### Básico

Los controles básicos incluyen verificaciones sobre el objeto ARM inicial para configuraciones booleanas simples de "activar/desactivar" de dicho servicio.

**Ejemplo: adminUser de Azure Container Registry**

[acr_adminUser](https://github.com/jsa2/east/blob/public/providers/microsoft.containerregistry/functions/acr_adminUser.js)

Portal|EAST
-|-
  ![image](https://assets.kitploit.com/production/public/readmes/5701/955386627eceb05ef02ac4f9aed2c6671397ff9f86946fab1422f65c40510e5d.png) | ``if (item.properties?.adminUserEnabled == false ){returnObject.isHealthy = true }``



### Avanzado

Los controles avanzados incluyen verificaciones más allá del objeto ARM inicial. A menudo invocan nuevas solicitudes para obtener más información sobre el recurso en cuestión y su relación con otros servicios.


**Ejemplo: Asignaciones de roles**

Además de verificar las asignaciones de roles de la suscripción, se realiza una verificación adicional a través del Informe de acceso condicional de Azure AD para MFA, y que las cuentas privilegiadas no estén protegidas solo por contraseñas (SPN con secretos de cliente).

**Ejemplo: Azure Data Factory**

[ADF_pipeLineRuns](https://github.com/jsa2/east/blob/public/providers/microsoft.datafactory/functions/ADF_pipeLineRuns.js)

El mapeo de canalizaciones de Azure Data Factory combina canalizaciones -> actividades -> y destinos de datos, y luego verifica si hay secretos filtrados en los registros a través del historial de ejecución de dichas actividades.

![img](https://assets.kitploit.com/production/public/readmes/5701/bceb35d6b891df36e341228206a02952c46b7a271be23b40d9a72ff76a0c357f.png)

---

### Compuesto

Los controles compuestos combinan dos o más resultados de control de la canalización, para formar uno o más controles nuevos. El uso de compuestos resuelve dos casos de uso para EAST:
1. No se puede garantizar un orden en que los resultados de control sean devueltos en la canalización.
2. Se necesita devolver más de un resultado de control de una sola verificación.

**Ejemplo: [composite_resolve_alerts](https://github.com/jsa2/east/blob/public/composites/composite_resolve_alerts.js)**

1. Obtener alertas de Microsoft Cloud Defender en la verificación de suscripción.
2. Formar nuevos controles por resourceProvider para alertas.

## Informes

EAST no está enfocado en proporcionar generación automática de informes, ya que principalmente proporciona archivos JSON con el estado del control y la evaluación. La idea es usar herramientas separadas para crear informes, lo cual es bastante trivial de automatizar mediante scripts de creación de markdown y herramientas como [Pandoc](https://github.com/jgm/pandoc#the-universal-markup-converter).

- Si bien el enfoque no está en los informes, este repositorio incluye automatización de ejemplo para la creación de informes con pandoc para facilitar la lectura de los resultados en un formato de documento único.

Si bien esta herramienta no distribuye pandoc, se puede usar al crear los informes, por lo tanto se añade la siguiente cita: https://github.com/jgm/pandoc/blob/master/CITATION.cff```
cff-version: 1.2.0
title: Pandoc
message: "If you use this software, please cite it as below."
type: software
url: "https://github.com/jgm/pandoc"
authors:
  - given-names: John
    family-names: MacFarlane
    email: [email protected]
    orcid: 'https://orcid.org/0000-0003-2557-9090'
  - given-names: Albert
    family-names: Krewinkel
    email: [email protected]
    orcid: '0000-0002-9455-0796'
  - given-names: Jesse
    family-names: Rosenthal
    email: [email protected]

[jump to next step](#login-az-cli-and-run-the-scan)

#### Requisitos previos detallados (Esto es si optaste por no hacer la versión "disparar y olvidar")

**Requisitos previos**```bash

git clone https://github.com/jsa2/EAST --branch preview
cd EAST;
npm install

**Instalando pandoc en distribuciones que soportan APT**```bash
# Get pandoc for reporting (first time only)
sudo apt install pandoc

![img](https://assets.kitploit.com/production/public/readmes/5701/e85a6607ac555d9bbde7a179042df2a344b0a9f004e99f27ade78e0bc20af5b5.gif)





**Generar informe**

``cd EAST; node templatehelpers/eastReports.js --doc`` 

- Si desea incluir todos los resultados de Azure Security Benchmark en el informe

``cd EAST; node templatehelpers/eastReports.js --doc --asb`` 

**Exportar informe desde cloud shell**

`` pandoc -s fullReport2.md -f markdown -t docx --reference-doc=pandoc-template.docx -o fullReport2.docx `` 

![image](https://assets.kitploit.com/production/public/readmes/5701/503e773de2e18294b3d74101d8c2eb6f675e1057c838e89703b440650450c374.png)

**Azure Devops (Experimental)**
Hay un control de Azure Devops para volcar registros de canalización. Puede especificar la ejecución del control siguiendo el ejemplo:``` node ./plugins/main.js --batch=10 --nativescope=true --roleAssignments=true --helperTexts=true --checkAad=true --scanAuditLogs --composites --subInclude=$subId --azdevops "organizationName" ```

--- 
## Licensing

**Community use**
- Share relevant controls across multiple environments as community effort

**Company use**
- Companies have possibility to develop company specific controls which apply to company specific work. Companies can then control these implementations by decision to share, or not share them based on the operating principle of that company. 

**Non IPR components**
- Code logic and functions are under MIT license. since code logic and functions are alredy based on open-source components & vendor API's, it does not make sense to restrict something that is already based on open source

If you use this tool as part of your commercial effort we only require, that you follow the very relaxed terms of [MIT license](https://github.com/jsa2/east/blob/public/LICENSE)

[Read license](https://github.com/jsa2/EAST/blob/public/LICENSE)

---

# Tool operation documentation

## Principles


### AZCLI USE
**Existing tooling enhanced with Node.js runtime**

Use rich and maintained context of [Microsoft Azure CLI](https://github.com/Azure/azure-cli#microsoft-azure-cli) ``login & commands``  with Node.js control flow which supplies enhanced rest-requests and maps results to schema.
 - This tool does not include or distribute Microsoft Azure CLI, but rather uses it when it has been installed on the source system (Such as Azure Cloud Shell, which is primary platform for running EAST)

### Speedup

View more [details](https://github.com/jsa2/east/blob/public/speedup.md)

✅ Using Node.js runtime as orchestrator utilises Nodes asynchronous nature allowing batching of requests. Batching of requests utilizes the full extent of Azure Resource Managers incredible speed. 

✅ Compared to running requests one-by-one, the speedup can be up to 10x, when Node executes the batch of requests instead of single request at time

## Parameters reference


**Example:**
```shell
node ./plugins/main.js --batch=10 --nativescope --roleAssignments --helperTexts=true --checkAad --scanAuditLogs --composites --shuffle --clearTokens``` 

Param| Description | Default if undefined
-|-|-
`` --nativescope `` | Currently mandatory parameter | no values
`` --shuffle `` | Can help with throttling. Shuffles the resource list to reduce the possibility of resource provider throttling threshold being met  | no values 
`` --roleAssignments `` | Checks controls as per [microsoft.authorization](https://github.com/jsa2/east/blob/public/providers/microsoft.authorization/controls) | no values
`` --includeRG `` | Checks controls with ResourceGroups as per [microsoft.authorization](https://github.com/jsa2/east/blob/public/providers/microsoft.authorization/controls) | no values
`` --checkAad `` | Checks controls as per [microsoft.azureactivedirectory](https://github.com/jsa2/east/blob/public/providers/microsoft.azureactivedirectory/controls) | no values
`` --subInclude `` | Defines subscription scope | no default, requires subscriptionID/s, if not defined will enumerate all subscriptions the user have access to
`` --namespace `` | text filter which matches full, or part of the resource ID <br> **example** `` /microsoft.storage/storageaccounts`` all storage accounts in the scope| optional parameter
`` --notIncludes `` | text filter which matches full, or part of the resource ID <br> **example** `` /microsoft.storage/storageaccounts`` all storage accounts in the scope are **excluded**| optional parameter
`` --batch `` | size of batch interval between throttles |5
`` --wait `` | size of batch interval between throttles | 1500
`` --scanAuditLogs `` | optional parameter. When defined in hours will toggle Azure Activity Log scanning for weak authentication events <br> **defined in:** [scanAuditLogs](https://github.com/jsa2/east/blob/public/providers/microsoft.authorization/functions/scanAuditLogs.js) | 24h
`` --composites `` | read [composite](#composite)| no values
`` --clearTokens `` | clears tokens in session folder, use this if you get authorization errors, or have just changed to other `` az login `` account <br> use `` az account clear`` if you want to clear AZ CLI cache too | no values
`` --tag `` | Filter all results in the end based on single tag``--tag=svc=aksdev``  | no values
``--ignorePreCheck``  | use this option when used with browser delegated tokens| no values
``--helperTexts``  | Will append text descriptions from [general](https://github.com/jsa2/east/blob/public/providers/microsoft.general/controls) to manual controls| no values
``--reprocess``  | Will update results to existing content.json. Useful for incremental runs| no values


**Parameters reference for example report:**
```shell
node templatehelpers/eastReports.js --asb``` 

Param| Description | Default if undefined
-|-|-
`` --asb `` | gets all ASB results available to users | no values
`` --policy `` | gets all Policy results available to users | no values
``  --doc`` | prints pandoc string for export to console | no values

## (Highly experimental) Running in restricted environments where only browser use is available

Read here [Running in restricted environments](https://github.com/jsa2/EAST/tree/DelegationToken#highly-experimental---bypassing-trusted-device-requirements-for-azure-cli-in-highly-restricted-environments-where-apis-are-available-for-browser-sessions)

## Developing controls 
Developer guide including control flow description is here [``dev-guide.md``](https://github.com/jsa2/east/blob/public/dev-guide.md)

        
## Updates and examples
### Auditing Microsoft.Web provider (Functions and web apps)

✅ Check roles that are assigned to function managed identity in Azure AD and all Azure Subscriptions the audit account has access to <br>
✅ Relation mapping, check which keyVaults the function uses across all subs the audit account has access to<br>
✅ Check if Azure AD authentication is enabled
✅ Check that generation of access tokens to the api requires assigment ``.appRoleAssignmentRequired`` <br>
✅ Audit bindings <br>
  - Function or Azure AD Authentication enabled
  - Count and type of triggers
<br>

✅ Check if [SCM](https://docs.microsoft.com/en-us/azure/azure-functions/security-concepts#secure-the-scm-endpoint) and [FTP](https://docs.microsoft.com/en-us/azure/azure-functions/security-concepts#disable-ftp) endpoints are secured 


![image](https://assets.kitploit.com/production/public/readmes/5701/b074ecdbe5d910c416ad2bbc5b5c57295c3f61348d5a8bb35146112959a15be8.png)


### Azure RBAC baseline authorization 

⚠️ Detect principals in privileged subscriptions roles protected only by password-based single factor authentication. 
-  Checks for users without MFA policies applied for set of conditions
-  Checks for ServicePrincipals protected only by password (as opposed to using Certificate Credential, workload federation and or workload identity CA policy)
  
  Maps to [App Registration Best Practices](https://docs.microsoft.com/en-us/azure/active-directory/develop/security-best-practices-for-app-registration#credential-configuration)
- *An unused credential on an application can result in security breach. While it's convenient to use  <span style="color:red">password</span>. secrets as a credential, we strongly recommend that you use x509 certificates as the only credential type for getting tokens for your application*

``✅State healthy`` - **User result example**  
```JSON
{ 
  "subscriptionName": "EAST -msdn",
  "friendlyName": "[email protected]",
    "mfaResults": {
      "oid": "138ac68f-d8a7-4000-8d41-c10ff26a9097",
      "appliedPol": [{
        "GrantConditions": "challengeWithMfa",
        "policy": "baseline",
        "oid": "138ac68f-d8a7-4000-8d41-c10ff26a9097"
      }],
      "checkType": "mfa"
    },
    "basicAuthResults": {
      "oid": "138ac68f-d8a7-4000-8d41-c10aa26a9097",
      "appliedPol": [{
        "GrantConditions": "challengeWithMfa",
        "policy": "baseline",
        "oid": "138ac68f-d8a7-4000-8d41-c10aa26a9097"
      }],
      "checkType": "basicAuth"
      },
    }

{ 
  "subscriptionName": "EAST - HoneyPot",
      "friendlyName": "thx138-kvref-6193053b-408b-44d0-b20f-4e29b9b67394",
      "creds": {
        "@odata.context": "https://graph.microsoft.com/beta/$metadata#servicePrincipals(id,displayName,appId,keyCredentials,passwordCredentials,servicePrincipalType)/$entity",
        "id": "babec804-037d-4caf-946e-7a2b6de3a45f",
        "displayName": "thx138-kvref-6193053b-408b-44d0-b20f-4e29b9b67394",
        "appId": "5af1760e-89ff-46e4-a968-0ac36a7b7b69",
        "servicePrincipalType": "Application",
        "keyCredentials": [],
        "passwordCredentials": [],
        "OnlySingleFactor": [{
          "customKeyIdentifier": null,
          "endDateTime": "2023-10-20T06:54:59.2014093Z",
          "keyId": "7df44f81-a52c-4fd6-b704-4b046771f85a",
          "startDateTime": "2021-10-20T06:54:59.2014093Z",
          "secretText": null,
          "hint": null,
          "displayName": null
        }],
        "StrongSingleFactor": []
        }
}