. Go to Elastic Compute Service
3. In the left-side navigation pane, click on 'Disks' which is under 'Storage & Snapshots'
4. Click on 'Create Disk'
5. Check the 'Disk Encryption' box in the 'Disk' section
6. Click on 'Preview Order' make sure parameters are chosen correctly
7. Click on 'Create', After you create a disk, attach that disk to other resources per your requirements..

Query:
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ecs-disk' AND json.rule = 'encrypted is false'```
Azure Virtual Machine scale sets Boot Diagnostics Disabled
This policy identifies Azure Virtual Machines scale sets which has Boot Diagnostics setting Disabled. Boot Diagnostics when enabled for virtual machine, captures Screenshot and Console Output during virtual machine startup. This would help in troubleshooting virtual machine when it enters a non-bootable state.
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure Portal
2. Select 'All services' from the left pane
3. Go to 'Compute' under 'Categories'
4. Select 'Virtual Machine scale sets'
5. Select the reported virtual machine scale sets
6. Click on 'Boot Diagnostics' under 'Support + troubleshooting'
7. Select 'On'
8. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-virtual-machine-scale-set' AND json.rule = properties.virtualMachineProfile.diagnosticsProfile.bootDiagnostics.enabled is false```
Azure PostgreSQL database server Infrastructure double encryption is disabled
This policy identifies PostgreSQL database servers in which Infrastructure double encryption is disabled. Infrastructure double encryption adds a second layer of encryption using service-managed keys. It is recommended to enable infrastructure double encryption on PostgreSQL database servers so that encryption can be implemented at the layer closest to the storage device or network wires.

For more details: 
https://docs.microsoft.com/en-us/azure/postgresql/concepts-infrastructure-double-encryption
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: Configuring Infrastructure double encryption for Azure Database for PostgreSQL is only allowed during server create. Once the server is provisioned, you cannot change the storage encryption.

To create an Azure Database for PostgreSQL server with Infrastructure double encryption, follow below URL:
https://docs.microsoft.com/en-us/azure/postgresql/howto-double-encryption

NOTE: Using Infrastructure double encryption will have performance impact on the Azure Database for PostgreSQL server due to the additional encryption process..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-postgresql-server' AND json.rule = (sku.tier equals GeneralPurpose or sku.tier equals MemoryOptimized) and properties.userVisibleState equals Ready and properties.infrastructureEncryption equals Disabled```
Azure Microsoft Defender for Cloud set to Off for File Integrity Monitoring
This policy identifies Azure Microsoft Defender for Cloud where the File Integrity Monitoring is set to Off.

File Integrity Monitoring tracks critical system files in Windows and Linux for unauthorized changes, helping to identify potential attacks. Disabling File Integrity Monitoring leaves your system vulnerable to unnoticed alterations, increasing the risk of data breaches or system failures. Enabling FIM enhances security by alerting you to suspicious changes, allowing for proactive threat detection and prevention of unauthorized modifications to system files.

As a security best practice, it is recommended to enable File Integrity Monitoring in Azure Microsoft Defender for Cloud.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal
2. Navigate to 'Microsoft Defender for Cloud'
3. Under 'Management', select 'Environment Settings'
4. Click on the subscription name
5. Select the 'Defender plans'
6. Click on 'Settings & monitoring' at the top
7. In the table, find 'File Integrity Monitoring' and select 'On' under Plan
8. Click 'Continue' in the top left
9. Click 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = not (pricings[?any(properties.extensions[?any(name equal ignore case FileIntegrityMonitoring AND isEnabled is true)] exists AND properties.pricingTier equal ignore case Standard )] exists)```
Azure Front Door Web application firewall (WAF) policy rule for Remote Command Execution is disabled
This policy identifies Azure Front Door Web application firewall (WAF) policies that have the Remote Command Execution rule disabled. It is recommended to define the criteria in the WAF policy with the rule ‘Remote Command Execution (944240)’ under managed rules to help in detecting and mitigating Log4j vulnerability. 

For details:
https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/ 
This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal
2. Select 'All services' > 'Web Application Firewall policies (WAF)'
3. Click on the reported Web Application Firewall policies (WAF) policy
4. Click on the 'Managed rules' from the left panel
5. Search '944240' rule from search bar and Select rule
6. Click on the 'Enable' to enable rule.

Query:
```config from cloud.resource where api.name = 'azure-frontdoor-waf-policy' AND json.rule = properties.policySettings.enabledState equals Enabled and properties.managedRules.managedRuleSets is not empty and properties.managedRules.managedRuleSets[*].ruleGroupOverrides[*].rules[?any(action equals Block and ruleId equals 944240 and enabledState equals Disabled)] exists as X; config from cloud.resource where api.name = 'azure-frontdoor' AND json.rule = properties.frontendEndpoints[*].properties.webApplicationFirewallPolicyLink exists and properties.provisioningState equals Succeeded as Y; filter '$.Y.properties.frontendEndpoints[*].properties.webApplicationFirewallPolicyLink.id contains $.X.name'; show X;```
bobby Copy of AWS SNS topic with cross-account access
This policy identifies AWS SNS topics that are configured with cross-account access. Allowing unknown cross-account access to your SNS topics will enable other accounts and gain control over your AWS SNS topics. To prevent unknown cross-account access, allow only trusted entities to access your Amazon SNS topics by implementing the appropriate SNS policies.
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: 1. Log in to the AWS Console
2. In the console, select the specific region from the region drop-down on the top right corner, for which the alert is generated.
3. Navigate to the 'Simple Notification Service' dashboard
4. Go to 'Topics', from the left panel
5. Select the reported SNS topic
6. Click on the 'Edit' button from the top options bar
7. On the edit page go to the 'Access Policy - optional' section
8. In the Access Policy section, verify all ARN values in 'Principal' elements are from trusted entities; If not remove those ARN from the entry.
9. Click on 'Save changes'.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-sns-get-topic-attributes' AND json.rule = Policy.Statement[?any(Effect equals Allow and (Principal.AWS does not equal * and Principal does not equal * and Principal.AWS contains arn and Principal.AWS does not contain $.Owner))] exists```
Azure App Service Web app doesn't use latest Java version
This policy identifies Azure web apps that don't use the latest Java version. Periodically, newer versions are released for Java software either due to security flaws or to include additional functionality. Using the latest Java version for web apps is recommended in order to take advantage of security fixes if any.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to Azure console
2. Go to App Services
3. Click on the reported App
4. Under Settings section, Click on Configuration
5. Select General settings
6. In Stack settings section, ensure that Stack is set with the latest Java version.
7. Click on Save.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-app-service' AND json.rule = 'properties.state equals Running and ((config.javaVersion exists and config.javaVersion does not equal 1.8 and config.javaVersion does not equal 11 and config.javaVersion does not equal 17) or (config.linuxFxVersion is not empty and config.linuxFxVersion contains JAVA and (config.linuxFxVersion contains 8 or config.linuxFxVersion contains 11 or config.linuxFxVersion contains 17) and config.linuxFxVersion does not contain 8-jre8 and config.linuxFxVersion does not contain 11-java11 and config.linuxFxVersion does not contain 17-java17) or (config.linuxFxVersion is not empty and config.linuxFxVersion contains JBOSSEAP and config.linuxFxVersion does not contain 7-java8 and config.linuxFxVersion does not contain 7-java11 and config.linuxFxVersion does not contain 7-java17) or (config.linuxFxVersion contains TOMCAT and config.linuxFxVersion does not end with 10.0-jre8 and config.linuxFxVersion does not end with 9.0-jre8 and config.linuxFxVersion does not end with 8.5-jre8 and config.linuxFxVersion does not end with 10.0-java11 and config.linuxFxVersion does not end with 9.0-java11 and config.linuxFxVersion does not end with 8.5-java11 and config.linuxFxVersion does not end with 10.0-java17 and config.linuxFxVersion does not end with 9.0-java17 and config.linuxFxVersion does not end with 8.5-java17))'```
Azure Storage logging is not Enabled for Blob Service for  Read Write and Delete  requests

This is applicable to azure cloud and is considered a low severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where api.name = 'azure-storage-account-list' as X; config from cloud.resource where api.name = 'azure-storage-account-blob-diagnostic-settings' AND json.rule = properties.logs[*].enabled all true as Y; filter 'not($.X.id contains $.Y.properties.storageAccountId)'; show X;```
Alibaba Cloud disk automatic snapshot policy is disabled
This policy identifies disks which have automatic snapshot policy disabled. As a best practice, enable automatic snapshot policy to prevent irreversible data loss from accidental or malicious operations.
This is applicable to alibaba_cloud cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To apply an automatic snapshot policy on the reported disk follow below URL:
https://www.alibabacloud.com/help/doc-detail/25457.htm.

Query:
```config from cloud.resource where cloud.type = 'alibaba_cloud' AND api.name = 'alibaba-cloud-ecs-disk' AND json.rule = status contains In_use and enableAutomatedSnapshotPolicy is false```
dnd_test_create_hyperion_policy_multi_cloud_child_policies_ss_finding_1
Description-d6a7725e-0ded-439f-b5cb-740eaf1df571
This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['SSH_BRUTE_FORCE'].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where cloud.type = 'aws' AND api.name = 'aws-cloudfront-list-distributions' AND json.rule = defaultRootObject is empty```
Copy of OCI Hosts test - Ali

This is applicable to oci cloud and is considered a informational severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where resource.status = Active AND api.name = 'oci-compute-instance' AND json.rule = lifecycleState exists```
GCP Cloud Function is publicly accessible
This policy identifies GCP Cloud Functions that are publicly accessible. Allowing 'allusers' / 'allAuthenticatedUsers' to cloud functions can lead to unauthorised invocations of the functions or unwanted access to sensitive information. It is recommended to follow least privileged access policy and grant access restrictively. 
This is applicable to gcp cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['INTERNET_EXPOSURE'].
Mitigation of this issue can be done as follows: It is recommended to review and add appropriate, but restrictive roles before revoking access.

To revoke access from 'allusers'/'allAuthenticatedUsers', follow the below mentioned steps:
1. Login to GCP console
2. Navigate to service 'Cloud Functions'
3. Click on the function on which the alert is generated
4. Go to tab 'PERMISSIONS'
5. Review the roles to see if 'allusers'/'allAuthenticatedUsers' is present
6. Click on the delete icon to revoke access from 'allusers'/'allAuthenticatedUsers'
7. On Pop-up select the check box to confirm 
8. Click on 'REMOVE'.

Query:
```config from cloud.resource where cloud.type = 'gcp' AND api.name = 'gcloud-cloud-function' AND json.rule = status equals ACTIVE and iamPolicy.bindings[?any(members[*] is member of ("allAuthenticatedUsers","allUsers"))] exists```
Azure Microsoft Defender for Cloud set to Off for Resource Manager
This policy identifies Azure Microsoft Defender for Cloud which has defender setting for Resource Manager (ARM) set to Off. Enabling Azure Defender for ARM provides protection against issues like Suspicious resource management operations, Use of exploitation toolkits, Lateral movement from the Azure management layer to the Azure resources data plane. It is highly recommended to enable Azure Defender for ARM.
This is applicable to azure cloud and is considered a medium severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal
2. Go to 'Microsoft Defender for Cloud'
3. Select 'Environment Settings'
4. Click on the subscription name
5. Select the 'Defender plans'
6. Expand 'Select Defender plan' 
7. Select 'On' status for 'Resource Manager' 
8. Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-security-center-settings' AND json.rule = pricings[?any(name equal ignore case Arm and properties.pricingTier does not equal ignore case Standard)] exists```
Azure Network Security Group allows all traffic on SSH port 22
This policy identifies Network security groups (NSG) that allow all traffic on SSH port 22. Review your list of NSG rules to ensure that your resources are not exposed. As a best practice, restrict SSH solely to known static IP addresses. Limit the access list to include known hosts, services, or specific employees only.
This is applicable to azure cloud and is considered a high severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: Before making any changes, please check the impact to your applications/services. Evaluate whether you want to edit the rule and limit access to specific users, hosts, and services only, deny access, or delete the rule completely.

1. Log in to the Azure Portal.
2. Select 'All services'.
3. Select 'Network security groups', under NETWORKING.
4. Select the Network security group you need to modify.
5. Select 'Inbound security rules' under Settings.
6. Select the rule you need to modify, and edit it to allow specific IP addresses OR set the 'Action' to 'Deny' OR 'Delete' the rule based on your requirement.
7. 'Save' your changes..

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name= 'azure-network-nsg-list' AND json.rule = securityRules[?any(access equals Allow and direction equals Inbound and (sourceAddressPrefix equals Internet or sourceAddressPrefix equals * or sourceAddressPrefix equals 0.0.0.0/0 or sourceAddressPrefix equals ::/0) and (destinationPortRange contains _Port.inRange(22,22) or destinationPortRanges[*] contains _Port.inRange(22,22) ))] exists```
Azure SQL Server ADS Vulnerability Assessment 'Send scan reports to' is not configured
This policy identifies Azure SQL Server which has ADS Vulnerability Assessment 'Send scan reports to' not configured. This setting enables ADS - VA scan reports being sent to email ids that are configured at 'Send scan reports to' field. It is recommended to update 'Send scan reports to' with email ids which would help in reducing time required for identifying risks and taking corrective measures.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Log in to the Azure portal
2. Select 'SQL servers', and select the SQL server you need to modify
3. Click on 'Microsoft Defender for Cloud' under 'Security'
4. Click on '(Configure)' next to 'Microsoft Defender for SQL: Enabled at the server-level'
5. Specify one or more email ids to 'Send scan reports to' under 'VULNERABILITY ASSESSMENT SETTINGS'
6. 'Save' your changes.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-sql-server-list' AND json.rule = vulnerabilityAssessments[*].properties.storageContainerPath exists and vulnerabilityAssessments[*].properties.recurringScans.emails[*] is empty```
API automation policy ojnou

This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where api.name = "aws-ec2-describe-instances" AND json.rule = architecture contains "foo"```
AWS ECS cluster not configured with a registered instance
This policy identifies ECS clusters that are not configured with a registered instance. ECS container instance is an Amazon EC2 instance that is running the Amazon ECS container agent and has been registered into an Amazon ECS cluster. It is recommended to remove Idle ECS clusters to reduce the container attack surface or register a new instance for the reported ECS cluster.

For details:
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ECS_instances.html 
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: To delete the reported idle ECS Cluster follow below mentioned URL:
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/delete_cluster.html

To register a new instance for reported ECS Cluster follow below mentioned URL:
https://docs.aws.amazon.com/AmazonECS/latest/developerguide/launch_container_instance.html.

Query:
```config from cloud.resource where api.name = 'aws-ecs-service' AND json.rule = launchType equals EC2 as X; config from cloud.resource where api.name = 'aws-ecs-cluster' AND json.rule = status equals ACTIVE and registeredContainerInstancesCount equals 0 as Y; filter '$.X.clusterArn equals $.Y.clusterArn'; show Y;```
API automation policy poumk

This is applicable to aws cloud and is considered a medium severity issue.
Sample categories of findings relevant here are [].
Mitigation of this issue can be done as follows: N/A.

Query:
```config from cloud.resource where api.name = "aws-ec2-describe-instances" AND json.rule = architecture contains "foo"```
AWS EBS volume region with encryption is disabled
This policy identifies AWS regions in which new EBS volumes are getting created without any encryption. Encrypting data at rest reduces unintentional exposure of data stored in EBS volumes. It is recommended to configure EBS volume at the regional level so that every new EBS volume created in that region will be enabled with encryption by using a provided encryption key.
This is applicable to aws cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['UNENCRYPTED_DATA'].
Mitigation of this issue can be done as follows: To enable encryption at region level by default, follow below URL:
 https://docs.aws.amazon.com/ebs/latest/userguide/work-with-ebs-encr.html#encryption-by-default

 Additional Information: 

 To detect existing EBS volumes that are not encrypted ; refer Saved Search:
 AWS EBS volumes are not encrypted_RL

 To detect existing EBS volumes that are not encrypted with CMK, refer Saved Search:
 AWS EBS volume not encrypted using Customer Managed Key_RL.

Query:
```config from cloud.resource where api.name = 'aws-ec2-ebs-encryption' AND json.rule = ebsEncryptionByDefault is false as X; config from cloud.resource where api.name = 'aws-region' AND json.rule = optInStatus does not equal not-opted-in as Y; filter '$.X.region equals $.Y.regionName'; show X;```
Azure Virtual machine NIC has IP forwarding enabled
This policy identifies Azure Virtual machine NIC which have IP forwarding enabled. IP forwarding on a virtual machine's NIC allows the machine to receive and forward traffic addressed to other destinations. As a best practice, before you enable IP forwarding in a Virtual Machine NIC, review the configuration with your network security team to ensure that it does not allow an attacker to exploit the set up to route packets through the host and compromise your network.
This is applicable to azure cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1.Login to Azure Portal
2.Click on 'All services' on left Navigation
3.Click on 'Network interfaces' under 'Networking'
4.Click on reported resource
5.Click on 'IP configurations' under Settings
6.Select 'Disabled' for 'IP forwarding'
7.Click on 'Save'.

Query:
```config from cloud.resource where cloud.type = 'azure' AND api.name = 'azure-network-nic-list' AND json.rule = ['properties.virtualMachine'].id is not empty and ['properties.enableIPForwarding'] exists and ['properties.enableIPForwarding'] is true```